Senior DevSecOps Engineer

Company Overview

Westaim and CC Capital have joined forces to strategically transform Westaim from a holding company into a global alternative credit asset manager with a unique, integrated insurance platform, branded as The Westaim Corporation. This partnership supports a long-term vision to deliver innovative, customized financial solutions across alternative credit and insurance, creating scalable growth and meaningful client impact.

Ceres USA Holdings, LLC, part of the insurance platform within The Westaim Corporation strategy, is the parent company of Ceres Life Insurance, a fast-growing, technology-driven annuity carrier startup. Ceres is focused on redefining retirement security by combining modern fintech capabilities, top-tier talent, and strong vendor partnerships to deliver exceptional annuity solutions and digital experiences.

Ceres is deeply committed to a client-centered culture. Through its Digital Contact Center and advisor-facing platforms, the company delivers proactive, personalized, and technology-enabled support that empowers clients and advisors while maintaining the highest standards of trust, security, and regulatory compliance.

About the Role

We are looking for a Senior DevSecOps Engineer to join the Information Security team and work closely with the Office of the CISO to help secure a modern, cloud-based insurance platform supporting annuity products and financial operations.

This is a hands-on role for someone who enjoys securing cloud infrastructure, software delivery workflows, code repositories, infrastructure as code, CI/CD pipelines, APIs, and application environments. You will work closely with engineering, infrastructure, data, product, and security stakeholders to embed security into development and cloud operations.

This role is ideal for a technically strong engineer with a background in software engineering, cloud security, AWS, infrastructure as code, and secure SDLC practices. The right candidate can learn new platforms quickly, understand how engineering systems fit together, and translate security findings into practical remediation and improved security patterns.

This is not a purely advisory or architecture-only role. You will be expected to review, configure, implement, document, troubleshoot, and help remediate security issues in partnership with the CISO, Deputy CISO, engineering teams, platform owners, and security partners.

Key Responsibilities

Secure Cloud and Engineering Environments

• Design, implement, and improve security controls across cloud infrastructure, application environments, developer workflows, and engineering platforms
• Review cloud architecture, infrastructure as code, APIs, integrations, and application design for security risks
• Help identify, prioritize, and remediate cloud misconfigurations, infrastructure weaknesses, and security findings
• Support secure configuration of cloud services, identity and access controls, network security controls, and service-level security settings
• Maintain documentation of cloud and engineering security decisions, control patterns, remediation actions, and operational procedures

Strengthen Secure SDLC and DevSecOps Practices

• Implement and improve security controls across code repositories, CI/CD pipelines, and software delivery workflows
• Support branch protection, repository permissions, secrets scanning, code scanning, dependency review, and secure development practices
• Partner with engineering teams to embed security into the development lifecycle without unnecessarily slowing delivery
• Coordinate remediation of vulnerabilities identified through cloud security platforms, code scanning, penetration testing, application security reviews, infrastructure-as-code review, and audit findings
• Help define repeatable secure development, deployment, and remediation patterns

Support Application, API, and Software Supply Chain Security

• Review applications, APIs, integrations, and platform designs for security risks and practical remediation options
• Help improve software supply chain security, dependency management, secrets handling, and secure deployment workflows
• Provide practical guidance to engineers on secure coding, secure cloud usage, access control, logging, monitoring, and remediation priorities
• Collaborate with engineering and platform teams to ensure security findings are understood, prioritized, and resolved

Strengthen Security Governance and Audit Readiness

• Help prepare the organization for Internal Audit, external audits, regulatory reviews, and control assessments
• Support security control implementation and evidence gathering for frameworks and expectations such as SOC 2, ISO 27001, NAIC, and other relevant standards
• Ensure security work is documented, repeatable, reviewable, and aligned with control requirements
• Follow change management processes and support appropriate review and approval of security configuration changes
• Partner with the Office of the CISO to prioritize cloud, application, and SDLC security improvements and reduce operational risk

