DevSecOps Engineer

Apex Systems, Inc.
Rockville, MD
Dec 01, 2021
Dec 04, 2021
Engineer, IT, QA Engineer
Full Time
Apex Systems has an immediate opening for a DevSecOps Engineer. This is a position supporting one of our large Federal Health clients in Rockville, MD. In this role, a typical day will include the following: Developing and implementing continuous integration and continuous delivery (CI/CD) pipelines to automate and shift left with security for the deployment of infrastructure and application code. Monitoring, coordinating, reporting the status, and responding to alerts for compliance violations, threats, and vulnerabilities reported by vendors and CISA or found using tools such as Tenable, Splunk, FireEye, Carbon Black, and Netsparker. Serving as a subject matter expert within the Enterprise Hosting Program to collaborate with and guide infrastructure engineers to build secure infrastructure services, address new and critical security vulnerabilities, and enhance cybersecurity best practices across the program by automating and developing streamlined processes. Working closely with senior leaders to develop a comprehensive, agile, and innovative DevSecOps program that supports all phases of the software development lifecycle, identifies and effectively manages risk, and establishes a user-friendly cybersecurity culture. Participating in a daily stand-up meeting to report your accomplishments, plans for the day, and any roadblocks you encountered. Your team will do the same, giving you an opportunity to understand and contribute to other ongoing initiatives. Occasionally presenting to our program or our software developer colleagues, on DevSecOps best practices and ways to solve challenging technical issues with agile security tools and practices. WHAT YOU'LL NEED: BA/BS or equivalent and eight years related experience or a MS and six years experience. Minimum of five years hands-on experience and subject matter expertise with enterprise infrastructure, such as recent versions of Windows server and RedHat Linux, F5 BigIP application services, DNS, Active Directory, Group Policy, Enterprise SQL and Postgres databases, and VMware to include VMware NSX. Minimum of five years of experience with DevSecOps tools to automate the integration of security at every phase of the software development lifecycle, from initial design through integration, testing, deployment, and product delivery. Examples of tools include Azure DevOps, GoCD, Jenkins, Maven, Codacy, GitHub, Sonarqube, Terraform, Vault, and OWASP ZAP. Experience with network and system security tools, including web application firewalls, endpoint protection, application vulnerability scanning, encryption protocols, security information and event management, and identity and access management. Knowledge of and the ability to explain cybersecurity processes and concepts, such as threats, vulnerabilities, encryption, network boundary defense, zero trust, SOAR, authentication, security certification and accreditation, and risk management framework. Experience designing solutions and implementing technologies following NIST standards, such as SP 800-53, SP 800-190, and SP 500-291. Hands-on experience with scripting languages such as Powershell, Python or Bash, and infrastructure as code tools such as Terraform to include writing scripts and modules from scratch. Experience analyzing solutions components, understanding systems integration challenges, and identifying security risks in current components that must be resolved to reach security targets and functionality requirements in enterprise infrastructure. Ability to obtain and maintain a Public Trust Preferred Qualifications: Experience with common AWS services, such as EC2, S3, RDS, VPC, Cloud Watch, Cloud Trail, and IAM. Experience configuring and securing containers and container orchestration solutions such as Docker and Kubernetes. Experience developing workflows in ServiceNow to integrate DevSecOps toolchains to provide data insights, accelerate change, and increase visibility across DevOps teams. Knowledge of Trusted Internet Connection (TIC) 3.0 policy and recommended frameworks. EEO EmployerApex Systems is an equal opportunity employer. We do not discriminate or allow discrimination on the basis of race, color, religion, creed, sex (including pregnancy, childbirth, breastfeeding, or related medical conditions), age, sexual orientation, gender identity, national origin, ancestry, citizenship, genetic information, registered domestic partner status, marital status, disability, status as a crime victim, protected veteran status, political affiliation, union membership, or any other characteristic protected by law. Apex will consider qualified applicants with criminal histories in a manner consistent with the requirements of applicable law. If you have visited our website in search of information on employment opportunities or to apply for a position, and you require an accommodation in using our website for a search or application, please contact our Employee Services Department at employeeservices@ or 844-463-6178.VEVRAA Federal ContractorWe request Priority Protected Veteran & Disabled Referrals for all of our locations within the state.We are an equal opportunity employer. We evaluate qualified applicants without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, veteran status, or any other protected characteristic. The EEO is the Law poster is available here.PDN-947a2c82-f86b-40c4-83f1-8b8e01da33f1