Staff Engineer - DevSecOps

Exelixis is seeking a Staff Engineer - DevSecOps to protect its AI infrastructure, data, and systems from cybersecurity threats. The role focuses on building AI-assisted development tools, implementing security solutions and guardrails, improving cloud and application security, and responding to security incidents in regulated environments.

Responsibilities:

• Build AI-assisted development tools, such as coding copilots or agentic coding tools
• Design, implement, and continuously improve security solutions, AI guardrails, and procedures
• Improve the organization's security posture by identifying weaknesses and vulnerabilities in its security infrastructure and implementing traditional and AI centric solutions to address them
• Integrate with various teams on technology initiatives to improve security of our applications, cloud, and AI infrastructure
• Assist in investigating and responding to security events and incidents, such as malware infections, unauthorized access attempts, and other potential security breaches
• Determine best procedures to contain threats, document findings, and escalate issues as needed
• Monitor and analyze security logs and events from various sources
• Stay current with the latest threat landscape, emerging trends, and solutions in AI and cybersecurity to proactively identify and mitigate potential security risks
• Improve the organization's security posture by identifying weaknesses and vulnerabilities in its security infrastructure and implementing solutions to address them
• Assist with and provide cyber expertise to internal staff, vendors, and partners on security practices and issues
• Follow industry and Exelixis best practices and procedures in a SOX and an FDA regulated environment
• Performs other duties as assigned
• Complies with all policies and standards

Requirements:

• Bachelor's degree in related discipline and 7 years of related experience; or
• Master's degree in related discipline and 5 years of related experience; or
• Equivalent combination of education and experience
• Experience with operation and implementation of cybersecurity tools
• Experience in designing, implementing, and managing security controls within cloud platforms, such as IAM, VPC, Zero Trust principles, IaC, IAAS, Security Groups, Key Management Services, SDLC, Ci/Cd pipelines and Network Security
• Experience in IT Security or related infrastructure administration role in an enterprise environment
• Experience in investigations and response to cyber events and incidents
• Experience in enhancing organizational security awareness and resilience
• Experience with cloud, system, and application security
• Experience administering IT systems
• Experience working in Agile environments and using ticketing systems (e.g., JIRA, JSM)
• Strong knowledge of general IT applications and infrastructure
• Advanced knowledge of CLI and scripting language experience (Python, PowerShell, etc..)
• Advanced knowledge of AWS
• Advanced knowledge of IAC, SDLC, Ci/Cd pipelines
• Advanced knowledge of cybersecurity technologies and concepts
• Strong analytical, problem solving, organizational, and communication skills
• Ability to work effectively with customers to solve business challenges while balancing the need for confidentiality, integrity, and availability
• Ability to multitask and work collaboratively
• Ability to work with ambiguity
• Ability to work with confidential data
• Ability to continuously learn and improve
• Ability to work with minimal guidance, to adapt to frequent priority changes, and response to ad-hoc requests
• 5% Occasional travel (5%)
• CISSP, CISM, CEH, OSCP, GIAC or similar cybersecurity certification preferred
• Experience in IT Security or related infrastructure administration role in an enterprise environment. Technical lead experience is preferred
• Experience in regulated industries (e.g., biotech, pharma) with knowledge of GxP and SOX compliance preferred