DevSecOps Engineer

Node.Digital•Herndon, VA

1d•Hybrid

About The Position

The DevSecOps Engineer architects and safeguards DevSecOps, test automation, and security automation solutions, supporting their operational efficiency and continuous improvement. The role embeds security and quality throughout the software delivery lifecycle and builds CI/CD pipelines to move code from source to production while meeting applicable security, credentialing, and privacy policies. Pipelines are integrated with configuration management, asset management, reporting, and monitoring systems to support governance and performance and compliance tracking. The engineer designs, builds, and maintains automated pipelines and testing and security controls; deploys AWS workloads; establishes reusable pipeline and infrastructure-as-code standards; and improves pipeline speed, reliability, and efficiency. The role also partners with security, privacy, and compliance stakeholders, develops leadership and governance metrics, and coaches development and operations teams on secure coding and automation practices. The position is located in Herndon, Virginia, with hybrid work. U.S. citizenship is preferred. The posting lists experience as “3+yrs & 8 yrs.”

Requirements

Bachelor's degree in Computer Science, Information Security, Engineering, or a related field, or equivalent experience.
Experience operating high-volume, large-scale applications with cloud-native security in AWS.
Hands-on experience in DevOps, DevSecOps, or security engineering roles.
Hands-on experience building and managing CI/CD pipelines, such as Jenkins or Harness.
Experience with infrastructure as code and containerization or orchestration, such as Kubernetes and Docker.
Experience integrating security tooling into pipelines, such as SonarQube, OWASP, or Checkmarx.
Experience with CMDB and asset management tools, such as ServiceNow, and monitoring and observability platforms, such as Splunk, Prometheus, or Grafana.
Strong communication skills and ability to work across technical and non-technical stakeholders.

Nice To Haves

Familiarity with security and privacy frameworks and regulations, such as NIST 800-53, FedRAMP, FISMA, and the Privacy Act.
Experience with policy-as-code, such as OPA, and software supply chain security, including SBOMs and artifact signing.
U.S. citizenship is preferred.

Responsibilities

Design, build, and maintain end-to-end CI/CD pipelines that move code from source control to production reliably and repeatably.
Build, package, and deploy container, serverless, and VM-based applications on AWS through automated pipelines, with controlled promotion across development, test, staging, and production environments.
Implement blue/green or canary releases and automated rollback.
Define and maintain reusable pipeline standards, templates, and infrastructure-as-code patterns.
Continuously refine pipelines to improve speed, reliability, and efficiency.
Establish and maintain automated unit, integration, functional, regression, and performance testing within pipelines.
Integrate automated security controls, including SAST, DAST, SCA, secrets detection, container and image scanning, and infrastructure-as-code scanning.
Ensure pipelines and deployed solutions comply with applicable security, credentialing, and privacy policies.
Partner with security, privacy, and compliance stakeholders to translate policy requirements into automated controls.
Build dashboards and metrics for leadership and governance bodies, including deployment frequency, lead time, change failure rate, and mean time to remediate vulnerabilities.
Coach development and operations teams on secure coding, pipeline use, and automation best practices.