Secure Ci/cd

Secure Ci/cd Engineer Jobs

2 jobs found

1d ago

Senior Security Engineer

FHLBanks Office of Finance Reston, VA

Reston, VA

1d ago

$140k - $202k/yr Full time Senior Api Security Application Security

Apply Now

Job Description

Senior Security Engineer will strengthen application security by embedding controls into the SDLC and CI/CD pipelines and improving proactive detection for web and APIs.

Responsibilities

Develop and maintain software application security policies and procedures
Implement software application security controls
Partner with DevOps teams to develop and support a secure CI/CD pipeline
Design and operate web application firewall (WAF) and API protections, including rule tuning, false-positive reduction, and automated policy updates
Identify application security vulnerabilities and issues, perform risk assessments, and provide mitigations
Develop security monitoring for the application stack
Conduct technical investigations of application security incidents
Interface with senior stakeholders across the IT leadership team to interpret risks and priorities proactively
Support the OF diversity and inclusion strategy by following policies and procedures that ensure opportunities for employees and diverse business partners
Assist with other job duties as assigned

Requirements

6 to 8 years of experience in Application Security (designing, implementing, and operating security controls in enterprise application environments)
Hands-on experience with web application security, including OWASP Top 10 vulnerabilities
Hands-on experience with WAF/API security (policy design, rule tuning, automation)
Hands-on experience with container security, including runtime hardening, image scanning, and vulnerability risk assessments
Hands-on experience conducting web application security scans, vulnerability assessments, and/or penetration testing
Experience investigating problems and processes using established methodologies and best practices
Experience working with Authentication and Authorization services such as OAuth and OpenID
Experience operating on-prem or cloud-based security platforms
Ability to troubleshoot security and network-related issues and communicate technical findings effectively
Ability to listen and integrate ideas from diverse individuals, build respectful relationships, collaborate, and resolve conflicts constructively
Bachelor’s Degree in Information Security or Computer Science or Computer/Electrical Engineering, or equivalent field experience
Proof of eligibility to work in the United States

Skills and Technologies

OWASP Top 10
Web application firewall (WAF)
OAuth
OpenID

Position Summary

Designs, implements, operates, and continuously improves OF security technologies and controls across applications and supporting platforms
Primary focus on Application Security by embedding security into the SDLC and CI/CD pipelines
Strengthens web and API protections and supports proactive detection
Contributes broadly to Security Engineering capabilities including identity, security platforms (cloud/on-prem), logging/telemetry, and automation
Partners with development, DevOps, and operations teams to build secure-by-default applications and services

Location and Compensation

Location: Reston, VA (onsite)
Salary: USD 140,441 to 202,303 per year

Core Values

Integrity: accountability, consistency, transparency, and trust
Agility: adaptability, continuous improvement, expertise, and flexibility
Partnership: collaboration, communication, leadership, and teamwork
Inclusivity: diversity, relationships, respect, and support

View full job page →

15d ago

Cyber Security Engineer

TherapyNotes.com Philadelphia, PA

Philadelphia, PA

15d ago

$110k - $150k/yr Full time Application Security Application Security Testing Cloud Platforms

Apply Now

Job Description

TherapyNotes.com is hiring a hands-on Cyber Security Engineer in Philadelphia, PA (onsite) to strengthen application security across the SDLC and CI/CD pipeline. This role will focus on securing GitHub Actions and scanning workflows, reviewing infrastructure-as-code, and supporting vulnerability management, incident response, and identity and access security within a healthcare-regulated environment.

Role Overview

In this position, you will own application security practices spanning development workflows and deployment pipelines. The work includes securing CI/CD/GitHub Actions, improving scanning coverage and configurations, partnering on Terraform and other IaC reviews, and contributing to incident response activities. You will also help align security controls with healthcare regulations and support audit readiness.

Responsibilities

Work with development teams to ensure security is integrated continuously into the SDLC and CI/CD pipeline.
Apply and enforce secure coding standards to reduce vulnerabilities and protect the confidentiality, integrity, and availability of customer data.
Conduct security assessments, code reviews, and threat modeling to identify vulnerabilities and related risks.
Own and operate GitHub Advanced Security, triaging code, secret, and dependency scanning findings, identifying recurring vulnerability patterns, recommending broader fixes, and improving scanning coverage and workflow configurations.
Secure CI/CD pipelines and GitHub Actions by addressing identities, runners, permissions, and secrets, and reduce software supply chain risk through third-party action review, dependency controls, action pinning, and artifact provenance.
Review Terraform and other infrastructure-as-code for security issues, partnering with IT platform teams on IaC scanning and secure deployment practices.
Ensure application security measures align with healthcare regulations and standards, including HIPAA, HITRUST, and HITECH, and support regular audits.
Collaborate with developers to remediate vulnerabilities by providing actionable guidance and supporting effective patching or mitigation.
Develop, deploy, and manage security tools and technologies such as SAST, DAST, and vulnerability management systems to automate security testing and scanning.
Support application security incident response by helping identify root causes and contributing to resolution strategies.
Contribute to security awareness efforts for development teams, emphasizing secure coding practices and proactive security measures.

Requirements

Bachelor’s degree in information security, computer science, or a related field preferred; equivalent experience will be considered.
5+ years in application security or security engineering.
Experience securing CI/CD pipelines and GitHub Actions, including SAST/DAST and code, secret, and dependency-scanning triage (for example, GitHub Advanced Security and Snyk), plus runner and workflow-permission security and third-party action or supply-chain risk controls.
Experience reviewing Terraform or other infrastructure-as-code for security misconfigurations.
Working knowledge of SIEM, EDR/XDR, and DLP platforms, including deployment, tuning, and alert triage.
Understanding of Zero Trust architecture principles as they apply to application and identity access.
Strong understanding of healthcare regulations including HIPAA, HITECH, and HITRUST and how they impact application security.
Experience with API security, including integrations with other healthcare systems; familiarity with HL7 or other healthcare data standards is preferred.
Prior experience securing cloud environments (Azure preferred, AWS a plus).
Willingness to participate in an incident response on-call rotation.
Industry certifications such as GWAPT, OSWE, GPEN, or a cloud security certification (Azure/AWS) are ideal; CISSP or HCISPP is a plus but not a substitute for hands-on tooling experience.

Key Technologies

GitHub Actions, GitHub Advanced Security, Snyk
Terraform
SIEM, EDR/XDR, DLP
Zero Trust architecture
API security
HL7
Azure, AWS
SAST, DAST
Vulnerability management systems
GWAPT, OSWE, GPEN, CISSP, HCISPP

Compensation and Benefits

Competitive salary: $110,000-$150,000 per year
Employer sponsored health, dental, vision, life, and disability insurance
Retirement plan with company contribution
Annual company profit sharing
Personal development and training budget
Open, collaborative work environment
Extensive 2-week onboarding plan
Comprehensive mentorship program

Additional Notes

Commitment to continuous learning and staying current on emerging trends and technologies.
Ability to take ownership of projects and drive them through to completion.
Strong collaboration skills to work effectively with cross-functional teams.

View full job page →

Secure Ci/cd Engineer Jobs

Senior Security Engineer

Cyber Security Engineer

Get Secure Ci/cd Engineer Jobs alerts