Senior DevSecOps Engineer

The group you'll be a part of

The Office of the CTO is where innovation takes center stage. We inspire our global technical community to take on grand challenges, understand emerging trends, identify the critical inflections, and drive our sustainability, Environment, Social, and Governance (ESG) practices that will define the next generation of semiconductors and continued impact.

The impact you'll make

Within Semiverse® Solutions at Lam Research, we build innovative software products to solve semiconductor technology challenges. Our leading 3D modeling software is revolutionizing the way semiconductor chips are fabricated around the world. Enabled by our core intellectual property – an accelerated 3D voxel modeling and visualization engine – our software is highly successful and is quickly evolving as our business and customer base expand rapidly.

As a Senior DevSecOps Engineer, you will be part of the Engineering Operations team, owning the security health of our desktop software products, web applications, and development pipelines. You'll upgrade third-party and open-source dependencies directly in our product code, run automated tests, and troubleshoot compatibility issues. You'll maintain the security scanning built into our CI/CD pipelines, and you'll work closely with Product Security Engineers and Application Security Engineers in our central InfoSec organization to guide our products through a Secure Software Development Lifecycle (SDLC). This is a senior-level position with opportunities for independently driving projects to completion as well as technical career growth.

What you'll do

Remediate vulnerabilities in third-party and open-source dependencies identified by SCA and SAST scans, opening and testing pull requests directly against product code

Run automated test suites and troubleshoot build and compatibility issues caused by dependency upgrades, collaborating with developers when deeper product expertise is needed

Reduce outstanding security exceptions by identifying upgrade paths, replacement components, or mitigations for vulnerable dependencies

Maintain and improve SAST, SCA, and DAST scanning and its integration into CI/CD pipelines, including scan templates, quality gates, and policies

Generate and maintain Software Bills of Materials (SBOMs) and support vulnerability tracking and handling for released products

Serve as the primary point of contact between Engineering and InfoSec, coordinating risk assessments, architecture and infrastructure reviews, and security exception requests by gathering inputs from development teams and tracking reviews through to approval

Partner with Application Security Engineers on DAST and penetration testing, helping developers interpret findings and track remediation

Who we're looking for

Team player who enjoys supporting and working with others

Systematic work style and excellent attention to detail

Bachelor's degree in Computer Science or a related field with at least 8 years of professional experience, a Master's degree with at least 6 years, or an Associate degree or equivalent technical background with at least 10 years, in software engineering, DevOps, or application security

Proficient with Git and source code management platforms, such as Bitbucket, GitHub, or Azure Repos

Proficient in both Windows and Linux environments

Strong Python skills, including dependency management (pip, virtual environments, requirements and lock files) and reading and modifying production code

Proficient with CI/CD tools, such as Jenkins, Azure DevOps, or GitHub Actions

Proven experience upgrading third-party dependencies in an existing codebase and resolving the resulting build, API, and test failures

Hands-on experience with SCA and SAST tools, such as Black Duck and SonarQube, including triaging findings and identifying false positives

Working knowledge of Secure SDLC practices and vulnerability standards, such as CVE, CVSS, and the OWASP Top 10

Clear written communication skills for preparing security documentation and working with security teams

Preferred qualifications

Experience with containerization technologies, such as Docker or Kubernetes

Experience with repository managers, such as Artifactory

Experience with cloud computing services, such as Azure, AWS, or GCP

Experience with C++ and build systems, such as gmake, scons, or cmake

Experience with DAST tools, such as Invicti

Experience generating and managing SBOMs in standard formats, such as SPDX or CycloneDX

Understanding of open-source license compliance

Experience supporting application security reviews, threat modeling, or penetration test remediation

Familiarity with Python scientific and engineering libraries

Experience managing JavaScript/TypeScript dependencies with npm, including upgrades in Angular applications

Our commitment

We believe it is important for every person to feel valued, included, and empowered to achieve their full potential. By bringing unique individuals and viewpoints together, we achieve extraordinary results.

Lam Research ("Lam" or the "Company") is an equal opportunity employer. Lam is committed to and reaffirms support of equal opportunity in employment and non-discrimination in employment policies, practices and procedures on the basis of race, religious creed, color, national origin, ancestry, physical disability, mental disability, medical condition, genetic information, marital status, sex (including pregnancy, childbirth and related medical conditions), gender, gender identity, gender expression, age, sexual orientation, or military and veteran status or any other category protected by applicable federal, state, or local laws. It is the Company's intention to comply with all applicable laws and regulations. Company policy prohibits unlawful discrimination against applicants or employees.

Lam offers a variety of work location models based on the needs of each role. Our hybrid roles combine the benefits of on-site collaboration with colleagues and the flexibility to work remotely and fall into two categories – On-site Flex and Virtual Flex. 'On-site Flex' you'll work 3+ days per week on-site at a Lam or customer/supplier location, with the opportunity to work remotely for the balance of the week. 'Virtual Flex' you'll work 1-2 days per week on-site at a Lam or customer/supplier location, and remotely the rest of the time.

Our Perks and Benefits

At Lam, our people make amazing things possible. That's why we invest in you throughout the phases of your life with a comprehensive set of outstanding benefits.