DevSecOps Engineer

Quick Facts

• Role: DevSecOps Engineer (software-engineering-focused security)

• Duration: 6 months (long term)

• Work model: Hybrid onsite (4 days/week from day 1; transition to 100% onsite anticipated)

• Location: Washington, DC 20433

Description

DevSecOps Engineer for a geospatial solutions portfolio, serving as the primary application security and DevSecOps resource across multiple teams. The role combines hands-on code remediation (frontend and API), secure pipeline engineering, container/cloud security hardening, and close collaboration with product and engineering to strengthen security posture and release reliability.

Responsibilities

• Own application security and DevSecOps for multiple geospatial solution teams, including vulnerability management and security guidance

• Remediate vulnerabilities in frontend (JavaScript/TypeScript, Angular/React) and API codebases (Python/Node), including upgrading libraries/frameworks and refactoring for breaking changes

• Resolve vulnerabilities without upstream fixes using dependency overrides/pinning, patching/forking open-source libraries, or building/publishing custom dependency versions to the internal repository

• Operate and tune security scanning tools across the SDLC (Wiz, Dependabot, SAST, SCA, secrets scanning, container image scanning; optionally DAST and IaC scanning); triage and prioritize by severity, exploitability, and exposure

• Build, upgrade, and harden Docker images (update base images, remediate OS/package vulnerabilities, minimize attack surface) and publish approved images to Azure Container Registry and Amazon ECR

• Integrate security controls into CI/CD pipelines (Azure DevOps, Jenkins) with scanning gates, dependency/image policy enforcement, secrets management, and SBOM generation before production promotion

• Identify and remediate Azure/AWS cloud security misconfigurations using cloud security posture findings (least privilege, secure-by-default)

• Define remediation metrics/targets, report security posture and risk acceptances, and support audits/incidents

• Provide secure coding guidance aligned with OWASP Top 10; review code and dependency changes for security impact

• Support release management and Azure DevOps administration (repositories, pipelines, access controls, environments) with secure configuration and auditability

• Participate in PI Planning and SAFe Agile ceremonies; maintain documentation for security controls, remediation decisions, and secure pipeline configurations

Requirements

• Hands-on software development experience in frontend and API/backend technologies (JavaScript/TypeScript, Python, Node), including diagnosing and fixing breaking changes from upgrades

• Experience fixing security vulnerabilities via code and dependency changes, including transitive dependencies and cases without an upstream fix (patched/custom dependencies)

• Experience with application and cloud security tools (e.g., Wiz, Dependabot, GitHub Advanced Security/CodeQL, Veracode, SonarQube, Snyk, Trivy), including tuning and triage

• Strong application security knowledge (OWASP Top 10, secure coding practices, CVE/CVSS risk prioritization, software supply chain security such as SBOMs and dependency provenance)

• Strong working knowledge of Docker/container security (Dockerfiles, base image management, image vulnerability remediation, registry operations)

• Experience remediating security risks in Microsoft Azure and/or AWS (IAM and cloud security posture management)

• Experience building/maintaining CI/CD pipelines (Azure DevOps and/or Jenkins) with embedded security controls; knowledge of Git, code reviews, branching strategies, and secrets management

• Familiarity with Agile/SAFe practices (PI Planning, ART activities)

• Ability to propose solutions to moderately complex application security and secure delivery challenges

• Strong analytical, communication, and documentation skills; ability to explain security risks to technical and non-technical stakeholders in clear English

• Ability to manage multiple priorities while maintaining quality, security, and operational excellence

Benefits

Not specified in the provided posting.