Altera
DevSecOps and AI/Automation Engineer
San Jose, California, United States · Senior
Sponsorship not specified$149k-$216kDetected 16 days ago
Code ReviewGitAWSAzureKubernetesCI/CDGitHub ActionsJenkinsDevOpsCybersecurityProduct ManagementJiraSupply ChainIntellectual PropertyCommunicationCollaborationBitbucketArgo CDBurp Suite
Stay score
odds of building a lasting career here
61Sponsors, lottery-bound
Cap-exempt (no lottery)0
Sponsors this role90
Entry-level history0
PERM / green-card track0
Lottery odds (Level IV)94
Fits your clock70
Sponsors, but it's cap-subject — you still face the weighted lottery (~61% per draw at Level IV). Good if you win; have a cap-exempt backup on your list.
Lottery odds assume a STEM candidate.
Personalize to your clock →Employer immigration record
from this employer's Department of Labor filings
Files H-1B transfers
13 transfer filings in the last year, covering 13 workers. Median labor-condition decision: 7 days. An employer that already files transfers is one that can take over an existing H-1B.
Sourced from Department of Labor LCA, PERM and prevailing-wage disclosure data. Employer matching is by name, so figures may be split across an employer's legal entities. Absence of a filing means none appears in our copy of the data, not that none exists.
Community outcomes
No reports yet — be the first to help the next applicant.
About the role
- The AppSec / DevSecOps Engineer will help strengthen application and software supply chain security across a global semiconductor organization.
- The successful candidate will combine application security expertise with practical DevSecOps engineering, automation, risk-based assessment, and strong collaboration with development and technology teams.
- The Application Security and DevSecOps team helps protect the company's software, engineering platforms, cloud services, intellectual property, and business applications by embedding security throughout the development lifecycle.
Responsibilities
- Define and maintain secure software development lifecycle standards, procedures, control requirements, and developer guidance.
- Embed security requirements across planning, architecture, design, coding, testing, release, deployment, and operations.
- Develop security gates based on application risk, data sensitivity, business criticality, and deployment model.
- Support secure architecture reviews, threat modeling, security requirements definition, and go-live risk assessments.
- Implement and operate SAST, DAST, software composition analysis, secrets detection, container scanning, API security, and infrastructure-as-code scanning.
Requirements
- Bachelor's degree in Computer Science, Cybersecurity, Information Technology, Engineering, Information Systems, or a related technical discipline
- 6+ years of professional experience in AppSec, DevSecOps, secure SDLC, cloud security, cybersecurity engineering, software security, or a related discipline.
- Hands-on experience with secure SDLC, application security, secure-by-design, or DevSecOps activities.
- Experience with CI/CD or modern software engineering environments.
- Experience with at least three of the following: SAST, DAST, SCA, secrets scanning, IaC scanning, container security, API security, threat modeling, or vulnerability management.
- Experience translating cybersecurity policies, standards, or control requirements into technical controls, engineering requirements, security procedures, or SDLC workflows.
- Experience with at least one cloud or cloud-native environment, including Microsoft Azure, AWS, Kubernetes, or container-based application environments.
- Experience using engineering, security workflow, or automation platforms such as Azure DevOps, GitHub, GitLab, Jenkins, Jira, or ServiceNow.
- We use artificial intelligence to screen, assess, or select applicants for the position. Applicants must be eligible for any required U.S. export authorizations.
- Applicants must be eligible for any required U.S. export authorizations.
- Bachelor's degree in Computer Science, Cybersecurity, Information Technology, Engineering, Information Systems, or a related technical discipline; equivalent experience may be considered.
- Ability to conduct or support application security assessments and communicate findings to technical and nontechnical stakeholders.
- Strong written and verbal communication skills, attention to detail, and ability to manage multiple priorities.
- Ability to work independently and collaborate effectively across geographically distributed teams.
Nice to have
- Experience supporting complex global, high-technology, regulated, or intellectual-property-intensive organizations.
- Experience securing enterprise applications, developer platforms, cloud services, source code repositories, business-critical systems, product lifecycle platforms, or intellectual property systems.
- Experience with Checkmarx, Fortify, Veracode, Semgrep, GitHub Advanced Security, CodeQL, SonarQube, Snyk, Mend, Black Duck, or comparable tools.
- Experience with Burp Suite, OWASP ZAP, Invicti, or comparable DAST and API security tools.
- Experience securing containers, Kubernetes, serverless applications, APIs, and infrastructure-as-code.
- Experience with Azure DevOps, GitHub Actions, GitLab CI/CD, Jenkins, Bitbucket, Argo CD, or comparable platforms.
- Familiarity with OWASP Top 10, OWASP ASVS, OWASP SAMM, NIST SSDF, BSIMM, SLSA, CIS Controls, or similar frameworks.
- Experience with SBOM, software provenance, artifact integrity, code signing, PKI, HSM, or dependency governance.
Compensation
- The pay range below is for Bay Area California only.
- Actual salary may vary based on a number of factors including job location, job-related knowledge, skills, experiences, trainings, etc.
- We also offer incentive opportunities that reward employees based on individual and company performance.
- $149,100 - $215,925 USD
Benefits
- Measure improvements in secure SDLC adoption, remediation timeliness, control coverage, and recurring vulnerability reduction.
- Monitor tool health, scan coverage, pipeline failures, vulnerability backlogs, critical findings, and remediation performance.
Company info
- The team works across product, application development, IT, cloud, infrastructure, supply chain, corporate technology, and other business functions to improve secure development practices, automate security controls, and reduce application and software supply chain risk.
This listing is sourced directly from Altera's careers page and normalized into a canonical job model.