DevSecOps ENGINEER

Quantum Research International Inc•Colorado Springs, CO

33d•$120,000 - $145,000

About The Position

Quantum Research International, Inc. (Quantum) is seeking a DevSecOps Engineer to serve as a hands-on member of the Software Assurance Team. This role will support the secure development, deployment, and maintenance of software by integrating security practices into development workflows, reviewing security tool results, supporting vulnerability remediation, justifying false positives, and assisting with the creation and maintenance of containerized application environments. The position requires close collaboration with cybersecurity teams, software developers, system administrators, and other technical stakeholders to improve software assurance, pipeline security, vulnerability management, and DevSecOps compliance.

Requirements

Bachelor’s degree of science in Computer Science or a related engineering or scientific field of study from an accredited college or university.
Minimum of two (2) years of experience, of which at least one (1) must be specialized experience including cybersecurity analysis and implementation of cybersecurity technical controls.
Understanding of heterogeneous information systems and networking technologies.
Understanding of information system ports, protocols and services.
Understanding of interface standards specifications and information system programming techniques, best practices and standards.
Must have and maintain an appropriate DoDI 8570.01-M (Information Assurance Workforce Improvement Program) certification for the appointed duty level.
Current Secret clearance and able to obtain Top Secret security clearance with SCI eligibility.
Three to five years of relevant DevSecOps, cybersecurity, software assurance, or secure software development experience.
Experience with tools and platforms such as Azure DevOps, GitLab, SonarQube, Sonatype, Burp Suite Professional, and AWS GovCloud.
Experience with containerized application deployments using AWS EKS, Helm charts, Docker, Kubernetes, or similar containerization technologies.
Proficiency with scripting languages such as PowerShell.
Experience creating, configuring, or maintaining containerized applications.
Strong experience with C# and .NET programming languages.
Ability to review security tool findings, support vulnerability remediation, and document false-positive justifications.
Ability to work collaboratively with cybersecurity teams, developers, and technical stakeholders.
Must demonstrate a basic understanding of AI governance within source code management platforms such as GitLab, including how governance-related documentation, workflows, and controls may apply to AI-enabled development activities.
Familiarity with Army DevSecOps, RMF, software assurance, or compliance requirements.
Active Secret security clearance.
IAT Level II baseline certification.
Computing Environment certification.

Nice To Haves

Experience with Amazon Web Services architectures, security services, and cloud-native security practices.
Experience with secure container deployments and configuring containerized environments.
Experience configuring and maintaining automated pipelines within DevOps or DevSecOps environments.
Experience developing automated security, compliance, or reporting capabilities.
Strong communication skills, especially when coordinating between cybersecurity teams and software development teams.

Responsibilities

Manage security measures for containerized services using Docker, Kubernetes, AWS EKS, Helm, and similar technologies.
Develop and maintain documentation related to DevSecOps processes, tools, workflows, and compliance activities.
Monitor security tools within CI/CD pipelines and recommend adjustments to improve automation, accuracy, and effectiveness.
Collaborate with developers to enforce secure coding standards and identify, validate, and mitigate security risks.
Integrate security tools into CI/CD pipelines to support secure deployment practices and reduce software vulnerabilities.
Support the transition, configuration, and maintenance of DevSecOps workflows within GitLab.
Review results from static application security testing, software composition analysis, container scanning, dynamic testing, and other security tools.
Assist development teams with vulnerability remediation, false-positive analysis, and risk-based prioritization.
Secure system configurations, install and maintain security tools, scan systems for compliance, report results, and evaluate security posture.
Conduct security program audits and develop recommendations to mitigate identified risks.
Evaluate, develop, and enhance security assessment capabilities.
Perform vulnerability assessments and support the development of risk mitigation strategies.
Support implementation of DevSecOps compliance standards set forth by the Army.
Applies science and/or engineering techniques to develop cybersecurity controls for information system, network and/or application design.
Ensures cybersecurity controls are effectively implemented early in the system design and engineering process to enable the technology to be used at the minimal acceptable level of risk.
Serves as a cybersecurity technical expert that participates in critical system development review meetings as part of the acquisition life cycle.
Promotes the design and development of secure interface specifications between interconnected systems and develops interface control documentation.
Conducts analysis of and documents ports, protocols and services used in information systems and/or networks.
Designs, develops, integrates, and updates system security measures (including polices and requirements) that provide confidentiality, integrity, availability authentication, and non-repudiation of information systems, networks, components, and/or applications that are consistent with technical specifications.
Conducts analysis of requirements for cross domain solutions, test cross domain solutions and make implementation recommendations.
Analyzes and resolves cybersecurity technical problems.
Configures testbeds and conducts testing, records and analyzes results, and provides recommendations for improvements for the products/systems under test.
Identifies threats and vulnerabilities, develops risk analyses, risk assessment documentation, and researches and develops countermeasures to those threats and vulnerabilities.
Promotes secure engineering techniques, principles, architectures, and designs within the organization and with external stakeholders. Techniques for doing so include, but are not limited to, authoring white papers, creating and delivering presentations, and participating/leading working groups or integrated product teams.