1 day ago
Richmond, VA, USA or McLean, VA, USASenior
Responsibilities
- Design, build, and maintain automated security workflows across the software development lifecycle and broader security environment.
- Automate vulnerability intake, ticket creation, assignment, enrichment, escalation, remediation tracking, exception handling, and reporting.
- Integrate security platforms with ticketing, CI/CD, cloud, and engineering systems using APIs, webhooks, scripts, and workflow automation.
- Embed application, dependency, secrets, infrastructure-as-code, container, and API security testing into CI/CD pipelines.
- Implement risk-based release gates, remediation timelines, exception processes, finding ownership, reusable secure pipeline templates, hardened images, self-service controls, and policy-as-code guardrails.
- Strengthen security across cloud infrastructure, containers, Kubernetes, identity, secrets management, networking, and deployment processes.
- Triage and prioritize vulnerabilities and security findings according to severity, exploitability, exposure, asset criticality, technical risk, and business impact.
- Secure source code, dependencies, build systems, artifacts, container images, and software supply-chain processes.
- Support application security reviews, threat modeling, security architecture reviews, monitoring, and incident-response activities.
- Translate regulatory and compliance requirements into scalable technical controls and automated audit evidence.
- Partner with Engineering teams to remediate security issues and promote secure development practices.
- Evaluate security technologies, develop security metrics and dashboards, lead cross-functional initiatives, and mentor engineers on DevSecOps and secure engineering practices.
Requirements
- At least eight years of experience in DevOps, platform engineering, cloud engineering, application security, product security, DevSecOps, or cybersecurity engineering.
- Significant hands-on experience designing, implementing, and operating DevSecOps capabilities in production environments.
- Demonstrated experience building security automation and integrating security tools with ticketing platforms, CI/CD systems, and engineering workflows.
- Strong software development or scripting experience with Python and/or Java, plus additional experience with PowerShell, Bash, JavaScript, or TypeScript.
- Ability to develop maintainable, reusable, and tested automation.
- Strong knowledge of REST APIs, webhooks, systems integrations, CI/CD security, application security testing, vulnerability management, and software supply-chain security.
- Experience securing cloud platforms, containerized workloads, Kubernetes, infrastructure as code, Linux, networking, identity, encryption, logging, and secrets management.
- Knowledge of SAST, DAST, software composition analysis, secrets scanning, container scanning, infrastructure-as-code scanning, threat modeling, OWASP guidance, web and API security, authentication, and authorization.
- Bachelor’s degree in computer science, cybersecurity, engineering, or a related discipline, or equivalent practical experience.
- Preferred experience with CrowdStrike, Microsoft Sentinel, Aikido Security, Code42, Qualys, Jira, ServiceNow, SOAR platforms, Docker, Terraform, Helm, cloud IAM, OPA, Rego, Kyverno, SBOMs, artifact signing, dependency security, provenance, and software-supply-chain frameworks.
- Preferred experience supporting FedRAMP, NIST, SOC 2, ISO 27001, or similar regulated-environment standards, and developing security metrics, dashboards, and automated compliance evidence.
Benefits
- Hybrid work policy, with Richmond, Virginia preferred; the hybrid policy may be periodically reviewed and adjusted.
- Equal employment opportunity and consideration for qualified applicants regardless of legally protected characteristics.
Tech Stack
Categories
About Exiger
Exiger builds AI- and data-driven software for supply chain, third‑party risk, and compliance management, used by corporations, banks, and government agencies. Its 1Exiger platform provides supplier visibility, risk detection, and due diligence, delivered as SaaS with supporting analytics and advisory services. Headquartered in McLean, Virginia, Exiger is FedRAMP authorized for U.S. public‑sector use and is majority‑owned by The Carlyle Group.