Lead DevSecOps Engineer

The technical lead for AEG's DevSecOps and SSDLC programmes, sitting in the global Information Security organisation with a reporting line to the VP of Information Security. The engineer sets enterprise secure development standards, shapes CI/CD pipeline security for builds, container images and third-party dependencies, chooses and governs SAST, DAST and related tools, leads application risk assessments and threat modelling, performs secure code reviews and drives remediation, keeps SDLC controls aligned with ISO 27001, SOC 2 and NIST, and supports audits and incident response for applications.

AEG wants five or more years in DevSecOps, AppSec or security engineering, hands-on SAST, DAST, SCA and container security, and familiarity with OWASP and SSDF. Based in Los Angeles, with some meetings across North American and European time zones.