DevSecOps Engineer

Support government and infrastructure cybersecurity engagements by strengthening application security and modernizing CI/CD delivery pipelines.

Responsibilities

• Assess application delivery toolchains and practices, including source control, build and release automation (for example, Jenkins and Bitbucket), artifact management (Artifactory), code quality (SonarQube), Infrastructure-as-Code and configuration management (Terraform, Ansible), and monitoring (Datadog); identify manual release steps and delivery gaps
• Evaluate application security posture to support rationalization, including:
  • Open vulnerabilities and outdated or vulnerable dependencies
  • SBOM availability
  • Secrets handling and authentication patterns
  • Open POA&Ms (plans of action and milestones)
• Design, build, and maintain secure CI/CD pipelines for the modernization factory with integrated security testing, including SAST/DAST, software composition analysis, container image scanning, and Infrastructure-as-Code scanning
• Add secrets detection, quality gates, and integrated security checks across delivery workflows
• Implement policy-as-code and automated evidence collection to support continuous Authorization to Operate (cATO) and NIST SP 800-53 control traceability
• Harden container images and environments against applicable security benchmarks (DISA STIGs or CIS Benchmarks)
• Integrate governance gates for AI-assisted development, including provenance, human review, and traceability for AI-generated code
• Define reference DevSecOps patterns and reusable pipeline templates for future modernization waves
• Report delivery and security metrics such as DORA metrics and vulnerability aging
• Support vulnerability triage and remediation guidance, collaborating with client cybersecurity and authorization stakeholders

Requirements

• Bachelor’s degree in computer science, software engineering, information systems, computer engineering, or related field, or equivalent practical experience
• 2+ years of experience in DevOps, software engineering, or security engineering
• Hands-on CI/CD pipeline engineering experience with Jenkins, GitHub Actions, GitLab CI, or Azure DevOps
• Experience using at least one application security scanning tool (for example, Fortify, Checkmarx, SonarQube, Snyk, Trivy, or OWASP ZAP)
• Working knowledge of containers and Infrastructure-as-Code
• Scripting skills in Python, PowerShell, or Bash
• Knowledge of the NIST Risk Management Framework, NIST SP 800-53, and secure software development lifecycle practices
• Ability to obtain and maintain a secret level clearance
• Comfort with in-person work as needed in the Washington, DC area

Technologies

• Jenkins, Bitbucket, GitHub Actions, GitLab CI, Azure DevOps
• Artifactory, SonarQube
• Terraform, Ansible
• Datadog
• SAST, DAST
• Software composition analysis, container image scanning, Infrastructure-as-Code scanning, secrets detection
• Policy-as-code: OPA/Gatekeeper, Azure Policy
• NIST SP 800-53
• DISA STIGs, CIS Benchmarks
• SBOM standards: CycloneDX, SPDX
• Certs and tooling examples listed: Fortify, Checkmarx, Snyk, Trivy, OWASP ZAP
• NIST Risk Management Framework, DORA metrics
• Scripting: Python, PowerShell, Bash

Ideally, You’ll Also Have

• Experience supporting continuous ATO or FedRAMP authorizations and managing POA&Ms
• Kubernetes security and policy engines (OPA/Gatekeeper, Azure Policy)
• SBOM tooling and standards (CycloneDX, SPDX)
• Certifications such as CompTIA Security+, CISSP, CCSP, Certified Kubernetes Security Specialist (CKS), or relevant GIAC certifications

Benefits

• Comprehensive compensation and benefits package, including medical and dental coverage, pension and 401(k) plans, and paid time off options
• Flexible vacation policy with time off for EY Paid Holidays, Winter/Summer breaks, Personal/Family Care, and other leaves of absence

Additional Location and Travel Notes

• Primary location: McLean
• Work may be required at client, EY, and/or contractor sites within a commutable distance
• In certain circumstances, travel may be required beyond the local work location based on client and project needs
• Willingness to travel 20–30% or more

Salary

• USD 82,500 - 148,500 per year
• Base salary ranges vary by office location; individual salaries are determined based on factors including education, experience, knowledge, skills, and geography

Requisition ID: 1749118

Date: Oct 2, 2026