DevSecOps Engineer

Responsibilities and Duties:

• Design, implement, and maintain secure DevSecOps pipelines that integrate security throughout the Software Development Lifecycle (SDLC).
• Lead the implementation of security controls and automation solutions supporting Digital Solution Development, Automation, and Infrastructure Support initiatives.
• Develop and maintain Continuous Integration/Continuous Delivery (CI/CD) pipelines to support rapid and secure software delivery.
• Integrate automated security testing tools, including Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Software Composition Analysis (SCA), and container security scanning.
• Collaborate with application developers, architects, cybersecurity personnel, and infrastructure teams to embed security requirements into system designs and development processes.
• Establish and enforce secure coding practices, vulnerability management procedures, and DevSecOps best practices.
• Support cloud security architecture and automation efforts across cloud-hosted and hybrid environments.
• Design and implement Infrastructure as Code (IaC) solutions using modern automation tools and frameworks.
• Conduct security assessments, code reviews, architecture reviews, and risk analyses for applications and infrastructure platforms.
• Monitor, analyze, and remediate security vulnerabilities identified through automated scanning and assessment tools.
• Develop and maintain security baselines, secure configuration standards, and deployment templates.
• Support containerization and orchestration technologies, including security hardening and compliance monitoring activities.
• Lead security-related technical projects and provide technical guidance to project teams and stakeholders.
• Collaborate with system administrators, network engineers, and developers to ensure secure deployment and operation of enterprise systems.
• Support Authority to Operate (ATO), FISMA, NIST, FedRAMP, and other compliance-related activities as applicable.
• Develop security automation capabilities to improve detection, response, monitoring, and reporting functions.
• Participate in incident response, root cause analysis, and corrective action planning activities.
• Mentor junior engineers and provide technical leadership on information security initiatives.
• Create and maintain technical documentation, architecture diagrams, operational procedures, and security implementation guides.
• Evaluate emerging DevSecOps, cloud, and security technologies and recommend improvements to organizational security posture.
• Support enterprise modernization, automation, and digital transformation initiatives by ensuring security is integrated from design through deployment.
• Develop security metrics, dashboards, and reports to communicate program health, risk posture, and compliance status to leadership.

Basic Qualifications

• Bachelor’s Degree in Computer Science, Information Technology, Cybersecurity, Computer Engineering, or a related field.
• Minimum of eight (8) years of progressive experience in information security, cybersecurity engineering, or related disciplines. Minimum of two (2) years of experience providing technical leadership for information security projects.

• Experience supporting DoD information systems and Security Technical Implementation Guide (STIG) compliance programs.
• Develop and maintain automation scripts and Infrastructure as Code (IaC) templates to enforce STIG-compliant configurations across enterprise environments.
• Experience implementing DevSecOps practices within Agile, DevSecOps, or CI/CD environments.
• Experience with security automation tools, vulnerability management platforms, and secure software development methodologies.
• Knowledge of secure coding standards, application security principles, and security testing methodologies.
• Experience with CI/CD platforms such as Azure DevOps, Jenkins, GitLab, GitHub Actions, or similar technologies.
• Experience supporting cloud environments, including Microsoft Azure, AWS, or Google Cloud Platform (GCP).
• Familiarity with Infrastructure as Code (IaC) technologies such as Terraform, Ansible, CloudFormation, or ARM Templates.
• Knowledge of containerization and orchestration technologies such as Docker, Kubernetes, and OpenShift.
• Strong understanding of NIST Cybersecurity Framework, NIST 800-53, RMF, FISMA, and related federal security standards.
• Experience identifying, assessing, and mitigating application and infrastructure security risks.
• Strong analytical, troubleshooting, and problem-solving skills.
• Excellent written, verbal, and presentation communication skills.
• Ability to work effectively across multidisciplinary technical and business teams.
• U.S. Citizen, and ability to get the clearance.

 Preferred Qualifications

• Experience supporting Department of Homeland Security (DHS) and/or Cybersecurity and Infrastructure Security Agency (CISA) programs.
• Experience designing and implementing Zero Trust architectures and modern cloud security solutions.
• Knowledge of Infrastructure Automation, Platform Engineering, and Site Reliability Engineering (SRE) practices.
• Experience supporting FedRAMP, Continuous Diagnostics and Mitigation (CDM), or enterprise cybersecurity programs.
• Hands-on experience with SIEM, SOAR, and security monitoring technologies.
• Relevant certifications such as CISSP, CCSP, AWS Security Specialty, Azure Security Engineer Associate, GIAC certifications, Certified DevSecOps Professional, Security+, or equivalent.
• Experience supporting enterprise modernization, application transformation, and infrastructure automation programs.