Senior DevSecOps SME: Secure SDLC & Artifacts

GCA

Quantico (VA)

Hybrid

USD 140,000 - 180,000

Full time

2 days ago

Be an early applicant

Get a reply from this employer

Your resume and cover letter, tailored to exactly what they’re hiring for.

Get past ATS filters

Benefits offered by this job

401(k) match

Health insurance

Dental insurance

Vision insurance

Paid time off

Parental leave

PTO cash out

Disability insurance

Life insurance

Competitive salary

Job summary

GCA is seeking a Software Engineer SME specializing in DevSecOps and secure software development to support NCIS in Quantico, VA. The role focuses on migrating mission applications to secure toolchains, enhancing software supply chain security, and guiding development teams.

The ideal candidate has 10+ years of technical experience, TS/SCI clearance, and deep expertise in artifact management and engineering security across diverse environments; hybrid work with onsite 1–2 days weekly.

Qualifications

Active Top Secret clearance with SCI access.
Minimum of 10 years of relevant technical experience with a high school diploma, or commensurate experience.
Expert-level secure software development and DevSecOps principles across full-stack application environments.
Expertise with artifact management platforms such as Nexus, Artifactory, NuGet, or comparable technologies.
Experience implementing and supporting SAST/DAST and code quality platforms such as SonarQube, Aikido, CodeQL, or similar tools.
Strong knowledge of secure coding practices, software dependency management, software supply chain security, and SBOM requirements.
Experience implementing Git-based development workflows, including branch protection policies, pre-commit hooks, and code management practices.
Experience with relational and NoSQL databases and application development across compiled and interpreted programming languages.
Understanding of Zero Trust principles and their application to secure software development.
Ability to apply software engineering and security principles across multiple operating systems, programming languages, and hosting environments.
Strong analytical, troubleshooting, and problem-solving skills.
Ability to provide technical guidance and mentorship to software development teams.
Must reside within commuting distance of Quantico, VA, and be available for onsite support as required.

Responsibilities

Provide technical expertise and guidance in migrating mission applications to secure software development toolchains and environments.
Implement and support DevSecOps practices throughout the software development lifecycle (SDLC), ensuring compliance with applicable Department of the Navy cybersecurity policies.
Configure, maintain, and optimize software artifact management platforms such as Nexus, JFrog Artifactory, NuGet, or similar solutions.
Support secure coding practices, application security standards, and software supply chain security initiatives.
Implement and manage Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) capabilities using tools such as SonarQube, Aikido, CodeQL, or similar platforms.
Support Software Bill of Materials (SBOM) development, dependency management, vulnerability identification, and remediation processes.
Implement secure Git-based development workflows, including branch management rules, pre-commit hooks, and code quality controls.
Provide technical guidance on Zero Trust principles and their application to software development environments.
Evaluate application security and software engineering practices across relational and NoSQL databases, compiled and interpreted programming languages, and diverse operating systems.
Collaborate with software developers, cybersecurity personnel, and technical teams to integrate security controls into development processes.
Identify security weaknesses, code quality issues, and software development risks, recommending appropriate corrective actions.
Provide mentorship and technical guidance to development teams to promote consistent adoption of secure software development standards and best practices.