DevSecOps Engineer

DevSecOps Engineer

At Gifthealth, we're revolutionizing the way people experience healthcare by simplifying the process of managing prescriptions and health services. Our mission is to provide a seamless, personalized, and efficient healthcare experience for all our customers. We're a dynamic, innovative, and customer-centric company dedicated to making a positive impact on people's lives.

We are seeking a DevSecOps Engineer to integrate security into the organization's software development and delivery processes. This position plays a key role in supporting the Information Security department and reports to the Director of Security, ensuring alignment with organizational goals, operational excellence, and compliance standards.

This role partners closely with Software Engineering, Platform Engineering, DevOps, and Security teams to build security controls directly into CI/CD pipelines, development workflows, infrastructure-as-code, container environments, and application delivery processes. Rather than operating as a final security checkpoint, the DevSecOps Engineer helps engineering teams identify and address security issues earlier in the development lifecycle while building scalable security automation that allows teams to move quickly without sacrificing security.

Key Responsibilities

• Secure Software Development
• Design and implement automated security testing within CI/CD pipelines.
• Evaluate applications and APIs for common security weaknesses.
• Review Terraform, CloudFormation, Kubernetes manifests, and similar infrastructure definitions for security risks.
• Help establish security standards for containers and Kubernetes environments.
• Participate in architecture and design reviews.
• Track application and pipeline security findings through remediation.

Qualifications

Education: Not specified as a requirement; we evaluate demonstrated hands-on experience.

Licensure/Certification: Not required. Relevant certifications in cloud, security, Kubernetes, or application security are a plus.

Experience: 3+ years of experience in DevOps, DevSecOps, application security, platform engineering, software engineering, or security engineering.

Knowledge, Skills, and Abilities

• Experience with modern CI/CD systems and software delivery practices.
• Working knowledge of application security, API security, GitHub Advanced Security/CodeQL, dependency and vulnerability alert triage (e.g., Dependabot), CI/CD pipelines, Infrastructure-as-Code, secrets management, and software supply chain security.
• Experience with scripting or programming using languages such as Python, Go, JavaScript, PowerShell, or Bash. Ruby experience is a strong plus, since GifthealthOS, the core application, is built on Ruby on Rails.
• Experience with Git-based development workflows and the ability to work directly with developers and engineering teams.
• Preferred: experience with Terraform, Kubernetes, or container orchestration.
• Preferred: experience implementing SAST, SCA, secrets scanning, or IaC security tools.
• Preferred: familiarity with the OWASP Top 10 and common application vulnerability classes, cloud-native security services, and threat modeling methodologies.
• Preferred: understanding of identity, authentication, authorization, and secrets management, and experience working within regulated environments.

Measures of Success

• Security testing becomes consistently integrated into engineering pipelines.
• Security vulnerabilities are identified earlier in the development lifecycle.
• Engineering teams have clear, usable guidance for resolving security findings.
• Reusable security controls reduce reliance on manual security reviews.
• Critical security issues can prevent unsafe deployments without creating excessive development friction.
• Application and software supply chain risks are measurable and actively managed.
• Secure development practices become part of normal engineering workflows.

Work Environment

• Location: Not specified in the source job description; to be confirmed with the hiring manager.
• Schedule: Full-time; standard business hours.
• May require flexibility for security-critical deployment reviews or urgent remediation timelines.
• Regular collaboration with Software Engineering, Platform Engineering, DevOps, and Security teams to ensure alignment.

Key Essential Functions

• Must be able to work at a computer for extended periods
• Must be able to communicate effectively, verbally and in writing, with engineering and security stakeholders
• Must be able to handle and access sensitive security and system data in compliance with organizational data handling requirements
• Must be able to respond to critical security or deployment issues outside standard working hours when required

Employment Classification

Status: Full-time FLSA: Exempt

Equal Employment Opportunity (EEO) Statement

Gifthealth is an Equal Opportunity Employer and prohibits discrimination and harassment of any kind. All employment decisions are made without regard to race, color, religion, sex, sexual orientation, gender identity, transgender status, national origin, age, disability, veteran status, or any other legally protected status.

We celebrate diversity and are committed to creating an inclusive environment for all employees. If you do not meet every requirement but still feel you would be a great fit for this role, we encourage you to apply!

Disclaimer

This job description is intended to describe the general nature and level of work being performed. It is not intended to be an exhaustive list of all responsibilities, duties, or skills required of personnel. Gifthealth reserves the right to modify job duties or descriptions at any time.