{"id":4205129,"url":"https://alion.io/job/altera-software-security-devsecops-architect","title":"Software Security / DevSecOps Architect","company":{"id":5328,"name":"Altera","domain":"altera.com","url":"https://alion.io/company/altera","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":84,"open_postings":15,"ghost_share":0,"stale_share":0.6,"repost_share":0.067,"time_to_fill_p50_days":54,"computed_at":"2026-11-12T10:38:37Z"}},"role":"Security","role_family":"Security","seniority":"staff","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["San Jose, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":166900,"max":241700,"currency":"USD","period":"year","gross":null,"usd_annual":241700},"salary_estimate":null,"experience_years_min":10,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"C#","optional":false},{"name":"C++","optional":false},{"name":"CI/CD","optional":false},{"name":"Go","optional":false},{"name":"JavaScript","optional":false},{"name":"OWASP","optional":false},{"name":"Python","optional":false},{"name":"SLSA","optional":false},{"name":"Threat Modeling","optional":false},{"name":"TypeScript","optional":false},{"name":"AWS","optional":true},{"name":"Azure","optional":true},{"name":"ISO 27001","optional":true},{"name":"Kubernetes","optional":true},{"name":"NIST CSF","optional":true},{"name":"OWASP ASVS","optional":true},{"name":"OWASP SAMM","optional":true},{"name":"OWASP Top 10","optional":true},{"name":"PCI DSS","optional":true},{"name":"Platform Engineering","optional":true},{"name":"SBOM","optional":true},{"name":"SOC 2","optional":true}],"status":"live","first_seen_at":"2026-11-12T23:26:20Z","employer_posted_date":"2026-11-12","last_verified_at":"2026-11-12T23:26:20Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"Job Details:\nJob Description:\nAbout the Role\nThe Software Security, and DevSecOps Architect is a senior technical lead responsible for defining and advancing the organization’s software security strategy from design through deployment and operation. This role establishes secure-by-design architecture, strengthens application and product security practices, and enables engineering teams to integrate effective security controls into modern development and delivery workflows.\nThe architect partners with product, engineering, cloud, infrastructure, security operations, compliance, and leadership teams to reduce software risk without slowing innovation. The role combines strategic influence with hands-on technical leadership, including security architecture reviews, threat modeling, tooling strategy, reference architectures, secure engineering standards, and risk-based remediation.\nKey Responsibilities\nSecurity Architecture and Strategy\nDefine and maintain the enterprise software, application, product, and DevSecOps security architecture.\nEstablish security principles, reference architectures, design patterns, and minimum security requirements for applications, services, APIs, platforms, devices, and products.\nTranslate business, customer, regulatory, and threat requirements into practical security controls and engineering standards.\nDevelop multi-year roadmaps for improving software security maturity, automation, developer enablement, and risk reduction.\nEvaluate emerging technologies, frameworks, cloud services, AI-enabled development tools, and architectural patterns for security implications.\nServe as a trusted security advisor to engineering and product leadership.\nProduct and Application Security\nEmbed security throughout the product development lifecycle, from requirements and design to release, maintenance, and end-of-life.\nLead or guide threat modeling, attack-surface analysis, abuse-case analysis, architecture reviews, and security requirements definition.\nEstablish risk-based application security testing strategies covering static analysis, dynamic analysis, software composition analysis, API testing, secrets detection, container security, infrastructure-as-code scanning, and penetration testing.\nDefine security gates and release criteria appropriate to application criticality, data sensitivity, exposure, and business risk.\nOversee vulnerability discovery, triage, prioritization, remediation, exception handling, and verification for software security findings.\nPartner with product teams to improve secure defaults, identity and access controls, cryptography, data protection, logging, resilience, and privacy safeguards.\nSupport security assessments for externally developed software, open-source components, third-party integrations, and acquired products.\nSoftware Supply Chain Security\nDefine controls for source code, build systems, artifact repositories, package management, release processes, and deployment pipelines.\nImprove software supply chain integrity through provenance, artifact signing, dependency governance, reproducible builds, access controls, and tamper detection.\nEstablish practices aligned to recognized frameworks and standards such as SSDF, SLSA, OWASP, NIST, and applicable regulatory requirements.