R&D DevSecOps Engineering Scientist

Phase2 Technology; Austin (TX); On-site; USD 117,000 - 161,000; Full time

Benefits offered by this job

100% employer-paid medical coverage

Retirement contributions

Paid vacation and sick time

Paid holidays

Job summary

The University of Texas at Austin invites applications for an R&D DevSecOps Engineering Scientist on the Pickle Research Campus. The role focuses on designing and maintaining secure CI/CD pipelines, implementing Security-as-Code, and integrating security gates to prevent vulnerable code from production.

Responsibilities include securing infrastructure via IaC, managing secrets, performing regular vulnerability assessments, and collaborating with development teams to advance DevSecOps practices

Qualifications

• Bachelor's degree in engineering, computer or information science, or other applied sciences.
• Three years of experience in DevOps, SRE, or security engineering roles.
• Experience with CI/CD tools such as GitHub Actions, GitLab CI, Jenkins, or ArgoCD.
• Experience with continuous integration and deployment systems.
• Proficiency with at least one major cloud platform.
• Experience with Infrastructure as Code methodologies.
• Experience with Linux administration.
• Knowledge of container technologies and container security.
• Familiarity with security scanning and testing methodologies.
• Understanding of security best practices for software development.
• Familiarity with identity and access management principles.
• Strong problem-solving and analytical skills.
• Excellent communication skills with ability to explain security concepts to non-technical audiences.
• Strong documentation skills.
• Must currently hold, or be able to obtain within the first six months of employment, a DoD 8140 compliant security certification (e.g., Security+).

Responsibilities

• Establish and Enhance Secure CI/CD: Design, implement, and maintain secure continuous integration/deployment pipelines to meet project requirements.
• Develop and enhance automated build, test, and deployment processes.
• Integrate automated security scanning tools.
• Implement Security-as-Code and Policy-as-Code practices into CI/CD to ensure safe and secure code for production.
• Integrate security gates that block vulnerable code from progressing to production.
• Infrastructure & Cloud Security: Implement and maintain security for Infrastructure as Code.
• Configure and enforce network security policies.
• Manage secrets securely using enterprise secret management solutions.
• Harden cloud environments including IAM roles, security groups, and logging.
• Establish and improve basic IaC approaches across project codebases.
• Vulnerability Management & Compliance: Perform regular security scans and assess results across applications and dependencies.
• Identify, prioritize, track, and help remediate vulnerabilities.
• Establish vulnerability remediation workflows.
• Coordinate periodic security testing and assessments.
• Automate compliance checks for relevant standards.
• Implement automated compliance controls.
• Maintain audit trails and documentation for security controls.
• Support internal and external security audits.
• Security Enablement & Collaboration: Partner with development teams to promote secure coding practices and increase DevSecOps adoption across projects.
• Provide security guidance and training to engineers.
• Help squads integrate DevSecOps practices into their workflows.
• Contribute to security policies and standards.
• Incident Response: Participate in security incident response and investigation.
• Support systems administration duties as needed, including privileged user access to support systems at ARL and partner sites.
• Other related functions as assigned.

Skills

Attention to detail

Time management

Communication skills

Documentation skills

Problem-solving

Education

Bachelor's degree in engineering, computer or information science, or other applied sciences

Tools

GitHub Actions

GitLab CI

Jenkins

ArgoCD

AWS

Job description

Job Title

R&D DevSecOps Engineering Scientist

Location

PICKLE RESEARCH CAMPUS

Eligibility and Security

US Citizen. Applicant selected will be subject to a government security investigation and must meet eligibility requirements for access to classified information at the level appropriate to the project requirements of the position.

Required Competencies

Applicant must be highly organized, have excellent attention to detail, and possess sound scientific judgment. The position will require effective management of their own time with the ability to plan, coordinate, and execute multiple tasks simultaneously. Regular and punctual attendance in the workplace is required.

