Government and Infrastructure - Cybersecurity - DevSecOps Senior Engineer

The DevSecOps Senior Engineer will join EY’s Government & Infrastructure cybersecurity team in McLean, VA to assess application delivery and security maturity, then design and implement secure CI/CD practices that support modernization goals, continuous authorization, and NIST-aligned control traceability.

Role Focus

As a Senior Consultant, you will help ensure security is embedded into the software delivery lifecycle by building secure CI/CD pipelines, automating evidence collection, and standardizing DevSecOps patterns and metrics for authorization-ready modernization efforts.

Key Responsibilities

• Assess application delivery toolchains and practices, including source control, build and release automation (for example, Jenkins and Bitbucket), artifact management (Artifactory), code quality (SonarQube), Infrastructure-as-Code and configuration management (Terraform, Ansible), and monitoring (Datadog), and identify manual release processes and gaps.
• Evaluate application security posture for rationalization, including open vulnerabilities, outdated or vulnerable dependencies, SBOM availability, secrets handling, authentication patterns, and open POA&Ms.
• Design, build, and maintain secure CI/CD pipelines for the modernization factory with integrated SAST/DAST, software composition analysis, container image scanning, Infrastructure-as-Code scanning, secrets detection, and quality gates.
• Implement policy-as-code and automated evidence collection to support continuous Authorization to Operate (cATO) and NIST SP 800-53 control traceability.
• Harden container images and environments against applicable security configuration benchmarks, including DISA STIGs or CIS Benchmarks.
• Integrate governance gates for AI-assisted development, covering provenance, human review, and traceability of AI-generated code.
• Define reference DevSecOps patterns and reusable pipeline templates for future modernization waves, and report delivery and security metrics such as DORA metrics and vulnerability aging.
• Support vulnerability triage and remediation guidance, collaborating with client cybersecurity and authorization stakeholders.
• Own DevSecOps architecture and toolchain standards for the team.
• Lead the security-posture assessment methodology and ensure findings are scored consistently across the portfolio.
• Act as the primary security engineering contact for client cybersecurity stakeholders and prepare artifacts for authorization reviews.
• Mentor a Staff DevSecOps engineer and reinforce secure engineering practices across the team.

Required Qualifications

• Bachelor’s degree in computer science, software engineering, information systems, computer engineering, or a related field, or equivalent practical experience.
• 3-6+ years of experience in DevOps, software engineering, or security engineering.
• Hands-on CI/CD pipeline engineering using Jenkins, GitHub Actions, GitLab CI, or Azure DevOps.
• Experience with at least one application security scanning tool, such as Fortify, Checkmarx, SonarQube, Snyk, Trivy, or OWASP ZAP.
• Working knowledge of containers and Infrastructure-as-Code.
• Scripting experience in Python, PowerShell, or Bash.
• Understanding of the NIST Risk Management Framework, NIST SP 800-53, and secure software development lifecycle practices.
• Ability to obtain and maintain a secret level clearance.
• Comfort working in-person as needed in the Washington, DC area.

Technologies and Tooling

• Jenkins, Bitbucket, Artifactory, SonarQube, Terraform, Ansible, Datadog
• SAST, DAST, software composition analysis, container image scanning, Infrastructure-as-Code scanning, secrets detection
• Policy-as-code, cATO, NIST SP 800-53, DISA STIGs, CIS Benchmarks, DORA metrics
• AI-assisted development with governance gates for provenance, human review, and traceability
• CI/CD platforms: GitHub Actions, GitLab CI, Azure DevOps
• Security scanning tools: Fortify, Checkmarx, Snyk, Trivy, OWASP ZAP
• NIST Risk Management Framework, SBOM with standards such as CycloneDX and SPDX
• Kubernetes security and policy engines (OPA/Gatekeeper, Azure Policy)
• Programming and scripting: Python, PowerShell, Bash

Compensation and Benefits

• Salary: USD 104,800 - 209,700 per year
• Comprehensive compensation and benefits package
• Medical and dental coverage
• Pension and 401(k) plans
• Paid time off options, including paid time off for designated EY Paid Holidays and Winter/Summer breaks, Personal/Family Care, and other leaves of absence

Location, Travel, and Work Setting

• Location: McLean, VA (onsite)
• Work may be required to be completed at client, EY, and/or contractor sites, with professionals assigned within a commutable distance of the work location office.
• In certain circumstances, travel may be required beyond the work location based on client and project needs.
• Candidates should be willing to travel 20-30% or more.

Additional Preferred Qualifications

• Experience supporting continuous ATO or FedRAMP authorizations and managing POA&Ms.
• Kubernetes security and policy engines (OPA/Gatekeeper, Azure Policy).
• SBOM tooling and standards (CycloneDX, SPDX).
• Certifications such as CompTIA Security+, CISSP, CCSP, Certified Kubernetes Security Specialist (CKS), or relevant GIAC certifications.

Posting Details

• Date: Oct 2, 2026
• Requisition ID: 1749123