DevSecOps Lead-4004560

TCG•Washington, DC

1d•$175,000 - $185,000•Hybrid

About The Position

You've stumbled upon the rare B Corp government contractor! At TCG, we aim to prove that businesses can be good to their employees and responsible to their community while being profitable. TCG is an award-winning, government IT solutions provider. We are seeking a DevSecOps Lead to join our project team at a major Federal agency to help design, develop, and implement solutions. in anticipation of an upcoming award. U.S. citizenship is required for this role. In addition, the selected applicant must submit to a government background investigation and be favorably adjudicated before their first day. The selected candidate will be required to be on site (Washington, DC) 2-3 days monthly and therefore must live within commuting distance of Washington, D.C.

Requirements

A minimum of 10 years of progressively responsible experience working in a software development environment that includes:
At least 3 years of experience as a Solutions Architect
At least 5 years of experience as DevSecOps Engineer, Senior Full Stack Developer or Technical Lead
Experience with JavaScript Development within an agile team environment
Experience with DevSecOps tools including Jenkins, Git, GitLab, Docker, Ansible
Experience writing SQL and other RDBMS such as MySQL, MS SQL Server
Experience implementing DevSecOps processes and CI/CD tools to automate software delivery
Direct experience leading, mentoring, and coaching a team technically and ability to contribute quickly to the project
Troubleshooting skills and experience such as reviewing logs, attaching a debugger, use of Chrome developer tools
Comfortable with web security best practices (e.g. OWASP Top 10)
Independent problem-solving skills, strong analytical abilities, creativity, and clear appreciation of end customer needs
The ability to prioritize and organize efforts in a fast-paced environment
Demonstrates excellent grammar and spelling in written communication and ability to produce clear technical documentation

Nice To Haves

Certification in Cloud-based platforms (AWS and Azure preferred).
Experience with Retrieval-Augmented Generation (RAG) architectures.
Practice working with regulatory, legal, or government data sets.

Responsibilities

Serves as the senior technical authority responsible for bridging development, security, and operations across every phase of the Software Development Life Cycle (SDLC).
Operates as the "connective tissue" between the development teams, operations staff, and the Information System Security Manager (ISSM) to provide transparent communication on security risks and progress to stakeholders.
Lead all development/product activities, including updates to each sprint on the development roadmap based on the Product Owner's feedback and preparation for sprint activities (e.g. review of user stories)
Guide the full-stack .NET development of custom applications, upgrades, and adapting for cloud migration
Conduct proactive code analysis to find sources of risk, causes of errors and revise programs as needed
Attends agile ceremonies and mentors junior developers
Participates in software design meetings and analyzes new user needs to determine technical requirements, including testing approach and criteria
Consults with the PM and Product Owner as needed to prototype, refine, test, and debug programs
Actively participates in the CCB process as a technical advisor, identifying technical interface, data, and software implications and presenting proposed changes, along with their known risks and impacts, to the CCB to secure necessary approvals.
Supports physical and functional configuration audits (PCA/FCA) for each code baseline prior to release to verify that the "as-built" system matches the "as-designed" configuration records.
Enforces strict repository-level control for every code change to guarantee integrity and traceability, maintains code baseline
Ensures critical systems maintain continuous authorization and remain resilient against cyber threats.
Drives a "shift-left" security model by embedding Security Impact Analysis (SIA) directly into the change and release lifecycle at intake. This allows for the early identification of control inheritance changes, boundary modifications, or documentation updates required to preserve the system's authorization posture
Identify opportunities where Natural Language Processing, Large Language Models, and other AI approaches can generate value for the public or improve internal processes.
Stay current on DevSecOps and AI trends, tools, and best practice.