DevSecOps Architect (Remote Option)

Job Description

As a DevSecOps Architect, you will be responsible for overall design and direction of eCommerce Security Engineering across all our applications.

This role is responsible for building platforms and frameworks to create consistent, verifiable, and automatic management of applications and infrastructure between non-production and production environments. Leading a team of DevOps Engineers, you will utilize technical expertise and experience in driving the design and automation of processes to support the CI/CD of digital technology, enterprise systems, microservices applications and database services along with providing guidance and/or implement mitigation to address discovered abuse patterns using modern security tools, and work with developers and performance engineers to assist in securing the solution. This role is critical in the development and on-going security posture for digital commerce applications and accountable for identifying and implementing our security principles and best practices to maintain application security, vulnerability scanning, create processes for analyzing web traffic to identify patterns of abuse and address the impact of non-human HTTP traffic on both the performance and security of the application by applying blocks, rate limits, tarpits, or other remediation.

As a DevSecOps Architect, you will report to our Director of Strategy & Architecture. This role can work remote from any U.S. state where Balsam Brands is currently setup as an employer, which includes: CA, CO, FL, GA, ID, IL, IN, KS, KY, MD, MA, MO, NJ, NC, OH, OR, PA, TN, TX, VA, and WA. This role can also work locally in our Redwood City, CA or Boise, ID office location. Our local teams work in a hybrid model, which includes two days in-office.

To ensure sufficient overlap with functional and cross-functional team members globally, some flexibility with this role's regular work schedule will be required. Most of our teams have overlap with early morning and/or early evening PST. Specific scheduling needs for this role will be discussed in the initial interview.

What you’ll do:

• Analyzing, developing, and recommending improvement of software security infrastructures and standards
• Ensures direct and regular engagement with product/software development and infrastructure teams to achieve security compliance and security requirements within the organization
•  Identifies and corrects data security issues and takes appropriate actions in a multiple computing platform environment. This may involve delivering and promoting secure coding techniques, assessing vulnerabilities, providing remediation guidance, designing multiple security technologies such as cloud security, secure network design, multiple-level security applications, and ensuring compliance with PCI-DSS, GDPR, HITRUST, NIST, SOX, SOC and other related requirements of regulation
• Provides security guidance on infrastructural designs and organizes numerous risk assessments to identify and eliminate application/product threats
• Automate software maintenance of applications like Jenkins, Sonarqube, etc. which are part of CI/CD pipeline
• Design and maintain cloud-based solutions on public cloud
• Lead problem-solving or brainstorming activities related to issues, tasks, plans, and experiments
• Lead competence improvement and growth plans of the team and the system

What you bring to the table:

• Minimum of eight (8) years relevant DevOps experience
• Minimum of eight (8) years of architectural/ lead experience
• Bachelor’s degree or higher in Computer Science, Computer Engineering, or related technical degree
• Must have experience in the design and implementation of fully automated Continuous Integration, Continuous Delivery, Continuous Deployment pipelines and DevOps processes for Agile projects
• Must have experience in any public clouds leveraging Terraform.
• Knowledge of IP networking, VPN's, DNS, load balancing and firewall
• Experience defining, implementing, and engineering network environments compliant with information security policies, procedures, and standards like SOC2, GDPR, HIPPA, ISO 27001
• Analyzing security systems, audits, and seeking improvements on a continuous basis
• Developing, documenting, and maintaining DevSecOps implementation for the team
• Integrating DevSecOps tools and services (code repository, artifact repository, source code analyzer, security scanning, testing tools, and an orchestrated integration and delivery platform) to enable automated application building, testing, and securing of our deployments
• Experience with monitoring and log aggregating frameworks such as Kafka, Logstash, Splunk, Elasticsearch, and Kibana
• AWS/Azure Certification(s) such as Solutions Architect Pro, DevOps