Security Engineer

The Security Engineer will embed with the platform engineering team to strengthen the security of Kubernetes and Red Hat OpenShift platforms and the services running on them. This hybrid role in St. Louis, MO focuses on vulnerability and posture assessment, remediation ownership, and automation that improves security across software-delivery and supply-chain workflows.

Role Overview

This position assesses vulnerabilities and platform security posture, drives practical remediation, and automates repeatable security activities. The engineer will independently execute well-defined work, help shape approaches to security problems, and own assigned deliverables while partnering with platform engineers, application teams, and enterprise security functions to translate findings into actionable remediation plans and durable controls.

Location and Work Arrangement

Hybrid role based in St. Louis, MO.

Salary Range

A reasonable estimate of the current base pay range for this position is $92,000 to $138,000 annually. Actual salary depends on factors including shift, location, experience, skill set, performance, licensure and certification, and business needs. The range may differ for other geographic locations, and some roles may include variable incentive compensation not included in base pay.

Responsibilities

• Monitor emerging vulnerabilities and regularly assess the security posture of Kubernetes, OpenShift, underlying Linux hosts, container workloads, and shared platform services; identify and prioritize risks and control gaps, then drive assigned remediation through completion.
• Develop automation to continuously assess security posture, streamline vulnerability management, and remediate repeatable, well-understood security issues where appropriate.
• Implement and improve Kubernetes and OpenShift security controls, including RBAC, Security Context Constraints (SCCs), Pod Security Admission, network policies and segmentation, ingress and service mesh security (including mTLS and authorization policies), secrets and certificate management, workload identity, and policy-as-code controls.
• Configure, integrate, maintain, and optimize security tools to provide accurate, actionable insight into platform vulnerabilities and risks.
• Evaluate and recommend security tools and technical controls to improve vulnerability management, security monitoring, access visibility, and compliance.
• Strengthen DevSecOps and software supply-chain security across CI/CD and GitOps workflows, including vulnerability and secret scanning, dependencies, container images, SBOMs, image provenance, and workflow permissions.
• Partner with platform and application engineers to interpret findings and determine remediation approaches that balance security with reliability, developer experience, and business needs, incorporating security into platform designs and delivery workflows.
• Document security findings, control decisions, remediation approaches, exceptions, standards, and recurring processes, and communicate material risks to technical and non-technical stakeholders.
• Participate in security investigations, incident response, a shared on-call rotation, and scheduled platform maintenance, including some activities outside normal business hours.

What You Will Work On (Platform and Technology Scope)

• Primarily Kubernetes and Red Hat OpenShift environments across a hybrid footprint of on-premises and cloud-connected infrastructure.
• Shared application platforms running within those environments, including MongoDB, PostgreSQL, Redis, RabbitMQ, and Apache Solr.
• Delivery ecosystem including GitHub Actions, Codefresh, Argo CD, GitOps, Helm, APIs, and configuration-as-code practices.
• Vulnerability management, Kubernetes and container security, compliance, and risk visibility using Wiz, Tenable, and Red Hat Advanced Cluster Security (ACS).
• Use of approved AI-assisted engineering tools is expected, including automating security analysis, triage, and remediation workflows, and shaping safe use of AI and agentic tooling with sound judgment, validation of results, and secure data-handling practices.

Required Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field (or equivalent combination of education, training, and practical experience).
• Three (3) to five (5) years of experience in security engineering, platform security, infrastructure security, DevSecOps, vulnerability management, or a related technical field.
• Hands-on experience securing Kubernetes or containerized platforms, including identity and access, workload security, network controls, secrets, images, and secure configuration.
• Experience using vulnerability and security findings to assess risk, prioritize remediation, and improve security posture, including configuring or maintaining the security tools that produce those findings.
• Experience scripting or building automation with Python, PowerShell, Bash, or a similar language.
• Understanding of DevSecOps and secure software-delivery practices, including CI/CD, container images, application dependencies, and software supply-chain risk.
• Ability to troubleshoot technical issues, analyze risk, document findings, and move assigned work to completion with limited direction.
• Strong written and verbal communication skills, sound engineering judgment, and ability to collaborate effectively with platform engineers, developers, security teams, and compliance partners.

Preferred Qualifications

• Experience applying Kubernetes security practices in Red Hat OpenShift, including SCCs, operators, and cluster policy.
• Experience with Red Hat Advanced Cluster Security (ACS), Wiz, Tenable, or comparable container security, cloud security, and vulnerability-management platforms.
• Hands-on experience implementing controls such as SAST, SCA, secret scanning, SBOM generation, container scanning, image signing, or provenance.
• Ability to read and review code in at least one common language such as Java, TypeScript, Python, or Go, along with familiarity with common application and API vulnerability classes.
• Experience securing service mesh (such as Istio), ingress, API gateways, or Linux hosts.
• Experience with GitOps, Helm, Ansible, Terraform, Kubernetes operators, or YAML-based pipeline automation.
• Familiarity with security standards and practices such as OWASP Top 10, OWASP API Security Top 10, NIST Secure Software Development Framework, CIS Benchmarks, SLSA, or MITRE ATT&CK.
• Relevant security or cloud certifications, such as Security+, CISSP, CCSP, or Certified Kubernetes Security Specialist (CKS).

Technologies and Tools

• Kubernetes, containerized platforms, Red Hat OpenShift, Linux, service mesh (such as Istio), ingress, API gateways
• Security controls and concepts: RBAC, Security Context Constraints (SCCs), Pod Security Admission, network policies, mTLS, authorization policies, secrets and certificate management, workload identity, policy-as-code, SBOMs, OWASP Top 10, OWASP API Security Top 10, NIST Secure Software Development Framework, CIS Benchmarks, SLSA, MITRE ATT&CK
• DevSecOps and supply chain: DevSecOps, CI/CD, container images, software supply-chain risk, GitOps, Helm, Ansible, Terraform, GitHub Actions, Codefresh, Argo CD, YAML-based pipeline automation, SAST, SCA, secret scanning, container scanning, image signing, provenance
• Security tools: Wiz, Tenable, Red Hat Advanced Cluster Security (ACS)
• Additional platforms and data stores: MongoDB, PostgreSQL, Redis, RabbitMQ, Apache Solr
• Languages and ecosystems: Python, PowerShell, Bash, Java, TypeScript, Go

Benefits

• Health (Medical & Prescription), Dental, and Vision Care
• Onsite Health Centers (MO & IL)
• Employee Assistance Program
• Wellness program
• Competitive Pay
• Profit Sharing
• 401k Plan with Company Matching
• Life and Disability Insurance
• Flexible Spending Accounts
• Tuition Reimbursement
• PTO & Holidays
• Parental Leave, Medical Leave, Military Leave
• Bereavement, Day of Caring
• Family Planning Benefits, Nursing Mothers Benefits
• Voluntary Legal, Voluntary Supplemental Accident/Illness/Hospital
• Voluntary ID Theft
• Pet Insurance
• Employee Discount Program

Additional Eligibility and Posting Notes

• This position requires permanent U.S. work authorization. Candidates requiring current or future visa sponsorship, including those on OPT, CPT or H1/H4, are not eligible.
• This role is not open for staffing partners or corp-to-corp candidates.