DevSecOps Engineer Journeyman

ASM Research•Fairfax, VA

1d•Onsite

About The Position

The DevSecOps Engineer Journeyman maintains and operates an enterprise DevSecOps software factory, ensuring CI/CD pipelines are secure, reliable, and efficient from code commit through deployment in a mission‑critical federal IT environment. They embed security controls into every phase of the software lifecycle, automating build, test, release, and security scanning activities across highly regulated systems. The role designs and optimizes pipelines using common DevOps toolchains, applies infrastructure as code, and enforces secure branching, artifact management, and deployment strategies while collaborating closely with development, security, and operations stakeholders.

Requirements

Bachelor’s degree in Computer Science, Engineering, Information Technology, or a related field, or equivalent relevant experience.
Typically 3–5 years of combined experience in DevOps, security engineering, or software development with hands‑on exposure to CI/CD pipelines and automation.
Demonstrated experience building and operating CI/CD pipelines with tools such as Jenkins, GitLab CI, or GitHub Actions, including integration of automated testing and security scanning.
Practical experience with infrastructure as code tools (e.g., Terraform, Ansible, CloudFormation) and secure configuration of environments in on‑premises and cloud platforms.
Experience managing Git‑based source control, including branching strategies, code review processes, and protected branches to support secure delivery.
Ability to obtain and maintain a SECRET security clearance and work in a U.S.‑only staffing context as a U.S. citizen.
Strong understanding of secure coding practices, common vulnerability types, and integrating remediation into the CI/CD and SDLC processes.

Nice To Haves

Experience with containerization and orchestration technologies such as Docker and Kubernetes in secure, multi‑tenant environments.
Experience implementing blue‑green, canary, and rolling deployment strategies to achieve zero‑ or low‑downtime releases.
Industry certifications such as CompTIA Security+, AWS or Azure cloud certifications, or a vendor DevSecOps/secure DevOps credential.
Experience working in or supporting highly regulated government environments with established audit, compliance, and security governance requirements.

Responsibilities

Design, implement, and maintain CI/CD pipelines using tools such as Jenkins, GitLab CI, or GitHub Actions, automating build, test, and deployment processes for mission‑critical applications.
Integrate application, container, and infrastructure security scanning (e.g., SAST, SCA, DAST) into CI/CD workflows and configure automated quality gates to prevent vulnerable or non‑compliant releases.
Apply infrastructure as code practices (e.g., Terraform, Ansible, CloudFormation) to define consistent, repeatable environments and enforce security baselines across on‑premises and cloud platforms.
Manage source control repositories and branching strategies (e.g., GitFlow, trunk‑based development), including code review workflows and protected branches to support secure, collaborative delivery.
Implement artifact management, versioning, and promotion policies using repository managers (e.g., Nexus, Artifactory) to maintain traceability and controlled releases across multiple environments.
Configure and maintain monitoring, logging, and alerting for pipeline health, performance, and security events, integrating with enterprise observability and SIEM solutions where appropriate.
Collaborate with development, security, and operations teams to codify security policies as code, strengthen DevSecOps guardrails, and support auditability in a highly regulated government setting.
Apply secure coding, threat modeling, and vulnerability remediation practices within the SDLC, ensuring security is treated as a shared responsibility across the delivery lifecycle.