DevSecOps Engineer

About the role

You'll work at the intersection of Site Reliability Engineering and Cloud Security, keeping our platform highly available, scalable and secure by design. We treat infrastructure as software and believe security should enable engineering velocity, not block it.

You'll ship most infrastructure, automation and remediation work with AI coding agents. Your core job is to design the guardrails, reviews and tests that make that safe at scale, and to help build the internal agents that run a growing part of our reliability and security operations.

The skill we value most is judgment: knowing when an agent's output is wrong, unsafe or not ready for production, and building systems that catch it when you're not looking.

What you will do

SRE & Dev Ops

• Infrastructure as code: Build and run secure, multi-account AWS infrastructure with Terraform and GitOps.
• Kubernetes: Operate and harden Amazon EKS workloads and the container platform.
• Service reliability: Define, track and enforce SLOs, SLIs and error budgets across our microservices, including services that depend on LLMs (fallbacks, latency and cost budgets).
• Observability: Run and improve our observability stack on Grafana, Newrelic
• Toil reduction: Write automation in Python or Go. Agents do much of the authoring; you own the design, testing and review.
• Developer support: Be the go-to partner for engineering teams on infrastructure, deployments and environments. Help them debug build, pipeline and runtime issues, and turn recurring requests into self-service.
• Infrastructure enablement: Help teams provision and change infrastructure through reviewed Terraform and GitOps workflows, and support new services from first deploy to production readiness.
• CI/CD & release: Maintain and improve build and deployment pipelines, release processes and environment management so teams can ship quickly and safely.

Cloud Security

• AWS security posture: Own IAM, KMS, Secrets Manager, GuardDuty, Security Hub, AWS Config, CloudTrail and Control Tower across our accounts.
• Zero trust & identity: Enforce least privilege and short-lived credentials for people, services and AI agents alike.
• Network defense: Design secure network boundaries, egress filtering and WAF rules that limit blast radius.
• Shift-left security: Embed SAST, SCA, container scanning and policy-as-code (OPA) into GitLab CI and ArgoCD without slowing teams down.
• Vulnerability management: Scale scanning, triage and code review to match the growing volume of AI-generated code.
• Secure by default: Partner with product teams in design reviews so new services follow secure architecture patterns.
• Detection & response: Build detections mapped to MITRE ATT&CK and respond to both reliability outages and security incidents as part of the on-call rotation.

AI Native Platform Development

• Internal agents: Build and operate agents, MCP servers and skills that automate SRE and security workflows.
• Agent identity & guardrails: Treat agents as non-human identities with scoped permissions, approval gates for high-risk actions (such as production changes and IAM edits) and full audit trails.
• AI supply chain: Vet and pin third-party models, MCP servers and agent plugins the same way we manage open-source dependencies.
• Data protection for AI: Control what consumer and panel data can reach external model APIs, and set usage and cost limits.
• Agent-ready operations: Write runbooks, alerts and blameless postmortems as structured, testable steps an agent can execute, with clear stop conditions.
• Evaluation: Test and evaluate agents before they reach production, and monitor them once they do.

Day to Day expectations

• AI Native Platform (~50%): Building agents, paved paths and guardrails for platform engineering
• Cloud Security (~30%): Owning AWS security posture, embedding security into CI/CD, and detection and response.
• SRE & DevOps (~20%): Running reliable infrastructure, observability, and day-to-day developer and infrastructure support.

What you bring to the role

• Experience: 5+ years of hands-on experience in Site Reliability Engineering (SRE), DevOps, Cloud Engineering, or Cloud Security Engineering roles.
• Cloud Expertise: Strong production expertise with AWS core services, networking, multi-account governance, and AWS-native security tooling (IAM, GuardDuty, Security Hub, KMS).
• Infrastructure as Code: Advanced hands-on proficiency with Terraform, GitOps, and configuration management.
• Containers & Kubernetes: In-depth knowledge of Docker and Kubernetes (EKS) administration, deployment, and container runtime security.
• Coding & Scripting: Proven ability to write clean, modular automation code in Python or Go (not just configuring tools, but authoring custom automations, tooling, and integrations).
• CI/CD Integration: Solid experience building, maintaining, and securing CI/CD pipelines (GitLab CI, ArgoCD, ArgoWorflows).
• AI Tooling Adoption: Active, daily experience leveraging AI coding agents and development tools (Claude Code, Cursor, Copilot) to accelerate delivery and automate workflows.
• Mindset: Strong collaboration, clear communication, and a philosophy that security empowers development velocity rather than acting as a blocker.

Preferred Qualifications

• Certifications: AWS Certified DevOps Engineer, AWS Certified Security - Specialty, CKA/CKS (Certified Kubernetes Administrator/Security Specialist), or CISSP.
• SecOps / EDR Experience: Familiarity with endpoint security (CrowdStrike), modern SIEM/SOAR platforms, and vulnerability management workflows.
• Compliance Frameworks: Familiarity with SOC 2 Type I/II, ISO 27001, GDPR, and CCPA compliance requirements in cloud environments.

• #LI-MV1
• At DISQO, we pride ourselves on having a positive, performance-oriented workplace that includes a flexible hybrid approach, competitive medical benefits, and an amazing vacation policy. Read more about our culture on Glassdoor.
• You can learn more about what’s happening at DISQO by visiting the DISQO Company Blog.

Perks & Benefits

*100% covered Medical/Dental/Vision for employee, competitive dependent coverage

• *Stock options
• *401K
• *Generous PTO policy
• *Team offsites, social events & happy hours
• *Life Insurance
• *Health FSA
• *Catered lunch and fully stocked kitchen
• *Paid Maternity/Paternity leave
• *Disability Insurance
• *Travel Assistance Program
• *24/7 Counseling Services offered to Employees

Note: The benefits noted above are for full time US based employees only.

• Discovery, innovation, and growth are possible when we open ourselves to new possibilities, perspectives, and approaches.
• That’s why, at DISQO, we welcome, support, and empower individuals from diverse backgrounds.
• Exceptional teams are rooted in extraordinary people, each with a unique story and a compelling set of skills.

*Recruiting firms that submit resumes to DISQO without first entering into a written contract will not be entitled to any compensation on candidates referred by that firm.