DevSecOps Engineer

Position Summary :

CPI is looking for a DevSecOps Engineer  to join our application engineering team . This is not a traditional DevOps role . T his role must recognize and imbed security a cross the entire application delivery lifecycle . This teammate d riv es efficiency into the engineering team’s work , while e mbedding controls, automation, and threat-aware thinking into every pipeline, deployment, and platform.

You'll work at the intersection of Salesforce delivery, cloud infrastructure, and application security, partnering with engineers and security team mate s to ship faster and safer.

Key Responsibilities :

Manage release engineering , branching strategies, automated deployments, metadata diffing, sandbox seeding, and rollback playbooks ( Salesforce / GearSet are currently core applications)

Design and operate secure CI/CD pipelines and cloud-native services ( Salesforce, AWS , Snowflake)

Work in conjunction with other IT teammates to identify and resolve technical pipeline issues and escalate items while retaining ownership

Embed automated security gates  ( SAST, DAST, SCA, IaC scanning ) , container image scanning, and secrets detection directly into developer workflows

Support and extend AI and Snyk code quality gates

Architect and maintain AWS infrastructure  IaC ( Terraform ) , with security baselines enforced via policy-as-code

Containerize workloads with Docker, orchestrate via ECS/EKS (or AKS) , and harden images against CVEs and supply-chain attacks (SBOMs, signing, provenance)

Partner with security team for pipeline incident response and infrastructure security events and postmortems

Continuously evaluate tool alerts and reduce alert fatigue through tuning and automation

Support and troubleshoot all pipeline IaC tools to ensure engineering adoption

Contribute to scrum ceremonies as a technical voice on delivery, release readiness, and risk

Core Experience

10+ years of professional software development experience across one or more of: Java, .N ET/C# , Python, Node.js, or Apex

5+ years in a DevOps, SRE, or Platform Engineering role, with at least the last 2 years explicitly focused on  DevSecOps  practices

Demonstrated history of owning production systems end-to-end ( design, deployment, monitoring, and incident response )

Independent problem solver able to investigate, identify , evaluate, and drive practical solutions

Salesforce Delivery

Hands-on experience for Salesforce CI/CD: pipeline configuration, automated testing, problem analysis, and unit test coverage enforcement ( GearSet preferred)

Strong understanding of Salesforce metadata, sandbox strategy, and Apex test automation

Experience integrating Salesforce deployments with Git-based source-of-truth workflow s

Cloud Infrastructure

AWS at depth: IAM, VPC design, KMS, Secrets Manager, GuardDuty , Security Hub, CloudTrail, Config, WAF

Docker and container orchestration (ECS, EKS, or Kubernetes) in production

Infrastructure as Code: Terraform (preferred) with modular, reusable, policy-checked patterns.

CI/CD platforms: GitHub Actions, GitLab CI, Jenkins, or CircleCI

Security Tooling Practices

SAST/DAST/SCA tooling; e.g. Snyk (preferrable) , Checkmarx , SonarQube

Container/image scanning , SBOM generation , and p olicy-as-code

Soft Skills

Strong communication — you can explain a vulnerability to an executive and a regex to a junior engineer in the same afternoon

Pragmatic risk thinker — you know when to block a deploy and when to file a ticket

Collaborative; sensitive to "security as a department of no"

Nice to Have

Salesforce certifications (Platform Developer I/II)

AWS certifications (Solutions Architect Professional, Securi t y Specialty)