Senior Security Engineer

Istari

. Serve as the technical owner of pipeline security tooling, including SAST, SCA, secrets detection, container scanning, and artifact signing .

Posted 10/27/2026full-timeRemote • United StatesSenior💰 $135,000 - $220,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in DevSecOps and application security, with a strong focus on configuring and enforcing security tooling in CI/CD pipelines. Proficient in translating NIST requirements into actionable security policies and automating security processes to enhance operational efficiency.

Highest-signal resume keywords

DevSecOps ExpertiseSAST ConfigurationNIST SP 800-53 MappingPython ScriptingSecurity+ Certification

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

SASTSCASecrets DetectionContainer ScanningPenetration TestingRisk-Based GatesVulnerability ThresholdsAutomationArtifact SigningPolicy-as-Code

Soft Skills

CollaborationInfluencing Without AuthorityProblem Solving

Tools & Technologies

GitHubDockerKubernetesAWSJFrogSnykArgo CD

Certifications & Qualifications

Security+CISSPCASP+GIAC

Industry Keywords

DevSecOpsSecurity OperationsIncident ResponseContinuous MonitoringATO EffortsSBOMVEX DataRMF

Tech Stack

Tools & technologies

AWSCloudCyber SecurityDockerKubernetesPython

About the role

Key responsibilities & impact

Serve as the technical owner of pipeline security tooling, including SAST, SCA, secrets detection, container scanning, and artifact signing
Assess tooling effectiveness and coverage; identify gaps and lead improvements, consolidation, or replacement
Develop automated and manual penetration-testing capabilities with rapid feedback loops into engineering
Help mature security operations and incident response capabilities
Define the long-term roadmap for security tooling and processes with Cybersecurity and Engineering leadership
Translate NIST SP 800-53, NIST SP 800-171, and RMF requirements into enforceable pipeline gates, thresholds, and policies
Maintain risk-based pass/fail criteria while minimizing false positives
Ensure tooling outputs produce assessor-ready evidence for authorizations, continuous monitoring, and audits
Own documented and traceable exception and manual-review processes
Enforce artifact signing, signature verification, commit signing, branch protection, and repository rulesets
Automate creation and maintenance of SBOMs and VEX data
Move security checks earlier into developer workstations, pre-commit hooks, and pull requests
Partner with engineering teams to embed security into workflows
Apply AI tooling to vulnerability triage, remediation, and security automation; evaluate emerging AI capabilities

Requirements

What you’ll need

7+ years in DevSecOps, application security, security operations and incident response, and general security engineering, including at least 3 years owning security tooling in CI/CD pipelines
Deep hands-on experience configuring, tuning, and enforcing SAST, SCA, secrets detection, and container scanning tools in production pipelines, including risk-based gates, vulnerability thresholds, and exception processes
Demonstrated experience mapping security tooling and pipeline controls to NIST SP 800-53, NIST SP 800-171, or RMF requirements, and producing evidence for assessments or authorizations
Track record of evaluating, selecting, or evolving security tooling, and influencing engineering teams without direct authority
Scripting or automation experience in Python, Bash, or similar
Security+ or equivalent DoD 8140 qualifying certification, or ability to obtain within 2 months of hire
U.S. citizen residing and working in the U.S.
Preferred: Familiarity with GitHub, Argo CD, JFrog, and Snyk
Preferred: Experience in DoD software factory or Government DevSecOps environments
Preferred: Experience supporting ATO efforts, including control assessment and POA&M management
Preferred: Experience with software supply chain integrity and policy-as-code practices, such as artifact signing, signature verification, SBOMs, OPA, or Kyverno
Preferred: Experience applying AI and LLM tools to security engineering
Preferred: Experience with penetration testing tools, processes, and strategies
Preferred: Familiarity with cloud and container environments such as GitHub, Docker, Kubernetes, and AWS
Preferred: Advanced certifications such as CISSP, SecurityX (CASP+), or GIAC
Preferred: Active security clearance (Top Secret highly desired)

Benefits

Comp & perks

Bonuses
Equity
Comprehensive benefits package