DevSecOps Engineer

TISTA Science and Technology Corporation is seeking a DevSecOps Engineer / Security Specialist to support the Department of Veterans Affairs Supply Chain Management DevSecOps program. The role embeds automated security controls into CI/CD pipelines, manages cloud and application security, supports compliance and ATO evidence collection, remediates vulnerabilities, and guides secure development and incident response.

Responsibilities:

• Embed automated "Guardrails-as-Code" into all CI/CD pipelines, enforcing security scans (SAST/DAST), SBOM generation, and strict policy gates that block builds with critical vulnerabilities
• Manage secrets, cryptographic code signing, and artifact integrity while maintaining hardened, compliant container images and automating configuration drift detection
• Triage and resolve security vulnerabilities within strict deadlines (5 days for Critical, 10 days for High), ensuring zero unaccepted high-level risks reach production
• Automate the collection of security evidence to support Continuous Assessment and Authorization (ATO) and ensure all systems meet VA and FedRAMP compliance standards
• Implement Zero Trust architecture, strict access controls, logging, and comprehensive cloud security measures across VA Enterprise Cloud, AWS, and Azure environments
• Mentor development teams on secure coding practices, guide security design reviews, and rigorously validate the safety of AI-generated code and test scripts
• Drive security incident response efforts—including rapid component isolation, forensics, and strict 1-hour reporting windows—and participate in after-hours escalation rotations
• Support business growth by contributing DevSecOps strategies to proposals, tracking pipeline security performance metrics, and interviewing technical talent to build a strong team bench
• Advance corporate thought leadership by developing reusable pipeline security templates, leading internal cybersecurity communities, and supporting corporate quality assessments

Requirements:

• 7+ years in IT security or DevSecOps, including at least 4 years integrating continuous security controls into CI/CD pipelines for federal Agile/SAFe programs
• 3+ years of hands-on experience managing automated pipeline security, including SAST/DAST, container scanning, secrets management, and generating SBOMs (e.g., SPDX, CycloneDX)
• Proven ability to automate infrastructure hardening and configuration compliance using tools like Ansible and Terraform to meet strict DISA STIG and CIS benchmarks
• Strong background supporting NIST Risk Management Framework (RMF) and Authority to Operate (ATO) processes, including managing POA&Ms and automating continuous control evidence collection
• Extensive experience implementing robust cloud security controls across AWS, Azure, and the VA Enterprise Cloud, covering IAM, encryption, and network segmentation
• Skilled in tracking, triaging, and remediating security vulnerabilities within strict deadlines while partnering directly with developers to resolve findings
• Proficient in setting up comprehensive security monitoring and logging (e.g., Splunk) as well as strict identity and access controls (e.g., HashiCorp Vault, mutual TLS, ICAM/PIV)
• Capable of guiding secure coding practices across multiple languages (Java, .NET, Python, legacy MUMPS) and embedding automated Section 508 accessibility testing into build pipelines
• ISC2 CISSP, or Security+
• AWS Solutions Architect Associate or AWS Developer Associate, or Azure Solutions Architect or Azure Developer Associate Red Hat Certified
• Specialist in Ansible Automation or Red Hat Certified Architect
• Bachelor's degree in Cybersecurity, Computer Science, Computer Engineering, Information Systems, or related field
• Tier 2 / Moderate Risk Background Investigation; ability to obtain a VA PIV credential
• Highly preferred experience includes securing VA supply chain systems, protecting HL7/FHIR healthcare APIs, managing one-hour incident responses, and validating AI-generated code
• Master's degree preferred