DevSecOps Engineer

Join Divergent Technologies Inc., a leader in digital manufacturing. As a DevSecOps Engineer, you will embed security into every stage of the software delivery lifecycle, from the first commit through production operation. You will own the automation that makes secure delivery the default, partner with software, platform, and IT teams to reduce risk without slowing delivery, and design, build, and maintain CI/CD pipelines with automated security gates. You will also provision and manage cloud infrastructure as code, triage and prioritize vulnerability findings, and build and maintain software supply chain controls.

• Automate the CI/CD pipelines to ensure secure delivery of code, including implementing automated security gates and policy-as-code guardrails.
• Partner with software, platform, and IT teams to reduce risk without slowing delivery, treating security controls as engineering problems to be solved with tooling.
• Triage and prioritize vulnerability findings across source code, third-party dependencies, container images, and cloud posture; partner with engineering owners to drive remediation to closure.

• Must be a U.S. Person as defined by the International Traffic in Arms Regulations (22 CFR §120.62) — a U.S. citizen, lawful permanent resident, or other protected individual
• Hands-on experience building and maintaining pipelines in a modern CI/CD system such as GitHub Actions, GitLab CI, Azure Pipelines, or Jenkins
• Automation and scripting ability in Python, Go, Bash, or PowerShell sufficient to build internal tooling and integrate vendor APIs, not solely to configure existing tools
• 5–10 years of professional experience in DevOps, platform, site reliability, security, or software engineering, including at least 3 years with direct responsibility for securing CI/CD pipelines or cloud infrastructure
• Practical experience integrating and operating application security tooling (Blackduck or Rapid7) — SAST, software composition analysis, secrets scanning, and image scanning — and triaging its output
• Clear written and verbal communication, with the ability to explain security risk and engineering tradeoffs to both technical and non-technical audiences
• Proficiency with infrastructure as code (Terraform, Bicep, CloudFormation, or Pulumi), with changes managed through version control and peer review
• Working knowledge of containers and orchestration (Docker and Kubernetes), including image hardening and cluster access control
• Experience with Git-based team workflows, code review, and branch protection
• Bachelor's degree in Computer Science, Information Systems, Cybersecurity, Engineering, or a related technical field, or equivalent demonstrated experience
• Solid grasp of core security concepts, including least privilege, network segmentation, key management, authentication and authorization protocols (OAuth 2.0, OIDC, SAML), and common vulnerability classes such as the OWASP Top 10
• Production experience with at least one major cloud provider (Azure or AWS), including its identity and access management, networking, and logging services
• Experience in an export-controlled or otherwise regulated environment (ITAR/EAR, CMMC, NIST SP 800-171), or in aerospace, automotive, or advanced manufacturing
• Exposure to manufacturing or operational technology systems, including securing build, test, or production-floor systems that cannot tolerate unplanned downtime
• Software supply chain security experience with SBOM tooling (Syft, CycloneDX, SPDX), artifact signing (Sigstore/cosign), SLSA provenance, or platforms such as Black Duck, Snyk, or Dependency-Track
• Policy-as-code experience with Open Policy Agent/Rego, Kyverno, Conftest, Checkov, or cloud-native policy engines
• Kubernetes security depth, including admission controllers, service mesh mTLS, and runtime detection tooling such as Falco or Tetragon
• Detection engineering or SIEM experience (Microsoft Sentinel, Splunk, or Elastic), including log pipeline design and tuning
• Secrets platform experience with HashiCorp Vault, Azure Key Vault, or AWS Secrets Manager, including dynamically issued credentials
• Threat modeling experience and familiarity with the MITRE ATT&CK framework
• Observability tooling experience with Prometheus, Grafana, OpenTelemetry, or Datadog
• Relevant certifications such as CISSP, CCSP, CKS, GIAC (GCSA, GCLD, GWAPT), or a cloud provider security specialty
• Contributions to internal developer platforms, golden-path templates, or open-source security tooling