DevSecOps Engineer - Government & Infrastructure

Ernst & Young Advisory Services Sdn Bhd; McLean (VA); On-site; USD 83,000 - 136,000; Full time

Job summary

Ernst & Young Advisory Services Sdn Bhd in McLean, VA is seeking a DevSecOps Engineer Consultant to join the Government & Infrastructure cybersecurity practice. You will assess toolchains, design secure pipelines, and implement automated evidence for ongoing authorization and control tracing.

The role emphasizes building secure CI/CD, integrating SAST/DAST, container hardening, and policy-as-code, with collaboration across client security and authorization stakeholders.

Qualifications

• Bachelor’s degree in CS/engineering or related field or equivalent experience.
• 2+ years in DevOps, software or security engineering.
• Hands-on CI/CD pipeline engineering with Jenkins, GitHub Actions, GitLab CI or Azure DevOps.
• Experience with at least one application security scanning tool (Fortify, Checkmarx, SonarQube, Snyk, Trivy, OWASP ZAP).
• Working knowledge of containers and Infrastructure-as-Code.
• Scripting: Python, PowerShell or Bash.
• Familiarity with NIST RMF and secure SDLC practices.

Responsibilities

• Assess delivery toolchains and identify gaps in build, release, and artifact management.
• Design, build and maintain secure CI/CD pipelines with SAST/DAST and SCA.
• Implement policy-as-code and automated evidence for cATO and NIST 800-53 traceability.
• Harden container images and environments against benchmarks.
• Define reusable DevSecOps patterns and report metrics.

Skills

CI/CD pipelines

Security concepts

Communication to executives

Education

Bachelor's degree or equivalent

Tools

Jenkins

GitHub Actions

GitLab CI

Azure DevOps

Fortify

Checkmarx

SonarQube

Snyk

Trivy

OWASP ZAP

Terraform

Ansible

Datadog

Job description

Ernst & Young Advisory Services Sdn Bhd in McLean, VA is seeking a DevSecOps Engineer Consultant to join the Government & Infrastructure cybersecurity practice. You will assess toolchains, design secure pipelines, and implement automated evidence for ongoing authorization and control tracing.

The role emphasizes building secure CI/CD, integrating SAST/DAST, container hardening, and policy-as-code, with collaboration across client security and authorization stakeholders.