Iac Security Engineer Jobs

1 job found

Today

Government and Infrastructure - Cybersecurity - DevSecOps Senior Engineer

EY McLean, VA

McLean, VA

Today

$105k - $210k/yr Full time Application Security Container Security Cybersecurity Tools

Apply Now

Job Description

The DevSecOps Senior Engineer will join EY’s Government & Infrastructure cybersecurity team in McLean, VA to assess application delivery and security maturity, then design and implement secure CI/CD practices that support modernization goals, continuous authorization, and NIST-aligned control traceability.

Role Focus

As a Senior Consultant, you will help ensure security is embedded into the software delivery lifecycle by building secure CI/CD pipelines, automating evidence collection, and standardizing DevSecOps patterns and metrics for authorization-ready modernization efforts.

Key Responsibilities

Assess application delivery toolchains and practices, including source control, build and release automation (for example, Jenkins and Bitbucket), artifact management (Artifactory), code quality (SonarQube), Infrastructure-as-Code and configuration management (Terraform, Ansible), and monitoring (Datadog), and identify manual release processes and gaps.
Evaluate application security posture for rationalization, including open vulnerabilities, outdated or vulnerable dependencies, SBOM availability, secrets handling, authentication patterns, and open POA&Ms.
Design, build, and maintain secure CI/CD pipelines for the modernization factory with integrated SAST/DAST, software composition analysis, container image scanning, Infrastructure-as-Code scanning, secrets detection, and quality gates.
Implement policy-as-code and automated evidence collection to support continuous Authorization to Operate (cATO) and NIST SP 800-53 control traceability.
Harden container images and environments against applicable security configuration benchmarks, including DISA STIGs or CIS Benchmarks.
Integrate governance gates for AI-assisted development, covering provenance, human review, and traceability of AI-generated code.
Define reference DevSecOps patterns and reusable pipeline templates for future modernization waves, and report delivery and security metrics such as DORA metrics and vulnerability aging.
Support vulnerability triage and remediation guidance, collaborating with client cybersecurity and authorization stakeholders.
Own DevSecOps architecture and toolchain standards for the team.
Lead the security-posture assessment methodology and ensure findings are scored consistently across the portfolio.
Act as the primary security engineering contact for client cybersecurity stakeholders and prepare artifacts for authorization reviews.
Mentor a Staff DevSecOps engineer and reinforce secure engineering practices across the team.

Required Qualifications

Bachelor’s degree in computer science, software engineering, information systems, computer engineering, or a related field, or equivalent practical experience.
3-6+ years of experience in DevOps, software engineering, or security engineering.
Hands-on CI/CD pipeline engineering using Jenkins, GitHub Actions, GitLab CI, or Azure DevOps.
Experience with at least one application security scanning tool, such as Fortify, Checkmarx, SonarQube, Snyk, Trivy, or OWASP ZAP.
Working knowledge of containers and Infrastructure-as-Code.
Scripting experience in Python, PowerShell, or Bash.
Understanding of the NIST Risk Management Framework, NIST SP 800-53, and secure software development lifecycle practices.
Ability to obtain and maintain a secret level clearance.
Comfort working in-person as needed in the Washington, DC area.

Technologies and Tooling

Jenkins, Bitbucket, Artifactory, SonarQube, Terraform, Ansible, Datadog
SAST, DAST, software composition analysis, container image scanning, Infrastructure-as-Code scanning, secrets detection
Policy-as-code, cATO, NIST SP 800-53, DISA STIGs, CIS Benchmarks, DORA metrics
AI-assisted development with governance gates for provenance, human review, and traceability
CI/CD platforms: GitHub Actions, GitLab CI, Azure DevOps
Security scanning tools: Fortify, Checkmarx, Snyk, Trivy, OWASP ZAP
NIST Risk Management Framework, SBOM with standards such as CycloneDX and SPDX
Kubernetes security and policy engines (OPA/Gatekeeper, Azure Policy)
Programming and scripting: Python, PowerShell, Bash

Compensation and Benefits

Salary: USD 104,800 - 209,700 per year
Comprehensive compensation and benefits package
Medical and dental coverage
Pension and 401(k) plans
Paid time off options, including paid time off for designated EY Paid Holidays and Winter/Summer breaks, Personal/Family Care, and other leaves of absence

Location, Travel, and Work Setting

Location: McLean, VA (onsite)
Work may be required to be completed at client, EY, and/or contractor sites, with professionals assigned within a commutable distance of the work location office.
In certain circumstances, travel may be required beyond the work location based on client and project needs.
Candidates should be willing to travel 20-30% or more.

Additional Preferred Qualifications

Experience supporting continuous ATO or FedRAMP authorizations and managing POA&Ms.
Kubernetes security and policy engines (OPA/Gatekeeper, Azure Policy).
SBOM tooling and standards (CycloneDX, SPDX).
Certifications such as CompTIA Security+, CISSP, CCSP, Certified Kubernetes Security Specialist (CKS), or relevant GIAC certifications.

Posting Details

Date: Oct 2, 2026
Requisition ID: 1749123

View full job page →

Get Iac Security Engineer Jobs alerts

New Iac Security Engineer Jobs, daily.