DevSecOps Engineer

TISTA is seeking a DevSecOps Engineer to support the Department of Veterans Affairs (VA) Supply Chain Management DevSecOps program. This role will partner with VA stakeholders and Agile delivery teams to translate business needs into clear, actionable requirements supporting supply chain and logistics solutions.

The DevSecOps Engineer / Security Specialist is the hands-on pipeline security engineer for TISTA's prime contract performance on the Department of Veterans Affairs Supply Chain Management DevSecOps (SCMDSO) task order supporting VA's supply chain and logistics Product Line. Where the Cyber Security Architect / Policy Lead defines the security architecture, policy interpretation, and Guardrails-as-Code standard, and the Engineer Solution Lead owns the platform and pipeline infrastructure, the DevSecOps Engineer / Security Specialist makes security real inside every build. This position embeds automated security scanning, software bill of materials generation, container and configuration hardening, secrets management, and vulnerability remediation tracking into the CI/CD pipelines used by every Scrum Team, and produces the security evidence that keeps every product's Authority to Operate current.

At TISTA, you’ll do meaningful, mission‑driven work that improves lives alongside teammates you trust and leaders who are transparent and supportive. We invest in your learning and internal mobility so you can build a career that keeps advancing. We’re proud to serve and hire Veterans, and we put people first in everything we do.

TISTA associates enjoy above Industry Healthcare Benefits, Remote Working Options, Paid Time Off, Training/Certification opportunities, Healthcare Savings Account & Flexible Savings Account, Paid Life Insurance, Short-term & Long-term Disability, 401K Match, Tuition Reimbursement, Employee Assistance Program, Paid Holidays, Military Leave, and much more!

• Embed automated "Guardrails-as-Code" into all CI/CD pipelines, enforcing security scans (SAST/DAST), SBOM generation, and strict policy gates that block builds with critical vulnerabilities.
• Manage secrets, cryptographic code signing, and artifact integrity while maintaining hardened, compliant container images and automating configuration drift detection.
• Triage and resolve security vulnerabilities within strict deadlines (5 days for Critical, 10 days for High), ensuring zero unaccepted high-level risks reach production.
• Automate the collection of security evidence to support Continuous Assessment and Authorization (ATO) and ensure all systems meet VA and FedRAMP compliance standards.
• Implement Zero Trust architecture, strict access controls, logging, and comprehensive cloud security measures across VA Enterprise Cloud, AWS, and Azure environments.
• Mentor development teams on secure coding practices, guide security design reviews, and rigorously validate the safety of AI-generated code and test scripts.
• Drive security incident response efforts—including rapid component isolation, forensics, and strict 1-hour reporting windows—and participate in after-hours escalation rotations.
• Support business growth by contributing DevSecOps strategies to proposals, tracking pipeline security performance metrics, and interviewing technical talent to build a strong team bench.
• Advance corporate thought leadership by developing reusable pipeline security templates, leading internal cybersecurity communities, and supporting corporate quality assessments.

• 7+ years in IT security or DevSecOps, including at least 4 years integrating continuous security controls into CI/CD pipelines for federal Agile/SAFe programs.
• 3+ years of hands-on experience managing automated pipeline security, including SAST/DAST, container scanning, secrets management, and generating SBOMs (e.g., SPDX, CycloneDX).
• Proven ability to automate infrastructure hardening and configuration compliance using tools like Ansible and Terraform to meet strict DISA STIG and CIS benchmarks.
• Strong background supporting NIST Risk Management Framework (RMF) and Authority to Operate (ATO) processes, including managing POA&Ms and automating continuous control evidence collection.
• Extensive experience implementing robust cloud security controls across AWS, Azure, and the VA Enterprise Cloud, covering IAM, encryption, and network segmentation.
• Skilled in tracking, triaging, and remediating security vulnerabilities within strict deadlines while partnering directly with developers to resolve findings.
• Proficient in setting up comprehensive security monitoring and logging (e.g., Splunk) as well as strict identity and access controls (e.g., HashiCorp Vault, mutual TLS, ICAM/PIV).
• Capable of guiding secure coding practices across multiple languages (Java, .NET, Python, legacy MUMPS) and embedding automated Section 508 accessibility testing into build pipelines.
• Highly preferred experience includes securing VA supply chain systems, protecting HL7/FHIR healthcare APIs, managing one-hour incident responses, and validating AI-generated code.

Certifications

• ISC2 CISSP, or Security+
• AWS Solutions Architect Associate or AWS Developer Associate, or Azure Solutions Architect or Azure Developer Associate Red Hat Certified.
• Specialist in Ansible Automation or Red Hat Certified Architect.

Education

• Bachelor's degree in Cybersecurity, Computer Science, Computer Engineering, Information Systems, or related field.
• Master's degree preferred.

• Tier 2 / Moderate Risk Background Investigation; ability to obtain a VA PIV credential.

Location:

• Rockville, MD / Remote (CONUS).
• Travel: Up to 10%.

Pay Range:

• The suggested pay for this position ranges from $161,00 to $176,000.
• The actual salary offer will carefully consider a wide range of factors, including your skills, qualifications, experience, and location.
• Also, certain positions are eligible for additional forms of compensation, such as bonuses.
• TISTA associates are eligible to participate in our comprehensive benefits plan! More information can be found here: https://tistatech.com/working-at-tista/