Sr. DevSecOps Engineer

Active Secret Clearance Bachelor’s degree in Computer Science, Engineering, or related field is preferred. IAT Level II baseline certification required (Security+ or allowed substitution). Strong DevOps/DevSecOps engineering experience for DoD programs. Strong expertise with CI/CD tools such as GitLab CI, Jenkins, Azure DevOps, or GitHub Actions. Hands-on experience with AWS and Azure Government Cloud, including IAM, networking, and automation. Proficiency with containerization and orchestration (Kubernetes, OpenShift, Docker). Knowledge of DoD cybersecurity frameworks, RMF, DISA STIGs, etc. Hands-on experience with Infrastructure as Code (Terraform, Ansible, Helm). Proficiency in automation and scripting languages (Python, Bash, PowerShell). Familiarity with integration tools such as MuleSoft in a DevSecOps pipeline highly desired. Excellent written and oral communication skills.

Lead the design, implementation, and optimization of secure DevSecOps pipelines in support of DoD applications and systems. Assess the landscape of DevSecOps tools, propose best practices, suggest alternatives, and identify gaps. Integrate and deploy DevOps tools and practices in accordance with NIST 800-53 and DoD DevSecOps policies. Develop and manage CI/CD pipelines using AWS and Azure DevOps. Configure AWS IAM roles, CodePipeline, and CodeDeploy for cross-account deployments. Integrate security tools (SonarQube, OWASP ZAP, Nexus, Sonatype IQ) into DevOps pipelines. Conduct cost-benefit analysis and provide tool recommendations for security and DevOps. Collaborate within an Agile SAFe framework, participating in PI planning sessions and aligning DevOps efforts with strategic goals. Develop Python scripts to review ZAP findings and break automation if critical vulnerabilities are detected with web-hosted applications. Provide technical leadership and act as a point of contact between the larger team and the customer. Support Authority to Operate (ATO) processes through automated compliance checks, vulnerability remediation, and continuous monitoring.