Bachelor's degree with 9+ years of experience, or Master's with 7+ years, or PhD with 4+ years; relevant experience may substitute for education.
TS/SCI clearance and U.S. citizenship required.
DoD 8140-aligned cybersecurity certification (e.g., Security+, CASP+, CISSP).
5-10 years in cybersecurity, application security, DevSecOps, or software engineering.
Hands-on experience with DevSecOps, CI/CD, and secure software delivery.
Familiarity with security tools like Fortify, OWASP ZAP, and SonarQube.
Experience with Git-based workflows and scripting languages (PowerShell, Python, Bash).
Responsibilities
Design, build, and maintain security capabilities within DevSecOps and CI/CD pipelines.
Integrate automated security tools for vulnerability detection and compliance.
Implement security gates to prevent vulnerable software from progressing.
Automate collection and delivery of security evidence for compliance objectives.
Develop and improve the Secure Coding Guide with best practices.
Translate security requirements into automated pipeline controls and developer workflows.
Support application onboarding and vulnerability remediation for Capability Providers.
Benefits
Comprehensive health insurance options.
Retirement savings plans with company matching.
Professional development and training opportunities.
Flexible work schedules and remote work options.
Generous paid time off and holiday policies.
Full Job Description
Job Description
SAIC is seeking a DevSecOps Security Engineer to design, implement, and operate security capabilities within software delivery pipelines supporting the development, integration, testing, and deployment of mission applications. This engineer will work with Cloud, DevSecOps, Software, Integration, Test, and Cyber teams to help Capability Providers identify vulnerabilities earlier, remediate findings, and deliver secure software more efficiently.
The successful candidate will build automated security checks, generate evidence supporting the Risk Management Framework (RMF), guide developers through secure software delivery processes, and develop the program's Secure Coding Guide. This position will also help establish the foundation for a certified CI/CD pipeline, automated compliance, and future continuous authorization capabilities.
Job Duties Include
Design, build, and maintain security capabilities within DevSecOps and CI/CD pipelines.
Integrate automated SAST, DAST, container scanning, Software Composition Analysis (SCA), and Software Bill of Materials (SBOM) generation.
Implement security gates that identify vulnerabilities and prevent unacceptable software artifacts from progressing through the delivery pipeline.
Automate the collection, organization, and delivery of security evidence supporting RMF, ATO, Continuous Monitoring, and future continuous authorization objectives.
Develop, maintain, and continuously improve the program's Secure Coding Guide, including required practices, prohibited practices, secure design patterns, and software security expectations.
Translate Secure Coding Guide requirements into pipeline controls, automated checks, developer workflows, and application onboarding criteria.
Support Capability Providers with application onboarding, security tool use, secure coding practices, and vulnerability remediation.
Review and help resolve CWE, CVE, STIG, dependency, container, and application security findings.
Validate software artifacts through integrity checks, image signing, provenance tracking, SBOM review, and other software supply chain security practices.
Assist with ISSO functions including Continuous Monitoring (ConMon), vulnerability management, security control assessments, remediation tracking, and maintenance of cybersecurity evidence supporting RMF and ATO activities.
Identify opportunities to reduce manual security activities, improve developer feedback, and accelerate secure capability delivery.
Partner with Cloud and DevSecOps engineers to implement secure-by-default pipelines, infrastructure, and platform services. Support security implementation across classified, multi-classification, containerized, and cloud-based development environments.
Qualifications
Required Qualifications
Bachelor's degree and nine (9) years or more related experience; OR Master's degree and seven (7) years or more of related experience; OR PhD and four (4) years or more of related experience. Relevant experience may substitute for education.
TS/SCI clearance and U.S. citizenship.
DoD 8140-aligned cybersecurity certification, such as Security+, CASP+, CISSP, CCSP, or equivalent.
Five (5) to ten (10) years of cybersecurity, application security, DevSecOps, software engineering, or related experience.
Hands-on experience with DevSecOps, CI/CD, application security, security automation, or secure software delivery.
Experience with security tools such as Fortify, OWASP ZAP, Grype, Trivy, SonarQube, or comparable products.
Experience analyzing and supporting remediation of CWE, CVE, STIG, dependency, container, or application security findings.
Experience with Git-based workflows, CI/CD platforms, and automated pipeline controls.
Experience scripting with PowerShell, Python, Bash, or a similar language.
Desired Qualifications and Experience
Experience with GitLab CI/CD, Gitea, container registries, artifact repositories, or pipeline runners.
Experience automating RMF, ATO, Continuous Monitoring, or compliance evidence.
Experience developing secure coding standards, secure software development guidance, or application security requirements.
Experience with SBOMs, SCA, image signing, artifact provenance, and software supply chain security.
Familiarity with Kubernetes, RKE2, containers, and cloud-native security.
Familiarity with Zero Trust, policy as code, continuous authorization, or certified CI/CD pipeline concepts.
Experience supporting DoD, Intelligence Community, command and control, or other mission systems.
About SAIC
Science Applications International Corporation (SAIC) is a technology integrator in the technical, engineering, intelligence, and enterprise information technology markets. SAIC has approximately 26,000 employees and operates in more than 70 countries. The company was founded in 1969 and is headquartered in Reston, Virginia. SAIC provides services to the U.S. government, including the Department of Defense, the intelligence community, and civilian agencies. The company also serves commercial customers in the healthcare, energy, and financial services sectors.
