Senior DevSecOps Engineer

As a Sr DevSecOps Engineer you will be responsible for;

· Define and own the DevSecOps architecture and roadmap for embedded capital equipment platforms, including CI/CD pipelines, build infrastructure, security automation, release evidence, and long-term maintainability.

· Develop and maintain secure embedded platform software, build infrastructure, and reusable automation capabilities.

· Create and support Yocto-based embedded Linux distributions, BSP software, device drivers, hypervisors, and platform-level OS components.

· Establish secure software supply chain practices, including SBOM generation, SOUP/OTS component tracking, license awareness, vulnerability monitoring, end-of-support tracking, and remediation workflows.

· Develop reusable CI/CD templates and pipeline controls for static analysis, software composition analysis, unit test automation, artifact signing, provenance tracking, cybersecurity evidence capture, and release readiness.

· Lead threat modeling and cybersecurity risk analysis for embedded platform components, including asset identification, attack surface analysis, exploitability assessment, security controls, and traceability to risk mitigations.

· Drive CVE intake, enrichment, asset mapping, triage, risk scoring, remediation planning, validation, and reporting in partnership with Product Security, SWQA, Systems, and program teams.

· Design and implement secure boot, firmware signing, cryptographic configuration, key/certificate lifecycle support, authenticated update mechanisms, and secure device communication patterns.

· Define runtime security monitoring requirements and support post-market cybersecurity monitoring and vulnerability response workflows.

· Review reported anomalies, assess cybersecurity impact, and support incident-response activities as needed.

· Support regulatory submissions and audits by ensuring cybersecurity, software lifecycle, and DevSecOps evidence is complete, traceable, reproducible, and aligned with internal quality system expectations.

· Define platform-level OS and BSP maintenance strategies, including Linux kernel support, Yocto release planning, driver update strategy, patchability, and security update governance across the product lifecycle.

· Collaborate with external vendors and internal partners to evaluate security tooling, embedded Linux support models, vulnerability intelligence, penetration testing outputs, and long-term maintenance approaches.

· Provide technical leadership and mentoring to software engineers, DevOps engineers, and platform teams on secure coding, build automation, vulnerability handling, and regulated software development practices.

· Partner with product teams to define platform capabilities that are reusable, secure, testable, and scalable across multiple capital equipment programs.

· Technologies & Tools

· AMD Zynq and Zynq UltraScale+ SoCs, NVIDIA ORIN, SafeRTOS, FreeRTOS

· Yocto-based embedded Linux package development

· Embedded hypervisors, Linux device drivers, BSPs, and boot flows

· Custom build systems and CI/CD pipelines

· Docker, Snyk, SonarQube, and software composition analysis tools

· Static analysis, software composition analysis, artifact signing, and vulnerability management tools

· Python, Bash, and Go

· Atlassian tools including Bitbucket, Jira, Bamboo, and Confluence

· GitHub and GitLab

· Networking security, secure boot, firmware signing, and secure update technologies

Qualifications;

· Strong experience in embedded Linux platform development for regulated, safety-critical, or high-reliability products.

· Hands-on experience with AMD/Xilinx SoC-based embedded systems, including AMD Zynq 7000 series, Zynq UltraScale+, Kria SOM, and the NVIDIA ORIN platform. Experience with real-time operating systems such as SafeRTOS and QNX Neutrino.

· Experience with Yocto, BSPs, OS layers, kernel configuration, boot flows, device drivers, and embedded platform security.

· Experience developing or governing DevSecOps practices in regulated medical device, safety-critical, aerospace, automotive, or industrial control environments.

· Strong understanding of FDA cybersecurity expectations, IEC 62304, ISO 14971, ISO 13485, SOUP/OTS software management, SBOM practices, and software lifecycle evidence generation.

· Experience implementing security automation in CI/CD pipelines, including SAST, SCA, container scanning, artifact signing, build reproducibility, traceability, and vulnerability reporting.

· Strong experience with threat modeling, vulnerability assessment, cybersecurity risk analysis, and secure-by-design architecture reviews.

· Experience with CVE triage methods that include exploitability, asset exposure, configuration applicability, runtime reachability, known exploited vulnerabilities, and remediation validation.

· Ability to collaborate across hardware, software, systems, product security, quality, regulatory, program management, and product management stakeholders.

· Demonstrated ability to influence cross-functional engineering and leadership decisions without direct authority.

· Experience defining reusable platform practices across multiple products, programs, hardware variants, or software release branches.

· Strong debugging, problem-solving, and root-cause analysis skills.

· Strong technical communication skills with the ability to translate cybersecurity and DevSecOps risks into actionable engineering and leadership decisions.

Salary Range: $125k-$150k

The actual salary offered is dependent on various factors including, but not limited to, location, the candidate’s combination of job-related knowledge, qualifications, skills, education, training, and experience

MANDATORY FOR ALL REMOTE/HYBRID AND/OR CALIFORNIA, DISTRICT OF COLUMBIA, HAWAII, COLORADO, MARYLAND, CONNECTICUT, ILLINOIS, MINNESOTA, VERMONT, MASSACHUSETTS, NEVADA, NEW YORK, RHODE ISLAND, WASHINGTON STATE & CINCINNATI, OHIO, JERSEY CITY, NEW JERSEY, TOLEDO, OHIO BASED ROLES.

Note: Due to the nature of the work, only US Persons (citizens or permanent residents) need apply for this position. - OPTIONAL