DevSecOps Engineer
Posted
Summary
DevSecOps Engineer embedding automated security (SAST/DAST/SCA/container scanning, policy-as-code) into CI/CD pipelines and cloud infrastructure at a loyalty program provider for banks and credit unions. Day to day: triage vulnerabilities, build secure AWS–GCP integrations, and automate guardrails with Terraform/CDK and GitHub Actions.
Overview
The DevSecOps Engineer is responsible for embedding automated security guardrails, vulnerability scanning, and compliance controls directly into our cloud platform and CI/CD pipelines. By managing security tooling platforms (SAST/DAST/SCA), automating vulnerability triage, and building secure multi-cloud integration patterns (including AWS to Google Gemini Enterprise Plus), this role ensures our core cloud infrastructure remains scalable, secure, and friction-free. This position operates as a mid-to-senior technical resource, accelerating software delivery while reducing administrative security overhead across teams.
Responsibilities
- Implement, configure, and maintain automated security scanning platforms (SAST, DAST, SCA, container scanning) across our development pipelines.
- Triage security scan findings and automate remediation workflows to streamline vulnerability management across teams.
- Partner with Architecture and Engineering to establish secure multi-cloud guardrails, including AWS-to-GCP identity federation, KMS key management, and API gateway access controls for AI platform integrations.
- Enforce Infrastructure as Code (IaC) security automation (such as Terraform, Checkov, and Trivy) to embed policy-as-code across environments.
- Serve as a Subject Matter Expert (SME) for cloud security tooling, CI/CD automation, and multi-cloud access patterns, providing technical guidance across the organization.
- Proactively tune security tools to reduce false positives and eliminate operational noise for software delivery teams.
- Serve as a secondary point of escalation for security and platform incidents, rather than participating in the primary on-call rotation.
- Coordinate technical resolution during security events and contribute to post-mortem analysis to prevent recurrence.
Essential Skills and Experience
- 3 to 5+ years of experience in DevSecOps, cloud security, or platform security engineering.
- Multi-cloud experience across public cloud platforms, with deep expertise in AWS and working experience in GCP (Google Cloud Platform).
- Deep experience with AWS core security infrastructure (IAM, KMS, Secrets Manager, VPC, EKS/ECS).
- Strong proficiency in Terraform or AWS CDK to enforce infrastructure guardrails as code across cloud environments.
- Hands-on experience integrating security testing tools (SAST/DAST/SCA/Container scanning) into CI/CD pipelines (GitHub Actions, AWS CodeBuild, or Jenkins).
- Experience establishing identity flows, OAuth configurations, and Workload/Workforce Identity Federation across multi-cloud environments (AWS and GCP).
- Hands-on experience with container security, image scanning repositories (ECR, Trivy), and containerized application runtime security.
- Proficiency in CloudWatch, SIEM log monitoring, and security findings triage.
Preferred Skills and Experience
- Professional or Associate cloud or security certifications (such as AWS Certified Security Specialty, GCP Professional Cloud Security Engineer, CISSP, AWS SysOps Administrator, or DevOps Engineer).
- Hands-on experience implementing cross-cloud integration patterns between AWS workloads and GCP enterprise services (such as Google Gemini Enterprise Plus).
- High proficiency in scripting languages (Python, Go, Bash, or PowerShell) to automate security workflows and vulnerability triage.
- Direct experience with container orchestration platforms (AWS ECS/Fargate or EKS) and microservice security.
- Familiarity with database security controls and encrypted connectivity in cloud environments (Postgres, MySQL, DynamoDB).
Key Competencies and Attributes
- Proactive Problem Solver: Does not wait for tickets; actively identifies platform bottlenecks, security risks, and scanner noise, proposing and implementing automated solutions independently.
- Developer-Centric Mindset: Views the developer as a customer, focusing on creating frictionless security controls and actionable feedback loops for engineering teams.
- Cross-Functional Collaborator: Able to navigate and work effectively across multiple departments (Security, Dev, Ops, Architecture), bridging technical gaps to ensure successful integrations.
- Automation-Driven: Constantly seeks opportunities to replace manual security administration with automated scripts, policy-as-code, and self-service tools.
- Adaptable: Comfortable with the rapid pace of cloud-native and AI developments, quickly mastering new cloud provider features to enhance platform security.
Work Arrangement
- Based at ampliFI’s Naperville, IL Corporate office, this hybrid role requires onsite reporting Tuesday-Thursday weekly.
- National remote opportunities require residency in one of the following states AZ, CO, FL, GA, IL, IN, MA, MT, NC, NE, NH, NJ, NY, OH, PA, SC, TX, UT, VA, or WI.
Physical Requirements
This role involves sitting or standing for extended periods, using computers, phones, and other office equipment. Visual acuity and manual dexterity are needed for reading documents and handling materials. Occasional lifting of items up to 20 lbs. and frequent phone communication is required.
Other Duties
Duties, responsibilities, and activities are not all encompassing and may change at any time with or without notice. To perform this job successfully, an individual must be able to satisfactorily carry out each essential duty. Reasonable accommodation may be made to enable qualified individuals with disabilities to perform essential job functions
The compensation range listed below represents the potential salary for this role at the time of posting. However, the final salary may be higher or lower than the stated range, and this range may be adjusted in the future. An employee’s placement within the salary range will depend on various factors, including but not limited to relevant education, qualifications, certifications, experience, skills, seniority, geographic location, performance, shift, travel requirements, sales or revenue-based metrics, any applicable collective bargaining agreements, and the needs of the business or organization. The salary range for this role is $90,000 to $100,000 per year.
About ampliFI
At ampliFI Integrity guides every decision, Curiosity drives innovation, and Advocacy ensures we always put our clients and teammates first. We foster a supportive, fun workplace where your contributions are valued, and your growth is encouraged.
ampliFI provides fully outsourced, customized credit and debit card loyalty programs exclusively focused on banks and credit unions nationwide. For nearly two decades, we have delivered compelling rewards programs, unique earn and burn opportunities and card-linked programs to leverage merchant funded offers. Here at ampliFI, we are always looking for more great people to be a part of the relentless pursuit of excellence in everything we do.
Benefits and Perks
- Competitive pay plus 401(k) with employer match
- Medical, dental, vision, and life insurance
- Voluntary café plans, including voluntary life, accident, hospital, critical care, and parking/transit options
- Tuition Reimbursement
- Paid time off, company holidays, and parental leave
- Employee Assistance Program
- Hybrid work environment with flexible hours
- Onsite perks including gym access and snacks
- Employee recognition programs celebrating milestones and achievements
- Growth opportunities within a supportive, team-oriented environment
ampliFI Loyalty Solutions embraces diversity and equal opportunity. We are committed to building a team that represents a variety of backgrounds, perspectives, and skills because we believe that the more inclusive we are, the greater impact we can make together.
Skills
- AI
- API
- Automation
- AWS
- Bash
- CDK
- CI/CD
- Cissp
- Cloud
- Cloud Native
- Cloud Security
- CloudWatch
- Container Security
- DAST
- DevOps
- DevSecOps
- DynamoDB
- ECS
- EKS
- GCP
- Gemini
- GitHub
- GitHub Actions
- IAM
- Infrastructure as Code
- Jenkins
- Microservices
- MySQL
- OAuth
- PostgreSQL
- PowerShell
- Python
- SAST
- SIEM
- Terraform
- VPC
- Vulnerability Scanning