\nGuide the secure use, review, approval, and monitoring of open-source software and third-party components.\nDevelop strategies for managing dependency vulnerabilities, end-of-life technologies, malicious packages, compromised credentials, and build-environment threats.\nDevSecOps Enablement\nDesign and implement scalable security capabilities within CI/CD and developer workflows.\nIntegrate security tools into source control, pull requests, build pipelines, registries, deployment platforms, and production feedback loops.\nEstablish developer-friendly security patterns, guardrails, self-service workflows, and actionable feedback mechanisms.\nReduce false positives and security friction through policy tuning, automation, risk-based prioritization, and clear remediation guidance.\nDefine security-as-code approaches for infrastructure, cloud configurations, policies, pipeline controls, and compliance evidence.\nBuild reusable templates, libraries, controls, and platform capabilities that make the secure path the easiest path.\nGovernance, Risk, and Assurance\nMaintain software security policies, standards, procedures, and exception processes.\nProvide technical input to enterprise risk assessments, customer security reviews, audits, regulatory inquiries, and product assurance activities.\nDefine measurable security objectives, key risk indicators, and program health metrics.\nPrepare clear risk narratives and recommendations for technical and executive audiences.\nPartner with incident response and security operations teams to investigate and contain software-related security incidents.\nEnsure security architecture decisions and risk acceptances are documented, traceable, and periodically reviewed.\nLeadership and Collaboration\nMentor security engineers, application security specialists, architects, developers, and DevOps engineers.\nEstablish communities of practice and champion secure engineering across the organization.\nFacilitate architecture and design reviews with multiple stakeholders and competing priorities.\nInfluence without direct authority and communicate complex security topics in clear, business-oriented language.\nRepresent software security in architecture councils, engineering planning, product reviews, and strategic technology initiatives.\nCore Competencies\nSecure-by-design architecture\nProduct and application security\nThreat modeling and attack-surface management\nSoftware supply chain security\nCloud and container security\nCI/CD and DevSecOps engineering\nSecurity automation and policy-as-code\nVulnerability and risk management\nSecure coding and developer enablement\nTechnical leadership and influence\nStrategic planning and execution\nExecutive communication and decision support\nSuccess Measures\nSuccess in this role may be measured by:\nIncreased adoption of secure architecture patterns and threat modeling across critical products and services.\nImproved coverage, quality, and risk-based effectiveness of application security testing.\nReduced time to identify, prioritize, remediate, and verify software vulnerabilities.\nIncreased security automation and reduced manual effort in development and delivery workflows.\nImproved software supply chain integrity, dependency governance, and build-environment security.\nHigher developer engagement with security guidance, training, tooling, and self-service capabilities.\nReduced recurrence of security defects and improved security outcomes for products and applications.\nStrong audit, customer assurance, and regulatory outcomes supported by reliable evidence and traceability.\nWorking Relationships\nThis role works closely with:\n· Product management and product engineering\n· Software development and platform engineering\n· Cloud, infrastructure, and DevOps teams\n· Security operations, incident response, and vulnerability management\n· Enterprise architecture and technology governance\n· Privacy, legal, compliance, and internal audit\n· Customer assurance and technical account teams\n· Executive and business leadership\nSalary Range\nThe pay range below is for Bay Area California only. Actual salary may vary based on a number of factors including job location, job-related knowledge, skills, experiences, trainings, etc. We also offer incentive opportunities that reward employees based on individual and company performance.\n$166,900 - $241,700 USD\nWe use artificial intelligence to screen, assess, or select applicants for the position. Applicants must be eligible for any required U.S. export authorizations.\nQualifications:\nMinimum Qualifications\nBachelor’s degree in computer science, cybersecurity, software engineering, information systems, or a related field; equivalent practical experience may be considered.\n10 or more years of experience in cybersecurity, software engineering, application security, product security, cloud security, DevOps, or a related discipline.