Senior DevSecOps Engineer - Government & Infra

Cybersecurity Jobs; McLean (VA); On-site; USD 105,000 - 210,000; Full time

Benefits offered by this job

Medical and dental coverage

Pension and 401(k) plans

Paid time off and flexible vacation

Job summary

EY is hiring a Senior DevSecOps Engineer to support its Government & Infrastructure cybersecurity team in McLean, VA. You will design secure CI/CD pipelines, automate evidence for authorization, and ensure security is embedded throughout the software lifecycle with mapping to authorization and control traceability.

The role focuses on evaluating delivery toolchains, security postures, and governance for continuous authorization to operate (cATO) and NIST SP 800-53 compliance.

Qualifications

• Bachelor's degree or equivalent practical experience.
• 3–6+ years of experience in DevOps, software engineering, or security engineering.
• Hands-on CI/CD pipeline engineering with Jenkins, GitHub Actions, GitLab CI, or Azure DevOps.
• Experience with at least one application security scanning tool (Fortify, Checkmarx, SonarQube, Snyk, Trivy, OWASP ZAP).
• Working knowledge of containers and Infrastructure-as-Code.
• Scripting skills in Python, PowerShell, or Bash.
• Understanding of NIST RMF, NIST SP 800-53, and secure software development lifecycle practices.
• Ability to obtain and maintain a secret clearance.
• Willingness to work in-person in the Washington, DC area.

Responsibilities

• Assess application delivery toolchain and practices, including CI/CD and artifact management, and identify gaps.
• Evaluate security posture and POA&Ms to inform rationalization.
• Design, build, and maintain secure CI/CD pipelines with SAST/DAST, software composition analysis, and image scanning.
• Implement policy-as-code and automated evidence collection for continuous cATO and NIST-53 traceability.
• Harden container images and environments to DISA STIGs/CIS benchmarks.
• Integrate governance gates for AI-assisted development and traceability of AI-generated code.
• Define DevSecOps patterns and reusable pipeline templates; report on DORA metrics and vulnerabilities.
• Support vulnerability triage and remediation with client cybersecurity stakeholders.
• Own DevSecOps architecture and toolchain standards for the team.
• Lead security-posture assessment methodology and ensure consistent scoring across portfolio.
• Serve as primary security engineering contact for client stakeholders and prepare authorization artifacts.
• Mentor Staff DevSecOps engineer and promote secure engineering practices.

Skills

DevOps

Security engineering

CI/CD pipelines

Python scripting

Education

Bachelor's degree or equivalent

Tools

Jenkins

GitHub Actions

GitLab CI

Azure DevOps

Fortify

Checkmarx

SonarQube

Snyk

Trivy

OWASP ZAP

Terraform

Ansible

Datadog

Job description

EY is hiring a Senior DevSecOps Engineer to support its Government & Infrastructure cybersecurity team in McLean, VA. You will design secure CI/CD pipelines, automate evidence for authorization, and ensure security is embedded throughout the software lifecycle with mapping to authorization and control traceability.

The role focuses on evaluating delivery toolchains, security postures, and governance for continuous authorization to operate (cATO) and NIST SP 800-53 compliance.