AWS DevSecOps Engineer

VITG is seeking a DevSecOps Engineer responsible for automating security integration throughout the CI/CD pipeline and the AWS cloud environment.

The DevSecOps Engineer provides hands‑on expertise to integrate and maintain the security posture for corporate systems that support Federal programs, ensuring a successful program Authority To Operate (ATO). You will develop, monitor, and maintain systems and procedures to safeguard internal information systems, networks, and CI/CD pipelines through automation.

• US citizen or authorized to work in the United States
• Must have lived in the USA for three years of the last five years
• Must be able to obtain a US federal government badge and be eligible for Public Trust clearance
• Must be able to pass a background check, including a drug test

Job Responsibilities

• Develop, implement, and maintain security automation throughout the entire SDLC, integrating security into the CI/CD pipelines using Jenkins/GitHub and Infrastructure‑as‑Code principles.
• Run and manage security scans with tools such as Snyk (SAST/SCA) and establish automated tracking and enforcement mechanisms for vulnerability remediation.
• Integrate and manage security workloads running on AWS containers and ensure container image scanning and runtime security policies are enforced.
• Design, manage, and maintain source code for AWS infrastructure in GitHub and manage automated pipelines, ensuring security checks and gates are embedded in every deployment.
• Maintain security information on JIRA/Confluence and participate in agile DevSecOps practices, promoting a “Secure‑by‑Design” culture.
• Provide hands‑on support for developing, coordinating, implementing, and enforcing information systems security policies, standards, and methodologies as code.
• Maintain operational security posture for Enterprise Salesforce FISMA system by ensuring security is baked into configuration and deployment practices.
• Implement security tools, usage, and policy‑as‑code to ensure configurations remain compliant and properly configured, ensuring a successful program ATO.
• Automate vulnerability/risk assessment analysis to support continuous monitoring and authorization.
• Manage changes to the system and assess the security impact of those changes through automated compliance checks.
• Assist with the management of security aspects of the information system and perform day‑to‑day security operations of the system.
• Evaluate security solutions to ensure they meet security requirements for processing classified information.
• Perform vulnerability/risk assessment analysis to support certification and accreditation.
• Prepare and review documentation including System Security Plans (SSPs), Risk Assessment Reports, Certification and Accreditation packages, and System Requirements Traceability Matrices (SRTMs).

Qualifications & Skills

• Bachelor’s or Master’s degree in Computer Science, Engineering, Information Technology, or a related discipline.
• Minimum of 6 years in Information Technology, including 4 years in the DevSecOps or Application Security space.
• Hands‑on experience in cloud environments such as AWS Commercial and GovCloud, specifically with security automation, logging, and monitoring services (e.g., GuardDuty, Security Hub, CloudTrail).
• Expertise in CI/CD pipeline management and the integration of security tools for SAST, DAST, and SCA.
• Strong hands‑on experience with AWS, Snyk, GitHub, JIRA, and Confluence to implement and manage the end‑to‑end DevSecOps toolchain.
• Experience with Infrastructure‑as‑Code security (e.g., Checkov or Terrascan on Terraform/CloudFormation).
• Preferred: Experience with Salesforce Platform and tool ecosystem.
• Preferred: Salesforce or any other platform tool – configuration/setup of external client applications and secure communications (TLS).
• Preferred: AppOmni – ability to manage issues, perform new org additions and configurations.
• Strong background in the certification and accreditation process (ATO) and the ability to automate compliance checks against frameworks like FISMA, NIST, and FedRAMP.
• Knowledge of business security practices, current security automation tools, and policy‑as‑code implementation.
• Experience with vulnerability assessment and penetration testing processes, focusing on automating these checks.
• Experience with Government Agency Security Assessment Process in support of maintaining and/or establishing an ATO and the appropriate boundary.
• Knowledge of guidelines such as FISMA, NIST, HIPAA, and IRS Pub‑1075 (preferred).

Preferred Certifications

• AWS DevOps or SysOps certification or equivalent.
• Industry certifications such as CISSP, CEH, or GIAC.

Job Type

Full Time

Benefits

• 401(k) with employer contribution
• Medical/Dental/Vision insurance (option for full coverage for employee)
• Life, STD/LTD insurance

Schedule

• 8‑hour shift
• May include minimal after‑hours support depending on deployment schedule

Work Type

• Hybrid remote in Ellicott City, MD 21043
• 1 to 2 days in office weekly

Seniority Level

Mid‑Senior level

Employment Type

Full‑time

Job Function

Information Technology

Referrals increase your chances of interviewing at VITG by 2x.

#J-18808-Ljbffr