Platform Security Engineer

Booz Allen Hamilton•McLean, VA

19h

About The Position

Apply DevSecOps expertise to integrate and enhance security in software delivery pipelines, fortify mission-critical systems, and support compliance with Department of War (DoW) cybersecurity mandates. The Platform Security Engineer serves as a technical expert in secure development practices and continuous improvement across the CI/CD ecosystem. The role evolves secure CI/CD pipelines by integrating and automating security tools such as SAST, DAST, SCA, and container scanning to meet DoW requirements and reduce operational risk. It improves vulnerability detection thresholds, tunes scanners, reduces false positives, and optimizes remediation workflows. The engineer hardens infrastructure-as-code templates, including Terraform, enforces policy-as-code, conducts risk assessments, and contributes to system security plans (SSPs) and continuous ATO efforts. The role collaborates with development, operations, and security teams to support secure software delivery, monitors pipeline activity for anomalies, assists with security incident response, and champions Zero Trust principles across the SDLC.

Requirements

At least 5 years of cybersecurity engineering experience, including DevSecOps in federal or defense environments using IaC/CaC, CI/CD, and SDLC concepts.
At least 3 years of software engineering experience using Python, TypeScript, or Bash and automation frameworks.
At least 2 years of experience implementing cybersecurity solutions in AWS cloud and container orchestration such as Kubernetes.
Experience with AI software development, Claude Code, Codex, or Pi.
Experience using Agile and Change Management methodologies.
Knowledge of cybersecurity best practices and threat-based cybersecurity frameworks, including AI/ML security best practices.
Knowledge of NIST SP 800-53 controls, RMF compliance, eMASS, STIG Manager, STIG Viewer, and SCAP tools.
Ability to obtain a Secret clearance.
High school diploma or GED.

Nice To Haves

Experience reviewing code samples and applying whitelisting or exemption processes.
Experience developing Zero Trust security solutions for DevSecOps pipelines.
Experience evaluating security tools and assessing their fit for Development or Operational environments.
Knowledge of GRC engineering practices, including policy-as-code implementation, automated compliance validation, continuous control monitoring, security control mapping such as NIST 800-53, RMF, or CIS, risk assessment automation, POA&M management, audit evidence collection, compliance reporting, and integrating GRC requirements into CI/CD and DevSecOps workflows.
Excellent verbal, technical writing, and documentation skills.
Possession of a Secret clearance.
Bachelor’s degree in Cybersecurity, Computer Science, or a related field.
Security+, AWS Solutions Architect, AWS Security, or CISSP certifications.

Responsibilities

Integrate and automate SAST, DAST, SCA, and container-scanning tools in secure CI/CD pipelines to meet DoW requirements and reduce operational risk.
Refine vulnerability detection thresholds, tune scanners, reduce false positives, and optimize remediation workflows.
Harden infrastructure-as-code templates, including Terraform, and enforce policy-as-code across environments.
Conduct risk assessments and contribute to system security plans (SSPs) and continuous ATO efforts.
Collaborate with development, operations, and security teams to support secure software delivery.
Monitor pipeline activity for anomalies and assist in responding to security incidents.
Champion Zero Trust principles and drive their adoption across the SDLC.