Senior DevSecOps Engineer

Hi 👋🏻 I’m Louis, Head of Security. You’ll report directly to me.

What Ashby gives you in return is the best of both early and growth-stage environments. The agency and no-nonsense of a seed startup: you contribute to useful projects, make practical decisions, and work in an almost-no-meeting culture. The product-market fit and scale of a growth-stage startup: tens of thousands of daily users who depend on our software, and customers whose trust your work will help us earn.

We have notable customers like Notion, Linear, Shopify, and Snowflake. Our growth and retention metrics are best-in-class among our peers: we have tens of millions in ARR, growing >100% year over year, very low churn, and many years of runway. We’ll share more details once we meet.

You’ll join our Security team, a single team with multiple specializations overseeing security across the business. I report to Abhik, our Co-Founder and VP of Engineering. We’re bubbling with ideas on how to support Talent Acquisition through software, and we’ve started the journey of building products beyond Talent Acquisition. We read every application and aim to respond to yours within 3-4 days (often sooner).

Role Overview

We’re looking for an engineer with a passion to learn whose focus is on building “paved roads” specifically around making secure delivery part of the way we build and ship software. You’ll operate the checks and workflows around our delivery pipeline, help engineers act on useful findings, and make routine exceptions straightforward under agreed policies.

We expect you to bring the same care to the reliability of a security check and the time it costs an engineer as you bring to the risk it addresses. You’ll build the integrations, learn from rollout, and maintain what you ship.

We have notable customers like Notion, Linear, Shopify, and Snowflake. Our growth and retention metrics are best-in-class among our peers: we have tens of millions in ARR, growing >100% year over year, over 2500 customers, very low churn, and many years of runway. We’ll share more details once we meet, but you now probably have a good idea as to why we're hiring for this role 😅.

About the Role and How We Work

We’re also advertising this opening as Senior Security Platform Engineer - Secure Delivery. Both titles describe the same position; please apply once using the title that best reflects your experience.

Your mission is to make our delivery pipeline secure by default across application code, infrastructure, dependencies, containers, and product configuration. You’ll own the technical implementation and operation of delivery-security tooling and controls, including integration, configuration, tuning, reliability, and coverage.

Product Engineering teams own triage and remediation for the features they maintain. Application Security provides specialist analysis and defines product-security test requirements. Infrastructure retains ownership of the underlying cloud platform. You’ll work with those teams to make agreed checks and policies run reliably in the delivery workflow.

In practice, you’ll:

Deploy, configure, integrate, and tune static analysis, dependency, secret, container, and Infrastructure as Code scanning in our CI/CD workflows.

Inventory production repositories and delivery paths, including prompts and model configuration. Make scanner coverage distinct from application-specific tests of AI behavior; AppSec defines those tests, and you operate agreed delivery checks.

Start new checks in report-only mode where appropriate, then implement agreed warn and block policies using exploitability, exposure, and compensating controls.

Give engineers self-service exceptions within documented rules, with an owner, justification, expiry, and audit trail. Escalate decisions outside those rules to Security leadership with the relevant specialist analysis.

Build automation and AI-assisted workflows that enrich findings, propose fixes, and support Product Engineering’s triage under documented criteria. Preserve required checks, review, and rollback for automated patch changes.