DevSecOps Engineer

As we rapidly scale our impact, we're seeking a passionate DevSecOps engineer to help build and mature our application security program. Working closely with our security lead, you'll implement best practices and help embed security principles across the org. If you thrive on building secure systems, automation, fostering a security-conscious culture, and making a tangible difference in protecting sensitive health information, this role is for you.

Responsibilities

Improve Security Design: Help assess our current security controls within GCP and Kubernetes, identify areas for improvement, and contribute to the maturation of our security posture from good to great.; Champion Secure Development: Partner closely with Engineering, Product, and Platform teams to integrate security best practices early and often ("shift-left") into the software development lifecycle.; Build and Automate: Design, implement, and manage security tooling and automation to streamline vulnerability detection, remediation, and compliance verification. Replace manual processes with efficient, automated solutions.; Refine Access Control: Evolve our identity and access management (IAM) strategy, ensuring least-privilege access and robust auditing capabilities across our systems.; Strengthen Network Security: Continuously improve our network security architecture, policies, and controls within our cloud environment.; Develop Clear Standards: Establish, document, and communicate practical security policies, standards, and guidelines for engineering teams.; Support Security Initiatives: Drive vulnerability management efforts and enhance our incident response preparedness, ensuring we are ready to handle potential threats effectively.; Cultivate Security Awareness: Act as a security evangelist, promoting security awareness and best practices throughout the engineering organization.; Follow Virta's security and privacy procedures to ensure patients' information remains strictly confidential.

Requirements

Understanding and practical experience in securing cloud-native applications and infrastructure, particularly in Kubernetes environments; Strong grasp of networking concepts, identity management (IAM), encryption, and common web application vulnerabilities (e.g., OWASP Top 10); Strong communication skills with the ability to clearly articulate complex security concepts to diverse audiences and influence technical direction across teams; Hands-on experience in application security, including secure coding practices, vulnerability management, and security testing (SAST, DAST, IAST); Proficiency in Infrastructure as Code (IaC) tools, specifically Terraform; Development experience with Go and/or Python; 5-7+ years of experience with 2+ at a high growth startup or similar environment

Nice to have

GCP experience is strongly preferred; Exposure to threat modeling is a plus