DevSecOps Engineer

Department of Homeland Security Headquarters • Arlington, VA

2d • Onsite

About The Position

This is a 6–12 month, non-reimbursable Joint Duty Assignment (JDA) with the Cybersecurity and Infrastructure Security Agency (CISA). It is a detail, not a developmental rotation, and offers no temporary promotion. The only compensation is the federal salary the employee is already receiving. The assignment is not virtual or remote and is limited to current, full-time permanent federal employees at the grade level of the detail who have supervisory approval and meet the stated eligibility conditions.

The DevSecOps Engineer provides enterprise expertise across cloud security, secure software delivery, and development, security, and operations teams. The role provides technical leadership for cloud and application security platforms, including Prisma Cloud, Wiz, and Checkmarx, and conducts cloud security posture assessments, application security testing, container and Kubernetes security reviews, and vulnerability analysis. The engineer evaluates and prioritizes security findings, reduces false positives, and provides actionable remediation guidance.

The position secures enterprise artifact management and GitOps-based deployment practices, including software supply chains, binary repositories, vulnerability scanning, signature verification, and synchronization of code and infrastructure across cloud-native environments. It leads integration of automated security controls into CI/CD pipelines and administers development and delivery platforms such as GitHub, GitHub Actions, CloudBees/Jenkins, Artifactory, and ArgoCD. The engineer develops and maintains secure build and deployment pipelines, repository governance, access controls, secrets management, and shared automation frameworks while promoting secure-by-design practices and organizational DevSecOps maturity.

Applicants must document relevant work history and submit the required application materials before the closing date. There is no educational substitution for this position. DHS provides no additional benefits beyond those the federal employee already receives. The posting also states that employees placed into a position requiring a security clearance must have and maintain a SECRET or TOP SECRET clearance, while the assignment summary lists Public Trust.

Requirements

• Must be a current permanent federal employee and currently at the grade level of the detail.
• Must have supervisory approval to apply and submit the required DHS 250-2 Application Form.
• Must not have pending or outstanding disciplinary actions.
• Must have achieved at least “meet expectations/proficiency” on the latest performance appraisal or evaluation.
• Expertise integrating SAST, DAST, SCA, and Infrastructure-as-Code scanning into CI/CD pipelines while enabling secure software delivery.
• Experience with vulnerability management, security tool optimization, and software supply chain security practices.
• Advanced proficiency administering and securing enterprise development platforms such as GitHub, GitHub Actions, CloudBees/Jenkins, JFrog Artifactory, and ArgoCD, including repository governance, secrets management, access controls, build automation, and GitOps workflows.
• Strong experience with Terraform, CloudFormation, Kubernetes, containers, and cloud environments.
• Hands-on experience with Wiz, Prisma Cloud, and Checkmarx, including cloud security posture management, application security testing, and container security.
• Ability to serve as a technical lead, guide development and security teams, advance secure-by-design principles, and improve enterprise DevSecOps maturity and software supply chain resilience.
• Resume must clearly document relevant work history, including job title and federal series/grade, duties, agency, supervisor contact details, and start and end dates.
• If the position requires a security clearance, must have a SECRET or TOP SECRET clearance for placement and maintain that level while in the position.

Responsibilities

• Provide technical leadership for cloud and application security platforms, including Prisma Cloud, Wiz, and Checkmarx.
• Conduct cloud security posture assessments, application security testing, container and Kubernetes security reviews, and vulnerability analysis.
• Evaluate and prioritize security findings, reduce false positives, and provide actionable remediation guidance to development and platform engineering teams.
• Secure software supply chains and enterprise artifact management, including binary repositories, vulnerability scanning, signature verification, and secure synchronization of code and infrastructure.
• Provide enterprise DevSecOps, cloud security, and secure software delivery expertise across development, security, and operations teams.
• Lead integration of automated security controls into CI/CD pipelines, including automated scanning, vulnerability management, and Infrastructure as Code validation.
• Administer and secure enterprise development and delivery platforms, including GitHub, GitHub Actions, CloudBees/Jenkins, Artifactory, and ArgoCD.
• Develop, configure, and maintain secure build and deployment pipelines, repository governance, access controls, secrets management, and shared automation frameworks.
• Collaborate with stakeholders to strengthen cyber resilience, improve secure-by-design engineering practices, and advance organizational DevSecOps maturity.
• Complete the DHS Training Course 15 days before arrival to the JDA and complete the three phases of the DHS Joint Duty Assignment Progress Plan.

Benefits

• A federal employee benefits package is available according to the employee’s existing position and eligibility; the assignment offers no additional benefits.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed