{"schemaVersion":"jobsearcher.job.v1","id":"b9a8584cdf0785b836d12b8e","url":"https://jobsearcher.com/jobs/b9a8584cdf0785b836d12b8e","canonicalUrl":"https://jobsearcher.com/jobs/b9a8584cdf0785b836d12b8e","title":"Senior DevSecOps Engineer (Senior Application Security Engineer)","description":"IDEMIA Public Security, a division of IDEMIA Group, is the leading provider of secure and trusted biometric-based solutions, transforming public and private organizations across the globe. Our industry-enabled and client-specific solutions draw upon decades of expertise in biometrics to revolutionize the fields of public security, justice and public safety, travel and transport, identity, and access control. Built on privacy and trust, our market-leading iris, fingerprint and facial recognition solutions top independent benchmarking for accuracy, fairness and scalability. These exacting standards enable our clients to build safer, fairer societies where people can live, interact, and move about freely. With 4000+ employees around the world and 150+ partners worldwide, we offer more than just a job - we provide a dynamic environment where innovation thrives, opportunities abound, and your talents are valued. Be part of a global leader shaping the future of biometric based technology. Learn more here.\n\nPosition Overview\nIDEMIA's Justice & Public Safety division develops biometric identification platforms used by law enforcement agencies across North America. Our systems process fingerprint, facial recognition, and criminal history data in support of active investigations, which requires that security be embedded throughout our engineering practices rather than addressed at the end of the development cycle.\n\nWe are seeking a Senior Application Security Engineer to define and own our holistic approach to application security across the full software development lifecycle. You will establish the security controls that govern our engineering practices, guide multiple teams across three product lines in their implementation, and remain directly involved in hands-on execution. This is a senior individual contributor position with significant organizational influence and no direct reports.\n\nKey Responsibilities\n\nDefine and own the holistic approach to security\n\nEstablish security controls and validation gates for each lifecycle stage: design, code, build, deploy, software customization and delivery, and operations\nDevelop the standards, guardrails, and documentation guiding multiple engineering teams across three product lines\nPartner with our internal shared security services team, which conducts penetration testing and SAST/SCA scanning, to triage findings, assess severity, and set remediation priorities\n\nExecute hands-on security work\n\nConduct architecture and design reviews to identify security risk, and collaborate with engineering teams on remediation\nDevelop and enhance security stages within our CI/CD pipelines\nParticipate in incident response and triage activities\n\nSupport compliance and customer engagement\n\nMaintain our FedRAMP and CJIS compliance posture as it pertains to application security\nRepresent our security approach in customer engagements, audits, and technical reviews\n\nTechnical Environment\n\nLanguages and runtimes: Java, TypeScript, AWS Lambda\n\nCloud platforms: AWS GovCloud, Azure Government\nCI/CD: GitLab CI, AWS CodePipeline, Jenkins\nSecurity tooling: SonarQube, Nexus, Tenable\n\nPerformance Expectations\n\nFirst 90 days — Document the current lifecycle and tooling landscape, publish a defined set of security controls organized by lifecycle stage, establish a triage cadence with the shared security services team, and deliver at least one measurable improvement to pipeline security posture.\nFirst year — Security controls applied consistently across all product lines, findings remediated on a predictable schedule, and engineering teams engaging security during design rather than at review.\n\nScope of Authority\nWhere a release does not meet established security criteria, you will raise the concern and escalate to the Vice President of Engineering for final determination. Your technical judgment will drive these discussions, supported by executive sponsorship.\n\nThe US base salary range for this position is $112,130.00 - 140,171.00 + bonus + benefits. While it is uncommon for candidates to be hired at or near the top of the pay range, all compensation decisions are made based on the specific facts and circumstances of each hire. The final offer may vary depending on a combination of factors, including a candidate’s skills, qualifications, experience, and geographic location.\n\nRequired Qualifications\n\nMinimum 10 years of combined software engineering and security experience, including substantive time in a DevSecOps capacity\nDemonstrated experience embedding security controls directly into CI/CD pipelines\nProven ability to conduct security reviews of application and cloud architectures\nPractical experience triaging SAST, SCA, and penetration test findings, including distinguishing material risk from false positives\nWorking knowledge of cloud security in AWS and/or Azure, preferably government cloud environments\nAbility to obtain and maintain background clearances from local, state, and federal agencies\nAvailability to travel approximately 10% of the time\nCandidates must be a U.S. Person (U.S. citizen, Green Card holder, or otherwise authorized under applicable U.S. regulations) to be considered for this position.