DevSecOps Engineer

What the role needs

• Build a vulnerability management program, including triage processes, severity-based remediation timelines, and security exception workflows.
• Standardize and automate GitLab security scanning (SAST, dependency scanning, container image scanning) across multiple projects while actively tuning to reduce false positives.
• Build and automate software bill of materials (SBOM) generation and dependency tracking.
• Document all processes, standards, and training materials to ensure a seamless handoff to the internal DevOps team.
• Extensive hands-on experience authoring GitLab CI/CD pipelines.
• Deep expertise with GitLab Security Features (SAST, dependency/container scanning, security policies, and vulnerability reporting).
• Proven track record building vulnerability management programs, triage processes, and remediation workflows.
• Experience defining severity-based remediation SLAs and formal exception management processes.
• Hands-on proficiency with SBOM generation and container/dependency scanning.
• Strong background in writing clear, operational technical documentation.

From the employer

Our client, a large professional services partner, is looking to hire a remote DevSecOps Engineer for a 3-month contract. This role focuses entirely on building the program, defining workflows, and standardizing scanning infrastructure. Fixing application vulnerabilities is out of scope; application development teams retain ownership of their code remediation. Key Responsibilities: • Build a vulnerability management program, including triage processes, severity-based remediation timelines, and security exception workflows. • Standardize and automate GitLab security scanning (SAST, dependency scanning, container image scanning) across multiple projects while actively tuning to reduce false positives. • Build and automate software bill of materials (SBOM) generation and dependency tracking. • Document all processes, standards, and training materials to ensure a seamless handoff to the internal DevOps team. Required Skills: • Extensive hands-on experience authoring GitLab CI/CD pipelines. • Deep expertise with GitLab Security Features (SAST, dependency/container scanning, security policies, and vulnerability reporting). • Proven track record building vulnerability management programs, triage processes, and remediation workflows. • Experience defining severity-based remediation SLAs and formal exception management processes. • Hands-on proficiency with SBOM generation and container/dependency scanning. • Strong background in writing clear, operational technical documentation. Desired Skills: • Automation experience with dependency management tools like Renovate. • Cloud infrastructure experience with AWS ECS. • Familiarity with languages/package managers such as Elixir/Hex, Node.js, Ruby, or Lucee/CFML on the JVM. • Technical experience producing CycloneDX or SPDX SBOM formats. • Experience pulling compliance evidence to support SOC 2 audits from the engineering side. ClearBridge Technology Group is an Equal Opportunity Employer. We offer excellent benefits and compensation packages. The expected hourly rate range for this role is: $56-$81 per hour The posted range is an estimate, the actual compensation offer will be based on the candidate’s experience, skills, qualifications and will be in line with internal equity Apply for this Job