Dev Sec Ops Engineer | Full Time | Remote | US Only Please

Title: Dev Sec Ops Engineer (AWS)Type: Full-TimeLevel: Mid-Level (3–5 years experience)We are seeking a mid-level Dev Sec Ops Engineer to support and operate our AWS-based communication platform. This role focuses on maintaining reliable, secure, and scalable infrastructure while working closely with internal support teams and external development partners. In addition to strengthening our platform's security, we put in place practical, effective controls.While this platform is not subject to HIPAA, it operates in the healthcare vertical and requires strong attention to security standards, data protection, system reliability, and operational discipline.This role will support and operate our AWS-based communication platform. This role focuses on maintaining reliable, secure, and scalable infrastructure while working closely with internal support teams and external development partners. In addition to strengthening our platform's security, we put in place practical, effective controls. While this platform is not subject to HIPAA, it operates in the healthcare vertical and requires strong attention to security standards, data protection, system reliability, and operational discipline.Key Responsibilities1. Secure Software Delivery and SDLC• Embed SAST (Semgrep, Bandit), DAST (OWASP ZAP, Nuclei), SCA (Snyk, OWASP Dependency-Check), and secret scanning (GitLeaks, truffleHog, detect-secrets) directly into GitHub Actions / GitLab CI pipelines with enforced quality gates.• Enforce image scanning (Trivy, Grype, Clair) in every build pipeline. Maintain hardened, minimal base images. Enforce Dockerfile best practices via hadolint. Sign images using Cosign / Sigstore.• Generate and maintain Software Bill of Materials (CycloneDX / SPDX) for all application components. Track dependency provenance and enforce SLSA supply chain controls.• Scan all Terraform/CloudFormation with tfsec, Checkov, and Terraform Sentinel policies before deployment. Break builds on high/critical misconfigurations.• Enforce signed artifacts, pinned dependencies, and hash-verified third-party packages throughout the build chain.2. AWS Cloud Security Posture• Implement and continuously validate CIS AWS Foundations Benchmark v2.0.Use AWS Security Hub with CIS standards enabled as a live scorecard.• Enforce least-privilege IAM policies; eliminate wildcard permissions and unused credentials via AWS IAM Access Analyzer. Enforce MFA for all human users. Separate workload identities using IAM roles with OIDC federation (no long-lived access keys).• Manage all secrets via AWS Secrets Manager or HashiCorp Vault with automated rotation. Zero tolerance for plaintext credentials in code, environment variables, or SSM Parameter Store as unencrypted strings.• Enforce KMS CMK encryption for all S3 buckets, RDS instances, EBS volumes, and SQS queues. Implement key rotation policies. Audit encryption posture via AWS Config rules.• Design and enforce VPC architecture with private subnets, security group least-privilege, NACLs as secondary controls, VPC Flow Logs, and AWS Network Firewall or third-party NGFW for egress filtering.• Build and maintain hardened AMI pipelines (CIS Level 1/2 benchmarks via EC2 Image Builder or Packer). Enforce no SSH in production; use AWS Systems Manager Session Manager with logging.• Deploy AWS SCPs (Service Control Policies) across the Organization to prevent privilege escalation, disable unused regions, and block non-compliant resource creation.3. SaaS Product Security and SSPM• Deploy and operate an SSPM tool (Obsidian, Reco, AppOmni, or Valence) to continuously audit third-party SaaS integrations, OAuth grants, and cross-app permissions.• Enforce SSO (SAML 2.0 / OIDC) with MFA for all SaaS platforms. Implement SCIM-based user provisioning/deprovisioning. Eliminate local accounts on all managed SaaS.• Configure AWS WAF with custom managed rule groups for OWASP Top 10.Enforce rate limiting, input validation, and authentication on all API Gateway endpoints. Validate API security with automated tooling.• Assess and document the security posture of all third-party integrations. Review vendor OAuth scopes; enforce the principle of least privilege for SaaS-to-SaaS data flows.• Implement data classification taxonomy and enforce controls (S3 bucket policies, DLP rules, access logging) aligned to sensitivity tiers.4. Threat Detection, SIEM, and Incident Response• Configure GuardDuty with automated findings triage and suppression for known-good noise. Integrate findings into Security Hub and plan to implement and to a centralized SIEM (Splunk, Elastic/OpenSearch, or Datadog SIEM) for correlation.o Write and tune SIEM detection rules and correlation queries. Define baselines for IAM activity, network egress, and API call patterns. Implement anomaly-based alerting beyond threshold alerts.