DevSecOps Engineer Role

The work

Dev Sec Ops  Engineers make secure delivery repeatable. They design the CI/CD paths, deployment controls, and operational feedback loops that carry software from a change in source code to a running service. In federal environments, that work also includes assembling and maintaining security evidence for an Authority to Operate (ATO), the formal decision to allow a system to operate at an accepted level of risk.

The role works across development, operations, and security. Dev Sec Ops  Engineers automate build, test, deployment, configuration, vulnerability management, logging, and recovery practices so teams can release with visible controls and usable evidence. They partner with Cloud Infrastructure Engineers who provide the underlying platform, while they own the delivery path and its security integration.

• CI/CD pipelines that run tests, security checks, approvals, and deployments consistently.
• Infrastructure-as-code modules and deployment patterns that are versioned and reviewable.
• Container build, image-scanning, and release processes for application workloads.
• Observability and vulnerability-management workflows that turn operating signals into action.
• Control evidence and traceability that support authorization, assessment, and continuous monitoring.

You treat security, reliability, and delivery speed as one engineering problem. You look for manual deployment steps, unreviewed configuration changes, and missing evidence because each makes a system harder to operate and defend.

You can work across specialties without blurring accountability. You understand enough application engineering, cloud infrastructure, and security practice to create a dependable delivery system, communicate tradeoffs clearly, and help teams use it.

• Hands-on experience with source control, automated testing, CI/CD, and deployment automation.
• Infrastructure-as-code experience with tools such as Terraform, Amazon Web Services Cloud Formation, or comparable platforms.
• Working knowledge of container security, software supply-chain controls, and vulnerability remediation.
• Experience with logging, monitoring, incident response, and recovery practices.
• Ability to translate National Institute of Standards and Technology (NIST) Special Publication 800-53 control expectations into engineering work and evidence.

Some openings may ask for experience supporting an ATO or working with the Risk Management Framework, a structured NIST process for managing security risk. Others may focus on a specific cloud, orchestration platform, programming language, or delivery toolchain.

Openings with production accountability may require demonstrated work with on-call operations, incident response, security assessments, or regulated release controls. Requirements should distinguish responsibility for the delivery pipeline from responsibility for the underlying cloud environment or independent security assessment.

Compensation, benefits, work location, and employment terms are set for each specific opening and will be stated with that opening.