Senior DevSecOps Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Act as the senior technical security engineering leader and Subject Matter Expert (SME) in Security Engineering.

• Oversee the hands-on remediation of security vulnerabilities, control gaps, and technical security liabilities.

• Convert security requirements, assessment results, vulnerabilities, and Plans of Action and Milestones (POA&Ms) into engineering solutions.

• Execute remediation through code, infrastructure, configurations, system rules, access policies, and other technical modifications.

• Design, implement, and maintain automated security quality gates within GitHub Actions and CI/CD pipelines.

• Enhance and integrate Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Software Composition Analysis (SCA), secret detection, dependency scanning, and other automated security evaluations.

• Create and uphold secure configuration baselines for cloud infrastructure and platform elements.

• Establish centralized secrets management and secure credential handling practices.

• Direct vulnerability remediation efforts across AWS infrastructure, containers, applications, dependencies, CI/CD pipelines, and shared platform components.

• Provision, secure, and maintain resilient CI/CD runner infrastructure in Virginia cloud environments.

• Automate patching, vulnerability remediation, and security configuration management processes.

• Enhance security logging, monitoring, and alerting systems for the detection and response to security incidents.

• Integrate platform systems with security monitoring and telemetry, including relevant CSOC and continuous monitoring requirements.

• Configure and refine AWS GuardDuty, AWS Security Hub CSPM, and associated AWS security services.

• Lead or assist in DAST/WASA, SAST, secret detection, and runtime security implementations.

• Collaborate with Risk Management Framework (RMF) and security personnel on the technical remediation of NIST SP 800-53 control deficiencies.

• Work alongside the Security Automation Engineer to generate reliable security evidence and measurable security posture data.

• Offer technical guidance to VA.gov product and engineering teams.

• Lead technical planning and requirements definition across various systems or engineering teams.

• Document security controls, remediation actions, architectural decisions, and operational procedures.

• Engage in technical reviews, incident response, troubleshooting, and participate in a 24/7 engineering on-call rotation.

⛳️ Requirements

• A Bachelor's degree and over 10 years of relevant experience, or an equivalent combination of education and experience.

• Extensive hands-on experience in DevSecOps, cloud infrastructure, platform engineering, Site Reliability Engineering, or security engineering.

• Advanced proficiency with AWS, ideally in complex production cloud environments.

• Strong experience in designing, implementing, and maintaining CI/CD pipelines, preferably using GitHub Actions.

• Experience in implementing security controls through infrastructure-as-code, configuration management, automation, or software development.

• Familiarity with the identification, prioritization, remediation, and validation of vulnerabilities.

• Experience with SAST, DAST, SCA, secret detection, container scanning, or similar security capabilities.

• Knowledge of infrastructure-as-code and configuration management technologies.

• Comprehensive understanding of cloud security, Identity and Access Management (IAM), secrets management, network security, logging, monitoring, and secure configuration practices.

• Experience with containerized workloads and modern cloud-native architectures.

• Proficient in one or more scripting or programming languages utilized for infrastructure and security automation.

• Capability to troubleshoot complex production infrastructure and security challenges across multiple technology stack layers.

• Ability to communicate technical security risks and remediation strategies to engineering, security, product, and program stakeholders.

• Capability to obtain and maintain the necessary background investigation and access to support Department of Veterans Affairs systems.

• Willingness to participate in a 24/7 on-call rotation.

• Must be a U.S. Citizen or Permanent Resident.

• Required to undergo and successfully complete a Public Trust clearance process.

• Preferred: experience with federal systems under NIST RMF; NIST SP 800-53 Rev. 5; FISMA Moderate or High systems; AWS GovCloud or VAEC; AWS security services; GitHub Actions runners; Kubernetes and container security; SBOM and software supply-chain security; continuous monitoring and security telemetry; security assessments and penetration testing; federal ATO processes, POA&Ms, and control evidence; technical leadership across multiple teams.

🏝️ Benefits

• Medical, Dental, and Vision coverage.

• Health Savings Account with company contribution when enrolled in an eligible plan.

• Company-paid Life, Accidental Death, Short-term & Long-term Disability insurance.

• Voluntary Accident, Hospital Indemnity, & Critical Care Insurance options.

• Voluntary Medical & Dependent Care Flexible Spending Accounts.

• Accrued Paid Time Off.

• Company-paid Holidays.

• 401(k) Retirement Plan with Company match.