DevSecOps Engineer

Role overview Embed application security practices throughout the software development lifecycle, helping teams identify and reduce risk as they design, build, test, and release software. The role combines hands-on security review and testing with vulnerability coordination, incident support, and day-to-day Agile team planning.

Responsibilities - Review application designs and architectures, identify security risks, and recommend safer implementation patterns. - Conduct manual and automated code reviews and help developers address identified weaknesses. - Integrate and maintain application security testing in CI/CD workflows, including static, dynamic, and dependency analysis. - Triage and track vulnerabilities, prioritize remediation, and coordinate fixes with development teams. - Support application security incident investigations and remediation, and report risk status in program reviews. - Help teams apply secure coding practices, align security work with release plans, and support scrum and sprint planning.

Requirements - At least five years of hands-on application security experience in a software development environment. - Bachelor’s degree in cybersecurity, computer science, or a related field, or equivalent experience; additional experience may substitute for the degree. - Experience integrating security into CI/CD pipelines and managing vulnerabilities through remediation. - Understanding of secure software development lifecycle practices and experience supporting security incident response. - Ability to communicate risks and recommendations clearly and work across development, architecture, and operations teams. - Experience working in an Agile DevSecOps team and U.S. citizenship.

Nice to have - Secure code review experience, familiarity with common web application vulnerabilities, and experience with SAST, DAST, or software composition analysis tools. - Threat modeling or secure architecture knowledge, and experience with container or cloud security. - Experience in federal or regulated environments, or with risk-based vulnerability prioritization and release gates.