Senior DevSecOps Engineer — Government Cybersecurity

Ernst & Young Advisory Services Sdn Bhd; McLean (VA); On-site; USD 105,000 - 192,000; Full time

Job summary

EY is seeking a Senior DevSecOps Engineer to join Our Government and Infrastructure cybersecurity team in McLean, VA. You’ll design and operate secure CI/CD pipelines, integrate SAST/DAST tooling, and lead DevSecOps standards across the portfolio.

The role requires 3–6+ years in DevOps or security engineering, strong container and IaC skills, and the ability to obtain required clearances. You’ll mentor peers and collaborate with government clients on risk-informed security programs.

Qualifications

• Bachelor’s degree or equivalent practical experience.
• 3–6+ years in DevOps, software or security engineering.
• Hands-on CI/CD pipeline engineering with major tooling.
• Experience with application security scanning tools.
• Knowledge of containers and Infrastructure-as-Code.
• Proficient scripting in Python/PowerShell/Bash.
• Familiarity with NIST RMF and SP 800-53.

Responsibilities

• Design, build and maintain secure CI/CD pipelines with SAST/DAST.
• Implement policy-as-code and evidence collection for ATO and NIST mapping.
• Harden container images and environments against benchmarks.
• Lead DevSecOps architecture and toolchain standards.
• Mentor junior DevSecOps engineers and promote secure engineering practices.
• Collaborate with client stakeholders on security posture and POA&Ms.

Skills

CI/CD pipeline design

Security engineering

Risk management knowledge

Education

Bachelor's degree in computer science, software engineering, information systems, computer engineering or related field

Tools

Jenkins

GitHub Actions

GitLab CI

Azure DevOps

Fortify

Checkmarx

SonarQube

Snyk

Trivy

OWASP ZAP

Job description

EY is seeking a Senior DevSecOps Engineer to join Our Government and Infrastructure cybersecurity team in McLean, VA. You’ll design and operate secure CI/CD pipelines, integrate SAST/DAST tooling, and lead DevSecOps standards across the portfolio.

The role requires 3–6+ years in DevOps or security engineering, strong container and IaC skills, and the ability to obtain required clearances. You’ll mentor peers and collaborate with government clients on risk-informed security programs.