DevSecOps Engineer II

ATTAINX INC•Herndon, VA

6d•$104,000 - $107,000•Hybrid

About The Position

AttainX is seeking a DevSecOps Engineer II to integrate security practices throughout the DevOps lifecycle for CISA’s DocuSign implementation and integrations, ensuring secure deployment of high-quality IT infrastructure. This role works independently and collaboratively, contributes to moderately complex project activities, and applies secure automation, Infrastructure as Code, and continuous integration and deployment practices.

Requirements

3-5 years of related experience in DevSecOps, software engineering, infrastructure automation, or security engineering.
A bachelor’s degree in computer science, cybersecurity, information systems, engineering, or a related field.
Proficiency with CI/CD tools such as Jenkins, GitLab, or Azure DevOps, including pipeline automation, version control, Infrastructure as Code, and controlled deployments.
Experience with static application security testing (SAST), dynamic application security testing (DAST), software composition analysis (SCA), vulnerability scanning, and penetration testing frameworks.
Experience programming or scripting in one or more languages such as Python, Perl, Bash, PHP, PowerShell, Java, SQL, or C++.
Knowledge of security principles, practices, and technologies, including encryption, authentication, authorization, network security, and secure handling of credentials and secrets.
Experience with REST APIs, connectors, webhooks, SaaS integrations, and Microsoft 365 or enterprise identity platforms.
Experience supporting lifecycle testing, technical documentation, Federal security requirements, and Section 508 accessibility compliance.
Ability to work independently and collaborate with architects, developers, security engineers, and stakeholders on moderately complex project activities.
Must be a US Citizen able to obtain a DHS CISA Public Trust clearance.

Nice To Haves

DocuSign integration experience is preferred.
A current Microsoft Certified: DevOps Engineer Expert or AWS Certified DevOps Engineer - Professional certification is highly preferred.

Responsibilities

Integrate security practices throughout the development, testing, deployment, and operation of DocuSign integrations and supporting infrastructure.
Design, implement, and maintain security controls across CI/CD pipelines; automate SAST, DAST, SCA, and other security checks to identify risks before deployment.
Perform regular security assessments, vulnerability scanning, and authorized penetration testing within approved scope; prioritize findings and coordinate remediation with development and security teams.
Implement Infrastructure as Code, automated testing, and controlled release and rollback procedures to support secure, reliable delivery.
Configure and maintain DocuSign accounts, groups, templates, routing rules, administrative settings, policies, alerts, and approved branding.
Build and maintain plugins, connectors, and custom APIs for automated envelope creation, routing, and archival; integrate DocuSign with Microsoft 365, enterprise identity systems, and contract or case platforms.
Implement encryption, secure authentication, authorization, role-based access, network and boundary protection, and secure credential handling; monitor logs and systems for threats and escalate findings.
Develop, maintain, and enforce security policies and procedures aligned with Federal, DHS, and CISA requirements and approved development and deployment practices.
Execute developmental and operational tests; document defects, security findings, remediation, test results, and deployment readiness.
Automate document conversion and records capture while preserving NARA-compliant formats, metadata consistency, and disposition requirements.
Document configurations, deployment procedures, integration architecture, and exception handling; support secure releases and knowledge transfer to system administrators.
Stay current with security trends, tools, and technologies; proactively recommend and implement approved improvements to pipeline security, automation, and threat monitoring.
Other related duties as assigned.