Application/Devsecops Engineer

TL;DR

Application/DevSecOps Engineer: Designing, implementing, and maintaining secure, automated delivery pipelines in support of application modernization within the AECC environment with an accent on integrating tools such as GitLab, Terraform, and Ansible to automate development, deployment, and security workflows. Focus on ensuring applications and pipelines comply with applicable standards and frameworks, including DoD RMF, CIS Benchmarks, and NIST SP 800-53.

Location: Rocket Center, RESEARCH TRIANGLE PARK, Hampton, DURHAM, Charlotte, Raleigh, Annapolis Junction, ALEXANDRIA, Chantilly, Reston, McLean, Herndon, Bethesda, Catonsville, Frederick, Ashburn, North Carolina, Virginia, Maryland, West Virginia, United States. US Citizenship Required.

Company

IBM Consulting is IBM’s consulting and global professional services business, with market leading capabilities in business and technology transformation.

What you will do

• Design, implement, and maintain a comprehensive DevSecOps framework to modernize applications hosted in the AECC environment.
• Build and manage CI/CD pipelines by integrating tools such as GitLab Ultimate, Terraform, and Ansible to automate development, deployment, and security workflows.
• Develop and enforce security gates within CI/CD pipelines to ensure only secure code, container images, and configurations are deployed.
• Collaborate with development teams to containerize legacy applications and migrate them to Kubernetes-based environments.
• Integrate security testing into pipelines, including static application security testing (SAST), dynamic application security testing (DAST), and container image scanning.
• Monitor CI/CD pipelines and Kubernetes workloads for performance, security, and compliance using GitLab CI/CD dashboards.

Requirements

• Strong expertise in implementing and managing DevSecOps frameworks using tools such as GitLab, Azure DevOps, or Atlassian.
• Proficiency in Infrastructure as Code (IaC) tools, including Terraform and Ansible.
• Experience with containerization and orchestration tools, such as Docker, Kubernetes, and Red Hat OpenShift.
• DoD 8570.01-M IAT Level II certification (e.g., Security+ CE).
• Must obtain computing environment certifications (e.g., any GitLab certification, Azure DevOps, Jira, etc.) within 6 months of hire.
• Must hold and maintain and active secrect security clearance

Nice to have

• Knowledge of static application security testing (SAST) and dynamic application security testing (DAST) tools (e.g., SonarQube, OWASP ZAP, Burp Suite).
• Familiarity with container image scanning tools (e.g., Trivy, Clair, Anchore).
• Experience with secrets management tools (e.g., hirify.global Vault, Sealed Secrets).
• Proficiency in scripting languages (e.g., Python, Bash, PowerShell) for automating tasks and workflows.

Culture & Benefits

• Healthcare benefits including medical & prescription drug coverage, dental, vision, and mental health & well being
• Financial programs such as 401(k), cash balance pension plan, the IBM Employee Stock Purchase Plan, financial counseling, life insurance, short & long- term disability coverage, and opportunities for performance based salary incentive programs
• Generous paid time off including 12 holidays, minimum 56 hours sick time, 120 hours vacation, 12 weeks parental bonding leave in accordance with IBM Policy, and other Paid Care Leave programs.
• Training and educational resources on our personalized, AI-driven learning platform where IBMers can grow skills and obtain industry-recognized certifications to achieve their career goals