DevSecOps Engineer

DevSecOps Engineer

Remote Role Contract

Key Responsibilities:

• Support DevSecOps initiatives by developing and implementing test-driven security within a CI/CD pipeline
• Create automation to support the NIST Risk Management Framework (SP800-37, SP800-53/53a)
• Develop and track Plan of Action and Milestones (POA&Ms) to address identified security vulnerabilities and compliance gaps
• Able to document clear and repeatable process and train others to be able to perform automated assessment reviews
• Develop and implement security assessment automation tools to support DevSecOps practices
• Collaborate with development teams to integrate security assurance into the CI/CD pipeline
• Conduct security assessments and risk analyses on new and existing software
• Provide Subject Matter Expertise in the creation of security policies, standards
• Develop and document procedures specific to the role
• Work closely with compliance teams to ensure continuous monitoring and authorization
• Assist in developing security training and awareness for technical staff
• Stay current with evolving security landscape, industry trends, tools, and best practices

Required Qualifications:

• Bachelor's degree in Computer Science, Information Security, or a related field (preferred)
• Proven experience with security assessment tools and methodologies
• Experience with wide range of programming languages, automation tools and scripting languages (e.g., Python, Ruby, Go, Bash/Shell, JavaScript/Node.js, Groovy, YAML/JSON, PowerShell, Java, Terraform)
• Understanding languages in the context of various DevSecOps tools and platforms like Docker, Kubernetes, Ansible, Chef, Puppet, Jenkins, GitLab CI, and cloud service providers (AWS, Azure, GCP)
• Experience with Policy as Code and Compliance as Code
• Knowledge of compliance frameworks and continuous authorization processes. Prefer NIST SP800-37, SP800-53/53a
• Excellent communication skills and the ability to work collaboratively
• Operational vulnerability analysis
• Deep understanding of Dev/Sec/Ops processes and testing

Preferred Qualifications:

• Certifications such as GCSA, CISSP, CEH, or OSCP
• Experience in a policy and assurance or quasi-governmental environment
• Familiarity with cloud service providers and associated security challenges