LEXIPOL
Login

Senior DevSecOps Engineer

Lexipol | TX

Posted Date 11/12/2024
Description This is a Remote, US-based position. Candidates must live in the United States.
No sponsorship of any type of Visa.

At Lexipol, our mission is to create safer communities and empower the individuals on the front lines with market-leading content and technology. Our top-notch team works closely with law enforcement, fire, EMS, corrections, and local government professionals to tailor our solutions to better address today’s challenges and keep first responders coming home safely at the end of each shift.

Working at Lexipol means making a difference – day in and day out.

The Work
The DevSecOps team at Lexipol is responsible for integrating security into our DevOps pipeline, ensuring secure and compliant infrastructure and application environments, and supporting secure development practices. This team collaborates across development, operations, QA, and security to implement security testing, monitoring, and compliance standards that protect Lexipol's platforms and align with regulatory requirements.  As a DevSecOps team, our goal is to build secure, resilient, and compliant infrastructure and processes that safeguard Lexipol’s products and user data.

The Senior DevSecOps Engineer will play a critical role in advancing Lexipol's security posture, responsible for embedding security in CI/CD processes, managing cloud security, and overseeing automated compliance across AWS and Azure. You will work closely with multiple teams to support Lexipol's operational goals and regulatory requirements, including SOC2, CJIS, and NIST standards.

Key Performance Objectives
Key Performance Objective #1: Integrate Security into CI/CD Pipelines (25%)
  • Design and implement security testing (SAST, DAST) within CI/CD pipelines to identify vulnerabilities early in the development cycle.
  • Collaborate with development teams to integrate secure coding practices and automated compliance checks.
  • Harden pipelines to ensure secure handling and storage of secrets, using best-in-class secret management solutions.
Key Performance Objective #2: Implement Secure Infrastructure as Code (IaC) (25%)
  • Develop and enforce secure IaC standards with Terraform, CloudFormation, and similar tools.
  • Regularly scan configurations and IaC for security compliance, addressing any deviations promptly.
  • Ensure robust secrets management across IaC implementations and cloud environments.
Key Performance Objective #3: Implement and Manage SIEM for Security Monitoring (20%)
  • Lead the deployment and configuration of a Security Information and Event Management (SIEM) solution, ensuring real-time security monitoring for all critical systems.
  • Develop and fine-tune alerting rules and dashboards to detect and respond to suspicious activities, leveraging automated responses where possible.
  • Collaborate with incident response teams to establish workflows for rapid triage and mitigation based on SIEM alerts.
Key Performance Objective #4: Manage Cloud Security and Compliance (15%)
  • Collaborate with cloud and infrastructure teams to implement and monitor cloud security controls in AWS and Azure.
  • Develop automated compliance auditing and reporting for SOC2, CJIS, NIST, and internal policies.
  • Implement security controls around serverless and containerized environments, ensuring secure and scalable deployments.
  • Manage and oversee the work of contract resources to ensure project timelines and goals are met.
Key Performance Objective #5: Conduct Threat Modeling and Security Reviews (15%)
  • Lead threat modeling sessions to identify and mitigate potential risks across Lexipol's products.
  • Perform security reviews for new and existing applications, focusing on high-risk components and dependencies.
  • Ensure adherence to secure coding practices and dependency management, particularly for open-source libraries.
Requirements: 
To be considered for this role, you must have:
  • 5+ years of experience in a DevOps or DevSecOps role, with a focus on security within CI/CD pipelines and cloud environments.
  • Proficiency in security practices and tools, including SAST, DAST, vulnerability scanning, and automated testing.
  • Extensive experience in AWS and Azure security, including IAM, network security, and secrets management.
  • Strong hands-on experience with IaC tools like Terraform and CloudFormation.
  • Knowledge of compliance frameworks (SOC2, CJIS, NIST) and experience with automated auditing tools.
  • Strong scripting skills (Python, Bash, etc.) to automate security processes and integrate tooling.
  • Strong verbal and written communication and collaboration skills, with an initiative-taking attitude towards knowledge sharing and team success.
  • Familiarity with Agile methodologies and practices.
Preferred Experience:
  • AWS Certified Security Specialty, Certified Information Systems Security Professional (CISSP), or Certified Cloud Security Professional (CCSP).
  • Familiarity with serverless and container security.
  • Experience with secure code review and open-source dependency management.
Target Outcomes/ Target Results
  • Create, Define, and Complete DevOps Strategy, User Stories, and Tasks in Jira in collaboration with the entire DevOps team & partner teams.
  • Implement a robust SIEM solution, achieving 24/7 visibility into security events across all critical systems.
  • Ensure compliance with SOC2 and CJIS standards in all infrastructure and pipelines.
  • Integrate security into CI/CD processes.
  • Efficiently manage and oversee contract resources to ensure on-time project delivery.
Employee Value Proposition
  • Supporting First Responders: You will be contributing to systems and platforms that directly help first responders such as law enforcement, fire, EMS, and other government professionals.
  • Career Development: Reporting to a senior engineering leader, this role offers growth in security architecture and DevSecOps leadership.
  • Team Collaboration: Collaborate cross-functionally, influencing security practices and initiatives at Lexipol.
  • Training: You will have access to ongoing AWS and Azure training resources and certifications that enable expanded capabilities for your role.
The Environment
  • All equipment provided
  • Remote working 100% - Office visits very infrequent
Applicants must be authorized to work for ANY employer in the U.S. We are unable to sponsor or take over sponsorship of an employment Visa at this time.

Duties listed are not intended to be exhaustive or exclusive; other duties may be assigned. Management retains the discretion to add to or change the duties of the position at any time.

Compensation and Benefits
Lexipol offers a competitive base salary, monthly, quarterly, or annual incentive and a comprehensive benefits package including 401(k) with Company match and a flexible paid time off plan.
Base salary for this role is $175k to 190k, based on experience, plus bonus opportunity.

About Lexipol
Lexipol empowers first responders and public servants to best meet the needs of their residents safely and responsibly. We are the experts in policy, training, and wellness support, committed to improving the quality of life for all community members. Our solutions include state-specific policies, online learning, behavioral health resources, grant assistance, and industry news and information offered through the websites Police1, FireRescue1, EMS1, Corrections1 and Gov1. Lexipol serves more than 2 million public safety and government professionals in over 12,000 agencies and municipalities. For additional information, visit www.lexipol.com.

Lexipol Is an Equal Opportunity Employer (EOE)
Lexipol, LLC provides equal employment opportunities (EEO) to all team members and applicants for employment without regard to race, color, religion, gender, national origin, age, sex, pregnancy, disability, sexual orientation, gender identity or expression, veteran status, genetic information, or any other non-job-related characteristic. Lexipol complies with applicable federal, state, and local laws governing nondiscrimination in employment in every location in which the company has facilities. This policy applies to all terms and conditions of employment, including hiring, placement, promotion, termination, layoff, recall, transfers, leave of absence, compensation, and training.

Share this job