Description
We are seeking a DevSecOps Engineer to join our AI Strategic Planning Group (AI SPG) on the Cloud Control & AI Canvas team.
As a DevSecOps Engineer, you will play a critical role in building and securing the next generation of cloud infrastructure and enterprise AI platforms.
Your Impact:
- Build cutting-edge AI agent workflows to automate alert triage, threat modeling, evidence collection, and guided incident response with built-in human-in-the-loop guardrails.
- Design and implement robust, secure-by-default AWS cloud foundations,advancing IAM least privilege, data encryption, network segmentation, and automated guardrails.
- Build seamless CI/CD automation with GitHub Actions, Terraform, and container security tooling (SAST/DAST/SCA, SBOMs, artifact signing) to empower developers to ship fast and securely.
- Partner early with engineering teams to conduct pragmatic threat modeling across microservices, APIs, Kubernetes, and AI/LLM applications.
- Streamline audit readiness and operational workflows for frameworks like SOC 2, FedRAMP, and ISO 27001 using Python, APIs, and Infrastructure-as-Code.
Minimum Qualifications (Must-Have Skills):
- 7+ years of hands-on experience in Cloud Security, Application Security, or Software Engineering.
- Proven experience securing AWS multi-account environments, including IAM policies, SCPs, WAF, KMS, CloudTrail, GuardDuty, and Security Hub.
- Proven scripting and automation capability in Python (or Go/Bash) with hands-on Terraform (IaC) and GitHub Actions (CI/CD pipelines).
- Experience performing security architecture reviews, threat modeling, and integrating vulnerability scanning into software delivery lifecycles.
- Daily comfort using AI coding assistants and modern developer tools (e.g., GitHub Copilot, Cursor, LLMs) to accelerate daily workflows.
- Strong communication and teamwork skills, with a track record of partnering empathetically with developers to solve security challenges.
Preferred Qualifications (Optional Skills):
- Securing generative AI apps, prompt guardrails, and agent tool permissions.
- Automating audit evidence for SOC 2, FedRAMP, ISO 27001, or IRAP/ISMAP.
- Hands-on with SBOMs, provenance, and artifact signing (e.g., Sigstore/Cosign).
- Experience with SIEM logging, detection engineering, and incident triage.