- Location
- Herndon, Virginia, United States · published
- Workplace
- Hybrid
- Type
- Full-time
- Department
- Engineering
- Source
- Workable
Description
DevSecOps Engineer
Location: Herndon, VA (Hybrid Work)
Preferred: US Citizenship
Experience: 3+yrs & 8 yrs
The DevSecOps Engineer is the architect and guardian of DevSecOps, Test Automation, and Security Automation. This role ensures the operational efficiency and continuous improvement of these solutions, embedding security and quality into every stage of the software delivery lifecycle. The engineer builds comprehensive CI/CD pipelines that carry code from source to production while ensuring compliance with applicable security, credentialing, and privacy policies, and integrates those pipelines with CMDB, reporting, and monitoring systems to support configuration management, asset management, governance, and performance and compliance tracking.
Key Responsibilities
DevSecOps Architecture and Pipeline Engineering
- Design, build, and maintain end-to-end CI/CD pipelines that move code from source control to production in a reliable and repeatable way.
- Build, package, and deploy applications on AWS (container, serverless, and VM-based workloads) through automated pipelines, with controlled promotion across dev, test, staging, and production, blue/green or canary releases, and automated rollback.
- Define and maintain pipeline standards, templates, and infrastructure-as-code patterns for reuse across teams.
- Continuously refine pipelines to improve speed, reliability, and efficiency.
- Establish and maintain comprehensive automated testing within pipelines, including unit, integration, functional, regression, and performance tests.
- Integrate automated security controls into pipelines, such as SAST, DAST, SCA, secrets detection, container and image scanning, and IaC scanning.
- Ensure all pipelines and deployed solutions comply with applicable security, credentialing, and privacy policies.
- Partner with security, privacy, and compliance stakeholders to translate policy requirements into automated controls.
- Build dashboards and metrics (e.g., deployment frequency, lead time, change failure rate, mean time to remediate vulnerabilities) for leadership and governance bodies.
- Coach development and operations teams on secure coding, pipeline use, and automation best practices.