Sr Pncpl DevSecOps Engineer

• Build and continuously improve an internal security tooling platform that consolidates vulnerability data, scan results, asset context, and remediation workflows into a single source of truth.
• Develop and maintain the Vulnerability Management (VM) application — including ingestion pipelines, normalization, deduplication, risk scoring (CVSS/EPSS/contextual), SLA tracking, and reporting dashboards over very large finding datasets.
• Engineer the Web Application Security (WAS) tooling — orchestration of DAST scans, authenticated scan profiles, scan scheduling, finding triage workflows, and developer ticketing integrations (Jira, Azure DevOps, GitHub Issues).
• Integrate SAST, SCA, secrets-scanning, IaC scanning, and container-image scanning tools into CI/CD pipelines, and surface results through the security platform.
• Model assets, identities, and relationships as a graph to power blast-radius and attack-path analysis used by remediation workflows.
• Reduce manual effort for the security team by automating recurring workflows (ticket creation, exception management, evidence collection, compliance evidence) using durable workflow orchestration.
• Partner with the AppSec and Cloud Security teams to operationalize Secure SDLC controls (threat modeling intake, security requirements, gating policies, paved-road templates).
• Deliver a high-quality developer and analyst experience: fast, intuitive UIs handling high-cardinality data; reliable APIs; well-documented integrations; observable, resilient services.
• Champion engineering best practices — code quality, automated testing, performance, accessibility, and security-by-design in everything we build.

Key Responsibilities
Full Stack Development

• Design, develop, test, deploy, and maintain end-to-end features across frontend, backend, and data layers for the security tooling platform.
• Build responsive, accessible web UIs using React with TypeScript, virtualized data grids, charting libraries, and real-time updates (WebSockets / Server-Sent Events) for scan progress and live findings.
• Develop scalable backend services and REST APIs (OpenAPI-first) using Python (FastAPI/Django) or Node.js — including authentication, authorization (RBAC/ABAC), and audit logging.
• Design relational, document, search, and analytical data models — PostgreSQL for operational data, OpenSearch/Elasticsearch for finding search, and a columnar store (ClickHouse, Snowflake, BigQuery, or Iceberg/Parquet) for analytics over billions of findings.
• Build event-driven and batch data pipelines for ingesting scanner output, asset inventory, ticketing data, and threat intelligence feeds.
  • Implement durable workflow orchestration for scan lifecycle, ticket lifecycle, SLA timers, and evidence collection.