DevSecOps Engineer - JobID-0336

Innovative Defense Technologies•San Diego, CA

9d•Onsite

About The Position

Innovative Defense Technologies (IDT) is hiring a DevSecOps Engineer for its Integrated Mission Systems (IMS) team in San Diego, California. This on-site role requires at least four days per week in the office and work at nearby government facilities. The engineer will lead and support cybersecurity accreditation for mission-critical Department of War systems and U.S. Navy programs, including ATO efforts, Risk Management Framework (RMF) implementation, vulnerability management, continuous monitoring through Navy and DoW DevSecOps pipelines, and security engineering. The position also maintains process and procedure documentation and supports internal engineers and customers on-site. Applicants must be able to obtain and maintain an active Secret U.S. Security Clearance. The engineer will design and implement secure architectures for autonomous systems, AI-driven platforms, and edge-computing devices; integrate automated security gates into CI/CD pipelines; and support transition to continuous authorization by automating control verification and monitoring. The role also involves securing virtualized and containerized multi-tenant environments for IL5/IL6 mission sets, implementing Zero Trust-oriented ICAM solutions, managing RMF artifacts and authorization packages, and coordinating with Navy authorization and assessment stakeholders. The successful candidate may serve as the appointed Information System Security Officer (ISSO) for product-level ATOs and DCSA-authorized information systems. In coordination with the ISSM, the ISSO supports authorization activities, compliance, continuous monitoring, vulnerability and security control assessments, STIG compliance, POA&M management, and evaluation of system security posture. The position may require travel up to 10% as needed.

Requirements

Bachelor’s degree in Cyber Security, Information Assurance, Computer Science, Information Technology, or equivalent full-time professional experience.
Meet DoD 8570/8140 baseline requirements through either an approved IAM Level I certification (Security+, SSCP, or GSEC) or a qualifying degree recognized by the DoD 8140 educational matrix.
At least 5 years of cybersecurity or systems engineering experience within the Defense Industrial Base, with mastery of RMF.
Ability to obtain and maintain an active Secret U.S. Security Clearance.
Ability to travel up to 10% as needed.

Nice To Haves

Experience navigating the Department of the Navy RAISE 2.0 process to achieve continuous cyber readiness and inherit platform ATO (cATO/eATO) for containerized mission applications.
Familiarity with the Overmatch Software Armory or similar Navy DevSecOps/RAISE platforms for pipeline execution, automated security gating, SBOM generation, and container scanning.
Familiarity with deploying, hardening, or integrating software services in Navy tactical environments, especially ACS and CANES architectures.
Proficiency with CI/CD pipelines, including automated STIG compliance, SAST/DAST, vulnerability remediation, and container hardening for Navy Cyber Ready directives.
Expert-level knowledge of securing OCI-compliant Docker containers and Kubernetes clusters, including network policies, Istio service meshes, and runtime security.
Significant experience with server virtualization (ESXi, KVM) and desktop virtualization (VDI), including hardware root of trust and secure hypervisor configuration.
Strong knowledge of Infrastructure as Code deployments using Terraform, Ansible, or CloudFormation.
Experience with automated security assessment tools such as ACAS/Nessus and SCAP, and integrating security data into eMASS.
Experience configuring multiple forms of authentication, including PKI concepts.
Experience identifying hardware and/or software for purchase to meet use cases.
Experience with Ansible, PowerShell, Chef, Salt, Puppet, or other configuration automation software.
DoD 8570/8140 IAM Level III certification, such as CISSP or CISM.

Responsibilities

Design and implement secure, high-performance architectures for autonomous systems, AI-driven platforms, and edge-computing devices.
Embed automated security gates, including SAST, DAST, IAST, and SRM, into CI/CD pipelines.
Support the transition from static RMF cycles to Continuous Authority to Operate (cATO) by automating control verification and continuous monitoring.
Architect secure multi-tenant environments using Type-1 hypervisors and containerized orchestration for IL5/IL6 mission sets.
Engineer ICAM solutions that enforce Zero Trust principles across distributed hardware and software nodes.
Lead RMF activities across categorization, control selection, control implementation, assessment, authorization, and continuous monitoring.
Develop and maintain RMF artifacts, including SSPs, SARs, SAPs, POA&Ms, inventories, architecture diagrams, and continuous monitoring documentation.
Coordinate with U.S. Navy Authorizing Officials, Security Control Assessors, ISSMs, ISSOs, and Program Managers.
Perform server updates, patch management, and software installations.
Manage cybersecurity authorization packages and support (I)ATO and (I)ATT activities.
Perform ACAS scans on devices across multiple systems as needed.
Collect, review, and submit STIG checklists for RMF processes.
Develop and maintain access control policies for organizational assets.
Remediate vulnerabilities and document POA&Ms as required.
Work with developers and engineers to implement, maintain, and review security processes, compliance, and user permissions.
Help develop and maintain operating system images, virtual machines, and other golden images.
Create and maintain detailed system and network documentation for technical and non-technical stakeholders.
Serve as the appointed ISSO for product-level ATOs and DCSA-authorized information systems, supporting security authorization and compliance with applicable policies, standards, and regulations.
Perform assigned continuous monitoring activities in accordance with RMF requirements and the approved SSP, including vulnerability assessments, security control assessments, STIG compliance, POA&M management, and ongoing evaluation of system security posture.
Coordinate with the ISSM on information system security matters and serve as the on-site representative for DSCA-related activities.
Travel up to 10% as needed.