Software Engineer SME DevSecOps & Artifact Management TS/SCI

Geospatial and Cloud Analytics, Inc.; Virginia; Hybrid; USD 120,000 - 160,000; Full time

Benefits offered by this job

401(k) matching

Dental insurance

Health insurance

Vision insurance

Paid time off

Parental leave

PTO Cash Out

Disability insurance

Life insurance

AD&D Insurance

Medical, Prescription coverage

Job summary

Geospatial And Cloud Analytics Inc. seeks a Software Engineer SME (DevSecOps) to migrate mission-critical apps to secure toolchains and strengthen the software supply chain. You will guide secure SDLC practices across diverse environments and support SBOM development while ensuring DON-CIO policy compliance.

The role requires hands-on work with artifact platforms, SAST/DAST tooling, and Zero Trust guidance, with onsite support 1–2 days/week at Quantico, VA in a hybrid setting.

Qualifications

• Active Top Secret clearance with SCI access.
• 10+ years of relevant technical experience with a high school diploma or commensurate experience.
• Expert-level experience with secure software development and DevSecOps principles across full-stack application environments.
• Expertise with artifact management platforms such as Nexus, Artifactory, NuGet, or comparable technologies.
• Experience implementing and supporting SAST/DAST and code quality platforms such as SonarQube, Aikido, CodeQL, or similar tools.
• Strong knowledge of secure coding practices, software dependency management, software supply chain security, and SBOM requirements.
• Experience implementing Git-based development workflows, including branch protection policies, pre-commit hooks, and code management practices.
• Experience with relational and NoSQL databases and application development across compiled and interpreted programming languages.
• Understanding of Zero Trust principles and their application to secure software development.
• Ability to apply software engineering and security principles across multiple operating systems, programming languages, and hosting environments.
• Must reside within commuting distance of Quantico, VA, and be available for onsite support as required.

Responsibilities

• Provide technical guidance in migrating mission applications to secure software development toolchains and environments.
• Implement and support DevSecOps practices throughout the SDLC, ensuring compliance with applicable Department of the Navy cybersecurity policies.
• Configure, maintain, and optimize software artifact management platforms such as Nexus, JFrog Artifactory, NuGet, or similar solutions.
• Support secure coding practices, application security standards, and software supply chain security initiatives.
• Implement and manage Static and Dynamic Application Security Testing capabilities using tools such as SonarQube, Aikido, CodeQL, or similar platforms.
• Support SBOM development, dependency management, vulnerability identification, and remediation processes.
• Implement secure Git-based development workflows with branch management rules, pre-commit hooks, and code quality controls.
• Provide technical guidance on Zero Trust principles in software development environments.
• Evaluate security across relational and NoSQL databases, languages, and hosting environments.
• Collaborate with developers, cybersecurity personnel, and technical teams to integrate security controls into development processes.
• Identify security weaknesses, code quality issues, and risks; recommend corrective actions.
• Provide mentorship to development teams to promote secure SDLC adoption.

Skills

Top Secret clearance with SCI access

10+ years of technical experience

Secure software development and DevSec

Artifact management platforms

SAST/DAST and code quality platforms

SBOM requirements and software supply

Git-based development workflows

Zero Trust concepts in development

Relational & NoSQL databases knowledge

Mentoring development teams

Tools

Nexus

Artifactory

NuGet

SonarQube

Aikido

CodeQL

Job description

Benefits:

• 401(k) matching
• Competitive salary
• Dental insurance
• Health insurance
• Paid time off
• Parental leave
• Vision insurance

Overview

We are seeking a highly skilled Software Engineer Subject Matter Expert (SME) specializing in DevSecOps, artifact management, and secure software development to join our team supporting the Naval Criminal Investigative Service (NCIS) in Quantico, Virginia. The ideal candidate will possess extensive experience in secure software development practices, software artifact management, and application security across diverse development environments.

This position will support the migration of mission-critical applications to a secure software development toolchain while ensuring compliance with Department of the Navy Chief Information Officer (DON-CIO) policies and security requirements. The successful candidate will provide technical expertise, guidance, and hands-on support to software development teams to improve code quality, strengthen software supply chain security, and implement sustainable secure development practices.

This position offers a hybrid work schedule, with onsite support required approximately 1-2 days per week or as mission requirements dictate.

Duties

• Provide technical expertise and guidance in migrating mission applications to secure software development toolchains and environments.
• Implement and support DevSecOps practices throughout the software development lifecycle (SDLC), ensuring compliance with applicable Department of the Navy cybersecurity policies.
• Configure, maintain, and optimize software artifact management platforms such as Nexus, JFrog Artifactory, NuGet, or similar solutions.
• Support secure coding practices, application security standards, and software supply chain security initiatives.
• Implement and manage Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) capabilities using tools such as SonarQube, Aikido, CodeQL, or similar platforms.
• Support Software Bill of Materials (SBOM) development, dependency management, vulnerability identification, and remediation processes.
• Implement secure Git-based development workflows, including branch management rules, pre-commit hooks, and code quality controls.
• Provide technical guidance on Zero Trust principles and their application to software development environments.
• Evaluate application security and software engineering practices across relational and NoSQL databases, compiled and interpreted programming languages, and diverse operating systems.
• Collaborate with software developers, cybersecurity personnel, and technical teams to integrate security controls into development processes.
• Identify security weaknesses, code quality issues, and software development risks, recommending appropriate corrective actions.
• Provide mentorship and technical guidance to development teams to promote consistent adoption of secure software development standards and best practices.

Required Skills

• Active Top Secret clearance with SCI access.
• Minimum of 10 years of relevant technical experience with a high school diploma, or commensurate experience.
• Expert-level experience with secure software development and DevSecOps principles across full-stack application environments.
• Expertise with artifact management platforms such as Nexus, Artifactory, NuGet, or comparable technologies.
• Experience implementing and supporting SAST/DAST and code quality platforms such as SonarQube, Aikido, CodeQL, or similar tools.
• Strong knowledge of secure coding practices, software dependency management, software supply chain security, and SBOM requirements.
• Experience implementing Git-based development workflows, including branch protection policies, pre-commit hooks, and code management practices.
• Experience with relational and NoSQL databases and application development across compiled and interpreted programming languages.
• Understanding of Zero Trust principles and their application to secure software development.
• Ability to apply software engineering and security principles across multiple operating systems, programming languages, and hosting environments.
• Strong analytical, troubleshooting, and problem-solving skills.
• Ability to provide technical guidance and mentorship to software development teams.
• Must reside within commuting distance of Quantico, VA, and be available for onsite support as required.

Preferred Skills

• Experience supporting Department of Defense or Department of the Navy software development environments.
• Familiarity with DON-CIO secure software development policies.
• Experience supporting application modernization and migration to secure development toolchains.
• Experience establishing or improving enterprise DevSecOps processes and development security standards.
• Experience supporting software development initiatives within classified government environments.

Benefits

GCA is a Small Disadvantaged Veteran-Owned company supporting several government contracts. GCA is pleased to offer a competitive benefits package to all full-time employees. Below is a brief overview of our benefits package.

• Competitive Compensation
• Paid Time Off includes 10 federal holidays and 15 additional days
• Bereavement Leave
• Parental Leave
• PTO Cash Out
• Company-Paid Short-Term and Long-Term Disability (STD/LTD)
• Life and AD&D Insurance
• Medical, Prescription, Dental, and Vision Coverage
• 401(k) Savings Plan with Company Match
• Employee Referral Program

About GCA

At GCA, we stand at the forefront of innovation, lighting the way toward a future where technology serves as a beacon of possibility. As a premier provider of Information Technology and Audio-Visual Integration services, our mission is to empower individuals and organizations to navigate the digital landscape with confidence and clarity. We provide advanced information technology support services and Audio-Visual system solutions to government and commercial customers worldwide.

Flexible work from home options available.