Senior DevSecOps Engineer

What you’ll do

• Remediate vulnerabilities in third-party and open-source dependencies identified by SCA and SAST scans, opening and testing pull requests directly against product code Run automated test suites and troubleshoot build and compatibility issues caused by dependency upgrades, collaborating with developers when deeper product expertise is needed Reduce outstanding security exceptions by identifying upgrade paths, replacement components, or mitigations for vulnerable dependencies Maintain and improve SAST, SCA, and DAST scanning and its integration into CI/CD pipelines, including scan templates, quality gates, and policies Generate and maintain Software Bills of Materials (SBOMs) and support vulnerability tracking and handling for released products Serve as the primary point of contact between Engineering and InfoSec, coordinating risk assessments, architecture and infrastructure reviews, and security exception requests by gathering inputs from development teams and tracking reviews through to approval Partner with Application Security Engineers on DAST and penetration testing, helping developers interpret findings and track remediation Who we’re looking for Team player who enjoys supporting and working with others Systematic work style and excellent attention to detail Bachelor’s degree in Computer Science or a related field with at least 8 years of professional experience, a Master’s degree with at least 6 years, or an Associate degree or equivalent technical background with at least 10 years, in software engineering, DevOps, or application security Proficient with Git and source code management platforms, such as Bitbucket, GitHub, or Azure Repos Proficient in both Windows and Linux environments Strong Python skills, including dependency management (pip, virtual environments, requirements and lock files) and reading and modifying production code Proficient with CI/CD tools, such as Jenkins, Azure DevOps, or GitHub Actions Proven experience upgrading third-party dependencies in an existing codebase and resolving the resulting build, API, and test failures Hands-on experience with SCA and SAST tools, such as Black Duck and SonarQube, including triaging findings and identifying false positives Working knowledge of Secure SDLC practices and vulnerability standards, such as CVE, CVSS, and the OWASP Top 10 Clear written communication skills for preparing security documentation and working with security teams Preferred qualifications Experience with containerization technologies, such as Docker or Kubernetes Experience with repository managers, such as Artifactory Experience with cloud computing services, such as Azure, AWS, or GCP Experience with C++ and build systems, such as gmake, scons, or cmake Experience with DAST tools, such as Invicti Experience generating and managing SBOMs in standard formats, such as SPDX or CycloneDX Understanding of open-source license compliance Experience supporting application security reviews, threat modeling, or penetration test remediation Familiarity with Python scientific and engineering libraries Experience managing JavaScript/TypeScript dependencies with npm, including upgrades in Angular applications Our commitment We believe it is important for every person to feel valued, included, and empowered to achieve their full potential. By bringing unique individuals and viewpoints together, we achieve extraordinary results. Lam Research ("Lam" or the "Company") is an equal opportunity employer. Lam is committed to and reaffirms support of equal opportunity in employment and non-discrimination in employment policies, practices and procedures on the basis of race, religious creed, color, national origin, ancestry, physical disability, mental disability, medical condition, genetic information, marital status, sex (including pregnancy, childbirth and related medical conditions), gender, gender identity, gender expression, age, sexual orientation, or military and veteran status or any other category protected by applicable federal, state, or local laws. It is the Company's intention to comply with all applicable laws and regulations. Company policy prohibits unlawful discrimination against applicants or employees. Lam offers a variety of work location models based on the needs of each role. Our hybrid roles combine the benefits of on-site collaboration with colleagues and the flexibility to work remotely and fall into two categories – On-site Flex and Virtual Flex. ‘On-site Flex’ you’ll work 3+ days per week on-site at a Lam or customer/supplier location, with the opportunity to work remotely for the balance of the week. ‘Virtual Flex’ you’ll work 1-2 days per week on-site at a Lam or customer/supplier location, and remotely the rest of the time. Our Perks and Benefits At Lam, our people make amazing things possible. That’s why we invest in you throughout the phases of your life with a comprehensive set of outstanding benefits.