DevSecOps Engineer

Who you are

You have over 5 years of experience in a senior DevSecOps or Application/Product Security role, demonstrating a strong understanding of DevSecOps principles and the modern application threat landscape, including the OWASP Top 10. Your deep expertise in DevSecOps allows you to effectively balance rapid innovation with robust security practices, ensuring that security is integrated seamlessly into the software development lifecycle.

Your proven ability to 'shift left' security is evident in your experience embedding automated security controls such as SAST, DAST, SCA, and IAST into CI/CD pipelines. You have a strong focus on open-source security and supply chain mastery, with hands-on experience managing and hardening open-source software dependencies. You are skilled in utilizing Software Composition Analysis (SCA) tools like Dependency-Check, Snyk, and Black Duck to maintain an accurate Software Bill of Materials (SBOM) for all products.

As a Vulnerability & Risk Management Pro, you have established and owned a continuous CVE tracking and remediation process. Your expertise in risk-rating vulnerabilities based on exploitability and business impact enables you to drive engineering teams to efficiently remediate security risks using automation. You thrive in environments where you can empower teams to deliver exceptional value while upholding the required security standards.

Desirable

You have a proven track record of successfully balancing rapid innovation with robust security practices, and you are comfortable working in a performance-driven advertising company. Your ability to communicate effectively with cross-functional teams will be key to your success in this role.

What you'll do

In this role, you will be a critical enabler for teams, empowering them to move swiftly while ensuring that security standards are upheld throughout the software development lifecycle. You will collaborate closely with engineering teams to integrate security practices into their workflows, ensuring that security is not an afterthought but a fundamental part of the development process.

You will lead initiatives to embed automated security controls into CI/CD pipelines, enhancing the security posture of the organization. Your hands-on experience with SAST, DAST, SCA, and IAST will be crucial as you work to identify and mitigate security vulnerabilities early in the development process.

You will also manage and harden open-source software dependencies, utilizing your expertise in Software Composition Analysis tools to maintain an accurate Software Bill of Materials for all products. Your role will involve establishing a continuous CVE tracking and remediation process, ensuring that vulnerabilities are addressed promptly and effectively.

You will drive engineering teams to remediate security risks efficiently, leveraging automation to streamline processes and enhance overall security. Your ability to balance security with the need for rapid innovation will be essential as you work to empower teams to deliver exceptional value to clients.

What we offer

At Taboola, you will have the opportunity to work in a leading performance-driven advertising company, where your contributions will have a significant impact on the security of our products. We offer a hybrid work environment that allows for flexibility while fostering collaboration and innovation. You will be part of a dynamic team that values security as a core component of our development processes, and you will have the chance to grow your skills in a supportive and challenging environment.