Provide Practical Cloud and SDLC Security Architecture Input

• Provide hands-on security architecture input for cloud infrastructure, application platforms, APIs, CI/CD workflows, and engineering practices
• Identify security design gaps and recommend practical, implementable improvements
• Help define secure patterns for cloud services, infrastructure as code, source control, CI/CD, secrets management, and application delivery
• Advise on secure use of emerging technologies and AI-enabled development or automation tools where relevant

Required Qualifications

• 7+ years of experience in cybersecurity engineering, DevSecOps, cloud security, software engineering, infrastructure engineering, or a related field
• Strong hands-on experience securing cloud environments, preferably AWS
• Experience with infrastructure as code, especially Terraform or similar tools
• Experience securing code repositories, CI/CD pipelines, developer workflows, or software delivery platforms
• Familiarity with secure SDLC practices, application security, API security, vulnerability remediation, and software supply chain security
• Experience coordinating remediation of security findings with engineering teams
• Strong understanding of cloud IAM, network security controls, secrets management, logging, monitoring, and secure configuration
• Experience working in regulated environments or environments with formal audit, compliance, or control requirements
• Self-motivated learner who proactively researches emerging technologies, security trends, and evolving threats without waiting for direction
• Ability to learn a new platform and quickly become proficient
• Strong written and verbal communication skills, including the ability to document technical decisions and explain security concepts clearly to engineering and business stakeholders

Nice-to-Have Qualifications

• Experience supporting financial services, insurance, annuity, fintech, or other regulated environments
• Experience with cloud security posture management, cloud vulnerability management, or infrastructure security tooling
• Experience with GitHub security controls, GitHub Advanced Security, code scanning, secret scanning, dependency review, or similar capabilities
• Experience with penetration test remediation, application security review, threat modeling, or secure architecture review
• Familiarity with frameworks and requirements such as SOC 2, ISO 27001, NAIC, NIST, or similar control frameworks
• Experience with developer security enablement, security champions, engineering training, or secure SDLC rollout
• Certifications such as CISSP, cloud security certifications, AWS security certifications, or other relevant security or engineering certifications

Who This Role Is Ideal For

This role may be a strong fit for someone who has a software engineering, cloud engineering, platform engineering, or infrastructure-as-code background and has moved into security. It is also a fit for a hands-on cloud security or application security engineer who enjoys working directly with engineering teams and remediating real findings.

The ideal candidate enjoys solving practical cloud and software security problems, learning new platforms quickly, working directly with developers and platform teams, and turning security priorities into implemented controls and measurable risk reduction.

What This Role Is Not

This is not a pure architect role, a policy-only role, or a governance-only role. It is also not primarily a Microsoft 365, endpoint administration, corporate SaaS administration, or SOC operations role.

This role will provide practical cloud, application, and SDLC security architecture input when needed, but the day-to-day expectation is hands-on security engineering, review, remediation, documentation, and operational improvement.

Internal Audit and Control-Readiness Expectations

Ceres expects to continue maturing its internal audit and control environment. This role will help ensure cloud, application, and SDLC security controls are implemented, documented, monitored, and improved over time.

The Senior DevSecOps Engineer will help the Office of the CISO prepare for internal audit, external audit, regulatory reviews, and security control assessments by supporting evidence collection, remediation tracking, secure configuration, change management, and control documentation across cloud and engineering workflows.

Why Join Us?

• Be part of a fast-growing, innovative insurance business dedicated to delivering modern annuity solutions and exceptional advisor and client experiences
• Make a direct impact on the security, resilience, and control maturity of a growing regulated company
• Work closely with the Office of the CISO and engineering teams on meaningful, hands-on cloud and SDLC security initiatives
• Help shape secure engineering practices while working across modern cloud, code, infrastructure-as-code, and DevSecOps platforms
• Join a collaborative startup environment focused on technology, digital tools, and advisor enablement
• Competitive compensation package with PTO, health benefits, and career growth opportunities