Senior DevSecOps Engineer

The posting, as Exiger wrote it

Who We Are

Exiger is the AI partner for supply chain and procurement automation. Its centralized 1EXIGER.AI platform allows organizations to manage their entire operating network, from parts to suppliers, regulators, and customers, through an autonomous agentic workforce that learns, adapts, and augments with every decision. The AI-native platform, combined with the largest supply chain knowledge asset, empowers 550+ global customers, including 150 Fortune 500 and 80+ government and defense industrial organizations, to act first. Exiger is FedRAMP® authorized and a 2x Leader in Gartner® Magic Quadrant™ for Supplier Risk Management.

Senior DevSecOps Engineer

Location: Richmond, VA preferred

Position Summary

The Senior DevSecOps Engineer is a hands-on technical leader responsible for embedding scalable security controls, automation, and secure engineering practices throughout the software development lifecycle.

As a member of the Security team, this role partners closely with Engineering, Cloud, Platform, IT, and Compliance teams to automate security processes, improve vulnerability and finding management, and provide timely security feedback without creating unnecessary delivery friction.

A key focus of this role is security automation . The successful candidate will have experience building automated workflows that integrate security tools with engineering and operational systems, including automated ticket creation, routing, enrichment, escalation, remediation tracking, and reporting.

The ideal candidate combines strong DevSecOps and cloud security expertise with hands-on software development and automation experience and is comfortable operating in regulated, cloud-based environments.

Responsibilities

Design, build, and maintain automated security workflows across the software development lifecycle and broader security environment.

Automate security processes such as vulnerability intake, ticket creation, assignment, enrichment, escalation, remediation tracking, exception handling, and reporting.

Integrate security platforms with ticketing, CI/CD, cloud, and engineering systems using APIs, webhooks, scripts, and workflow automation.

Embed automated application, dependency, secrets, infrastructure-as-code, container, and API security testing into CI/CD pipelines.

Define and implement risk-based release gates, remediation timelines, exception processes, and finding ownership.

Build reusable secure pipeline templates, hardened images, self-service security controls, and policy-as-code guardrails.

Strengthen security across cloud infrastructure, containers, Kubernetes, identity, secrets management, networking, and deployment processes.

Triage vulnerabilities and security findings based on severity, exploitability, exposure, asset criticality, and business impact.

Automate vulnerability-management workflows to ensure findings are routed to the appropriate owners and tracked through remediation.

Secure sou
[…]
equivalent practical experience.

Preferred Qualifications

Hands-on experience with one or more of the following security platforms:

CrowdStrike

Microsoft Sentinel

Aikido Security

Code42

Qualys

Experience integrating security platforms with Jira, ServiceNow, or similar ticketing and workflow systems.

Experience with security orchestration, automation, and response (SOAR) platforms or equivalent automated security workflows.

Experience with cloud-native security technologies such as Kubernetes, Docker, Terraform, Helm, and cloud IAM.

Experience with policy-as-code technologies such as OPA, Rego, Kyverno, or similar tools.

Familiarity with SBOMs, artifact signing, dependency security, provenance, and software supply-chain frameworks.

Experience supporting regulated environments and frameworks such as FedRAMP, NIST, SOC 2, ISO 27001, or similar standards.

Experience developing security metrics, dashboards, and automated compliance evidence.

#LI-Hybrid
Exiger is named a Leader in the Gartner ® Magic Quadrant™ for Supplier Risk Management, twice selected as one of Fast Company's 'Brands That Matter,' and recipient of the Third Party Risk Association's Innovator Award, Exiger's technology has been recognized by leading analyst evaluations and 50+ awards. Learn more at Exiger.com and follow Exiger on LinkedIn .

At Exiger, our values define how we work and why we lead. We are mission-inspired, imagination-driven, trust-anchored, and compassion-focused—committed to building technology that makes the world safer, more transparent, and more resilient.

All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability or protected veteran status, or any other legally protected basis, in accordance with applicable law.

Exiger’s hybrid work policy is periodically reviewed and adjusted to align with evolving business needs.