DevSecOps Engineer

Caladwich is a U.S.-based Service-Disabled Veteran-Owned Small Business providing professional services and mission support solutions to federal agencies. The DevSecOps Engineer will support the Department of Veterans Affairs Office of Information Security COSE program by integrating security into software delivery, cloud-native engineering, and operational workflows. The role focuses on automating security controls and testing, strengthening supply-chain security, supporting compliance, and enabling secure releases.

Responsibilities:

• Design, implement, and improve secure CI/CD pipelines for application, infrastructure, and cloud-native delivery environments
• Integrate automated security testing, vulnerability scanning, policy enforcement, compliance checks, and evidence generation into DevOps workflows
• Engineer hardened security controls using deployment scripts, infrastructure-as-code, configuration-management frameworks, and approved automation tools
• Support container, orchestration, artifact repository, code repository, and cloud-native platform security
• Perform or support security assessments, vulnerability management, remediation validation, incident response, and secure release readiness
• Apply secure software development practices, code review, version control, branch protection, dependency management, and software supply-chain controls
• Collaborate with developers, architects, security teams, and platform engineers to address threats, control gaps, and operational constraints
• Develop pipeline patterns, reusable controls, metrics, technical documentation, and implementation guidance aligned with VA and Federal requirements
• Coordinate with VA stakeholders, technical teams, system owners, and other contractors to resolve issues and keep work aligned with VA priorities
• Develop, maintain, and submit accurate technical documentation, status information, and contract deliverables within required timeframes
• Apply VA security, privacy, accessibility, records-management, and configuration-management requirements to all work products
• Support risk, issue, dependency, schedule, and quality management activities, including corrective actions and continuous improvement
• Protect VA information and systems, use approved collaboration and remote-access methods, and promptly report security or privacy concerns
• Participate in meetings, reviews, briefings, and occasional travel as directed and approved under the task order
• Monitor pipeline security results, prioritize findings, troubleshoot failed security gates, and support timely remediation
• Evaluate and implement automation opportunities that reduce manual effort, review cycle time, and rework while preserving security and quality

Requirements:

• · Minimum 10 years of DevSecOps experience, including at least five years of Cybersecurity and Cloud Security experience at a large Government agency similar in size and scope to GSA, IRS, DoD, or VA
• · Expertise in DevSecOps or related fields, including CI/CD pipelines, containerization, cloud-native environments, software development, Git or comparable repositories, and version control
• · Cybersecurity experience that includes security assessments, vulnerability management, and incident response
• · Expertise integrating security tools into DevOps pipelines and automating security testing and compliance
• · Bachelor's degree in Business Administration, Business Management, Cybersecurity, Computer Science, Information Systems, Information Assurance, Information Security, Information Resource Management, or a related field
• · Certification in one or more of the following: IAT III, IAM III, or IASAE III
• · PWS substitution: IAT III, IAM III, or IASAE III certification may substitute for a relevant Bachelor's degree or four years of relevant experience
• · Must be able to read, write, speak, and understand the English language
• · Must be able to work from a Contractor-provided facility and travel occasionally to VA Central Office in Washington, D.C., or other approved locations when coordinated in advance
• · Remote access to VA systems must occur only through VA-approved methods and from locations permitted by VA policy