Functional Job (LCAT) Information:
The DevSecOps Engineer will design, implement, automate, secure, and maintain development and deployment processes supporting the VA COSE program. The engineer will integrate cybersecurity throughout the software development lifecycle and establish automated, repeatable, and secure processes for building, testing, deploying, configuring, and maintaining applications and infrastructure within enterprise and cloud environments.

Responsibilities:

• Design, implement, maintain, and optimize DevSecOps processes and CI/CD pipelines supporting secure software development, testing, integration, deployment, and operations.
• Integrate security controls and security gates directly into development and deployment pipelines to ensure applications and infrastructure are securely configured, tested, and deployed.
• Automate security testing and compliance activities throughout the software development lifecycle (SDLC).
• Develop and maintain automated deployment scripts, workflows, and configuration-management solutions that support consistent and repeatable deployment of hardened security configurations.
• Support development and implementation of cloud-native DevSecOps solutions, including secure build, test, deployment, and operational processes within cloud environments.
• Support secure implementation and management of containerized applications and workloads within enterprise and cloud-native environments.
• Integrate cybersecurity tools and technologies into CI/CD pipelines and DevOps workflows to identify security issues as early as possible in the development lifecycle.
• Implement automated mechanisms for identifying and addressing security vulnerabilities, configuration weaknesses, compliance issues, and other software security risks.
• Perform and support security assessments and vulnerability-management activities for applications, platforms, infrastructure, and cloud environments.
• Support cybersecurity incident-response activities involving applications, development pipelines, cloud infrastructure, software components, and related DevSecOps technologies.
• Apply secure software-development practices throughout the development lifecycle and promote security-by-design and security-by-default principles.
• Manage and maintain source-code repositories and version-control processes, including Git-based repositories, branching, merging, change tracking, and controlled software releases.
• Establish processes that ensure source code, configuration scripts, deployment artifacts, and other software components are appropriately version-controlled, traceable, and reproducible.
• Develop and maintain automation scripts supporting build, configuration, testing, deployment, security validation, compliance, and operational activities.
• Integrate automated security checks into development workflows to support continuous security validation and continuous compliance.
• Support development and maintenance of automated requirements traceability from foundational cybersecurity controls and architecture requirements through implementation and final Authority to Operate (ATO).
• Collaborate with cybersecurity engineers and architects to translate security requirements into automated technical controls, pipeline checks, deployment requirements, and configuration standards.
• Support secure engineering activities across applications, cloud platforms, networks, data environments, identity systems, and enterprise platforms.
• Review application and platform designs to identify potential security risks, control gaps, vulnerabilities, attack paths, and configuration weaknesses before implementation.
• Implement and maintain secure configuration baselines and automated controls supporting consistent configuration across operating systems, cloud-native platforms, applications, databases, and other enterprise technologies.
• Automate configuration and deployment processes using approved configuration-management frameworks and infrastructure automation technologies.
• Support continuous quality improvement by identifying opportunities to automate manual development, security, testing, deployment, and compliance processes.
• Develop automated workflows that improve the speed, repeatability, consistency, security, and reliability of software and infrastructure delivery.
• Support secure integration of cybersecurity tools and enterprise technologies through APIs, automation scripts, workflow orchestration, and other approved integration methods.
• Support development and maintenance of automated cybersecurity workflows, scripts, and configurations within Government-approved repositories and platforms.
• Assist with security tool integration and automation to reduce manual operational workload and improve enterprise cybersecurity effectiveness.
• Support software supply-chain security by helping ensure software components, dependencies, packages, patches, and other development artifacts meet applicable security and integrity requirements.
• Support generation, validation, or use of Software Bills of Materials (SBOMs) where required as part of software supply-chain risk management activities.
• Ensure software and patches provided for VA environments are appropriately evaluated for malware, unauthorized modifications, and other software integrity risks.
• Support secure software delivery practices, including applicable code signing, software integrity validation, and controlled deployment processes.
• Develop, maintain, and deliver custom code, scripts, APIs, configuration scripts, schemas, metadata, deployment artifacts, and supporting technical documentation in accordance with applicable Government requirements.
• Ensure custom-developed code and technical artifacts are structured and documented to support Government ownership, reuse, maintenance, testing, and future development.
• Support cloud security engineering activities by incorporating appropriate security controls into cloud architectures, workloads, deployment pipelines, and operational processes.
• Work closely with software developers, cybersecurity architects, cloud engineers, security engineers, system administrators, configuration-management personnel, and Government stakeholders to integrate security into development and operational processes.
• Participate in technical design reviews, security engineering reviews, modernization initiatives, pilots, testing activities, and engineering working groups.
• Document DevSecOps architectures, pipeline configurations, automation workflows, security controls, technical procedures, system configurations, deployment processes, and integration points.
• Support audit and compliance activities by producing technical evidence demonstrating implementation of required security controls, configurations, testing, and automated compliance checks.
• Assist with remediation of security and compliance findings by developing or implementing automated corrective actions and technical solutions.
• Ensure DevSecOps activities align with applicable VA security policies, Government architecture requirements, approved development methodologies, and Federal cybersecurity requirements.
• Support VA modernization efforts by applying DevOps, DevSecOps, automation, cloud-native, and Lean-Agile principles to continuously deliver secure and sustainable IT capabilities.
• May require up to two onsite travel visits per year

Originally posted on Himalayas