\n\nPreferred Qualifications\n\nFamiliarity with FedRAMP, CJIS, NIST 800-53, or comparable frameworks\nCertifications such as CISSP, CSSLP, GWAPT, or OSCP\nExperience in biometrics, identity management, or public safety software\nThreat modeling experience (STRIDE, PASTA, or comparable)\nSecrets management and software supply chain security, including SBOM generation","company":"Idemia","rawCompany":"idemia","city":"Denver","state":"CO","isRemote":false,"isActive":false,"createdAt":"2026-08-28T10:18:18.335Z","occupations":[{"code":"15-1299.08","title":"Computer Systems Engineers/Architects","slug":"computer-systems-engineers-architects"},{"code":"15-1299.05","title":"Information Security Engineers","slug":"information-security-engineers"},{"code":"15-1252.00","title":"Software Developers","slug":"software-developers"}],"industries":[{"code":"541512","title":"Computer Systems Design Services","slug":"computer-systems-design-services"},{"code":"513210","title":"Software Publishers","slug":"software-publishers"},{"code":"541511","title":"Custom Computer Programming Services","slug":"custom-computer-programming-services"}],"jobPosting":{"@context":"https://schema.org","@type":"JobPosting","title":"Senior DevSecOps Engineer (Senior Application Security Engineer)","description":"IDEMIA Public Security, a division of IDEMIA Group, is the leading provider of secure and trusted biometric-based solutions, transforming public and private organizations across the globe. Our industry-enabled and client-specific solutions draw upon decades of expertise in biometrics to revolutionize the fields of public security, justice and public safety, travel and transport, identity, and access control. Built on privacy and trust, our market-leading iris, fingerprint and facial recognition solutions top independent benchmarking for accuracy, fairness and scalability. These exacting standards enable our clients to build safer, fairer societies where people can live, interact, and move about freely. With 4000+ employees around the world and 150+ partners worldwide, we offer more than just a job - we provide a dynamic environment where innovation thrives, opportunities abound, and your talents are valued. Be part of a global leader shaping the future of biometric based technology. Learn more here.\n\nPosition Overview\nIDEMIA's Justice & Public Safety division develops biometric identification platforms used by law enforcement agencies across North America. Our systems process fingerprint, facial recognition, and criminal history data in support of active investigations, which requires that security be embedded throughout our engineering practices rather than addressed at the end of the development cycle.\n\nWe are seeking a Senior Application Security Engineer to define and own our holistic approach to application security across the full software development lifecycle. You will establish the security controls that govern our engineering practices, guide multiple teams across three product lines in their implementation, and remain directly involved in hands-on execution. This is a senior individual contributor position with significant organizational influence and no direct reports.\n\nKey Responsibilities\n\nDefine and own the holistic approach to security\n\nEstablish security controls and validation gates for each lifecycle stage: design, code, build, deploy, software customization and delivery, and operations\nDevelop the standards, guardrails, and documentation guiding multiple engineering teams across three product lines\nPartner with our internal shared security services team, which conducts penetration testing and SAST/SCA scanning, to triage findings, assess severity, and set remediation priorities\n\nExecute hands-on security work\n\nConduct architecture and design reviews to identify security risk, and collaborate with engineering teams on remediation\nDevelop and enhance security stages within our CI/CD pipelines\nParticipate in incident response and triage activities\n\nSupport compliance and customer engagement\n\nMaintain our FedRAMP and CJIS compliance posture as it pertains to application security\nRepresent our security approach in customer engagements, audits, and technical reviews\n\nTechnical Environment\n\nLanguages and runtimes: Java, TypeScript, AWS Lambda\n\nCloud platforms: AWS GovCloud, Azure Government\nCI/CD: GitLab CI, AWS CodePipeline, Jenkins\nSecurity tooling: SonarQube, Nexus, Tenable\n\nPerformance Expectations\n\nFirst 90 days — Document the current lifecycle and tooling landscape, publish a defined set of security controls organized by lifecycle stage, establish a triage cadence with the shared security services team, and deliver at least one measurable improvement to pipeline security posture.\nFirst year — Security controls applied consistently across all product lines, findings remediated on a predictable schedule, and engineering teams engaging security during design rather than at review.\n\nScope of Authority\nWhere a release does not meet established security criteria, you will raise the concern and escalate to the Vice President of Engineering for final determination. Your technical judgment will drive these discussions, supported by executive sponsorship.\n\nThe US base salary range for this position is $112,130.00 - 140,171.00 + bonus + benefits. While it is uncommon for candidates to be hired at or near the top of the pay range, all compensation decisions are made based on the specific facts and circumstances of each hire. The final offer may vary depending on a combination of factors, including a candidate’s skills, qualifications, experience, and geographic location.\n\nRequired Qualifications\n\nMinimum 10 years of combined software engineering and security experience, including substantive time in a DevSecOps capacity\nDemonstrated experience embedding security controls directly into CI/CD pipelines\nProven ability to conduct security reviews of application and cloud architectures\nPractical experience triaging SAST, SCA, and penetration test findings, including distinguishing material risk from false positives\nWorking knowledge of cloud security in AWS and/or Azure, preferably government cloud environments\nAbility to obtain and maintain background clearances from local, state, and federal agencies\nAvailability to travel approximately 10% of the time\nCandidates must be a U.S. Person (U.S. citizen, Green Card holder, or otherwise authorized under applicable U.S. regulations) to be considered for this position.\n\nPreferred Qualifications\n\nFamiliarity with FedRAMP, CJIS, NIST 800-53, or comparable frameworks\nCertifications such as CISSP, CSSLP, GWAPT, or OSCP\nExperience in biometrics, identity management, or public safety software\nThreat modeling experience (STRIDE, PASTA, or comparable)\nSecrets management and software supply chain security, including SBOM generation","datePosted":"2026-08-28T10:18:18.335Z","dateModified":"2026-08-28T10:18:18.335Z","hiringOrganization":{"@type":"Organization","name":"Idemia","sameAs":"https://jobsearcher.com"},"jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"Denver","addressRegion":"CO","addressCountry":"US"}},"identifier":{"@type":"PropertyValue","name":"JobSearcher","value":"b9a8584cdf0785b836d12b8e"},"url":"https://jobsearcher.com/jobs/b9a8584cdf0785b836d12b8e"}}