Jobs / EY
Government and Infrastructure - Cybersecurity - DevSecOps Engineer
EY · McLean, VA, United States
McLean, VA, United StatesExp: 2+ yrs82,500-148,500 USD/yearlyOnsite
Remuneration
$99,100–$148,500 (New York City, Boston, and Washington DC Metro Areas, Washington State, and Southern California offices); $103,100–$154,600 (Bay Area California offices); $82,500–$136,000 (all other US office locations, including Sacramento); medical and dental coverage; pension and 401(k) plans; paid time off
Location
McLean, VA, United States
Visa sponsorship
Not specified
Job summary
The DevSecOps Engineer assesses application delivery practices and security posture to inform modernization decisions, then builds secure pipelines, controls, and automated evidence for software delivery. The role integrates security testing into CI/CD, supports continuous Authorization to Operate and NIST SP 800-53 traceability, hardens containers against DISA STIGs or CIS Benchmarks, and establishes reusable pipeline patterns and delivery security metrics.
Benefits
Medical and dental coveragePension and 401(k) plansPaid time offPaid holidaysWinter and summer breaksPersonal and family care leave
Qualifications
- Bachelor's degree in a related field or equivalent practical experience.
- At least 2 years of experience in DevOps, software engineering, or security engineering.
- Hands-on CI/CD pipeline engineering with Jenkins, GitHub Actions, GitLab CI, or Azure DevOps.
- Experience with at least one application security scanning tool, such as Fortify, Checkmarx, SonarQube, Snyk, Trivy, or OWASP ZAP.
- Working knowledge of containers and Infrastructure as Code.
- Scripting experience with Python, PowerShell, or Bash.
- Understanding of the NIST Risk Management Framework, NIST SP 800-53, and secure software development lifecycle practices.
- Ability to obtain and maintain a secret-level clearance.
- Ability to work in person as needed in the Washington, DC area.
Responsibilities
- Assess application delivery toolchains and practices, including source control, build and release automation, artifact management, code quality, Infrastructure as Code, and monitoring.
- Assess application security posture, including vulnerabilities, dependency risks, software bill of materials availability, secrets handling, authentication patterns, and open POA&Ms.
- Build and maintain secure CI/CD pipelines with application security testing, software composition analysis, container scanning, Infrastructure-as-Code scanning, secrets detection, and quality gates.
- Implement policy as code and automated evidence collection for continuous Authorization to Operate and NIST SP 800-53 control traceability.
- Harden container images and environments against DISA STIGs or CIS Benchmarks.
- Integrate governance gates for AI-assisted development, including provenance, human review, and traceability of generated code.
- Define reusable DevSecOps patterns and pipeline templates, and report delivery and security metrics.
- Support vulnerability triage and remediation and collaborate with cybersecurity and authorization stakeholders.
Skills
AnsibleArtifactoryAzureAzure DevOpsBashBitbucketDatadogGatekeeperGitHubGitHub ActionsGitLabGitLab CIJenkinsKubernetesOpen Policy AgentPowerShellPythonSnykSonarQubeTerraformTrivyDocker
Certifications
CompTIA Security+CISSPCCSPCertified Kubernetes Security Specialist (CKS)GIAC certifications
Degrees
Bachelor's degree in computer science, software engineering, information systems
Travel
20–30% or more, based on client and project needs
Industry
Government and infrastructureFederal, state, local, and education
Security clearance
Must be able to obtain and maintain a secret-level clearance
Relocation
No