Cybersecurity Engineer - DevSecOps

• Conduct code and container vulnerability assessments using approved DoD vulnerability scanning tools, DISA Security Technical Implementation Guides (STIGs), Security Requirements Guides (SRGs), and other DoD/DoN software assurance tools.
• Implement and assess operating system security configurations in accordance with applicable DISA STIGs and SRGs.
• Perform cybersecurity assessments, security audits, and risk analyses to identify vulnerabilities and compliance gaps.
• Apply security testing methodologies, including Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST), throughout the software development lifecycle.
• Review and implement cybersecurity policies and security controls within CI/CD pipelines to support secure software delivery and DoD/DoN requirements.
• Serve as a GitLab security reviewer and approver for merge requests, reviewing security scan results and verifying that identified findings are remediated or appropriately documented through the approved risk-management process prior to release.
• Review GitLab SAST, dependency, secret detection, and container scanning results; coordinate remediation activities with development teams and track findings through closure.
• Review changes to GitLab security policies, pipeline controls, and protected branch settings to ensure required security checks and approvals remain properly enforced.
• Provide cybersecurity oversight for containerized workloads using NeuVector, including review of vulnerability findings, admission control decisions, and runtime security alerts.
• Collaborate with application and platform teams to investigate NeuVector findings, tune security policies, and document remediation actions or accepted risks.
• Ensure security-related provisions within system acquisition and program documentation address identified cybersecurity requirements.
• Provide cybersecurity guidance and assist with developing mitigation strategies for DoD information systems.
• Prepare Risk Management Framework (RMF) artifacts and Memoranda of Agreement (MoAs) with system owners supporting interface and networking implementations.
• Identify and evaluate Common Criteria and National Information Assurance Partnership (NIAP) certified technologies when applicable.
• Evaluate cybersecurity products and technologies used by programs to validate compliance with applicable DoD/DoN requirements.
• Support cybersecurity activities across the software lifecycle and collaborate with engineering, development, platform, and program teams to address security requirements and risks.

• Experience working within the DoD Risk Management Framework (RMF) and familiarity with DoDI 8510.01.
• An Information Assurance Manager (IAM) Level II certification in accordance with DoD 8570.01-M, such as: CISSP; GSLC; CISM
• Experience with DoD cybersecurity requirements, including DISA STIGs and SRGs.
• Experience with software security testing methodologies, including SAST and DAST.
• Experience supporting cybersecurity within CI/CD or DevSecOps environments.
• Experience with GitLab security tools and processes, including reviewing security scan results and supporting vulnerability remediation.
• Bachelor’s degree in Computer Science or related

Preferred Skills:

• Proficiency with GitLab, NeuVector, and Sonatype.
• Experience with container security and vulnerability management.
• Experience supporting cybersecurity within a DoD or Department of the Navy (DoN) environment.
• Experience with the Navy’s Rapid Assess and Incorporate Software Engineering (RAISE) methodology.
• Experience with the RAISE Platform of Choice (RPOC).
• Experience evaluating Common Criteria and NIAP-certified technologies.
• Experience developing or supporting RMF artifacts, security documentation, and cybersecurity mitigation strategies.

Certified Minority-owned Business Enterprise (MBE) - New York City (NYC), New York State (NYS) and The Port Authority of New York & New Jersey (PANYNJ)