DevSecOps Engineer

Position Summary

CPI is looking for a DevSecOps Engineer to join our application engineering team . This is not a traditional DevOps role . T his role must recognize and imbed security a cross the entire application delivery lifecycle . This teammate d riv es efficiency into the engineering team’s work , while e mbedding controls, automation, and threat-aware thinking into every pipeline, deployment, and platform.

You'll work at the intersection of Salesforce delivery, cloud infrastructure, and application security, partnering with engineers and security team mate s to ship faster and safer.

Key Responsibilities

• Manage release engineering , branching strategies, automated deployments, metadata diffing, sandbox seeding, and rollback playbooks ( Salesforce / GearSet are currently core applications)
• Design and operate secure CI/CD pipelines and cloud-native services ( Salesforce, AWS , Snowflake)
• Work in conjunction with other IT teammates to identify and resolve technical pipeline issues and escalate items while retaining ownership
• Embed automated security gates ( SAST, DAST, SCA, IaC scanning ) , container image scanning, and secrets detection directly into developer workflows
• Support and extend AI and Snyk code quality gates
• Architect and maintain AWS infrastructure IaC ( Terraform ) , with security baselines enforced via policy-as-code
• Containerize workloads with Docker, orchestrate via ECS/EKS (or AKS) , and harden images against CVEs and supply-chain attacks (SBOMs, signing, provenance)
• Partner with security team for pipeline incident response and infrastructure security events and postmortems
• Continuously evaluate tool alerts and reduce alert fatigue through tuning and automation
• Support and troubleshoot all pipeline & IaC tools to ensure engineering adoption
• Contribute to scrum ceremonies as a technical voice on delivery, release readiness, and risk

Core Experience

• 10+ years of professional software development experience across one or more of: Java, .N ET/C# , Python, Node.js, or Apex
• 5+ years in a DevOps, SRE, or Platform Engineering role, with at least the last 2 years explicitly focused on DevSecOps practices
• Demonstrated history of owning production systems end-to-end ( design, deployment, monitoring, and incident response )
• Independent problem solver able to investigate, identify , evaluate, and drive practical solutions

Salesforce Delivery

• Hands-on experience for Salesforce CI/CD: pipeline configuration, automated testing, problem analysis, and unit test coverage enforcement ( GearSet preferred)
• Strong understanding of Salesforce metadata, sandbox strategy, and Apex test automation
• Experience integrating Salesforce deployments with Git-based source-of-truth workflow s

Cloud & Infrastructure

• AWS at depth: IAM, VPC design, KMS, Secrets Manager, GuardDuty , Security Hub, CloudTrail, Config, WAF
• Docker and container orchestration (ECS, EKS, or Kubernetes) in production
• Infrastructure as Code: Terraform (preferred) with modular, reusable, policy-checked patterns.
• CI/CD platforms: GitHub Actions, GitLab CI, Jenkins, or CircleCI

Security Tooling & Practices

• SAST/DAST/SCA tooling; e.g. Snyk (preferrable) , Checkmarx , SonarQube
• Container/image scanning , SBOM generation , and p olicy-as-code

Soft Skills

• Strong communication — you can explain a vulnerability to an executive and a regex to a junior engineer in the same afternoon
• Pragmatic risk thinker — you know when to block a deploy and when to file a ticket
• Collaborative; sensitive to "security as a department of no"

Nice to Have

• Salesforce certifications (Platform Developer I/II)
• AWS certifications (Solutions Architect Professional, Securi t y Specialty)