DevSecOps Engineer - Secure SDLC & Artifact Management

Geospatial And Cloud Analytics Inc; Virginia; Hybrid; USD 120,000 - 160,000; Full time

Benefits offered by this job

401(k) matching

Dental insurance

Health insurance

Vision insurance

Paid time off

Parental leave

PTO Cash Out

Disability insurance

Life insurance

AD&D Insurance

Medical, Prescription coverage

Job summary

Geospatial And Cloud Analytics Inc. seeks a Software Engineer SME (DevSecOps) to migrate mission-critical apps to secure toolchains and strengthen the software supply chain. You will guide secure SDLC practices across diverse environments and support SBOM development while ensuring DON-CIO policy compliance.

The role requires hands-on work with artifact platforms, SAST/DAST tooling, and Zero Trust guidance, with onsite support 1–2 days/week at Quantico, VA in a hybrid setting.

Qualifications

• Active Top Secret clearance with SCI access.
• 10+ years of relevant technical experience with a high school diploma or commensurate experience.
• Expert-level experience with secure software development and DevSecOps principles across full-stack application environments.
• Expertise with artifact management platforms such as Nexus, Artifactory, NuGet, or comparable technologies.
• Experience implementing and supporting SAST/DAST and code quality platforms such as SonarQube, Aikido, CodeQL, or similar tools.
• Strong knowledge of secure coding practices, software dependency management, software supply chain security, and SBOM requirements.
• Experience implementing Git-based development workflows, including branch protection policies, pre-commit hooks, and code management practices.
• Experience with relational and NoSQL databases and application development across compiled and interpreted programming languages.
• Understanding of Zero Trust principles and their application to secure software development.
• Ability to apply software engineering and security principles across multiple operating systems, programming languages, and hosting environments.
• Must reside within commuting distance of Quantico, VA, and be available for onsite support as required.

Responsibilities

• Provide technical guidance in migrating mission applications to secure software development toolchains and environments.
• Implement and support DevSecOps practices throughout the SDLC, ensuring compliance with applicable Department of the Navy cybersecurity policies.
• Configure, maintain, and optimize software artifact management platforms such as Nexus, JFrog Artifactory, NuGet, or similar solutions.
• Support secure coding practices, application security standards, and software supply chain security initiatives.
• Implement and manage Static and Dynamic Application Security Testing capabilities using tools such as SonarQube, Aikido, CodeQL, or similar platforms.
• Support SBOM development, dependency management, vulnerability identification, and remediation processes.
• Implement secure Git-based development workflows with branch management rules, pre-commit hooks, and code quality controls.
• Provide technical guidance on Zero Trust principles in software development environments.
• Evaluate security across relational and NoSQL databases, languages, and hosting environments.
• Collaborate with developers, cybersecurity personnel, and technical teams to integrate security controls into development processes.
• Identify security weaknesses, code quality issues, and risks; recommend corrective actions.
• Provide mentorship to development teams to promote secure SDLC adoption.

Skills

Top Secret clearance with SCI access

10+ years of technical experience

Secure software development and DevSec

Artifact management platforms

SAST/DAST and code quality platforms

SBOM requirements and software supply

Git-based development workflows

Zero Trust concepts in development

Relational & NoSQL databases knowledge

Mentoring development teams

Tools

Nexus

Artifactory

NuGet

SonarQube

Aikido

CodeQL

Job description

Geospatial And Cloud Analytics Inc. seeks a Software Engineer SME (DevSecOps) to migrate mission-critical apps to secure toolchains and strengthen the software supply chain. You will guide secure SDLC practices across diverse environments and support SBOM development while ensuring DON-CIO policy compliance.

The role requires hands-on work with artifact platforms, SAST/DAST tooling, and Zero Trust guidance, with onsite support 1–2 days/week at Quantico, VA in a hybrid setting.