• Ensure 100% coverage across CloudTrail (management + data events), VPC Flow Logs, Route 53 query logs, S3 access logs, ELB/ALB access logs, and application logs. Define and enforce log retention policies.• Own and maintain IR runbooks for cloud-specific scenarios: credential compromise, data exfiltration, crypto mining, unauthorized EC2/Lambda, and SaaS account takeover. Conduct tabletop exercises. Lead active incident response without supervision.• Ensure forensic artifact preservation capability: memory capture (EC2 instance isolation), disk snapshots for forensic analysis, and CloudTrail integrity validation via log file validation.5. Vulnerability Management Program• Deploy and operate Amazon Inspector v2 for continuous EC2, container, and Lambda vulnerability scanning. Integrate scan results into Security Hub.• Define and enforce remediation of SLAs by CVSS/EPSS severity.• Operate AWS Systems Manager Patch Manager for automated OS patching. Enforce patch compliance baselines with AWS Config. Maintain patching dashboards for leadership.• Apply EPSS scores alongside CVSS for prioritization. Contextualize findings based on exploitability, internet exposure, and data sensitivity.6. Policy as Code and Compliance Posture• Maintain a full library of AWS Config rules (managed + custom Lambda) covering encryption, public access, IAM hygiene, and network controls. Enable automatic remediation for critical misconfigurations.• Implement OPA/Rego or Terraform Sentinel policies enforced at plan/apply time. Gate deployments on policy compliance.• Maintain evidence of collection and control mappings aligned to SOC 2 Trust Services Criteria (Security, Availability, Confidentiality). Support external audit engagements.• Ensure tamper-evident, centralized audit logs with retention meeting or exceeding 12 months for all privileged actions, configuration changes, and data access events.7. Platform Operations/Uptime• Own and maintain all Terraform modules for AWS infrastructure. Enforce remote state with S3 + DynamoDB locking, module versioning, and workspace-based environment separation.• Own GitHub Actions / GitLab CI pipeline architecture. Implement branch protection rules, required status checks, signed commits (GPG/Sigstore), and deployments to a protected environment.• Define and track SLOs/SLAs for platform uptime and deployment success rate. Implement structured runbooks for all common operational procedures.• Define and test RTO/RPO targets. Automate RDS snapshots, S3 versioning, and cross-region backup replication. Conduct quarterly DR drills and document the results.• Identify and remediate security misconfigurations that also create cost exposure (e.g., over-permissioned data transfer, unencrypted inter-AZ traffic, over-retained log volumes).Required Qualifications• 5-8 years in DevOps, Cloud Engineering, or Security Engineering, with a minimum of 3 years in a security-focused DevSecOps or Cloud Security role.• Demonstrated hands-on experience with: EC2, RDS (Aurora), S3, VPC, IAM, KMS, Secrets Manager, CloudTrail, GuardDuty, Security Hub, AWS Config, WAF, Systems Manager, and Lambda.• Proven implementation of SAST, DAST, SCA, secret scanning, and container image scanning gated within CI/CD pipelines (GitHub Actions, GitLab CI, or equivalent).• Experience writing and securing Terraform at production scale. Familiarity with tfsec, Checkov, or Sentinel for policy enforcement.• Experience hardening Docker images, scanning with Trivy or Grype, and managing ECR lifecycle policies. Experience with ECS/EKS security configurations (task role least-privilege, network policy, runtime security). • Hands-on experience with AWS Secrets Manager and/or HashiCorp Vault, including automated rotation and zero-plaintext-credential enforcement.• Experience configuring GuardDuty, CloudTrail, and Security Hub. Ability to write detection rules/queries in a SIEM environment.• Experience operating a vulnerability scanning program (Amazon Inspector, Tenable, Qualys) with SLA-based remediation tracking.• Proficient in Python and Bash for automation. Ability to independently write Lambda functions, CLI tooling, and operational scripts.• Experience leading or co-leading security incident response in a cloud environment, including evidence preservation and post-incident reporting.Key Traits• You identify gaps and fix them without being asked.• You think like an attacker, build like an engineer, and operate like a professional.• You don't wait for a ticket to remediate a critical finding.• You communicate security risks in business terms and drive decisions.• You are calm under pressure and decisive when it matters.• You have a strong knowledge of security architecture fundamentals and can back decisions with data.Thank you for your time and interest.