Senior DevSecOps Engineer

The Office of the CTO is where innovation takes center stage. We inspire our global technical community to take on grand challenges, understand emerging trends, identify the critical inflections, and drive our sustainability, Environment, Social, and Governance (ESG) practices that will define the next generation of semiconductors and continued impact.

Within Semiverse® Solutions at Lam Research, we build innovative software products to solve semiconductor technology challenges.  Our leading 3D modeling software is revolutionizing the way semiconductor chips are fabricated around the world.  Enabled by our core intellectual property – an accelerated 3D voxel modeling and visualization engine – our software is highly successful and is quickly evolving as our business and customer base expand rapidly.

As a Senior DevSecOps Engineer, you will be part of the Engineering Operations team, owning the security health of our desktop software products, web applications, and development pipelines. You’ll upgrade third-party and open-source dependencies directly in our product code, run automated tests, and troubleshoot compatibility issues.  You’ll maintain the security scanning built into our CI/CD pipelines, and you’ll work closely with Product Security Engineers and Application Security Engineers in our central InfoSec organization to guide our products through a Secure Software Development Lifecycle (SDLC). This is a senior-level position with opportunities for independently driving projects to completion as well as technical career growth.

• Remediate vulnerabilities in third-party and open-source dependencies identified by SCA and SAST scans, opening and testing pull requests directly against product code
• Run automated test suites and troubleshoot build and compatibility issues caused by dependency upgrades, collaborating with developers when deeper product expertise is needed
• Reduce outstanding security exceptions by identifying upgrade paths, replacement components, or mitigations for vulnerable dependencies
• Maintain and improve SAST, SCA, and DAST scanning and its integration into CI/CD pipelines, including scan templates, quality gates, and policies
• Generate and maintain Software Bills of Materials (SBOMs) and support vulnerability tracking and handling for released products
• Serve as the primary point of contact between Engineering and InfoSec, coordinating risk assessments, architecture and infrastructure reviews, and security exception requests by gathering inputs from development teams and tracking reviews through to approval
• Partner with Application Security Engineers on DAST and penetration testing, helping developers interpret findings and track remediation

• Team player who enjoys supporting and working with others
• Systematic work style and excellent attention to detail
• Bachelor’s degree in Computer Science or a related field with at least 8 years of professional experience, a Master’s degree with at least 6 years, or an Associate degree or equivalent technical background with at least 10 years, in software engineering, DevOps, or application security
• Proficient with Git and source code management platforms, such as Bitbucket, GitHub, or Azure Repos
• Proficient in both Windows and Linux environments
• Strong Python skills, including dependency management (pip, virtual environments, requirements and lock files) and reading and modifying production code
• Proficient with CI/CD tools, such as Jenkins, Azure DevOps, or GitHub Actions
• Proven experience upgrading third-party dependencies in an existing codebase and resolving the resulting build, API, and test failures
• Hands-on experience with SCA and SAST tools, such as Black Duck and SonarQube, including triaging findings and identifying false positives
• Working knowledge of Secure SDLC practices and vulnerability standards, such as CVE, CVSS, and the OWASP Top 10
• Clear written communication skills for preparing security documentation and working with security teams

• Experience with containerization technologies, such as Docker or Kubernetes
• Experience with repository managers, such as Artifactory
• Experience with cloud computing services, such as Azure, AWS, or GCP
• Experience with C++ and build systems, such as gmake, scons, or cmake
• Experience with DAST tools, such as Invicti
• Experience generating and managing SBOMs in standard formats, such as SPDX or CycloneDX
• Understanding of open-source license compliance
• Experience supporting application security reviews, threat modeling, or penetration test remediation
• Familiarity with Python scientific and engineering libraries
• Experience managing JavaScript/TypeScript dependencies with npm, including upgrades in Angular applications

We believe it is important for every person to feel valued, included, and empowered to achieve their full potential. By bringing unique individuals and viewpoints together, we achieve extraordinary results.

Lam Research ("Lam" or the "Company") is an equal opportunity employer. Lam is committed to and reaffirms support of equal opportunity in employment and non-discrimination in employment policies, practices and procedures on the basis of race, religious creed, color, national origin, ancestry, physical disability, mental disability, medical condition, genetic information, marital status, sex (including pregnancy, childbirth and related medical conditions), gender, gender identity, gender expression, age, sexual orientation, or military and veteran status or any other category protected by applicable federal, state, or local laws. It is the Company's intention to comply with all applicable laws and regulations. Company policy prohibits unlawful discrimination against applicants or employees.

Lam offers a variety of work location models based on the needs of each role. Our hybrid roles combine the benefits of on-site collaboration with colleagues and the flexibility to work remotely and fall into two categories – On-site Flex and Virtual Flex. ‘On-site Flex’ you’ll work 3+ days per week on-site at a Lam or customer/supplier location, with the opportunity to work remotely for the balance of the week. ‘Virtual Flex’ you’ll work 1-2 days per week on-site at a Lam or customer/supplier location, and remotely the rest of the time.