Senior DevSecOps Engineer

Virtuous is on a mission to inspire global generosity by helping nonprofits build better relationships with their donors. They are hiring a Senior DevSecOps Engineer to strengthen the security posture of their products and cloud infrastructure, partnering with various teams to embed security into the software development lifecycle.

Responsibilities:

• Design, implement, and continuously improve secure Azure cloud architectures, networking, governance, and infrastructure to support scalable, secure-by-default engineering
• Strengthen cloud security posture through infrastructure hardening, segmentation, secure connectivity patterns, RBAC/PIM, Azure Policy, and automated guardrails
• Improve security visibility through logging, monitoring, SIEM integrations, detection engineering, and operational security tooling
• Continuously assess and remediate cloud security risks, inherited infrastructure weaknesses, configuration drift, and operational security gaps
• Embed security into infrastructure, platforms, and engineering workflows by collaborating with Cloud Engineering and DevOps teams to build secure-by-default solutions
• Identify and address security risks in application architecture, authentication, APIs, and data flows throughout the product lifecycle
• Integrate security capabilities into CI/CD pipelines and engineering workflows, including SAST, DAST, dependency scanning, secrets management, software supply-chain security, and policy-based controls
• Lead threat modeling, architecture reviews, and secure design discussions to identify security risks early in the software development lifecycle
• Build developer-friendly security guardrails, reusable patterns, and automations that improve security without slowing delivery velocity
• Drive timely remediation of security findings by enabling engineering teams with practical guidance, automation, and secure-by-default patterns
• Lead efforts to reduce security backlog, cloud governance drift, stale permissions, infrastructure weaknesses, technical debt, and operational security risk
• Balance risk reduction, engineering impact, and business priorities when determining what to remediate, standardize, automate, or defer
• Collaborate with Security leadership to improve incident readiness, operational maturity, security visibility, and organizational resilience
• Help modernize inherited systems while improving container security, Kubernetes security, and secure cloud-native engineering practices
• Leverage automation, APIs, scripting, AI-assisted tooling, and emerging technologies to improve security operations, engineering productivity, and organizational effectiveness
• Continuously challenge traditional approaches by identifying opportunities to automate, simplify, or reimagine security and engineering workflows
• Build self-service capabilities, reusable tooling, and scalable workflows that improve developer experience while strengthening security outcomes
• Evaluate and adopt modern engineering practices, AI-assisted workflows, and emerging technologies that improve security outcomes, accelerate remediation, and increase engineering effectiveness
• Act as a force multiplier across Security, Engineering, and Cloud Operations by creating systems that increase organizational leverage and effectiveness

Requirements:

• 5+ years of experience in Security Engineering, Application Security, Cloud Security, DevSecOps, or related security-focused engineering roles within cloud-native SaaS environments
• Strong experience designing, securing, and modernizing Azure environments, including Azure networking, governance, RBAC/PIM, Azure Policy, and secure connectivity patterns
• Experience improving application security through secure SDLC practices, threat modeling, CI/CD security controls, and engineering partnership
• Hands-on experience implementing DevSecOps capabilities such as SAST, DAST, dependency scanning, secrets management, software supply-chain security, and policy automation
• Experience with Kubernetes, Docker, container security, IaC, and modern cloud-native platforms
• Hands-on experience with GitHub, GitHub Actions, GitHub Advanced Security (or equivalent), SIEM platforms, observability tooling, and cloud security technologies
• Strong automation, scripting, troubleshooting, and cross-functional collaboration skills, with a focus on scalable solutions and operational improvement
• Experience leveraging AI-assisted engineering tools (such as GitHub Copilot, Claude Code, or similar) and a demonstrated curiosity for applying automation and emerging technologies to improve security and engineering outcomes