← All roles

DevSecOps Engineer - Government

Applied Intuition· Security & IT
Apply on company site
Washington, D.C.$160k - $225kFull-timePosted 4w ago

About the role

DevSecOps Engineer responsible for securing the software delivery lifecycle, enabling secure code integration for Government and customer environments (including classified and air-gapped systems), and implementing automated security controls and evidence for assessments and ATO.

Responsibilities

  • Own secure code integration from source through build, test, release, and deployment
  • Directly support developers integrating and deploying software onto Government and customer systems
  • Build and maintain secure CI/CD pipelines, reusable pipeline templates, and hardened build environments
  • Integrate and tune SAST, DAST, SCA, secrets scanning, container scanning, and infrastructure-as-code scanning, and consolidate overlapping toolchains into a single supported stack
  • Define and enforce promotion gates: which findings block, which are advisory, and the severity thresholds applied. Where a finding cannot be remediated before release, record the exception with a justification, an accountable owner, and a remediation date
  • Serve as the primary technical resource for developers by troubleshooting findings, pairing on remediation, and removing delivery blockers
  • Automate system hardening, security validation, and compliance evidence collection using infrastructure-as-code and policy-as-code (OPA/Rego, cfn-guard, Cedar, or equivalent)
  • Build preventive and detective controls in AWS GovCloud, including SCPs and RPCs across multi-account Organizations, Config, Security Hub, IAM, KMS, CloudTrail, and EventBridge, with automated remediation workflows
  • Implement software supply chain protections including SBOM generation, artifact signing, and secure dependency management, and admission control that rejects unsigned or unscanned images at deploy time
  • Support software promotion into classified and air-gapped environments, including offline dependencies and controlled transfer workflows, and offline package mirrors for language and native dependency managers
  • Lead threat modeling and security design reviews for new services and pipeline changes, and propose compensating controls where direct remediation is not possible
  • Partner with the ISSM and Cyber Security Engineer to map technical controls to NIST 800-53, NIST 800-171, DISA STIGs, and CMMC Level 2, and support evidence production during assessments and ATO activity
  • Establish secure development guidance, technical documentation, and repeatable engineering patterns for product teams
  • Serve as a documented backup on build, artifact, and pipeline systems, and participate in the security on-call rotation

Qualifications

  • A Bachelor’s degree in Computer Science, Software Engineering, Cyber Security, or a related field, or equivalent hands-on experience
  • A minimum of 5 years of experience across software engineering, DevOps, platform engineering, or security engineering
  • DoD 8140/8570 IAT level II (Security+ Certification)
  • Hands-on scripting or software development experience using Python, Bash, Go, or similar languages
  • Experience with CI/CD platforms such as GitLab CI, GitHub Actions, Jenkins, or equivalent tooling
  • Production experience with containers and orchestration technologies such as Docker and Kubernetes
  • Experience with infrastructure-as-code or configuration management technologies such as Terraform or Ansible, AWS CDK, or CloudFormation
  • Hands-on AWS experience, including working knowledge of Config, Security Hub, IAM, KMS, CloudTrail, and CloudWatch/EventBridge
  • Experience writing and deploying policy-as-code (OPA Rego, cfn-guard, Cedar, or equivalent)
  • Working knowledge of NIST 800-53, NIST 800-171, DISA STIGs, and RMF, and of DFARS 252.204-7012 and CMMC Level 2 obligations
  • Experience producing audit-ready evidence and working directly with third-party assessors
  • Experience introducing blocking security gates into a delivery pipeline that did not previously have them, and sustaining them under delivery pressure
  • Demonstrated ability to integrate security tooling into developer workflows and make findings actionable
  • Proven ability to work directly with developers to troubleshoot issues, teach secure practices, and unblock delivery

Skills

Required:Security engineeringPython, Bash, GoCI/CD toolingContainerizationInfrastructure as CodePolicy as codeAWS GovCloudSecurity compliance
Last updated Oct 11, 2026. Interested? Apply on the company site.

About Applied Intuition

Building vehicle intelligence | Applied Intuition

Applied Intuition is the vehicle intelligence company with the tools, Vehicle OS, and autonomy stacks for creating safe, AI-powered vehicle experiences.

AIAutonomy stacksSelf-Driving SystemSimulationTesting & ValidationVehicle IntelligenceVehicle OSai-infrastructure-and-development
Company profileWebsite

More open roles at Applied Intuition