Engineer II - DevSecOps

SUMMARY/JOB PURPOSE

The Engineer II - DevSecOps is responsible for protecting the organization's AI infrastructure, data, and systems from internal and external cybersecurity threats by implementing, managing, and continuously improving security practices, tools, and operations with a focus on AI, cloud applications, and infrastructure.

ESSENTIAL DUTIES/RESPONSIBILITIES

• Develop AI-assisted security automation, secure software delivery pipelines, and operational DevSecOps capabilities
• Design and implement software components, scripts, prompts, test cases, and configuration changes that integrate security controls into development and cloud workflows.
• Use and extend approved AI-assisted development tools, including coding copilots and agentic coding tools, to accelerate secure development while applying appropriate human review, testing, and governance.
• Provide DevSecOps and cybersecurity expertise to internal teams, vendors, and partners; independently resolve moderately complex security questions and escalate high-risk issues as appropriate.
• Develop, integrate, and maintain prompts, agent workflows, retrieval-assisted use cases, and API integrations with appropriate security controls, logging, observability, and data protection.
• Develop and maintain automated unit, integration, security, and pipeline tests; troubleshoot failures, remediate defects, and improve validation coverage.
• Maintain technical documentation, including architecture and design summaries, prompt and specification notes, deployment procedures, user guidance, and operational runbooks.
• Actively contribute to code reviews, threat modeling, design reviews, demos, testing sessions, backlog refinement, and team learning activities.
• Identify weaknesses and vulnerabilities in applications, cloud platforms, AI systems, and delivery pipelines; implement risk-based remediation and security improvements.
• Implement and improve security controls and guardrails across CI/CD pipelines, infrastructure as code, cloud services, applications, APIs, AI systems, and development tooling.
• Partner with engineering, infrastructure, data, and business teams to integrate security requirements into technology initiatives and the software development lifecycle.
• Investigate and respond to security events involving applications, cloud environments, development pipelines, credentials, APIs, and AI systems; document findings and support containment and remediation.
• Monitor and analyze security logs, pipeline results, vulnerability findings, and telemetry to identify anomalous activity, control gaps, and opportunities for automation.
• Evaluate emerging cybersecurity, cloud, AI, and software supply chain risks; recommend practical controls and incorporate approved improvements into DevSecOps processes.
• Apply Exelixis and industry security practices in a regulated environment, including applicable SOX, FDA, privacy, and data protection requirements.
• Performs other duties as assigned
• Complies with all policies and standards

SUPERVISORY RESPONSIBILITIES

• No supervisory responsibilities.

EDUCATION/EXPERIENCE/KNOWLEDGE/SKILLS & ABILITIES

Education

• Bachelor’s degree in related discipline and 5 years of related experience; or
  •
• Master’s degree in related discipline and 3 years of related experience; or
• Equivalent combination of education and experience

Experience

• Experience developing and maintaining software, automation, or infrastructure solutions in an enterprise environment.
• Experience integrating security controls into cloud platforms, applications, APIs, infrastructure as code, and CI/CD pipelines.
• Experience with cloud, AI systems, application security, vulnerability management, and secure software development practices.
• Experience operating or implementing cybersecurity and DevSecOps tools, including source control, build and deployment tooling, security testing, secrets management, and logging or monitoring.
• Experience investigating and remediating security findings or events involving applications, cloud services, development pipelines, or access controls.
• Experience working in Agile environments and using work management and service management tools such as JIRA and JSM.
• Experience collaborating with engineering, infrastructure, security, vendors, and business stakeholders to deliver secure technology solutions.
• Experience in regulated industries, such as biotechnology or pharmaceuticals, with knowledge of GxP, SOX, privacy, or related compliance requirements preferred.

Knowledge, Skills and Abilities

Preferred:

• Proficient knowledge of enterprise applications, infrastructure, cloud architecture, and common cybersecurity controls.
• Proficiency with a scripting or programming language such as Python, PowerShell, JavaScript/TypeScript, or Java, and with command-line tooling.
• Working knowledge of AI, machine learning, generative AI, LLMs, prompt engineering, agent workflows, retrieval-assisted systems, and responsible AI practices.

…