Direct Supply is building the future of healthcare technology with industry-leading products, solutions and platforms to help improve the lives of millions of seniors and those who care for them.
The Principal Cyber Security Engineer provides technical leadership and strategic direction for Direct Supply's DevSecOps function, ensuring security is effectively integrated throughout the software development and delivery lifecycle. This role combines deep engineering expertise with ownership of DevSecOps capabilities, standards and technology to reduce security risk, improve development efficiency and enable secure, reliable software delivery.
Reporting to the Director of Information Security, you'll serve as a principal technical contributor, partnering across engineering, technology and security teams to shape secure architectures, advance automation and deliver measurable security improvements. You'll also provide technical guidance and limited supervisory support to strengthen DevSecOps capabilities across the organization.
What You'll Do and Impact: - Lead the DevSecOps function by defining and executing its technical strategy, roadmap and priorities to strengthen software security, improve engineering efficiency and align investments with business needs.
- Establish secure architecture and engineering standards by evaluating system designs, defining reusable security patterns and advancing threat modeling practices to reduce risk across applications and platforms.
- Embed security into software development by implementing secure coding practices, developer guidance, secrets detection and reusable automation to prevent vulnerabilities earlier in the development lifecycle.
- Engineer automated security testing by integrating static analysis (SAST), software composition analysis (SCA), dynamic testing (DAST) and infrastructure-as-code scanning into CI/CD pipelines to improve vulnerability detection and support risk-based releases.
- Strengthen software supply chain security by implementing controls for build pipelines, artifact repositories, access management, secrets protection and software integrity to reduce exposure across development and deployment processes.
- Design and implement cloud and infrastructure security capabilities by establishing secure configurations, deployment patterns and automated controls that improve security consistency across cloud, container and infrastructure environments.
- Drive remediation of application and platform security risks by partnering with engineering and operations teams to prioritize vulnerabilities, address recurring issues and verify corrective actions to reduce ongoing exposure.
- Integrate security into production operations by collaborating with security operations teams on logging, monitoring, detection and incident response improvements to strengthen resilience and prevent recurring security issues.
- Measure and improve DevSecOps effectiveness by establishing metrics for security coverage, tool adoption, remediation progress and control effectiveness to guide priorities and demonstrate measurable results.
- Build technical capability across teams by evaluating security technologies, mentoring engineers, guiding assigned resources and supporting security champions to improve adoption of secure engineering practices.
What You'll Bring: - Bachelor's degree in Computer Science, Engineering, Information Security or a related field.
- 10+ years of progressive experience in information security, software engineering, platform engineering or DevSecOps, including demonstrated technical leadership of complex security engineering initiatives.
- Deep expertise across the software development lifecycle, including secure architecture, application security, automated testing, build and release processes, cloud security and production operations.
- Hands-on experience designing and implementing security automation, integrating security testing tools into CI/CD pipelines and securing cloud-native applications, containers and infrastructure environments.
- Demonstrated experience establishing DevSecOps roadmaps, technical standards and security capabilities that improve engineering practices, reduce risk and deliver measurable business results.
- Strong knowledge of software supply chain security, secure development practices, threat modeling, vulnerability remediation and risk-based security controls.
- Ability to independently resolve complex technical challenges, evaluate security trade-offs and influence engineering decisions across multiple teams.
- Demonstrated ability to communicate complex security risks, guide technical teams, mentor engineers and coordinate cross-functional initiatives to deliver sustainable security improvements.
- CISSP, CCSP, GIAC or relevant cloud and DevSecOps certifications; experience securing AI/ML and generative AI solutions preferred.
Job to be performed in the location listed. Generous benefit package available.
2013 to 2026 Direct Supply, Inc. All rights reserved.
