USAF - DevSecOps Engineer

cFocus Software Incorporated; Linthicum (MD); On-site; USD 120,000 - 150,000; Full time

Job summary

cFocus Software Incorporated seeks a DevSecOps Engineer to support the United States Air Force. This on-site role in Linthicum Heights, MD requires an active TS/SCI clearance and expertise in CI/CD pipelines, IaC/CaC, and secure software delivery across on-prem, cloud, and hybrid environments.

You will implement government-approved strategies, automate security checks, and maintain end-to-end visibility through the software lifecycle, ensuring compliant configurations and proactive remediation.

Qualifications

• Active TS/SCI clearance required.
• B.S. in Computer Science, IT, or related field.
• Experience building and maintaining CI/CD pipelines for enterprise apps and infrastructure.
• Proficiency in scripting or programming for infrastructure automation and software delivery.
• Experience implementing IaC, CaC, source control, and configuration management practices.
• Ability to integrate testing, cybersecurity controls, scanning, and remediation into delivery workflows.
• Experience supporting on-premises, cloud, or hybrid environments and repeatable deployments.
• Working knowledge of STIGs, secure baselines, authorization boundaries, and ATO evidence.
• Experience with monitoring, logging, alerting, troubleshooting, and incident support.
• Strong technical documentation and collaboration across development, security, and operations

Responsibilities

• Implement the Government-approved DevSecOps strategy, policies, and processes for enterprise IT architecture, cloud, and data initiatives.
• Create, operate, and maintain CI/CD pipelines for infrastructure and applications with approved security guardrails.
• Implement IaC and CaC per Government-approved designs and baselines.
• Automate cybersecurity controls and checks within pipelines; coordinate remediation with cybersecurity personnel.
• Implement continuous monitoring, observability, logging, alerting, and reporting for availability and cybersecurity status.
• Tag and attribute data across resources under the data governance policy.
• Maintain configuration management to document and track changes.
• Enforce government-defined boundaries; provide evidence and monitoring data for ATO and continuous ATO.
• Develop scripts to apply STIGs and generate/update network diagrams and configurations.
• Manage versioned CI/CD artifacts across on-prem, cloud, and hybrid environments.
• Develop, integrate, and test software; prepare releases for Government review and deployment.
• Maintain visibility and traceability across requirements, code, configurations, tests, changes, and releases.
• Conduct regular vulnerability scans, analyze findings, and implement approved patches and corrections.
• Support incident response with procedures, data, and logs; implement corrective actions.
• Research and test agentic AI and other AI capabilities for CI/CD efficiency; integrate with Government approval.

Skills

TS/SCI clearance

CI/CD expertise

Scripting automation

Cloud/hybrid environments

Documentation skills

Stakeholder collaboration

Education

B.S. Computer Science / Information Technology or related field

Tools

CI/CD pipelines

Infrastructure as Code (IaC)

Configuration as Code (CaC)

Security controls integration

Job description

cFocus Software seeks a DevSecOps Engineer to join our program supporting the United States Air Force (USAF). This position is on-site in Linthicum Heights, MD. This position requires an Active TS/SCI clearance.

Qualifications:

• Active TS/SCI clearance
• B.S. Computer Science, Information Technology, or a related field
• Experience building and maintaining CI/CD pipelines for enterprise applications and infrastructure.
• Proficiency in scripting or programming for infrastructure automation and software delivery.
• Experience implementing IaC, CaC, source control, and configuration management practices.
• Ability to integrate testing, cybersecurity controls, scanning, and remediation into delivery workflows.
• Experience supporting on-premises, cloud, or hybrid environments and repeatable deployments.
• Working knowledge of STIGs, secure baselines, authorization boundaries, and ATO evidence.
• Experience with monitoring, logging, alerting, troubleshooting, and incident support.
• Strong technical documentation and collaboration skills across development, security, and operations

Duties:

• Implement the Government-approved DevSecOps strategy, cultural principles, policies, and processes in support of enterprise IT architecture, cloud, and data initiatives.
• Create, operate, and maintain Continuous Integration/Continuous Deployment (CI/CD) pipelines for infrastructure and applications with approved security guardrails.
• Implement Infrastructure as Code (IaC) and Configuration as Code (CaC) in accordance with Government-approved designs and configuration baselines.
• Automate Government-specified cybersecurity controls and checks within pipelines; coordinate remediation and validation with cybersecurity personnel.
• Implement continuous monitoring, observability, logging, alerting, and reporting for system availability and cybersecurity status.
• Implement data tagging and attribution mechanisms across assigned resources under the approved data governance policy.
• Maintain configuration management capabilities to document and track system and software changes under the approved Configuration Management Plan.
• Implement technical controls enforcing Government-defined boundaries; provide evidence, documentation, and monitoring data for Authority to Operate (ATO) and continuous ATO activities.
• Develop and maintain scripts to apply Security Technical Implementation Guides (STIGs) and generate or update network diagrams and system configurations from live environments.
• Manage versioned CI/CD pipeline artifacts to maintain consistency across on-premises, cloud, and hybrid environments under the approved enterprise architecture.
• Develop, integrate, and test software solutions; prepare releases for Government review and authorized deployment following successful testing.
• Maintain visibility and traceability throughout the software lifecycle, linking requirements, code, configurations, tests, changes, and releases.
• Conduct regular vulnerability scans through pipelines, analyze findings, recommend remediation, and implement approved patches and configuration corrections.
• Support incident response by executing approved procedures, providing system data and logs, and implementing directed corrective actions.
• Research, test, and recommend agentic AI and other AI capabilities for CI/CD efficiency; integrate selected capabilities following Government approval.