DevSecOps Engineer

Node.Digital•Herndon, VA

19h•Hybrid

About The Position

The DevSecOps Engineer architects and supports DevSecOps, test automation, and security automation solutions, ensuring their operational efficiency and continuous improvement. The role embeds security and quality throughout the software delivery lifecycle by building CI/CD pipelines that move code from source to production while meeting applicable security, credentialing, and privacy policies. It also integrates pipelines with CMDB, reporting, and monitoring systems to support configuration and asset management, governance, and performance and compliance tracking. The engineer designs and maintains automated pipelines for AWS container, serverless, and VM-based workloads, with controlled promotion between development, test, staging, and production environments. The role also establishes reusable pipeline standards and infrastructure-as-code patterns, incorporates automated testing and security controls, develops dashboards and metrics, and coaches development and operations teams on secure coding and automation practices.

Requirements

Bachelor’s degree in Computer Science, Information Security, Engineering, or a related field, or equivalent experience.
Experience operating high-volume, large-scale applications with cloud-native security in AWS.
Hands-on experience in DevOps, DevSecOps, or security engineering roles.
Hands-on experience building and managing CI/CD pipelines, such as Jenkins or Harness.
Experience with infrastructure as code and containerization or orchestration, such as Kubernetes and Docker.
Experience integrating security tools into pipelines, such as SonarQube, OWASP, or Checkmarx.
Experience with CMDB and asset management tools, such as ServiceNow, and monitoring and observability platforms, such as Splunk, Prometheus, or Grafana.
Strong communication skills and ability to work across technical and non-technical stakeholders.

Nice To Haves

Familiarity with security and privacy frameworks and regulations, such as NIST 800-53, FedRAMP, FISMA, and the Privacy Act.
Experience with policy-as-code, such as OPA, and software supply chain security, including SBOMs and artifact signing.
U.S. citizenship is preferred.

Responsibilities

Design, build, and maintain reliable, repeatable end-to-end CI/CD pipelines from source control to production.
Build, package, and deploy AWS container, serverless, and VM-based applications through automated pipelines.
Manage controlled promotion across development, test, staging, and production environments, including blue/green or canary releases and automated rollback.
Define and maintain reusable pipeline standards, templates, and infrastructure-as-code patterns.
Continuously refine pipelines to improve speed, reliability, and efficiency.
Establish automated unit, integration, functional, regression, and performance testing within pipelines.
Integrate security controls into pipelines, including SAST, DAST, SCA, secrets detection, container and image scanning, and infrastructure-as-code scanning.
Ensure pipelines and deployed solutions comply with applicable security, credentialing, and privacy policies.
Work with security, privacy, and compliance stakeholders to translate policy requirements into automated controls.
Build dashboards and metrics for leadership and governance bodies, including deployment frequency, lead time, change failure rate, and mean time to remediate vulnerabilities.
Coach development and operations teams on secure coding, pipeline use, and automation best practices.