DevSecOps Engineer Role

About OPEN Data Jobs

OPEN Data Jobs (ODJ) is built to craft data careers. We connect high-potential data, AI, and software professionals with meaningful work on the cutting edge of the federal sector, and our aim reaches beyond any single opening: to help you understand your strengths, find the right role, and grow throughout your career.

ODJ is organized around Roles and Openings. A Role is a durable career type, such as Data Engineer or AI Engineer: it describes the work, the skills that count, and where the path can lead. An Opening is a specific position hiring right now, with a level, a location, and an application. Roles help you see where you fit; from there, there is more than one way to move.

Today, you can apply to any Opening that fits you through our secure application system. You can also register for a Role to express interest in that broader category of work. A Role registration is not an application to every future Opening.

The work

DevSecOps Engineers make secure delivery repeatable. They design the CI/CD paths, deployment controls, and operational feedback loops that carry software from a change in source code to a running service. In federal environments, that work also includes assembling and maintaining security evidence for an Authority to Operate (ATO), the formal decision to allow a system to operate at an accepted level of risk.

The role works across development, operations, and security. DevSecOps Engineers automate build, test, deployment, configuration, vulnerability management, logging, and recovery practices so teams can release with visible controls and usable evidence. They partner with Cloud Infrastructure Engineers who provide the underlying platform, while they own the delivery path and its security integration.

What you'll build

· CI/CD pipelines that run tests, security checks, approvals, and deployments consistently.

· Infrastructure-as-code modules and deployment patterns that are versioned and reviewable.

· Container build, image-scanning, and release processes for application workloads.

· Observability and vulnerability-management workflows that turn operating signals into action.

· Control evidence and traceability that support authorization, assessment, and continuous monitoring.

Who you are

You treat security, reliability, and delivery speed as one engineering problem. You look for manual deployment steps, unreviewed configuration changes, and missing evidence because each makes a system harder to operate and defend.

You can work across specialties without blurring accountability. You understand enough application engineering, cloud infrastructure, and security practice to create a dependable delivery system, communicate tradeoffs clearly, and help teams use it.

What you bring

• · Hands-on experience with source control, automated testing, CI/CD, and deployment automation.
• · Infrastructure-as-code experience with tools such as Terraform, Amazon Web Services CloudFormation, or comparable platforms.
• · Working knowledge of container security, software supply-chain controls, and vulnerability remediation.
• · Experience with logging, monitoring, incident response, and recovery practices.
• · Ability to translate National Institute of Standards and Technology (NIST) Special Publication 800-53 control expectations into engineering work and evidence.
• Register for DevSecOps Engineer Role
• Click Apply below to register for DevSecOps Engineer Role.

Requirements

What openings may require

Some openings may ask for experience supporting an ATO or working with the Risk Management Framework, a structured NIST process for managing security risk. Others may focus on a specific cloud, orchestration platform, programming language, or delivery toolchain.

Openings with production accountability may require demonstrated work with on-call operations, incident response, security assessments, or regulated release controls. Requirements should distinguish responsibility for the delivery pipeline from responsibility for the underlying cloud environment or independent security assessment.