Who You Are
You believe the secure path should be the easy path. You've spent your career where security and engineering meet, and you've learned that scanners nobody reads and gates nobody can pass don't make software safer, they make engineers route around you. So you build guardrails instead: pipelines that catch vulnerabilities before a human ever has to, golden paths with security baked in, and automation that turns "did we patch that?" from a meeting into a dashboard.
You're comfortable in a CI/CD pipeline, an AWS account, and a Kubernetes cluster. You can read application code well enough to tell a real injection risk from scanner noise, and you'd rather fix the template that generated the bug than file 40 tickets about it.
This is a foundational role. You'll be one of the first dedicated DevSecOps engineers on a platform organization supporting 300+ engineers, working alongside our Developer Experience and SRE teams and partnering closely with the Security organization. You'll shape how secure software gets built here, not just review it after the fact – including how we use AI to find and fix vulnerabilities before they reach production.
Security is primarily responsible for discovering, prioritizing, and reporting on risk posture; Engineering is primarily responsible for remediation. This role lives at that seam — partnering with Digital Security on coverage, and driving the fixes through Engineering.
This role reports to Platform Engineering but has a dotted line reporting to Digital Security leadership.
Qualifications
- 5+ years of professional experience in software engineering, infrastructure, or security engineering
- 3+ years focused on application security, security automation, or DevSecOps practice
- Hands-on experience integrating security tooling into CI/CD pipelines (GitHub Actions strongly preferred): SAST, SCA, secrets detection, container scanning
- Proficiency with AWS and its security services (IAM, GuardDuty, Security Hub, CloudTrail); you understand cloud identity well enough to design least-privilege access, not just audit it
- Experience with Kubernetes and infrastructure-as-code (Terraform preferred), including policy-as-code enforcement
- Proficiency in at least one programming language (Go, Python, or Ruby preferred); you build tooling, not just configure it
- Demonstrated ability to reduce security friction for engineers, with examples of controls teams adopted willingly
- Strong written communication; you document as you build
The base wage range for this position based in our New York City Office is targeted at $188,000.00 to $242,000.00 per year.
Actual compensation is based on multiple factors that are unique to each candidate, including and not limited to skill set, level of relevant experience, and specific work location. Salary ranges for positions based in other locations may differ based on the cost of labor in that location.
For more information about Justworks’ Total Reward Philosophy, including all of the perks and benefits we are proud to offer our team members, please visit Total Rewards @ Justworks.