Senior DevSecOps and Vulnerability Management Engineer

Our client is an international IT company seeking an experienced Senior DevSecOps and Vulnerability Management Engineer to strengthen security practices across its development pipelines, cloud infrastructure, and vulnerability management processes.
The client is building a dedicated security team for a US-based SaaS provider whose platform serves hundreds of public-sector agencies across North America. The programme covers a large, varied estate of around a dozen product lines, running on Java, .NET, Node/TypeScript, Ruby and PHP across Azure and AWS, including legacy systems that need framework upgrades rather than quick patches. The work starts with a short phase where senior engineers do threat modelling and map the estate. A larger team then fixes vulnerabilities, hardens cloud infrastructure, builds security gates into CI/CD pipelines and consolidates identity services. Engineers work hands-on with modern AI coding tools and learn security from experienced tower leads. It’s a strong fit for good software, cloud and DevOps engineers who want to grow into application security. The team works in English, with partial overlap with US Eastern time.

The Project

The project focuses on establishing a centralized, risk-based vulnerability management framework, integrating automated security checks into CI/CD pipelines, and improving the accuracy and transparency of security reporting.

The engagement consists of two phases. During Phase 1, the engineer will lead vulnerability management improvements and DevSecOps security integration. In Phase 2, the role will transition into a leadership position within the client's DevOps team, overseeing cloud and infrastructure engineers and a vulnerability management analyst.

Key Responsibilities:

• Assess existing CI/CD pipelines, including GitHub Actions, Jenkins (Groovy), ArgoCD, Helm, and AWS CodePipeline, along with currently implemented security scanning tools.

• Establish a unified vulnerability triage process to consolidate findings, eliminate duplicates, and prioritize risks using CVSS, EPSS, CISA KEV, and exploitability/reachability indicators.

• Implement end-to-end vulnerability tracking, ensuring each finding has a designated owner and a documented resolution status (remediated, contained, or risk-accepted).

• Integrate SAST, software composition analysis (SCA), secrets detection, container security, and infrastructure-as-code scanning into CI/CD pipelines, including security gates to prevent regression.

• Establish branch management and repository hygiene practices to reduce accumulated vulnerabilities and prevent uncontrolled growth of security findings.

• Deliver accurate weekly vulnerability management reports and progress metrics to the CISO and senior leadership.

• During Phase 2, lead cloud and infrastructure engineering activities and vulnerability management operations within the DevOps team.

The Needs

Must-Have Requirements:

• Approximately 8+ years of experience in DevOps or platform engineering, with strong practical DevSecOps expertise.

• Proven experience implementing automated CI/CD security gates using GitHub Actions or Jenkins.

• Hands-on experience managing vulnerabilities at scale, including findings aggregation, deduplication, risk-based prioritization, and remediation tracking.

• Strong understanding of vulnerability scoring and prioritization frameworks, including CVSS, EPSS, and CISA KEV.

• Ability to transform complex security findings into reliable, actionable reporting for non-technical stakeholders and senior management.

• Ability to coordinate security remediation activities across engineering teams.

Nice-to-Have Skills:

• Experience with vulnerability aggregation and management platforms such as DefectDojo.

• Container and Kubernetes security expertise.

• Knowledge of software bill of materials (SBOM), software supply chain security, SLSA, and Sigstore.

• Experience with Azure DevOps or AWS CodePipeline.

• Dashboard development and security reporting using Power BI or Datadog.

Additional Info

• Location: Lithuania or Poland

• Start date: ASAP

• Contract duration: 12 months