Cybersecurity Engineer - DSOP

SAIC is seeking a DevSecOps Security Engineer to design, implement, and operate security capabilities that are embedded directly into software delivery pipelines for mission application development and deployment. The role centers on automated security testing, generating RMF/ATO evidence, and strengthening secure coding and CI/CD security gate practices, including software supply chain protections.

This position is based in Chantilly, VA and is onsite. The target salary range is USD 160,001 - 200,000, with Full-Time scheduling and a Day Job shift.

Responsibilities

• Design, build, and maintain security capabilities within DevSecOps and CI/CD pipelines.
• Integrate automated SAST, DAST, container scanning, Software Composition Analysis (SCA), and Software Bill of Materials (SBOM) generation.
• Implement security gates that identify vulnerabilities and stop unacceptable software artifacts from progressing through the delivery pipeline.
• Automate the collection, organization, and delivery of security evidence supporting RMF, ATO, Continuous Monitoring, and future continuous authorization objectives.
• Develop, maintain, and continuously improve the program’s Secure Coding Guide, including required practices, prohibited practices, secure design patterns, and software security expectations.
• Translate Secure Coding Guide requirements into pipeline controls, automated checks, developer workflows, and application onboarding criteria.
• Support Capability Providers with application onboarding, security tool use, secure coding practices, and vulnerability remediation.
• Review and help resolve security findings tied to CWE, CVE, STIG, dependencies, containers, and applications.
• Validate software artifacts using integrity checks, image signing, provenance tracking, SBOM review, and other software supply chain security practices.
• Document security controls, pipeline processes, evidence outputs, technical decisions, and developer guidance.
• Assist with ISSO functions including Continuous Monitoring (ConMon), vulnerability management, security control assessments, remediation tracking, and cybersecurity evidence maintenance supporting RMF and ATO activities.
• Identify opportunities to reduce manual security activities, improve developer feedback, and accelerate secure capability delivery.
• Partner with Cloud and DevSecOps engineers to implement secure-by-default pipelines, infrastructure, and platform services.
• Support security implementation across classified, multi-classification, containerized, and cloud-based development environments.

Requirements

• Bachelor’s degree and nine (9) years or more related experience; OR Master’s degree and seven (7) years or more related experience; OR PhD and four (4) years or more related experience. Relevant experience may substitute for education.
• TS/SCI clearance and U.S. citizenship.
• DoD 8140-aligned cybersecurity certification such as Security+, CASP+, CISSP, CCSP, or equivalent.
• Five (5) to ten (10) years of cybersecurity, application security, DevSecOps, software engineering, or related experience.
• Hands-on experience with DevSecOps, CI/CD, application security, security automation, or secure software delivery.
• Experience with security tools such as Fortify, OWASP ZAP, Grype, Trivy, SonarQube, or comparable products.
• Experience analyzing and supporting remediation of CWE, CVE, STIG, dependency, container, or application security findings.
• Experience with Git-based workflows, CI/CD platforms, and automated pipeline controls.
• Experience scripting with PowerShell, Python, Bash, or a similar language.

Technologies

• Fortify
• OWASP ZAP
• Grype
• Trivy
• SonarQube
• PowerShell
• Python
• Bash
• SAST
• DAST
• Software Composition Analysis (SCA)
• Software Bill of Materials (SBOM)

Travel

• Yes - 10% of the time

Additional Details

• Potential for remote work: ORA_ON_SITE
• Minimum clearance required: TS.SCI

Desired Qualifications and Experience

• Experience with GitLab CI/CD, Gitea, container registries, artifact repositories, or pipeline runners.
• Experience automating RMF, ATO, Continuous Monitoring, or compliance evidence.
• Experience developing secure coding standards, secure software development guidance, or application security requirements.
• Experience with SBOMs, SCA, image signing, artifact provenance, and software supply chain security.
• Familiarity with Kubernetes, RKE2, containers, and cloud-native security.
• Experience supporting classified cloud, multi-classification, MLS/MILS, or Cross Domain Solution environments.
• Familiarity with Zero Trust, policy as code, continuous authorization, or certified CI/CD pipeline concepts.
• Experience supporting DoD, Intelligence Community, command and control, or other mission systems.