> Markdown version of [/jobs/ext/3044913-security-devsecops-engineer](https://www.wearedevelopers.com/jobs/ext/3044913-security-devsecops-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Security / DevSecOps Engineer - **Company:** Shift - **Location:** Boston, United States - **Experience:** Expert - **Salary:** $120,000.0 - $150,000.0 - **Contract:** Permanent contract - **Skills:** Java (Programming Language), JavaScript (Programming Language), Application Programming Interfaces (APIs), Artificial Intelligence, Computing Platforms, ARM Architecture, Microsoft Azure, C Sharp (Programming Language), Software as a Service, Cloud Computing Security, Cyber Security, Continuous Integration, Query Languages, Github, Identity and Access Management, Python (Programming Language), Network Security, Networking Basics, Windows PowerShell, Kusto Query Language, Information Technology Security Auditing, Security Information and Event Management, Software Vulnerability Management, Web Applications, Scripting, ReactJS, Delivery Pipeline, Software Security, Mitre Att&ck, Cyber Threat Analysis, Azure Security Center, Falcon Platform, Information Technology, Microsoft Sentinel, Purple Team (Cyber Security), Devsecops, Static Application Security Testing, Programming Languages, Dynamic Application Security Testing - **Published:** September 24, 2026 - **Apply:** https://startup.jobs/application-security-devsecops-engineer-central-or-eastern-time-us-or-canada-shift-technology-10160262 ## About the Role * Bachelor's Degree in Cybersecurity, Computer Science, Information Technology, or a related field, or equivalent experience. * 7+ years of experience in Security Operations, Incident Response, Cybersecurity Monitoring, or a similar security role. Technical Skills * Experience working with a SIEM platform, preferably Microsoft Sentinel. * Experience with at least one Endpoint Detection and Response (EDR) platform such as Microsoft Defender for Endpoint, CrowdStrike, Cortex XDR, or similar. * Experience with application vulnerability management tools such as GitHub Advanced Security, Tenable, or similar. * Knowledge of API, web application, and software supply chain security (SBOM) * Familiarity with major language frameworks such as C#, Java, React, or Python. * Awareness of security considerations for AI/ML integrations, such as risks like prompt injection * Familiarity with SaaS application security concepts, such as tenant isolation and secure API design. * Familiarity with Microsoft Azure environments and development platforms such as GitHub and GitHub Actions. * Understanding of networking fundamentals and network security concepts. * Proficiency in at least one scripting or programming language such as Python, PowerShell, JavaScript, or Go. * Familiarity with KQL or similar query languages is preferred. Knowledge & Frameworks * Understanding of common cybersecurity threats, attack techniques, and defensive controls. * Familiarity with the MITRE ATT&CK framework. * Basic understanding of cloud security, identity security, endpoint security, and vulnerability management concepts. * Awareness of common security and compliance frameworks such as ISO 27001, NIST CSF, SOC 2, HIPAA, or GDPR. Core Competencies * Strong analytical and investigative mindset. * Excellent written and verbal communication skills. * Ability to communicate technical findings clearly, accurately, and concisely. * Strong organizational skills and attention to detail. * Disciplined, process-oriented approach to operational work. * Ability to prioritize effectively and manage multiple investigations simultaneously. * Collaborative team player with a strong desire to learn and grow within cybersecurity. * Ability to remain calm and methodical during security incidents. ## Description As an Application Security/DevSecOps Engineer, you will drive application security and DevSecOps practices across Shift's software delivery pipeline, from the first line of code through the CI/CD pipeline, working closely with data scientists, software delivery teams, and engineers to ensure security is built in by design. You will also serve as a first responder within Shift's Security Operations function, monitoring, triaging, investigating, and responding to security alerts and incidents across our environment. Working closely with engineering, infrastructure, and helpdesk teams, you will help ensure applications are secure by design and that threats are identified, contained, and remediated efficiently while following established processes and procedures., Secure by Design (Shift Left) * Working with data scientists, software delivery teams, and engineers to ensure technical security standards are well understood and best practices are followed. * Driving Application Security through defining technical policies, standards, and guidelines and championing these throughout the organisation. * Identification of systemic and cultural developer security issues, and remediation opportunities. * Promote a mind-set of developing secure systems, transferring knowledge of security standards/processes, and acting as a subject matter expert (SME). * Leading and facilitating threat modeling exercises. Secure the Build & Deploy Pipeline (DevSecOps/AppSec) * Automation of security testing (SAST, DAST, SCA, vulnerability management). * Ensuring full benefits realisation of relevant tooling. * Ensure maximum code and infrastructure coverage. * Ensure code and artifact integrity through automated signing and attestation processes within the CI/CD pipeline. * Establish guardrails and governance for AI-assisted development, ensuring AI-generated code is rigorously vetted for security vulnerabilities and adheres to internal coding standards. * Ensure company-wide best practices for Secret Management, IaC Security, and SBOM. * Security auditing of software developed by the company and its partners. * Operate a software vulnerability management program, taking responsibility for the identification, production, and improvement of meaningful metrics, and reporting on progress. * Prioritise and manage the remediation of code defects. Security Monitoring & Incident Response (SecOps) * Monitor and triage security alerts generated from Microsoft Sentinel, EDR platforms, cloud security tools, and other security technologies. * Investigate suspicious activity and determine the severity, scope, and potential impact of security events. * Validate alerts, differentiate false positives from actionable incidents, and escalate to relevant teams - following established processes - when additional investigation or response is required. * Serve as a first responder for security incidents and operational security events, executing response procedures and containment actions in accordance with established playbooks and guidance. * Gather relevant evidence, coordinate with internal stakeholders, and ensure timely remediation of identified issues. * Maintain accurate records of investigations and actions taken, and participate in post-incident reviews and documentation activities. Collaboration & Professional Development * Communicate investigation results clearly and concisely to technical and non-technical stakeholders. * Work closely with engineering and infrastructure teams to support remediation efforts. * Participate in internal purple team exercises and security initiatives. * Maintain a disciplined, process-driven approach to incident handling and operational responsibilities. * Continuously develop technical and security knowledge through training, collaboration, and hands-on experience. ## Related Videos - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [DevSecOps: Injecting Security into Mobile CI/CD Pipelines](https://www.wearedevelopers.com/videos/273-devsecops-injecting-security-into-mobile-ci-cd-pipelines) - [Innovating Developer Tools with AI: Insights from GitHub Next](https://www.wearedevelopers.com/videos/1268-innovating-developer-tools-with-ai-insights-from-github-next) - [Watch Tests Go Brrrr! : Getting Started with Cypress in ReactJS](https://www.wearedevelopers.com/videos/282-watch-tests-go-brrrr-getting-started-with-cypress-in-reactjs) - [DevSecOps culture](https://www.wearedevelopers.com/videos/783-devsecops-culture) - [DevSecOps: Security in DevOps](https://www.wearedevelopers.com/videos/36-devsecops-security-in-devops) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated) - [Dev Digest 191: Malware interviews, EU ❤️ Open Source and Skilled Agents](https://www.wearedevelopers.com/magazine/645-dev-digest-191-malware-interviews-eu-open-source-and-skilled-agents) - [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)