DevSecOps Engineer

Honeycomb Insurance

At Honeycomb, we're not just building technology; we’re reshaping the future of insurance. 

In 2025, Honeycomb was recognized by Dun & Bradstreet as “Top 10 Best Start Up Companies to Work For” in Israel, named by LinkedIn as “Top 10 Startups in Chicago”, and Newsweek’s "Greatest Startup Workplaces in America, 2025". Through the first half of 2026 we’ve been recognized on Inc. Magazine’s "Best Workplaces" List and Forbes "Fintech 50".

How did we earn these honors?

Honeycomb is a rapidly growing global startup, generously backed by top-tier investors and powered by an exceptional team of thinkers, builders, and problem-solvers. Dual-headquartered in Chicago and Tel Aviv (R&D center), and with 6 offices across the U.S., we are reinventing the commercial real estate insurance industry, an industry long overdue for disruption. Just as importantly, we ensure every employee feels deeply connected to our mission and one another.

With over $100B in insured assets, Honeycomb operates across 23 states, covering more than 65% of the U.S. population and increasing its coverage.

If you’re looking for a place where innovation is celebrated, culture actually means something, and smart people challenge you to be better every day - Honeycomb might be exactly what you’ve been looking for.

About the Role We are looking for a hands-on DevSecOps Engineer to strengthen the security of Honeycomb's cloud-native
environment, working closely with our Security, Engineering, DevOps, and AI teams. The role centers on Google
Cloud Platform (GCP), Kubernetes, vulnerability management, container and CI/CD security, cloud security
posture, and AI security. You will identify and remediate security risks across our infrastructure, applications,
pipelines, and AI environments, while building automation and controls that let our teams move quickly and
securely.

Responsibilities

● Identify, prioritize, and drive remediation of security vulnerabilities (CVEs) across container images,
application dependencies, Kubernetes workloads, and GCP infrastructure, in partnership with
Engineering, DevOps, and AI teams.
● Secure our GCP and Kubernetes environments: IAM, networking, logging, cluster and workload
hardening, RBAC, secrets, and network policies.
● Own container security practices, including image scanning, base image management, secrets
management, and runtime security.
● Operate SAST, SCA, and CSPM tools to surface code, dependency, and cloud misconfiguration risks, and
help teams remediate findings.
● Partner with the AI team to secure AI applications, models, agents, APIs, and development
environments, including access controls, data protection, and monitoring of both internal and third-
party AI tools.
● Implement automated security gates and policy enforcement throughout CI/CD pipelines and the SDLC,
without slowing development.
● Establish and improve vulnerability management processes: risk-based prioritization, remediation SLAs,
exception management, and reporting.
● Automate security and operational tasks with Bash, Python, or similar.
● Support security monitoring and incident response across cloud infrastructure, applications, and AI
workloads.
● Promote DevSecOps best practices and help build a security-first engineering culture. 

Requirements
● Proven experience as a DevSecOps Engineer, or DevOps Engineer with a strong security focus.
● Hands-on experience with GCP security and running Kubernetes in production.

● Hands-on experience managing CVEs, vulnerability remediation, patching, and risk-based prioritization.
● Strong Linux skills, including hardening, troubleshooting, networking, and logs.
● Experience with container security and CI/CD security, including integrating scanning and controls into
pipelines.
● Experience with SAST/SCA tools (e.g., Semgrep, Snyk, SonarQube) and CSPM platforms (e.g., Wiz, Prisma
Cloud, CrowdStrike Falcon Cloud Security).
● Solid scripting in Bash and/or Python.
● Ability to work hands-on with engineering and AI/ML teams to investigate and remediate security issues.
● Fluent English, written and verbal. 

Advantages
● Experience securing GKE at scale, including Google Cloud IAM, Workload Identity, and VPC networking.
● Infrastructure as Code and GitOps tools such as Terraform, Helm, or ArgoCD.
● Software supply-chain security (SBOM, dependency management) and Kubernetes policy tools
(admission controllers, Pod Security Standards, policy-as-code).
● Familiarity with CIS Benchmarks, OWASP, NIST, or ISO 27001.
● Experience with SIEM, cloud detection, and incident response.
● Background in fintech, insurance, or other regulated environments.