DevSecOps Engineer

Wider Circle develops community care technology that connects health plan members with their neighbors and the care they need. The DevSecOps Engineer will work across information security, AWS cloud engineering, and IT operations, administering endpoints, managing vulnerabilities and security alerts, implementing infrastructure changes, improving automation, and maintaining compliance documentation and evidence.

Responsibilities:

• Administer Google Workspace and our endpoint management and protection tooling across a fully remote, mixed Windows, macOS, and Chromebook fleet
• Manage device lifecycle mechanics end to end — provisioning, enrollment, policy enforcement, wipe and decommission — including the scripting that makes it repeatable at volume
• Execute hiring, personnel change, and termination access changes accurately and on time, and keep the evidence trail clean
• Improve the accuracy of our asset records through process improvement and automation
• Run our recurring vulnerability management cycles across cloud infrastructure and employee endpoints — pull the findings, analyze what moved, collaborate with other teams on remediation, and escalate as needed
• Triage security alerts as they arrive, decide what is real, and either fix it or escalate it to whoever can
• Review cloud configuration findings against our compliance baselines and drive the ones that matter to closure
• Execute periodic access reviews across our in-scope systems and collect the evidence that they happened
• Make hands-on changes in AWS — identity and permissions, network controls, encryption, logging, storage and database configuration
• Help move our infrastructure into Terraform and reduce the amount of production that exists only as console clicks
• Own pieces of legacy cloud sprawl clean up including having conversations with system owners, testing the impact of decommissions, documenting cost savings, and making sure no orphaned components are left behind
• Turn work that currently lives in someone's head into a runbook someone else can follow
• Even when you automate, you document your automation so that your teammates can repeat your work confidently and safely
• Write and maintain procedures, standards, and technical documentation that hold up when an auditor reads them
• Collect and organize control evidence for our HITRUST and SOC 2 programs

Requirements:

• Roughly three to five years of hands-on experience spanning at least two of security operations, cloud infrastructure, and IT systems administration — and genuine curiosity about the third
• • Real production experience. You have made changes in a production AWS account and/or Google Workspace, understood the blast radius before you made them, and know your way around the tools available. When something isn't working as expected, you know where to start investigating
• • Scripting fluency. Python or Bash at the level of automating a repetitive task, parsing a messy export, and reconciling two systems that disagree. You do not need to be a software engineer
• • Systems administration depth in an identity provider/endpoint management platform — Google Workspace and/or any mainstream MDM or EDR is ideal, but the transferable skill matters more than the specific product
• • Writing that a stranger can follow. This is a requirement, not a nice-to-have. Clear, plain, specific technical writing
• • An ownership and completion instinct. A finding is not closed because a ticket was raised. Someone has to own cross-functional remediation to completion, and in this role it is you
• • Comfort in an environment with real consequences. We handle health information for people who are often elderly or vulnerable. Getting it right matters, and getting it wrong has victims, not just tickets
• • Infrastructure as code, particularly Terraform
• • Responsibility for HIPAA, HITRUST, SOC 2, or any audited control environment
• • Container and CI/CD familiarity, and experience with vulnerability scanning or code analysis tooling
• • Salesforce platform administration
• Certifications are welcome and none are required