DevSecOps Engineer

TISTA is seeking a Dev Sec Ops  Engineer to support the Department of Veterans Affairs (VA) Supply Chain Management Dev Sec Ops  program. This role will partner with VA stakeholders and Agile delivery teams to translate business needs into clear, actionable requirements supporting supply chain and logistics solutions.

The Dev Sec Ops  Engineer / Security Specialist is the hands-on pipeline security engineer for TISTA's prime contract performance on the Department of Veterans Affairs Supply Chain Management Dev Sec Ops  (SCMDSO) task order supporting VA's supply chain and logistics Product Line. Where the Cyber Security Architect / Policy Lead defines the security architecture, policy interpretation, and Guardrails-as-Code standard, and the Engineer Solution Lead owns the platform and pipeline infrastructure, the Dev Sec Ops  Engineer / Security Specialist makes security real inside every build.

This position embeds automated security scanning, software bill of materials generation, container and configuration hardening, secrets management, and vulnerability remediation tracking into the CI/CD pipelines used by every Scrum Team, and produces the security evidence that keeps every product's Authority to Operate current.

At TISTA, you’ll do meaningful, mission‑driven work that improves lives alongside teammates you trust and leaders who are transparent and supportive. We invest in your learning and internal mobility so you can build a career that keeps advancing. We’re proud to serve and hire Veterans, and we put people first in everything we do.

• Industry Healthcare Benefits
• Remote Working Options
• Paid Time Off
• Training/Certification opportunities
• Healthcare Savings Account & Flexible Savings Account
• Paid Life Insurance
• Short-term & Long-term Disability
• 401K Match
• Tuition Reimbursement
• Employee Assistance Program
• Paid Holidays
• Military Leave
• and much more!

• Embed automated "Guardrails-as-Code" into all CI/CD pipelines, enforcing security scans (SAST/DAST), SBOM generation, and strict policy gates that block builds with critical vulnerabilities.
• Manage secrets, cryptographic code signing, and artifact integrity while maintaining hardened, compliant container images and automating configuration drift detection.
• Triage and resolve security vulnerabilities within strict deadlines (5 days for Critical, 10 days for High), ensuring zero unaccepted high-level risks reach production.
• Automate the collection of security evidence to support Continuous Assessment and Authorization (ATO) and ensure all systems meet VA and FedRAMP compliance standards.
• Implement Zero Trust architecture, strict access controls, logging, and comprehensive cloud security measures across VA Enterprise Cloud, AWS, and Azure environments.
• Mentor development teams on secure coding practices, guide security design reviews, and rigorously validate the safety of AI-generated code and test scripts.
• Drive security incident response efforts—including rapid component isolation, forensics, and strict 1-hour reporting windows—and participate in after-hours escalation rotations.
• Support business growth by contributing Dev Sec Ops  strategies to proposals, tracking pipeline security performance metrics, and interviewing technical talent to build a strong team bench.
• Advance corporate thought leadership by developing reusable pipeline security templates, leading internal cybersecurity communities, and supporting corporate quality assessments.

• 7+ years in IT security or Dev Sec Ops , including at least 4 years integrating continuous security controls into CI/CD pipelines for federal Agile/SAFe programs.
• 3+ years of hands‑on experience managing automated pipeline security, including SAST/DAST, container scanning, secrets…