DevSecOps Engineer

Leidos

2d•$87,100 - $157,450

About The Position

Leidos is seeking an embedded DevSecOps Engineer to proactively identify, assess, and remediate application security risks across the software development lifecycle. The role works closely with Project Managers and development, architecture, and operations teams to support DevSecOps priorities and roadmaps, identify epics, integrate security into design and implementation, conduct code reviews and testing, address vulnerabilities, and support incident response. The position also supports secure coding practices, coordinates remediation efforts, and ensures security activities align with program priorities and delivery timelines. The engineer analyzes application designs and architectures, performs manual and automated code reviews, integrates application security tools into CI/CD pipelines, and conducts application security testing. They manage vulnerability findings, guide developers in secure coding, support application-level incident response, report vulnerability status and risk posture, implement established security policies, and coordinate activities with development roadmaps, releases, and operational priorities. The role also facilitates daily scrum and sprint planning for DevSecOps and assists Project Managers with backlog priorities and removing team impediments.

Requirements

Bachelor’s degree in Cybersecurity, Computer Science, or a related field with 5+ years of experience, or equivalent experience; additional years of experience may be substituted in lieu of a degree.
5+ years of hands-on application security experience within a software development environment.
Experience integrating security into CI/CD pipelines and DevSecOps workflows.
Ability to manage and track vulnerabilities through remediation in collaboration with development teams.
Understanding of secure software development lifecycle (SDLC) principles.
Experience supporting or participating in security incident response.
Strong ability to communicate security risks and recommendations to technical teams.
Experience working in cross-functional environments with developers, architects, and operations teams.
Experience working in a DevSecOps team with an Agile development framework.
U.S. citizenship.

Nice To Haves

Experience performing secure code reviews and identifying common vulnerabilities, such as OWASP Top 10.
Experience with application security testing tools (SAST, DAST, SCA) and interpreting results.
Experience supporting federal or regulated environments, such as DOJ, FedRAMP, or FISMA.
Familiarity with threat modeling methodologies and secure architecture practices.
Experience with container and cloud security, such as Kubernetes, AWS, or Azure.
Knowledge of risk-based vulnerability prioritization and release gating practices.

Responsibilities

Analyze application designs and architectures to identify potential security risks and recommend secure design patterns.
Perform manual and automated code reviews to identify vulnerabilities and guide remediation.
Integrate and maintain application security tools within CI/CD pipelines for continuous testing.
Conduct application security testing, including SAST, DAST, SCA, and coordination of penetration testing.
Manage vulnerability findings by triaging, prioritizing, tracking, and coordinating remediation with development teams.
Partner with developers to implement secure coding practices and provide hands-on guidance and training.
Support application-level incident response, including investigation and remediation of security events.
Track and report vulnerability status and risk posture in formal reviews and program reporting.
Implement established security policies and recommend improvements.
Coordinate across teams to align DevSecOps activities with development roadmaps, releases, and operational priorities.
Facilitate daily scrum and sprint planning for DevSecOps.
Support Project Managers with unforeseen work and priorities in the current team backlog, and help remove impediments from the team.