Senior Security Engineer

Job not on LinkedIn

🔥 1 minute ago

🇺🇸 United States – Remote

💵 $135k - $220k / year

⏰ Full Time

🟠 Senior

👮‍♂️ Cybersecurity / Security Engineer

👻 Ghost score 22%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Istari

WebsiteLinkedInAll Job Openings

11 - 50 employees

🚀 Aerospace

☁️ SaaS

🤖 Artificial Intelligence

Aerospace • SaaS • Artificial Intelligence

Istari is at the forefront of digital engineering innovation, providing digital twin technology that revolutionizes industries from aerospace to agriculture. By making digital twins simple and secure, Istari unlocks advanced models and simulations, facilitating more efficient and sustainable product development. The company's innovative approach extends the internet into a future engineering metaverse, offering software-like agility for physical systems and empowering collaborative and secure workflows. Recognized for their groundbreaking work, Istari has secured a $19M contract to develop the world’s first digitally certified airplane, marking a significant milestone in digital certification and collaboration with partners like Lockheed Martin.

📋 Description

• Serve as the technical owner of pipeline security tooling, including SAST, SCA, secrets detection, container scanning, and artifact signing • Assess tooling effectiveness and coverage; identify gaps and lead improvements, consolidation, or replacement • Develop automated and manual penetration-testing capabilities with rapid feedback loops into engineering • Help mature security operations and incident response capabilities • Define the long-term roadmap for security tooling and processes with Cybersecurity and Engineering leadership • Translate NIST SP 800-53, NIST SP 800-171, and RMF requirements into enforceable pipeline gates, thresholds, and policies • Maintain risk-based pass/fail criteria while minimizing false positives • Ensure tooling outputs produce assessor-ready evidence for authorizations, continuous monitoring, and audits • Own documented and traceable exception and manual-review processes • Enforce artifact signing, signature verification, commit signing, branch protection, and repository rulesets • Automate creation and maintenance of SBOMs and VEX data • Move security checks earlier into developer workstations, pre-commit hooks, and pull requests • Partner with engineering teams to embed security into workflows • Apply AI tooling to vulnerability triage, remediation, and security automation; evaluate emerging AI capabilities

🎯 Requirements

• 7+ years in DevSecOps, application security, security operations and incident response, and general security engineering, including at least 3 years owning security tooling in CI/CD pipelines • Deep hands-on experience configuring, tuning, and enforcing SAST, SCA, secrets detection, and container scanning tools in production pipelines, including risk-based gates, vulnerability thresholds, and exception processes • Demonstrated experience mapping security tooling and pipeline controls to NIST SP 800-53, NIST SP 800-171, or RMF requirements, and producing evidence for assessments or authorizations • Track record of evaluating, selecting, or evolving security tooling, and influencing engineering teams without direct authority • Scripting or automation experience in Python, Bash, or similar • Security+ or equivalent DoD 8140 qualifying certification, or ability to obtain within 2 months of hire • U.S. citizen residing and working in the U.S. • Preferred: Familiarity with GitHub, Argo CD, JFrog, and Snyk • Preferred: Experience in DoD software factory or Government DevSecOps environments • Preferred: Experience supporting ATO efforts, including control assessment and POA&M management • Preferred: Experience with software supply chain integrity and policy-as-code practices, such as artifact signing, signature verification, SBOMs, OPA, or Kyverno • Preferred: Experience applying AI and LLM tools to security engineering • Preferred: Experience with penetration testing tools, processes, and strategies • Preferred: Familiarity with cloud and container environments such as GitHub, Docker, Kubernetes, and AWS • Preferred: Advanced certifications such as CISSP, SecurityX (CASP+), or GIAC • Preferred: Active security clearance (Top Secret highly desired)

🏖️ Benefits

• Bonuses • Equity • Comprehensive benefits package