Senior DevSecOps Engineer
Confirmed on the employer's own hiring board on Oct 29, 2026. First seen by Alion on Aug 25, 2026. Frame Payments scores D on the Alion truth index.
Frame is a compliance infrastructure company powering payments for complex, highly regulated industries. We enable businesses to move money with confidence by embedding compliance and payments into a single, intelligent platform. Our ambition is to become the infrastructure layer that regulated businesses rely on to operate, scale, and access services globally. How we build matters as much as what we build. Our values shape: how we work, make decisions, and support our merchants. We're headquartered in Los Angeles with a globally distributed team. We're committed to running an inclusive and accessible hiring process; if you need any adjustments along the way, let us know. Let's solve problems together.
The Role
We are hiring a Senior DevSecOps Engineer to own the infrastructure that runs FrameOS and the security posture that protects it.
This is a new shape of role for us. As Frame scales, we are formalizing and expanding our dedicated Security and Infrastructure Engineering function to support our next stage of growth. Our merchant base sits in verticals that draw more fraud pressure and more regulatory attention than most companies our size will ever see.
You will own the systems that keep Frame fast and reliable, and you will own the controls that keep Frame defensible. Payment infrastructure has no room for surprises. Neither do we.
Responsibilities
Own cloud infrastructure across AWS and Cloudflare, including provisioning, scaling, and cost management.
Build CI/CD pipelines that make deployment fast, predictable, and safe.
Enable engineering org with observability tooling and access to a reliable and robust metrics stack including: logging, tracing, alerting, and the on-call workflows that respond to it.
Operate Kubernetes or equivalent container orchestration at scale.
Own Frame's cloud security posture end to end: IAM and least privilege, account structure, network segmentation, encryption at rest and in transit, and separation of environments.
Design and optimize detection engineering pipelines and incident response workflows to ensure low-noise, actionable security alerting.
Lead security incident response, including the writeup and the follow through.
Keep Frame up-to-date on compliance and coverage for OWASP identified threats and vulnerabilities identified from other key security organizations and communities.
Translate SOC 2 and PCI DSS control requirements into automated technical controls, so evidence is a byproduct of how we operate.
Serve as the technical subject matter expert behind our compliance team, answering the engineering-level questions that come out of audits, sponsor bank reviews, and partner security questionnaires.
Report security posture and control maturity to engineering leadership on a regular cadence.
Infrastructure and reliability
Security
Compliance engineering
You will not be our compliance department. Our compliance team owns the audit relationship, policy, and the control narrative. You own making the controls real.
About You
- 5+ years of DevOps, infrastructure, or cloud security engineering experience.
Deep AWS experience, including VPC, IAM, RDS, EC2, ECR, EKS, KMS, and other core AWS services.
Proficiency with infrastructure-as-code tools like Terraform, Pulumi, or CDK, and a willingness to ship your own remediation rather than file tickets for someone else.
Container and orchestration security experience: image scanning, runtime hardening, admission controls.
Hands-on experience with baseline pipeline security (SCA, secrets scanning, static analysis) and familiarity with broader AppSec concepts (DAST, policy-as-code, penetration testing).
Strong scripting in Python, Ruby, or Go and enough fluency in our stack to review code and open pull requests, not just read scanner output.
Mindset of enabling the rest of the team. We want to build a security, ops, and observability posture that is defined,hardened, and then shared and maintained by the team. Help the team help themselves. You’re still the owner of dev ops and security, but other people in eng should eventually know how to interact and use tools and processes relevant to their jobs.
Experience in fintech, payments, or a regulated infrastructure environment is a strong plus, as is experience standing up a security function as the first dedicated hire. Familiarity with tokenization or vaulting architectures, detection engineering, or a sponsor bank model is also valued.
You Are Someone Who
Treats reliability and security as features, not backstops. You build infrastructure that other engineers can rely on without thinking about it, and you fix root causes rather than patching symptoms. You move quickly when systems are on fire, and methodically when they aren't. You can sequence work by real risk when you cannot do everything at once, and explain that sequencing to a founder, an auditor, and a bank partner in three different registers.