DevSecOps Engineer
US$159,000 – US$263,000 / yr base salary
Posted 28 Sep 2026
Advertised as “Senior/Staff DevSecOps Engineer”
BranchFactor Summary
The original posting with the fluff stripped out
- Management level
- People management
- Employment
- On-Site
- Contract
- Full-time
| Base salary | US$159,000 – US$263,000 / yr |
|---|
About the Company
America is under sustained cyber attack. Our adversaries infiltrate our networks, steal our IP, and degrade the digital infrastructure that modern life runs on. They’ve learned—correctly—that those attacks rarely produce consequences.
Twenty was founded to change that, by making our adversaries think twice before they attack us. Our vision is American and allied primacy in cyberspace—a future where they cannot contest us, deterrence is assured, and the free world remains secure.
Founded in 2024, Twenty Technologies (www.twenty.io) industrializes offensive cyber operations for the U.S. and its allies. Headquartered in Arlington, Virginia, Twenty has raised $168M from Khosla Ventures, Accel, Caffeinated Capital, Friends & Family Capital, Point72 Ventures, General Catalyst, and In-Q-Tel.
Mission | On Site | Full Time | U.S. Citizenship Required / No Active Clearance Required
Role Summary
You'll build and own the security infrastructure that keeps Twenty's engineering systems safe without slowing engineers down. This role spans runtime security, access control, secrets management, compliance, and CI/CD hardening — but it's equally about making security the path of least resistance. You'll embed with our engineering teams, design secure-by-default foundations, and build the tooling and automation that lets developers move fast without cutting corners. You'll report directly to the VP of Engineering and operate as a shared function across our product teams.
What You'll Do
-
Own runtime security and vulnerability management across cloud and container environments, including triage, prioritization, and remediation tracking.
-
Design and enforce identity and access management (IAM) across AWS and internal systems — least-privilege by default.
-
Own secrets and credentials management: policies, tooling, rotation, and developer workflows that make doing the right thing easy.
-
Lead security incident response: detection, containment, root cause analysis, and durable remediation.
-
Manage AWS Organization structure, account boundaries, SCPs, and guardrails.
-
Harden and maintain CI/CD pipelines, embedding security scanning and policy enforcement into the software delivery lifecycle.
-
Drive compliance efforts — own the evidence, controls, and remediation work to meet and maintain relevant frameworks.