DevSecOps Engineer

Join a leading global OEM specializing in test-and-measurement and instrumentation, renowned for its extensive portfolio of embedded and long-lifecycle products. In partnership with Aquent, we are seeking a highly skilled individual to play a pivotal role in a critical initiative. This is an exceptional opportunity to directly influence the security posture of a vast product ecosystem, ensuring compliance with evolving global standards and safeguarding product integrity for years to come. Your contributions will have a direct and lasting impact on product security, operational resilience, and customer trust across a diverse and innovative product line.

About the Role

We are seeking a senior DevSecOps professional to join a dedicated engineering team, focused on enhancing product security and achieving compliance with significant regulatory requirements. This is a unique chance to apply your expertise in a complex, high-impact environment, translating regulatory mandates into tangible, scalable technical solutions. You will be instrumental in integrating robust security controls into an existing, diverse product landscape, working with a wide array of systems and codebases. Your work will directly contribute to the long-term security and compliance of critical products, making a profound difference in a globally recognized organization.

What You'll Do

• Implement and scale Static Application Security Testing (SAST) and Software Composition Analysis (SCA) across heterogeneous and often legacy codebases.
• Generate and maintain comprehensive Software Bills of Materials (SBOMs).
• Integrate security tooling into multiple build systems and Continuous Integration/Continuous Delivery (CI/CD) pipelines, including vendor-specific and custom toolchains.
• Design scalable, reusable security workflows applicable across numerous repositories and product teams.
• Contribute to a central vulnerability and waiver database, supporting consistent risk-acceptance management, audit traceability, and long-term reporting.
• Translate regulatory requirements into concrete, engineering-pragmatic technical controls.
• Drive end-to-end ownership of initial priorities, including rapid implementation of security scanning and achieving full visibility of the current security posture.

Scope & Environment

This role focuses on introducing security controls into an existing and diverse product ecosystem rather than building greenfield solutions. Expect to encounter:

• A broad portfolio of products across embedded systems and long-lifecycle device lines.
• A large number of repositories, including legacy codebases predating modern DevSecOps/CI/CD practices.
• High heterogeneity: multiple build systems, toolchains, and packaging processes - standard, custom, and vendor-specific.
• Continuous balancing of regulatory compliance, engineering pragmatism, and portfolio-wide scalability.
• Solutions must be long-term maintainable, auditable, and reusable across teams.

Required Experience

• Demonstrable product-security or regulated-compliance background with the ability to translate regulation into technical solutions.
• Hands-on, production-scale experience with industry-leading SAST and SCA tools.
• Practical experience generating and maintaining SBOMs.
• CI/CD build and automation across various platforms and cloud environments.
• Working knowledge of C and C++.
• Working knowledge of Python (for automation scripts and supporting tools).
• Experience integrating security into multiple build systems and toolchains.
• Track record scaling security workflows across portfolios with many repositories and a mix of legacy and greenfield work.
• Experience designing or contributing to vulnerability, waiver, or risk-acceptance databases.
• Awareness of embedded systems and long-lifecycle product constraints.
• This role requires US Citizenship; Lawful Permanent Residents do not qualify.

Nice-to-Have Qualifications

• Prior exposure to semi-automated or AI-assisted vulnerability remediation workflows (as engineering support, not replacement for engineering decisions).
• Previous DevSecOps work at OEMs with broad hardware portfolios.
• Familiarity with federal or highly regulated industries.

About Skill:

Skill connects the best professional, IT, engineering, financial and administrative talent with the world's biggest brands. Our eligible talent get access to benefits such as health benefit contributions, retirement plans with match and flexible spending accounts.

Skill is an equal-opportunity employer. We evaluate qualified applicants without regard to age, race, color, religion, sex, sexual orientation, gender identity, national origin, disability, veteran status, and other legally protected characteristics. We're about creating an inclusive environment-one where different backgrounds, experiences, and perspectives are valued, and everyone can contribute, grow their careers, and thrive.