DevSecOps Engineer / Security Specialist

TISTA Science and Technology Corporation•Remote-United States, UNAVAILABLE

10h•Remote

About The Position

TISTA Science and Technology is seeking a DevSecOps Engineer / Security Specialist to join its growing team. The role supports federal systems through security integration in CI/CD pipelines, infrastructure hardening, vulnerability management, and authorization-to-operate (ATO) evidence. A Security QA variant includes validating controls before release, conducting WASA and Fortify scans, and signing off on security release criteria. The position is remote in the USA.

Requirements

At least 6 years of experience, including at least 3 years in DevSecOps or cyber engineering on federal systems (Mid / Level II).
Experience with security tooling in CI/CD pipelines, including SAST/DAST, dependency scanning, and container scanning.
Experience with vulnerability scanning and remediation tracking using ACAS/Nessus.
Bachelor's degree in computer science, cybersecurity, or a related field.
One of the following: AWS or Azure Solutions Architect or Developer certification; ISC2 CISSP.
Must be able to obtain a Tier 2 / Moderate Risk Public Trust and a VA PIV credential.

Nice To Haves

Ansible hardening and STIG compliance on RHEL and OpenShift.
Experience producing ATO evidence, including SSP sections, POA&Ms, and control documentation.
For the Security QA option: Fortify and WASA scans and security release sign-off.
Red Hat Certified Specialist in Ansible preferred.
For the Security QA option: CISSP, CAP, or Security+.

Responsibilities

Integrate SAST/DAST, dependency, container, and secrets scanning into CI/CD using GitHub, GitLab, Jenkins, and SonarQube.
Harden infrastructure-as-code and configurations with Ansible on AWS, Azure, and OpenShift.
Run vulnerability scans using ACAS/Nessus, track remediation, and meet CISA BOD 22-01 timelines.
Produce and maintain ATO evidence, including SSP sections, POA&Ms, and control documentation.
For the Security QA variant, validate controls before release, run WASA and Fortify scans, and sign off on security release criteria.