DevSecOps Engineer
About The Position
The DevSecOps Engineer will streamline secure software development, security automation and orchestration, and incident response from requirements through production monitoring. The role uses open-source tools, automation, and cloud resources to reduce repetitive work and support innovation. Systems protected include on-premises infrastructure, custom SaaS tools for data sharing and analysis, and AI/ML research and bioinformatics environments. The engineer evaluates security findings, builds and maintains security infrastructure, advises development and operations teams on vulnerabilities and remediation, and supports automated security checks in CI/CD pipelines. The position also develops DevSecOps metrics and processes, trains stakeholders, evaluates tools with vendors, and helps maintain FedRAMP Moderate and FISMA Moderate/Class C compliance. It includes application development and support activities, such as gathering requirements, testing code, supporting existing applications, and resolving technical problems. This at-will position is wholly or partially funded by contractual grant funding. Continued employment depends on receipt of grant funds and satisfactory job performance.
Requirements
- College or university degree in a related field.
- 2–5 years of work experience in a related job discipline.
- Ability to investigate, analyze, and resolve technical problems.
- Ability to gather and analyze requirements and design applications to meet business requirements.
- Ability to test code components and ensure implementation standards are met.
- Ability to support and maintain existing applications.
Nice To Haves
- Recognized university degree in Computer Science, Computer/Electrical Engineering, Information Technology, or equivalent.
- 2 or more years developing infrastructure, system configuration, or deployment automation for one or more cloud platforms, including OpenStack, AWS, GCP, or Azure.
- Technical experience with SAST, SCA, DAST, IAST, and other vulnerability scanning tools.
- Experience conducting secure code reviews and web application penetration tests.
- Understanding of the full DevSecOps pipeline, Agile methodology, container security, APIs, and microservices.
- Experience with CI/CD tools.
- Experience using and protecting against AI/ML tools.
- Familiarity with NIST 800-53, FedRAMP, FISMA, HIPPA, and other regulatory or industry requirements.
- Experience with Palo XSOAR.
- GWAPT, CEH, OSCP, CISSP, or similar certifications.
- Curiosity and willingness to learn independently about emerging technologies and trends.
- Ability to promptly respond to, triage, and resolve production incidents and events.
- Ability to prioritize and manage workload to meet critical milestones and deadlines.
- Ability to balance business needs against security concerns.
- Ability to organize and carry out a course of action, often under tight deadlines.
- Ability to present information consistently and concisely.
- Analytical thinking and excellent communication skills.
- Proficient understanding of programming languages.
- Scripting knowledge to support automation and continuous process improvement.
- Python knowledge for using and developing a Security Orchestration, Automation, and Response platform.
- Knowledge of build and release tools and CI/CD methodologies, including Argo and Helm.
- Ability to maintain confidentiality concerning sensitive matters, including strategic initiatives, trade secrets, quiet periods, and scientific discoveries not yet public.
Responsibilities
- Evaluate and analyze the threat, vulnerability, impact, and risk of security issues found by SAST, SCA, IAST, DAST, container security, and other DevSecOps tools.
- Design, develop, implement, and maintain security infrastructure for CTDS.
- Advise and collaborate with DevOps teams, developers, application teams, and project teams on security issues and vulnerability remediation.
- Develop and design DevSecOps metrics, policies, processes, and procedures.
- Train developers and other stakeholders in the use of security tools.
- Assist with designing and implementing automated security checks and additional security tools in CI/CD pipelines.
- Conduct proofs of concept and work with vendors to improve security automation and efficiency.
- Communicate effectively and manage stakeholder expectations.
- Track industry trends in security and DevSecOps and recommend continuous improvements.
- Assist in maintaining FedRAMP Moderate and FISMA Moderate/Class C compliance.
- Investigate, analyze, and resolve day-to-day technical problems using standard procedures.
- Gather and analyze requirements with stakeholders for developmental programs and design applications to meet University and business requirements, with moderate guidance.
- Test code components and help ensure implementation standards are met.
- Evaluate design alternatives for development costs and solutions using various methods.
- Support and maintain existing applications; work with developers and respond to user requests.
- Perform other related work as needed.
Benefits
- Benefits eligibility, with University benefits programs and resources including health, retirement, and paid time off.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Mid Level
