DevSecOps Engineer
Epay Policy · Austin, TX
About this role
## DevSecOps Engineer — ePayPolicy ### About ePayPolicy ePayPolicy helps over 10,000 insurance companies speed up incoming and outgoing payments by moving from manual, outdated payment collection to modern payment tools. Our secure online ACH and credit card payment page is the core product, supported by an integrated suite of features (including point-of-sale financing, payables network tools, and check reconciliation) within a single dashboard. Founded in 2014 and based in Austin, TX, ePayPolicy has grown rapidly and is recognized as a Best Place to Work in Austin. ### Role Summary Join the Information Security team as a **DevSecOps Engineer**. You’ll bridge Security and Engineering to keep our SaaS payment platform **secure by design**—without slowing development velocity. Reporting to the **Head of Information Security**, you’ll own application security guardrails and tooling (SAST/SCA), lead targeted internal web application penetration testing for high-risk releases, manage edge security controls (Cloudflare WAF), and partner with Tech Debt and Platform teams to triage and remediate vulnerabilities. ### What You’ll Do (Key Responsibilities) 1. **Application Security, Tooling & Guardrails** - Maintain and optimize **SAST** (Sonar) and **SCA** (NPM/Nuget scanners) to reduce noise and enforce actionable quality gates. - Embed automated security checks into **Azure DevOps / GitHub Actions** pipelines. - Triage **zero-day** and software supply chain risks with clear remediation paths. 2. **Internal Web Application Penetration Testing & Risk Assessments** - Perform hands-on manual penetration testing and security assessments on high-risk releases, APIs, and workflows. - Conduct **threat modeling** and logic reviews (authn/authz, business logic, boundaries). - Create clear, reproducible **PoCs** to help developers understand impact and fix issues. 3. **Edge & Infrastructure Security Alignment** - Audit for exposed secrets/credentials and support **vault** workflows. - Assist with **IaC scanning** rollout. - Audit cloud environments for misconfigurations, identity over-grants, and architectural vulnerabilities. 4. **Vulnerability Governance & Cross-Functional Partnership** - Partner with Tech Debt and Platform on a monthly cadence to prioritize and burn down vulnerabilities against SLA targets. - Translate findings into actionable tickets (repro steps, context, fix recommendations). - Track and report metrics such as **MTTR**, scan coverage, and open high/critical risks. 5. **Threat Monitoring & External Security** - Serve as the primary escalation point for dependency alerts, exposed credentials, and edge anomaly detections. - Validate externally submitted security reports before sharing verified findings with engineering. ### What We’re Looking For (Qualifications) - **3–5+ years** hands-on experience in Application Security, Security Engineering, or Penetration Testing in a modern **Azure-hosted SaaS** environment. - Experience securing applications built on **.NET Framework**, **.NET 10**, and **SQL**, plus operational familiarity with **Azure PaaS**, serverless functions, and **Cloudflare** edge controls. - Strong offensive skills: manual web app pen testing and **API security** assessments. - Defensive tooling: hands-on configuring/tuning **SAST/SCA/DAST** tools. - Strong web/SaaS fundamentals: **OWASP Top 10**, **OAuth2/OIDC**, **JWT**, **CORS**, **CSP**. - Experience with edge WA
Listing freshness
CronJobs last confirmed this listing 2h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.