Sr. DevSecOps Engineer

We are looking for a Sr. DevSecOps Engineer to work for our client. The ideal candidate aligns with the responsibilities and qualifications outlined below.

This is a great opportunity for a security-focused engineer to protect high-traffic web applications and APIs while building security directly into delivery pipelines, in a hybrid role based in Columbus, OH.

Responsibilities

Configure, manage, and tune Fastly's Next-Gen WAF (Signal Sciences) to protect web applications and APIs

Build security controls, vulnerability scanning, and automated testing into CI/CD pipelines

Review WAF logs to investigate suspicious or malicious traffic and support incident response

Fine-tune security rules and policies to cut false positives without weakening protection

Defend against bot activity, DDoS attacks, and common web and API vulnerabilities

Automate security configurations and infrastructure management with Terraform and scripting

Feed security data into SIEM tools such as Splunk or Microsoft Sentinel for monitoring and alerting

Work with developers and operations teams to remediate vulnerabilities and encourage secure development habits

Guide less experienced engineers on DevSecOps practices and tooling Qualifications

Hands-on experience with Fastly, especially Next-Gen WAF (Signal Sciences), including configuration and rule tuning

Experience integrating security tooling into CI/CD pipelines using GitHub Actions, Azure DevOps, or Jenkins

Strong understanding of OWASP Top 10, HTTP/HTTPS, API security, bot mitigation, DDoS protection, and common web application vulnerabilities

Proficiency with Python, Bash, or PowerShell, along with automation tools such as Terraform

Experience analyzing WAF logs, investigating malicious traffic, and working with SIEM tools such as Splunk or Microsoft Sentinel

Strong problem-solving skills and the ability to explain security risk clearly to engineering teams What Our Client Offers

Hands-on work with an enterprise-grade WAF protecting live, customer-facing traffic

A seat where security is built into delivery rather than added at the end

Room to shape detection, tuning, and response practices as the program grows

Collaboration with developers who treat security feedback as useful input