DevSecOps Engineer II

If you are unable to complete this application due to a disability, contact this employer to ask for an accommodation or an alternative application process.

Full Time Professional Herndon, VA, US

2 days ago Requisition

Salary Range: $ To $ Annually

Remote/Hybrid - DHS CISA; approved remote work location within the 50 United States or the District of Columbia. Government facility attendance may be required.

Monday through Friday, 8:00 a.m. to 5:00 p.m. Eastern Time; core availability 9:00 a.m. to 3:00 p.m., excluding federal holidays.

Must obtain and maintain a favorable DHS/CISA Entry on Duty or fitness determination and complete the background investigation appropriate to the position’s sensitivity and required access.

Must be authorized to work in the United States and meet DHS/CISA personnel and system access requirements.

AttainX is seeking a Dev Sec Ops  Engineer II to integrate security practices throughout the Dev Ops lifecycle for CISA’s Docu Sign implementation and integrations, ensuring secure deployment of high-quality IT infrastructure. This role works independently and collaboratively, contributes to moderately complex project activities, and applies secure automation, Infrastructure as Code, and continuous integration and deployment practices.

• 3-5 years of related experience in Dev Sec Ops , software engineering, infrastructure automation, or security engineering.
• A bachelor’s degree in computer science, cybersecurity, information systems, engineering, or a related field.
• Proficiency with CI/CD tools such as Jenkins, Git Lab, or Azure Dev Ops, including pipeline automation, version control, Infrastructure as Code, and controlled deployments.
• Experience with static application security testing (SAST), dynamic application security testing (DAST), software composition analysis (SCA), vulnerability scanning, and penetration testing frameworks.
• Experience programming or scripting in one or more languages such as Python, Perl, Bash, PHP, Power Shell, Java, SQL, or C++.
• Knowledge of security principles, practices, and technologies, including encryption, authentication, authorization, network security, and secure handling of credentials and secrets.
• Experience with REST APIs, connectors, webhooks, SaaS integrations, and Microsoft 365 or enterprise identity platforms;
  Docu Sign integration experience is preferred.
• Experience supporting lifecycle testing, technical documentation, Federal security requirements, and Section 508 accessibility compliance.
• Ability to work independently and collaborate with architects, developers, security engineers, and stakeholders on moderately complex project activities.
• Must be a US Citizen able to obtain a DHS CISA Public Trust clearance.

• Integrate security practices throughout the development, testing, deployment, and operation of Docu Sign integrations and supporting infrastructure.
• Design, implement, and maintain security controls across CI/CD pipelines; automate SAST, DAST, SCA, and other security checks to identify risks before deployment.
• Perform regular security assessments, vulnerability scanning, and authorized penetration testing within approved scope; prioritize findings and coordinate remediation with development and security teams.
• Implement Infrastructure as Code, automated testing, and controlled release and rollback procedures to support secure, reliable delivery.
• Configure and maintain Docu Sign accounts, groups, templates, routing rules, administrative settings, policies, alerts, and approved branding.
• Build and maintain plugins, connectors, and custom APIs for automated envelope creation, routing, and archival; integrate Docu Sign with Microsoft 365, enterprise identity systems, and contract or case platforms.
• Implement encryption, secure authentication, authorization, role-based access, network and boundary protection, and secure credential handling; monitor logs and systems for threats and elevate findings.
• Develop, maintain, and enforce security policies and procedures aligned with Federal, DHS, and CISA requirements and approved development and deployment practices.
• Execute developmental and operational tests; document defects, security findings, remediation, test results, and deployment readiness.
• Automate document conversion and records capture while preserving NARA-compliant formats, metadata consistency, and disposition requirements.
• Document configurations,…