Description
DevSecOps Engineer
Location: Herndon, VA (Hybrid Work)
This position supports a U.S. Federal Government project. U.S. citizenship is required to meet the project’s eligibility and security clearance requirements.
Experience: 3+yrs & 8 yrs
The DevSecOps Engineer is the architect and guardian of DevSecOps, Test Automation, and Security Automation. This role ensures the operational efficiency and continuous improvement of these solutions, embedding security and quality into every stage of the software delivery lifecycle. The engineer builds comprehensive CI/CD pipelines that carry code from source to production while ensuring compliance with applicable security, credentialing, and privacy policies, and integrates those pipelines with CMDB, reporting, and monitoring systems to support configuration management, asset management, governance, and performance and compliance tracking.
Key Responsibilities
DevSecOps Architecture and Pipeline Engineering
- Design, build, and maintain end-to-end CI/CD pipelines that move code from source control to production in a reliable and repeatable way.
- Build, package, and deploy applications on AWS (container, serverless, and VM-based workloads) through automated pipelines, with controlled promotion across dev, test, staging, and production, blue/green or canary releases, and automated rollback.
- Define and maintain pipeline standards, templates, and infrastructure-as-code patterns for reuse across teams.
- Continuously refine pipelines to improve speed, reliability, and efficiency.
- Establish and maintain comprehensive automated testing within pipelines, including unit, integration, functional, regression, and performance tests.
- Integrate automated security controls into pipelines, such as SAST, DAST, SCA, secrets detection, container and image scanning, and IaC scanning.
- Ensure all pipelines and deployed solutions comply with applicable security, credentialing, and privacy policies.
- Partner with security, privacy, and compliance stakeholders to translate policy requirements into automated controls.
- Build dashboards and metrics (e.g., deployment frequency, lead time, change failure rate, mean time to remediate vulnerabilities) for leadership and governance bodies.
- Coach development and operations teams on secure coding, pipeline use, and automation best practices.
Requirements
Required Qualifications
- Bachelor's degree in Computer Science, Information Security, Engineering, or a related field, or equivalent experience.
- Experience operating high volume and large scale applications with cloud-native security in AWS
- Hands on experience in DevOps, DevSecOps, or security engineering roles.
- Hands-on experience building and managing CI/CD pipelines (Jenkins, Harness)
- Experience with infrastructure as code and containerization/orchestration (Kubernetes, Docker)
- Experience integrating security tooling into pipelines (Sonarqube, OWASP, Checkmarx etc)
- Experience with CMDB and asset management tools (e.g., ServiceNow) and with monitoring and observability platforms (e.g., Splunk, Prometheus, Grafana).
- Strong communication skills and the ability to work across technical and non-technical stakeholders.
Preferred Qualifications
- Familiarity with security and privacy frameworks and regulations (e.g., NIST 800-53, FedRAMP, FISMA, Privacy Act).
- Experience with policy-as-code (e.g., OPA) and software supply chain security (SBOMs, artifact signing).
Benefits
- Medical
- Dental
- Vision
- Basic Life
- Health Saving Account
- 401K Matching
- Three weeks of PTO/Sick
- 11 Paid Holidays
- Pre-Approved Online Training
