DevSecOps Engineer

Whitespace is dedicated to delivering innovative technological solutions that meet the highest standards of security and compliance. They are seeking a highly experienced Senior DevSecOps Engineer to strengthen their cybersecurity posture and support federal compliance requirements.

Responsibilities:

• Design, implement, and maintain secure CI/CD pipelines aligned with DoD Enterprise DevSecOps Reference Design (DSOP)
• Automate deployment of secure environments using Terraform, Ansible, or CloudFormation for DoD or FedRAMP-compliant systems
• Integrate static code analysis (SAST), dynamic testing (DAST), container scanning and various security toolsets within pipelines to enforce continuous compliance
• Implement and manage DoD STIGs, DISA baselines, and RMF controls in Infrastructure as Code (IaC)
• Translate DoD security controls into automated enforcement and validation within development pipelines
• Develop scripts and tools for compliance validation (e.g., OpenSCAP, Chef InSpec, PowerSTIG)
• Help co-develop & maintain technical documentation for RMF authorization and continuous monitoring processes
• Implement and manage DevSecOps tools such as GitLab, Jenkins, ArgoCD, Harbor, Nexus, SonarQube, Anchore, etc
• Automate container security and orchestrate deployments using Kubernetes (Big Bang, Iron Bank images or similar)
• Manage secret storage, credential rotation, and logging using Vault, DoD-approved KMS, or AWS Secrets Manager
• Work closely with security, development, and operations teams to ensure alignment with DoD RMF, NIST SP 800-53, and/or FedRAMP
• Collaborate with Information System Security Officers (ISSOs), Information Systems Security Managers (ISSMs) and Security Control Assessors for ATO package development
• Serve as an internal primary subject matter expert in federal compliance standards and cybersecurity practices

Requirements:

• Secure CI/CD and Cloud Infrastructure
• Design, implement, and maintain secure CI/CD pipelines aligned with DoD Enterprise DevSecOps Reference Design (DSOP)
• Automate deployment of secure environments using Terraform, Ansible, or CloudFormation for DoD or FedRAMP-compliant systems
• Integrate static code analysis (SAST), dynamic testing (DAST), container scanning and various security toolsets within pipelines to enforce continuous compliance
• Implement and manage DoD STIGs, DISA baselines, and RMF controls in Infrastructure as Code (IaC)
• Translate DoD security controls into automated enforcement and validation within development pipelines
• Develop scripts and tools for compliance validation (e.g., OpenSCAP, Chef InSpec, PowerSTIG)
• Help co-develop & maintain technical documentation for RMF authorization and continuous monitoring processes
• Implement and manage DevSecOps tools such as GitLab, Jenkins, ArgoCD, Harbor, Nexus, SonarQube, Anchore, etc
• Automate container security and orchestrate deployments using Kubernetes (Big Bang, Iron Bank images or similar)
• Manage secret storage, credential rotation, and logging using Vault, DoD-approved KMS, or AWS Secrets Manager
• Work closely with security, development, and operations teams to ensure alignment with DoD RMF, NIST SP 800-53, and/or FedRAMP
• Collaborate with Information System Security Officers (ISSOs), Information Systems Security Managers (ISSMs) and Security Control Assessors for ATO package development
• Serve as an internal primary subject matter expert in federal compliance standards and cybersecurity practices
• Bachelor's degree in Computer Science or related field (or equivalent experience)
• 7+ years of hands-on experience with DevSecOps in AI/ML or data-intensive systems
• Familiarity with OpenShift or Kubernetes security hardening
• Knowledge of Zero Trust Architecture (ZTA) concepts
• Proven experience managing and driving successful ATO processes
• Expertise with DevSecOps tools, practices, and frameworks
• Strong understanding of federal security compliance standards (e.g., NIST 800-53, RMF, FedRAMP)
• Hands-on experience with cloud environments (AWS, Azure, or GCP) and containerization (Docker, Kubernetes)
• Strong scripting and automation skills (Python, Bash, or similar)
• Excellent leadership, communication, and documentation abilities
• Active security clearance or eligibility to obtain one
• Previous experience directly supporting government contracting or federal agencies
• Relevant certifications such as: Certified Kubernetes Administrator (CKA), AWS Certified Security or DevOps Engineer, HashiCorp Certified Terraform Associate