DevSecOps Engineer

TCG, Inc.•Washington, DC

71d•Remote

About The Position

TCG, a B Corp government contractor, is seeking a DevSecOps Engineer to join their project team. This role involves designing, developing, and implementing solutions for a government customer. U.S. citizenship is required, and the selected applicant must pass a government background investigation. This is a full-time, short-term position expected to end in September 2026, with a possibility of extension. The role is primarily remote, but occasional on-site presence in Washington, D.C. may be required, necessitating residency within commuting distance.

Requirements

Five (5) plus years of experience in DevSecOps engineering, with at least 3+ years managing and maintaining AWS ecosystems.
Expertise in managing and deploying containerized applications using Kubernetes and Docker.
Proficiency with AWS cloud security, including configuring baselines and security policies to create a Zero Trust Architecture for tools such as encrypted S3 buckets, IAM role, and service/network logging.
Proficiency in designing, implementing, and maintaining CI/CD pipelines using tools such as GitLab, and utilizing tools, such as Terraform or Cloud Formation, to implement an Infrastructure as Code methodology.
Hands-on experience with security scanning and analysis tools, including SAST/DAST (e.g., Sonarqube, Invicti) and vulnerability management (e.g., Tenable).
Ability to work in an agile or iterative development environment.
Experience authoring and debugging Dockerfiles for web applications, preferably for Docker images using Java or Angular.
Experience standing up and managing an AWS/Gitlab architecture, preferably in a non-DOD federal government space.
U.S. citizenship is required.
Must submit to a government background investigation and be favorably adjudicated before their first day.

Nice To Haves

DevSecOps relevant certifications in Cloud platforms (AWS preferred).
Experience ensuring application security for Java Spring Boot API containers.
Practice working with regulatory, legal, or government data sets.

Responsibilities

Design, implement, and maintain CI/CD pipelines in an AWS environment, leveraging tools like GitLab.
Manage and deploy containerized applications using Kubernetes and Docker in an AWS environment.
Configure and maintain AWS environments for various applications, including defining and applying baselines and security policies.
Implement security best practices throughout the DevSecOps lifecycle, focusing on vulnerability management and secure configuration.
Integrate SAST and DAST tools, such as Sonarqube and Invicti, into the CI/CD pipeline for analysis of code and container images.
Ensure application security specifically for containers in the Kubernetes and AWS environments.
Collaborate with development teams to resolve security vulnerabilities reported by tools like Tenable and track resolution progress.
Automate deployment and configuration management tasks across development, test, and production environments, leveraging tools like Ansible.
Implement and maintain monitoring and logging solutions (e.g. Splunk or ELK Stack) to ensure system uptime, performance, and application health.
Support platform operations, including updates, patching, and system maintenance for the underlying AWS cloud infrastructure.
Review and suggest improvements and changes to the current cloud architecture to aid in scaling cloud presence.