\n5 or more years of experience designing or leading software security, application security, product security, or DevSecOps programs.\nDemonstrated experience designing secure architectures for distributed applications, APIs, cloud services, microservices, platforms, or embedded and connected products.\nStrong understanding of software development and delivery practices, including source control, branching, code review, build systems, CI/CD, artifact management, deployment, and observability.\nPractical experience with threat modeling, secure design reviews, vulnerability management, security testing, and remediation programs.\nStrong understanding of identity and access management, authentication, authorization, secrets management, cryptography, data protection, logging, and secure communications.\nExperience with at least one major cloud platform and modern container or orchestration technologies.\nAbility to read and review code in one or more languages such as Java, Python, Go, JavaScript/TypeScript, C#, C/C++, or similar.\nExperience evaluating, integrating, governing, and operating application or cloud security tools.\nPreferred Qualifications\nMaster’s degree in cybersecurity, computer science, or a related field.\nProfessional certifications such as CISSP, CSSLP, SABSA, CCSP, OSCP, GIAC, AWS Security Specialty, Azure Security Engineer, or equivalent.\nExperience with product security for hardware, firmware, IoT, industrial, automotive, medical, or other connected systems.\nExperience implementing software supply chain security, SBOM programs, artifact signing, provenance, or SLSA-aligned controls.\nExperience with policy-as-code, infrastructure-as-code, cloud-native security, Kubernetes security, or platform engineering.\nExperience with security standards and frameworks including NIST CSF, NIST SSDF, OWASP ASVS, OWASP SAMM, OWASP Top 10, CIS Controls, ISO 27001, SOC 2, PCI DSS, IEC 62443, or relevant industry requirements.\nExperience building security developer education, champions, enablement, or secure coding programs.\nExperience supporting incident response involving compromised applications, packages, pipelines, credentials, or production services.\nExperience incorporating privacy, resilience, and responsible AI considerations into software architecture.\nJob Type:\nRegularShift:\nShift 1 (United States of America)Primary Location:\nSan Jose, California, United StatesAdditional Locations:\nPosting Statement:\nAll qualified applicants will receive consideration for employment without regard to race, color, religion, religious creed, sex, national origin, ancestry, age, physical or mental disability, medical condition, genetic information, military and veteran status, marital status, pregnancy, gender, gender expression, gender identity, sexual orientation, or any other characteristic protected by local law, regulation, or ordinance.","description_format":"text","description_chars":11023,"description_truncated":false,"requirements":{"experience_years_min":10,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","DevSecOps","Processors, MCUs & AI Chips","EDA Software"],"lifecycle":[{"event":"open","at":"2026-11-12T23:26:20Z"}],"visa":[{"country":"US","licensed_sponsor":true,"adverts_offering_sponsorship_24m":0,"sanctioned_now":false,"evidence":"H-1B filings in 12 months: 71","filings_12m":71,"filings_prev_12m":39,"green_card_filings_12m":0,"median_offered_wage_usd":157500,"route":null,"cap_exempt":false,"checked_at":"2026-11-12T07:36:15+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)"],"filings_for_role_12m":1}],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":54,"reasons":["conf:1","win:early","comp:brand"],"computed_at":"2026-11-13T01:05:02Z"},"pay":{"stated_usd_annual":241700,"is_top_pay":true},"html_url":"https://alion.io/job/altera-software-security-devsecops-architect","json_url":"https://alion.io/job/altera-software-security-devsecops-architect.json","meta":{"generated_at":"2026-11-13T01:05:02Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":2398,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-14T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":5328},"rest":"https://alion.io/mcp/rest/get_company?id=5328"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Faltera-software-security-devsecops-architect"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"free","price":{"credits":0,"usd":0},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Faltera-software-security-devsecops-architect"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Faltera-software-security-devsecops-architect"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/altera-software-security-devsecops-architect\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Faltera-software-security-devsecops-architect"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4205129}},{"tool":"search_jobs","arguments":{"company":"altera.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4205129},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}