3 days ago
Chantilly, VA, USASenior
Responsibilities
- Design, build, and maintain security capabilities within DevSecOps and software delivery pipelines.
- Integrate automated SAST, DAST, container scanning, software composition analysis, and SBOM generation.
- Implement security gates and controls that identify vulnerabilities and prevent unacceptable artifacts from progressing.
- Automate security evidence collection for RMF, ATO, Continuous Monitoring, and continuous authorization objectives.
- Develop and maintain the program’s Secure Coding Guide and translate its requirements into pipeline controls and developer workflows.
- Support application onboarding, secure coding, security tool usage, and vulnerability remediation.
- Analyze and help remediate CWE, CVE, STIG, dependency, container, and application security findings.
- Validate software artifacts through integrity checks, image signing, provenance tracking, and SBOM review.
- Document security controls, pipeline processes, evidence outputs, technical decisions, and developer guidance.
- Support ISSO functions including Continuous Monitoring, vulnerability management, security control assessments, and remediation tracking.
- Partner with Cloud and DevSecOps engineers to implement secure-by-default pipelines, infrastructure, and platform services.
- Support security implementation across classified, multi-classification, containerized, and cloud-based environments.
Requirements
- Bachelor’s degree and nine or more years of related experience, or master’s degree and seven or more years, or PhD and four or more years; relevant experience may substitute for education.
- TS/SCI clearance and U.S. citizenship are required.
- DoD 8140-aligned cybersecurity certification such as Security+, CASP+, CISSP, CCSP, or equivalent is required.
- Five to ten years of cybersecurity, application security, DevSecOps, software engineering, or related experience is required.
- Hands-on experience with DevSecOps, application security, security automation, or secure software delivery is required.
- Experience with security tools such as Fortify, OWASP ZAP, Grype, Trivy, SonarQube, or comparable products is required.
- Experience analyzing and remediating CWE, CVE, STIG, dependency, container, or application security findings is required.
- Experience with Git-based workflows, CI/CD platforms, automated pipeline controls, and scripting with PowerShell, Python, Bash, or a similar language is required.
- Preferred experience includes GitLab CI/CD, Gitea, container registries, artifact repositories, pipeline runners, and RMF or ATO evidence automation.
- Preferred experience includes secure coding standards, SBOMs, software composition analysis, image signing, artifact provenance, Kubernetes, RKE2, containers, and cloud-native security.
- Preferred experience includes classified cloud, multi-classification, MLS/MILS, Cross Domain Solution, Zero Trust, policy as code, continuous authorization, and DoD or Intelligence Community mission systems.
Tech Stack
Categories
About SAIC
SAIC (Science Applications International Corporation) is a government technology integrator delivering systems engineering, enterprise IT, secure cloud, cybersecurity, C5ISR, and data analytics for U.S. defense, space, intelligence, and civilian agencies. It builds and sustains mission IT and digital engineering solutions under multi-year federal contracts and task orders. Founded in 1969, SAIC is headquartered in Reston, Virginia, and is a public company traded on the NYSE under the ticker SAIC.