Responsibilities

• Establish and Enhance Secure CI/CD: Design, implement, and maintain secure continuous integration/deployment pipelines to meet project requirements. Develop and enhance automated build, test, and deployment processes. Integrate automated security scanning tools. Implement Security-as-Code and Policy-as-Code practices into CI/CD to ensure safe and secure code for production. Integrate security gates that block vulnerable code from progressing to production.
• Infrastructure & Cloud Security: Implement and maintain security for Infrastructure as Code. Configure and enforce network security policies. Manage secrets securely using enterprise secret management solutions. Harden cloud environments including IAM roles, security groups, and logging. Establish and improve basic IaC approaches across project codebases.
• Vulnerability Management & Compliance: Perform regular security scans and assess results across applications and dependencies. Identify, prioritize, track, and help remediate vulnerabilities. Establish vulnerability remediation workflows. Coordinate periodic security testing and assessments. Automate compliance checks for relevant standards. Implement automated compliance controls. Maintain audit trails and documentation for security controls. Support internal and external security audits.
• Security Enablement & Collaboration: Partner with development teams to promote secure coding practices and increase DevSecOps adoption across projects. Provide security guidance and training to engineers. Help squads integrate DevSecOps practices into their workflows. Contribute to security policies and standards.
• Incident Response: Participate in security incident response and investigation. Support systems administration duties as needed, including privileged user access to support systems at ARL and partner sites.
• Other related functions as assigned.

Required Qualifications

• Bachelor's degree in engineering, computer or information science, or other applied sciences.
• Three years of experience in DevOps, SRE, or security engineering roles.
• Experience with CI/CD tools such as GitHub Actions, GitLab CI, Jenkins, or ArgoCD.
• Experience with continuous integration and deployment systems.
• Proficiency with at least one major cloud platform.
• Experience with Infrastructure as Code methodologies.
• Experience with Linux administration.
• Knowledge of container technologies and container security.
• Familiarity with security scanning and testing methodologies.
• Understanding of security best practices for software development.
• Familiarity with identity and access management principles.
• Strong problem-solving and analytical skills.
• Excellent communication skills with ability to explain security concepts to non-technical audiences.
• Strong documentation skills.
• Must currently hold, or be able to obtain within the first six months of employment, a DoD 8140 compliant security certification (e.g., Security+).

Preferred Qualifications

• Experience with maintaining, securing, and monitoring applications/datastores in AWS.
• Experience with container orchestration platforms such as Kubernetes or ECS.
• Experience with secret management solutions such as HashiCorp Vault or AWS Secrets Manager.
• Experience in incident response or security operations.
• Experience with classified systems or in classified environments.
• Eligibility for immediate access to classified information.
• DoD 8140 compliant certifications (e.g., CISSP, Security+, GSEC).
• AWS certifications such as Solutions Architect, Security Specialty, or SysOps Administrator.
• Knowledge of compliance frameworks such as SOC 2, PCI-DSS, HIPAA, or ISO 27001.
• Ten or more years experience in software engineering or DevOps.
• Cumulative GPA of 3.0.

Benefits

• 100% employer-paid basic medical coverage.
• Retirement contributions.
• Paid vacation and sick time.
• Paid holidays.

Salary Range

$104,000-$174,000+/negotiable depending on qualifications.

Working Conditions

• Standard office conditions.
• Repetitive use of a keyboard at a workstation.
• Use of manual dexterity.
• Some weekend, evening and holiday work.
• Possible interstate/intrastate travel.

Required Materials

• Resume/CV.
• 3 work references with their contact information; at least one reference should be from a supervisor.
• Letter of interest.
• Unofficial College transcripts.

Equal Opportunity Employer

The University of Texas at Austin, as an equal opportunity/affirmative action employer, complies with all applicable federal and state laws regarding nondiscrimination and affirmative action. The University is committed to a policy of equal opportunity for all persons and does not discriminate on the basis of race, color, national origin, age, marital status, sex, sexual orientation, gender identity, gender expression, disability, religion, or veteran status in employment, educational programs and activities, and admissions.

Pay Transparency

The University of Texas at Austin will not discharge or in any other manner discriminate against employees or applicants because they have inquired about, discussed, or disclosed their own pay or the pay of another employee or applicant. However, employees who have access to the compensation information of other employees or applicants as a part of their essential job functions cannot disclose the pay of other employees or applicants to individuals who do not otherwise have access to compensation information, unless the disclosure is (a) in response to a formal complaint or charge, (b) in furtherance of an investigation, proceeding, hearing, or action, including an investigation conducted by the employer, or (c) consistent with the contractor's legal duty to furnish information.