USAF - DevSecOps Engineer

Develop and maintain scripts to apply Security Technical Implementation Guides (STIGs) and generate or update network diagrams and system configurations from live environments. Conduct regular vulnerability scans through pipelines, analyze findings, recommend remediation, and implement approved patches and configuration corrections.

cFocus Software seeks a DevSecOps Engineer to join our program supporting the United States Air Force (USAF). This position is on-site in Linthicum Heights, MD. This position requires an Active TS/SCI clearance.Qualifications:

• Active TS/SCI clearance
• B.S. Computer Science, Information Technology, or a related field
• Experience building and maintaining CI/CD pipelines for enterprise applications and infrastructure.
• Proficiency in scripting or programming for infrastructure automation and software delivery.
• Experience implementing IaC, CaC, source control, and configuration management practices.
• Ability to integrate testing, cybersecurity controls, scanning, and remediation into delivery workflows.
• Experience supporting on-premises, cloud, or hybrid environments and repeatable deployments.
• Working knowledge of STIGs, secure baselines, authorization boundaries, and ATO evidence.
• Experience with monitoring, logging, alerting, troubleshooting, and incident support.
• Strong technical documentation and collaboration skills across development, security, and operations

Duties:

• Implement the Government-approved DevSecOps strategy, cultural principles, policies, and processes in support of enterprise IT architecture, cloud, and data initiatives.
• Create, operate, and maintain Continuous Integration/Continuous Deployment (CI/CD) pipelines for infrastructure and applications with approved security guardrails.
• Implement Infrastructure as Code (IaC) and Configuration as Code (CaC) in accordance with Government-approved designs and configuration baselines.
• Automate Government-specified cybersecurity controls and checks within pipelines; coordinate remediation and validation with cybersecurity personnel.
• Implement continuous monitoring, observability, logging, alerting, and reporting for system availability and cybersecurity status.
• Implement data tagging and attribution mechanisms across assigned resources under the approved data governance policy.
• Maintain configuration management capabilities to document and track system and software changes under the approved Configuration Management Plan.
• Implement technical controls enforcing Government-defined boundaries; provide evidence, documentation, and monitoring data for Authority to Operate (ATO) and continuous ATO activities.
• Develop and maintain scripts to apply Security Technical Implementation Guides (STIGs) and generate or update network diagrams and system configurations from live environments.
• Manage versioned CI/CD pipeline artifacts to maintain consistency across on-premises, cloud, and hybrid environments under the approved enterprise architecture.
• Develop, integrate, and test software solutions; prepare releases for Government review and authorized deployment following successful testing.
• Maintain visibility and traceability throughout the software lifecycle, linking requirements, code, configurations, tests, changes, and releases.
• Conduct regular vulnerability scans through pipelines, analyze findings, recommend remediation, and implement approved patches and configuration corrections.
• Support incident response by executing approved procedures, providing system data and logs, and implementing directed corrective actions.
• Research, test, and recommend agentic AI and other AI capabilities for CI/CD efficiency; integrate selected capabilities following Government approval.

Powered by JazzHR