DevSecOps Engineer - JobID-0336

Innovative Defense Technologies•San Diego, CA

1d•$114,000 - $184,000•Onsite

About The Position

Innovative Defense Technologies (IDT) is seeking a DevSecOps Engineer for its Integrated Mission Systems (IMS) team in San Diego, California. This on-site role requires at least four days per week in the office and nearby government facilities. The engineer will lead and support cybersecurity accreditation for mission-critical Department of War systems and U.S. Navy programs, including Authority to Operate (ATO) efforts, Risk Management Framework (RMF) implementation, vulnerability management, continuous monitoring through Navy and DoW DevSecOps deployment pipelines, and security engineering. The position also maintains process and procedure documentation and supports internal engineers and customers on-site. Applicants must be able to obtain and maintain an active Secret U.S. Security Clearance. The role involves designing and implementing secure architectures for autonomous systems, AI-driven platforms, and edge-computing devices; integrating automated security gates into CI/CD pipelines; and advancing continuous authorization through automated control verification and monitoring. The engineer will support secure virtualized and containerized environments for IL5/IL6 mission sets, implement ICAM and Zero Trust principles, and lead RMF activities and authorization-package preparation. Responsibilities also include vulnerability and configuration management, documentation, security authorization, and coordination with Navy and program security stakeholders. IDT describes itself as a growing defense technology company with an entrepreneurial culture and offices in Arlington, Virginia; Fall River, Massachusetts; Mount Laurel, New Jersey; and San Diego, California. It offers competitive pay and benefits, professional development resources, and a modern, collaborative office environment.

Requirements

Bachelor’s degree in Cyber Security, Information Assurance, Computer Science, Information Technology, or equivalent full-time professional experience.
Meet DoD 8570/8140 baseline requirements through either an approved IAM Level I certification (Security+, SSCP, or GSEC) or a qualifying degree recognized by the DoD 8140 educational matrix.
At least 5 years of cybersecurity or systems engineering experience within the Defense Industrial Base, with mastery of the Risk Management Framework.
Ability to obtain and maintain an active Secret U.S. Security Clearance.
Ability to work on-site at least four days per week in San Diego, California, and nearby government facilities.

Nice To Haves

Experience navigating the Department of the Navy RAISE 2.0 process to achieve continuous cyber readiness and inherit platform ATO (cATO/eATO) for containerized mission applications.
Familiarity with the Overmatch Software Armory or similar Navy DevSecOps/RAISE platforms for pipeline execution, automated security gating, SBOM generation, and container scanning.
Familiarity deploying, hardening, or integrating software services within Navy tactical environments, specifically ACS and CANES architectures.
Proficiency with CI/CD pipelines, including automated STIG compliance, SAST/DAST, vulnerability remediation, and container hardening for Navy Cyber Ready directives.
Expert-level knowledge of securing OCI-compliant Docker containers and Kubernetes clusters, including network policies, Istio service meshes, and runtime security.
Significant experience with server virtualization (ESXi, KVM) and desktop virtualization (VDI), including hardware root of trust and secure hypervisor configuration.
Firm grasp of Infrastructure as Code deployments using Terraform, Ansible, or CloudFormation.
Experience with automated security assessment tools such as ACAS/Nessus and SCAP, and integrating security data into eMASS.
Experience configuring multiple forms of authentication, including PKI concepts.
Experience identifying hardware and/or software for purchase to meet use cases.
Experience with Ansible, PowerShell, Chef, Salt, Puppet, or other configuration automation software.
DoD 8570/8140 IAM Level III certification, such as CISSP or CISM.

Responsibilities

Design and implement secure, high-performance architectures for autonomous systems, AI-driven platforms, and edge-computing devices.
Embed automated security gates, including SAST, DAST, IAST, and SRM, into CI/CD pipelines.
Lead the transition from static RMF cycles to Continuous Authority to Operate by automating control verification and continuous monitoring.
Architect secure multi-tenant environments using Type-1 hypervisors and Kubernetes for IL5/IL6 mission sets.
Engineer ICAM solutions that apply Zero Trust principles across distributed hardware and software nodes.
Lead RMF activities across categorization, control selection, control implementation, assessment, authorization, and continuous monitoring.
Develop and maintain RMF artifacts, including SSPs, SARs, SAPs, POA&Ms, inventories, architecture diagrams, and continuous monitoring documentation.
Coordinate with U.S. Navy Authorizing Officials, Security Control Assessors, ISSMs, ISSOs, and Program Managers.
Perform server updates, patch management, and software installations.
Manage cybersecurity authorization packages and support (I)ATO and (I)ATT activities.
Perform ACAS scans on devices across multiple systems as needed.
Collect, review, and submit STIG checklists for RMF processes.
Develop and maintain access control policies for organizational assets.
Remediate vulnerabilities and document POA&Ms as required.
Work with developers and engineers to implement, maintain, and review security processes, maintain compliance, and ensure appropriate user permissions.
Develop and maintain golden images, including operating system images and virtual machines.
Create and maintain detailed system and network documentation for technical and non-technical stakeholders.
Serve as the appointed ISSO for product-level ATOs and DCSA-authorized information systems, supporting security authorization and compliance with applicable policies, standards, and regulations.
Perform assigned continuous monitoring activities in accordance with RMF requirements and the approved SSP, including vulnerability assessments, security control assessments, STIG compliance, POA&M management, and ongoing security-posture evaluation.
Coordinate with the ISSM on information system security matters and serve as the on-site representative for DSCA-related activities.
Travel up to 10% as needed.