DevSecOps & Security Compliance Engineer

Dev Sec Ops  & Security Compliance Engineer

Apiphani is a technology-enabled managed services company dedicated to redefining what it means to support mission-critical enterprise workloads. We’re a small but rapidly growing company, which means there’s lots of room for growth and learning opportunities abound!

Apiphani is dedicated to creating a diverse and inclusive work environment for all as a fundamental component of our business. Diversity and inclusion are the bedrock of creativity and innovation. Without diversity of experience and thought, we would fail to progress as a company and as a team.
Apiphani strives to foster an environment of belonging, where every employee feels respected, valued, and empowered. We embrace the unique experiences, perspective, and cultural background, which only you can bring to the table.

The Dev Sec Ops  & Security Compliance Engineer will be responsible for developing, implementing, and maintaining Apiphani's Dev Sec Ops  practices and security compliance programs to protect information assets throughout the software development lifecycle. This role will ensure that security and compliance requirements are embedded into Apiphani's infrastructure, applications, and operational processes. The Dev Sec Ops  & Security Compliance Engineer reports to the Head of Cybersecurity.

• Design and implement Dev Sec Ops  frameworks and practices across Apiphani's development and deployment pipelines
• Develop, deploy, and manage security compliance programs aligned with industry standards and regulatory requirements
• Develop and maintain security policies, standards, procedures, and compliance documentation
• Work with technical and business leaders at Apiphani to ensure compliance with industry standards and best practices, including SOC 2, ISO 27001, CMMC and other applicable frameworks
• Implement and manage security solutions integrated into the CI/CD pipeline, including container security, code scanning, secrets management, infrastructure as code scanning, and related technologies
• Oversee security assessments, penetration testing, and vulnerability assessments to identify potential threats and security exposures throughout the development lifecycle
• Maintain security incident response plans, monitor security incidents, and conduct incident response related to application and infrastructure security
• Maintain security awareness and training programs to educate developers and operations teams on secure coding practices and security policies
• Mentor security analysts and provide day-to-day tasking and guidance
• Stay up to date with the latest developments in Dev Sec Ops , security compliance, and cloud-native security practices
• Advise on the integration of security controls into infrastructure and application deployment processes
• Identify gaps in current security practices and solutions, and develop roadmaps to address compliance and Dev Sec Ops  maturity
• Advise on the direction and priorities of Apiphani's IT projects and initiatives as they relate to security and compliance
• Participate in infrastructure and security team meetings to ensure security is embedded in technical decisions
• Advise on vendor-specific partnerships and Dev Sec Ops  solutions available for Apiphani
• Support security risk assessments and help stakeholders understand business and compliance risks
• Meet with internal and external stakeholders to develop relationships and foster collaboration on security and compliance initiatives

• Bachelor of Science in Computer Science, Engineering, Applied Sciences, or equivalent work experience
• 5+ years of hands-on experience in security engineering, Dev Ops, cloud infrastructure, or application security
• Strong experience with CI/CD pipelines, container technologies (Docker, Kubernetes), and infrastructure as code (Terraform, Cloud Formation)
• Professional working knowledge of information security standards and guidelines such as ISO 27001, NIST 800-53, NIST 800-171, NIST CSF, CIS, PCI DSS, and SOC 2
• At least one of the following certifications, or the ability to obtain within six months of being hired: CISSP, CRISC, SANS GIAC, or relevant cloud security…