Job Title: Senior AI Dev Ops Engineer
Location: 1901 Market Street, Philadelphia, PA (Hybrid – onsite Tue/Wed/Thu)
Duration: Contract only. Hours: 9–5
Job Description:
This is not a traditional DevOps engineer role. We need someone with deep expertise in DevSecOps & AI-assisted security, including advanced SAST, SCA, vulnerability management, and software supply chain security. This role focuses on DevSecOps and AI-assisted security, leveraging advanced static application security testing (SAST), software composition analysis (SCA), and emerging AI-powered security capabilities to streamline software delivery, improve developer productivity, and strengthen application security throughout the SDLC.
Join a mature DevOps team to enhance the stability, security, and scalability of CI/CD pipelines across hybrid environments. This role focuses on DevSecOps and AI-assisted security, leveraging advanced static application security testing (SAST), software composition analysis (SCA), and emerging AI-powered security capabilities to streamline software delivery, improve developer productivity, and strengthen application security throughout the SDLC. The engineer will partner closely with application teams to implement secure delivery practices, remediate vulnerabilities, automate security controls, and leverage AI-powered tools to accelerate security analysis, vulnerability remediation, and code fixes.
Key Responsibilities:
- Perform advanced application security analysis using AI-assisted security tools, SAST, SCA, dependency analysis, and software supply chain security solutions.
- Partner with application teams to implement secure software delivery practices and embed security throughout the SDLC.
- Develop and automate security controls, policies, quality gates, and remediation workflows within CI/CD pipelines to enable secure and compliant software delivery.
- Leverage AI-powered tools and coding assistants to identify vulnerabilities, generate remediation recommendations, and accelerate code remediation efforts.
- Analyze and prioritize security findings, working with development teams to reduce risk and improve application security posture.
- Evaluate and implement emerging AI-driven security capabilities and automation solutions to strengthen enterprise security and improve developer productivity.
Minimum Education and Experience (client's Qualifications):
- 10+ years of experience in DevOps, DevSecOps, Application Security, Secure Software Engineering, or a related field.
- Expert knowledge of application security, vulnerability management, security assessments, and software supply chain security, including SAST, SCA, DAST, dependency analysis, and secure coding practices.
- Hands-on experience leveraging AI technologies, including LLMs, MCP servers, AI Skills, AI Agents, and code assistants such as Claude Code, GitHub Copilot, Codex, Antigravity, or similar platforms for security analysis, vulnerability remediation, and developer productivity.
- Experience with security tools such as SonarQube, Sonatype Nexus IQ, GitHub Advanced Security, HCL AppScan, Prisma, Qualys, or similar application security platforms.
- Experience developing and implementing secure CI/CD pipelines and automation using GitHub, GitHub Actions, Jenkins, Azure DevOps, GCP Cloud Build, or similar technologies.
- Strong understanding of SDLC, DevSecOps principles, security controls, and modern application security best practices.
- Experience partnering with application development teams to remediate vulnerabilities, implement security controls, and improve overall security posture.
- W2 only.
Preferred Qualifications:
- Healthcare payer or other regulated-industry application security experience.
- Demonstrated appetite for driving AI adoption forward – the hiring manager is explicitly looking for people who want to move AI forward in the organisation.
- [No separate preferred list was supplied by the client; the above is drawn from the job owner's notes.]
Soft Skills:
- Able to partner closely with application development teams and influence secure delivery practice without direct authority.
- Able to analyse and prioritise security findings and make the risk case to developers.
- Appetite for evaluating and adopting emerging technology rather than waiting for it to settle.
- [The intake form has no soft skills field; the above is drawn from the client's responsibilities and the job owner's notes.]
Skills:
|
Skill |
Required/Desired |
Amount |
of Experience |
|
DevOps / DevSecOps / Application Security / Secure Software Engineering. |
10+ |
Years |
|
|
SAST – static application security testing, at expert level. |
|
Years |
|
|
SCA – software composition analysis. |
|
Years |
|
|
Software supply chain security. |
|
Years |
|
|
Dependency analysis. |
|
Years |
|
|
DAST – dynamic application security testing. |
|
Years |
|
|
Vulnerability management and security assessments. |
|
Years |
|
|
Secure coding practices. |
|
Years |
|
|
AI-assisted security – LLMs applied to security analysis and vulnerability remediation. |
|
Years |
|
|
MCP servers. |
|
Years |
|
|
AI Agents and AI Skills. |
|
Years |
|
|
AI code assistants – Claude Code, GitHub Copilot, Codex, Antigravity or similar. |
|
Years |
|
|
Automating security controls, policies, quality gates and remediation workflows in CI/CD. |
|
Years |
|
|
Secure CI/CD pipeline development – GitHub, GitHub Actions, Jenkins, Azure DevOps, GCP Cloud Build or similar. |
|
Years |
|
|
SonarQube. |
|
Years |
|
|
Sonatype Nexus IQ. |
|
Years |
|
|
GitHub Advanced Security. |
Desired |
|
Years |
|
HCL AppScan. |
Desired |
|
Years |
|
Prisma. |
Desired |
|
Years |
|
Qualys. |
Desired |
|
Years |
|
SDLC and DevSecOps principles – strong understanding. |
|
Years |
|
|
Partnering with application development teams on remediation and security posture. |
|
Years |
|
|
Hybrid environment CI/CD – on-premises and cloud. |
|
Years |
|
|
Healthcare payer or other regulated-industry experience. |
Desired |
|
Years |