Security Engineer - DevSecOps

RESPONSIBILITIES:
Kforce has a client that is seeking a skilled Security Engineer to embed security best practices across the Software Development Lifecycle (SDLC), ensure compliance with enterprise security policies, and proactively identify and remediate risks across applications and data flows.

Responsibilities:
* Embed security controls and checkpoints throughout the SDLC, from design through deployment
* Collaborate with developers and product teams to review threat models, design secure architecture, and define secure coding practices
* Integrate automated security scans (e.g., SAST, DAST, OSS/Vulnerability scans) into CI/CD pipelines and ensure timely remediation
* Maintain security gates within Azure DevOps or similar ALM tools to enforce security quality standards
* Set up, configure, and manage static and dynamic code scanning tools (e.g., SonarQube, Veracode, Fortify)
* Monitor scan results, track vulnerabilities, and coordinate triage/resolution with development teams
* Maintain a vulnerability dashboard and produce reports that support security risk visibility and compliance
* Collaborate with data engineering teams to ensure data classification, encryption, access control, and retention policies are consistently applied
* Evaluate data flow diagrams and models for security exposure and recommend protections for sensitive data (PII, PCI, etc.)
* Support secure integration patterns between applications, APIs, and databases
* Participate in audits, risk assessments, and penetration testing exercises
* Escalate systemic risks and propose design-level mitigations
* Document security processes, requirements, and design patterns
* Educate developers and stakeholders on secure coding, SDLC security responsibilities, and emerging threats

REQUIREMENTS:
* 3-5+ years of experience in application security, cloud security, or a DevSecOps role
* Deep understanding of secure development practices and frameworks (OWASP Top 10, NIST)
* Experience with static and dynamic scanning tools (e.g., Fortify, Veracode, Checkmarx, Burp Suite)
* Familiarity with CI/CD tools and pipelines (e.g., Azure DevOps, GitHub Actions)
* Strong knowledge of data protection techniques (masking, encryption, RBAC)
* Hands-on experience with IAM, API security, and cloud-native platforms (Azure preferred)
* Excellent collaboration skills across cross-functional teams

Nice to Have:
* Security certifications (CISSP, CSSLP, OSCP, Azure Security Engineer Associate)
* Experience with IaC security (Terraform, Bicep, ARM templates)
* Background in regulated industries or compliance frameworks (SOC 2, PCI-DSS)

The pay range is the lowest to highest compensation we reasonably in good faith believe we would pay at posting for this role. We may ultimately pay more or less than this range. Employee pay is based on factors like relevant education, qualifications, certifications, experience, skills, seniority, location, performance, union contract and business needs. This range may be modified in the future.

We offer comprehensive benefits including medical/dental/vision insurance, HSA, FSA, 401(k), and life, disability & ADD insurance to eligible employees. Salaried personnel receive paid time off. Hourly employees are not eligible for paid time off unless required by law. Hourly employees on a Service Contract Act project are eligible for paid sick leave.

Note: Pay is not considered compensation until it is earned, vested and determinable. The amount and availability of any compensation remains in Kforce's sole discretion unless and until paid and may be modified in its discretion consistent with the law.

This job is not eligible for bonuses, incentives or commissions.

Kforce is an Equal Opportunity/Affirmative Action Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, pregnancy, sexual orientation, gender identity, national origin, age, protected veteran status, or disability status.

By clicking ?Apply Today? you agree to receive calls, AI-generated calls, text messages or emails from Kforce and its affiliates, and service providers. Note that if you choose to communicate with Kforce via text messaging the frequency may vary, and message and data rates may apply. Carriers are not liable for delayed or undelivered messages. You will always have the right to cease communicating via text by using key words such as STOP.