Senior DevSecOps Engineer (Senior Application Security Engineer)

IDEMIA develops secure biometric identification platforms for justice and public safety organizations. The Senior Application Security Engineer will define and own application security practices across the software development lifecycle, establish controls and validation gates, guide engineering teams across three product lines, and perform hands-on security reviews, CI/CD security improvements, incident response, compliance support, and customer engagements.

Responsibilities:

• Define and own the holistic approach to security
• Establish security controls and validation gates for each lifecycle stage: design, code, build, deploy, software customization and delivery, and operations
• Develop the standards, guardrails, and documentation guiding multiple engineering teams across three product lines
• Partner with our internal shared security services team, which conducts penetration testing and SAST/SCA scanning, to triage findings, assess severity, and set remediation priorities
• Conduct architecture and design reviews to identify security risk, and collaborate with engineering teams on remediation
• Develop and enhance security stages within our CI/CD pipelines
• Participate in incident response and triage activities
• Maintain our FedRAMP and CJIS compliance posture as it pertains to application security
• Represent our security approach in customer engagements, audits, and technical reviews

Requirements:

• Minimum 10 years of combined software engineering and security experience, including substantive time in a DevSecOps capacity
• Demonstrated experience embedding security controls directly into CI/CD pipelines
• Proven ability to conduct security reviews of application and cloud architectures
• Practical experience triaging SAST, SCA, and penetration test findings, including distinguishing material risk from false positives
• Working knowledge of cloud security in AWS and/or Azure, preferably government cloud environments
• Ability to obtain and maintain background clearances from local, state, and federal agencies
• Availability to travel approximately 10% of the time
• Candidates must be a U.S. Person (U.S. citizen, Green Card holder, or otherwise authorized under applicable U.S. regulations) to be considered for this position
• Familiarity with FedRAMP, CJIS, NIST 800-53, or comparable frameworks
• Certifications such as CISSP, CSSLP, GWAPT, or OSCP
• Experience in biometrics, identity management, or public safety software
• Threat modeling experience (STRIDE, PASTA, or comparable)
• Secrets management and software supply chain security, including SBOM generation