Senior/Staff DevSecOps Engineer

Twenty is seeking a Senior/Staff DevSecOps Engineer to build and own the security infrastructure that keeps Twenty's engineering systems safe without slowing engineers down. This role spans runtime security, access control, secrets management, compliance, and CI/CD hardening. The engineer will embed with engineering teams, design secure-by-default foundations, build tooling and automation, and report directly to the VP of Engineering. The role is on site in Arlington, VA, is full time, and is limited to U.S. citizens due to U.S. government contract and security requirements.

Responsibilities

Own runtime security and vulnerability management across cloud and container environments, including triage, prioritization, and remediation tracking; Design and enforce identity and access management (IAM) across AWS and internal systems with least-privilege by default; Own secrets and credentials management: policies, tooling, rotation, and developer workflows; Lead security incident response: detection, containment, root cause analysis, and durable remediation; Manage AWS Organization structure, account boundaries, SCPs, and guardrails; Harden and maintain CI/CD pipelines, embedding security scanning and policy enforcement; Drive compliance efforts, owning evidence, controls, and remediation to meet and maintain relevant frameworks; Build and maintain secure-by-default templates for repos, pipelines, and infrastructure modules; Reduce friction through automation (certificate issuance, secrets access, policy-as-code, developer-facing tooling); Produce lightweight, practical security guidance engineers actually use; Shape the direction of the DSO function as it scales and contribute to hiring and team-building

Requirements

8+ years in DevSecOps, platform security, or a closely related security engineering role; Deep hands-on experience with AWS (IAM, SCPs, Organizations, GuardDuty, Security Hub, CloudTrail, etc.); Strong IaC experience with Terraform, including using it to enforce security controls and policy-as-code or continuous compliance checks (e.g., OPA, Checkov, tfsec, AWS Config Rules); Experience owning secrets management end-to-end in a production engineering environment; Proven track record designing and hardening CI/CD pipelines (GitHub Actions); Hands-on experience with container security, including image scanning and runtime controls; Experience leading or meaningfully contributing to a compliance program (CMMC Level 2 or NIST SP 800-171 experience strongly preferred); Experience running incident response, including on-call, post-mortems, and shipping fixes; Strong communication skills and ability to drive security adoption through enablement; U.S. citizenship required; eligibility to obtain and maintain a U.S. Government security clearance

Nice to have

Experience growing a DSO or security engineering function (expanding scope, tooling, and team); Familiarity with observability tooling for security signal (LGTM stack); Background in configuration management tooling (Ansible or similar); Experience with developer-facing security platforms or internal tooling that improved engineering workflows; Interest in growing into a lead or manager role as the team scales

Benefits

Medical, dental, and vision plan options; Life / AD&D and disability coverage options; Paid parental leave for eligible full-time employees (12 weeks birthing parents, 4 weeks non-birthing parents, 6 weeks adoptive, foster, or intended parents through surrogacy); Paid holidays and flexible PTO; 401(k) with pre-tax and Roth options; HSA/FSA options and dependent care FSA