Senior Dev SecOps Engineer

Select how often (in days) to receive an alert:

Date: Aug 25, 2026

Location(s): St. Paul, MN, US, 55107

Company: Next Era Energy

Requisition : 97058

Next Era Analytics offers energy consulting services using industry-leading scientific analysis for planning, siting, forecasting and optimizing all forms of energy projects. Our optimization and analytics platforms integrate open-source technologies to leverage massive, diverse sets of utility operating data. This enables rapid development of operational solutions. Applying expertise in advanced mathematics, data and physical sciences, we solve some of the hardest problems facing the energy industry.

We are seeking a high-caliber Senior Dev Sec Ops  Engineer to embed security throughout the software development lifecycle and strengthen the security of our cloud platforms, development pipelines, and software supply chain. This role is designed for an experienced security engineer who combines deep technical expertise with a strong understanding of modern software engineering and developer workflows.

You will partner closely with software engineering, cloud, platform, cybersecurity, and governance teams to build scalable security controls that reduce risk without creating unnecessary friction. You will operate with a high degree of autonomy, establishing secure-by-default patterns, influencing system design, and implementing measurable controls across traditional and AI-assisted development environments.

• Secure CI/CD Pipelines: Build and maintain secure CI/CD pipelines with automated security gates, including static application security testing, software composition analysis, dynamic application security testing, secret scanning, infrastructure-as-code scanning, and container or image scanning.
• Risk-Based Security Controls: Configure and tune security tooling using exploitability and reachability-based prioritization to minimize false positives and reduce unnecessary developer friction.
• Secure Design Influence: Lead threat modeling, security design reviews, and the adoption of secure architecture patterns early in the development lifecycle.
• Root-Cause Remediation: Promote architectural and systemic security improvements that prevent recurring issues rather than relying on short-term or symptom-based fixes.
• Developer Guardrails: Develop reusable pipeline templates, hardened base images, security guardrails, and secure-by-default development patterns that shift security left without slowing delivery.
• AI-Assisted Development Security: Establish security standards and governance for AI coding assistants, agentic development tools, and AI-generated code.
• Agentic Security Controls: Implement least-agency permission models, human review requirements, code provenance standards, and controls governing autonomous agent access to tools, data, and environments.
• Secure Tool Integration: Evaluate and secure agent tool integrations, including Model Context Protocol integrations, while ensuring appropriate authentication, authorization, isolation, and oversight.

• Cloud Security Controls: Implement identity and access management, least-privilege access, network boundaries, centralized logging, and secure configuration standards across AWS and GCP environments.
• Software Supply Chain Security: Establish software and AI bills of materials, dependency governance, artifact signing, and software provenance aligned with frameworks such as SLSA.
• Pipeline Hardening: Protect the software delivery pipeline through OIDC-based publishing, ephemerl runners, controlled network egress, secure secrets management, and hardened build environments.
• Infrastructure- and Policy-as-Code: Implement infrastructure-as-code and policy-as-code controls that provide consistent enforcement, immutable logging, and automated evidence generation.

• Vulnerability Ownership: Lead vulnerability triage, exploitability-informed risk ranking, remediation service-level objectives, exception management, and recurrence prevention.
• Security Metrics: Define and track meaningful measures such as mean time to remediate, scan coverage, policy compliance, vulnerability recurrence, and developer adoption of security guardrails.
• Continuous Improvement: Use security findings, operational data, and engineering feedback to continuously improve tooling, processes, and preventative controls.
• Measurable Outcomes: Demonstrate risk reduction over time through clear reporting, actionable metrics, and transparent communication with technical and business stakeholders.

• Cross-Functional Partnership: Collaborate with application security, engineering, cloud, platform, cybersecurity, risk, and compliance teams to integrate security into technical delivery.
• Automated Security Evidence: Feed pipeline evidence, security findings, software inventories, and control results into…