About the company
This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a DevSecOps Engineer based in the United States.
Responsibilities
- Embed Guardrails-as-Code and automated security controls across CI/CD pipelines, including SAST, DAST, SBOM generation, vulnerability scanning, and policy gates.
- Manage secrets, cryptographic code signing, artifact integrity, hardened container images, and automated configuration drift detection.
- Triage, track, and remediate security vulnerabilities within defined deadlines, ensuring critical and high-risk findings are addressed before production.
- Automate security evidence collection to support Continuous Assessment and Authorization (ATO), NIST RMF activities, and VA/FedRAMP compliance.
- Implement Zero Trust principles, identity and access controls, logging, encryption, network segmentation, and cloud security measures across AWS, Azure, and VA Enterprise Cloud environments.
- Mentor development teams on secure coding and security design practices, including the review and validation of AI-generated code and test scripts.
- Support security incident response through component isolation, forensic activities, rapid reporting, and after-hours escalation rotations.
- Contribute to DevSecOps strategies for proposals, security performance metrics, technical interviews, reusable pipeline security templates, cybersecurity communities, and corporate quality initiatives.
Requirements
- 7+ years of experience in IT security or DevSecOps, including at least 4 years integrating continuous security controls into CI/CD pipelines within federal Agile/SAFe environments.
- 3+ years of hands-on experience with pipeline security automation, including SAST/DAST, container scanning, secrets management, and SBOM generation using standards such as SPDX or CycloneDX.
- Strong experience automating infrastructure hardening and configuration compliance with tools such as Ansible and Terraform against DISA STIG and CIS benchmarks.
- Proven knowledge of NIST Risk Management Framework (RMF), Authority to Operate (ATO) processes, POA&Ms, and automated continuous control evidence collection.
- Extensive experience securing AWS, Azure, and VA Enterprise Cloud environments, including IAM, encryption, network segmentation, and related cloud security controls.
- Strong vulnerability management experience, with the ability to partner directly with development teams to investigate, prioritize, and resolve findings.
- Experience with security monitoring and logging platforms such as Splunk, as well as identity and access technologies including HashiCorp Vault, mutual TLS, ICAM, and PIV.
- Ability to support secure development across Java, .NET, Python, and legacy MUMPS environments, with experience embedding automated Section 508 accessibility testing into pipelines.
- Experience with VA supply chain systems, HL7/FHIR healthcare APIs, one-hour incident response requirements, or AI-generated code validation is highly preferred.
- Bachelor's degree in Cybersecurity, Computer Science, Computer Engineering, Information Systems, or a related field; a master's degree is preferred.
- Required certification: ISC2 CISSP or Security+. Additional preferred certifications include AWS Solutions Architect Associate, AWS Developer Associate, Azure Solutions Architect, Azure Developer Associate, Red Hat Certified Specialist in Ansible Automation, or Red Hat Certified Architect.
- Ability to obtain a Tier 2 / Moderate Risk Background Investigation and VA PIV credential.
Conditions
- Suggested salary range of $161,000–$176,000, with actual compensation based on skills, qualifications, experience, and location.
- Certain positions may be eligible for additional compensation, including bonuses.
- Comprehensive healthcare benefits above industry standards.
- Remote working options for eligible employees.
- Paid time off and paid holidays.
- 401(k) matching.
- Healthcare Savings Account and Flexible Spending Account options.
- Paid life insurance and short- and long-term disability coverage.
- Training, professional development, and certification opportunities.
- Tuition reimbursement and Employee Assistance Program.
- Military leave and additional employee benefits.
- Remote position within the continental United States, with the option to work from Rockville, Maryland.
- Up to 10% travel.
- Opportunities to work on mission-driven federal technology initiatives while developing long-term career and technical expertise.