Senior DevSecOps Engineer - Secure SDLC & Cloud

DANASTAR Professional Services, LLC; Washington (District of Columbia); On-site; USD 140,000 - 185,000; Full time

Job summary

EastBay Systems is seeking a Senior DevSecOps Engineer to serve as the primary technical authority for Secure Software Development, DevSecOps, and Application Security within a complex multi‑cloud Federal environment.

This role leads secure software engineering practices, DevSecOps automation, software supply chain security, application threat modeling, security testing, and telemetry to ensure compliance with FISMA, NIST RMF, SSDF, FedRAMP, OMB directives before deployment.

Qualifications

• Bachelor's degree in Computer Science, Software Engineering, or related technical discipline.
• 8+ years of experience in software security, DevSecOps, or secure software engineering.
• Experience designing and securing CI/CD pipelines.
• Experience with SAST, DAST, SCA, IaC security scanning, and container security.
• Strong knowledge of NIST RMF, NIST SP 800-53 Rev.5, SSDF, FedRAMP, and OMB directives.

Responsibilities

• Lead SSDLC implementation and secure coding standards aligned with NIST SSDF.
• Design and secure CI/CD pipelines for cloud‑native and hybrid apps.
• Perform application security assessments and remediation.
• Collaborate with Cloud Security, SOC, and GRC teams to meet compliance.

Skills

DevSecOps

SDLC security

Threat modeling

Security architecture

Communication

Education

Bachelor's degree in Computer Science or related technical discipline

Tools

Git

GitHub

GitLab

Azure DevOps

Jenkins

Kubernetes

Docker

Python

PowerShell

SAST

DAST

SCA

IaC scanning

Job description

EastBay Systems is seeking a Senior DevSecOps Engineer to serve as the primary technical authority for Secure Software Development, DevSecOps, and Application Security within a complex multi‑cloud Federal environment.

This role leads secure software engineering practices, DevSecOps automation, software supply chain security, application threat modeling, security testing, and telemetry to ensure compliance with FISMA, NIST RMF, SSDF, FedRAMP, OMB directives before deployment.