135K–220K USD / year
Senior Security Engineer
DevOpsRemote — United States
Published on 2026-10-26
These details were extracted automatically from the original listing. They may not be complete or fully up to date — it's worth checking the original job post.
About this role
Lead the security tooling that tests and validates software against cybersecurity and compliance requirements. Build automated, risk-based controls across the software development lifecycle and help establish application security, penetration testing, and security operations capabilities for regulated environments.
About the company
Istari Digital specializes in developing advanced digital solutions for aerospace and commercial sectors, focusing on deploying cutting-edge technologies. Their team comprises engineers and executives dedicated to enhancing operational efficiency and strategic partnerships.
Stack
GitHubArgo CDJFrogSnykPythonBashDockerKubernetes
What you'll do
- Own and improve CI/CD security tooling, including SAST, SCA, secrets detection, container scanning, and artifact signing.
- Translate NIST and RMF requirements into risk-based pipeline controls and assessor-ready evidence.
- Define security gates, vulnerability thresholds, and documented exception and manual-review processes.
- Enforce software and repository integrity through signing, verification, branch protection, and repository rules.
- Automate SBOM and VEX generation and promote early security checks in developer workflows.
- Develop penetration testing, security operations, and incident response capabilities.
- Apply AI tools to accelerate vulnerability triage, remediation, and security automation.
What we're looking for
- 7+ years of experience in DevSecOps, application security, security operations, incident response, or security engineering.
- At least 3 years owning security tooling in CI/CD pipelines.
- Hands-on experience configuring and enforcing SAST, SCA, secrets detection, and container scanning in production pipelines.
- Experience mapping security controls to NIST SP 800-53, NIST SP 800-171, or RMF requirements and producing assessment evidence.
- Experience evaluating security tooling and influencing engineering teams without direct authority.
- Scripting or automation experience in Python, Bash, or similar.
- Security+ or equivalent DoD 8140 qualifying certification, or ability to obtain it within 2 months of hire.
- U.S. citizenship and residence and work location in the U.S.
Nice to have
- Experience in DoD software factories or Government DevSecOps environments, such as Platform One, Iron Bank, or Big Bang.
- Experience supporting ATO efforts, control assessments, and POA&M management.
- Experience with supply chain integrity, policy-as-code, artifact signing, SBOMs, OPA, or Kyverno.
- Experience applying AI or LLM tools to security engineering.
- Penetration testing experience and familiarity with cloud and container environments.
- Advanced security certifications or an active security clearance; Top Secret is highly desired.