Position Title: Senior DevSecOps Engineer Location: Remote (In the U.S) Other Considerations: U.S. Citizen or Permanent Resident (Required)
POSITION SUMMARY
Sprezzatura is seeking a Senior DevSecOps Engineer to serve as the technical security engineering lead supporting cybersecurity modernization for the Department of Veterans Affairs (VA).
The Senior DevSecOps Engineer will lead hands-on engineering efforts to identify and remediate security and control deficiencies across the platform's cloud infrastructure, CI/CD pipelines, shared platform services, and supporting systems. This position will help move the Platform toward a modern, engineering-first approach to cybersecurity by translating security requirements and identified control gaps into durable technical solutions. This role will work closely with security and RMF personnel to translate control deficiencies, vulnerabilities, assessment findings, and Plans of Action and Milestones (POA&Ms) into actionable engineering work. The Senior DevSecOps Engineer will then lead or directly implement remediation through infrastructure, configuration, access policy, system rules, pipeline, and code changes.
The ideal candidate combines deep cloud and DevSecOps engineering experience with a strong understanding of cybersecurity, vulnerability remediation, secure software delivery, and federal security requirements. This individual should be comfortable operating as both a hands-on senior engineer and technical security SME in a complex, large-scale cloud environment. This position will participate in a 24/7 on-call rotation.
RESPONSIBILITIES
- Serve as the team's senior technical security engineering lead and Security Engineering Subject Matter Expert (SME)
- Lead hands-on remediation of security vulnerabilities, control deficiencies, and technical security debt across platform infrastructure and shared services
- Translate security control requirements, assessment findings, vulnerabilities, and POA&Ms into actionable engineering solutions
- Implement security remediation through code, infrastructure, configuration, system rules, access policies, and other technical changes
- Design, implement, and maintain automated security quality gates within GitHub Actions and platform CI/CD pipelines
- Integrate and improve capabilities including SAST, DAST, Software Composition Analysis (SCA), secrets detection, dependency scanning, and other automated security checks
- Develop and maintain secure configuration baselines for cloud infrastructure and Platform components
- Implement and improve centralized secrets management and secure credential-handling practices
- Lead vulnerability remediation efforts across AWS infrastructure, containers, applications, dependencies, CI/CD pipelines, and shared Platform components
- Provision, secure, and sustain resilient CI/CD runner infrastructure within VA cloud environments
- Implement automation supporting patching, vulnerability remediation, and security configuration management
- Improve security logging, monitoring, and alerting capabilities to support timely detection and response to security events
- Integrate Platform systems with security monitoring and telemetry capabilities, including applicable CSOC and continuous-monitoring requirements
- Configure and improve cloud-native security capabilities such as AWS GuardDuty, AWS Security Hub CSPM, and related AWS security services
- Lead or support technical implementation associated with DAST/WASA, SAST, secrets detection, and runtime security
- Partner with RMF and security personnel to determine appropriate technical remediation for NIST SP 800-53 control deficiencies
- Partner with the Security Automation Engineer to ensure implemented controls generate reliable security evidence and measurable security posture data
- Provide hands-on technical guidance to VA.gov product and engineering teams implementing security requirements
- Lead technical planning and requirements definition when remediation requires coordination across multiple systems or engineering teams
- Document implemented security controls, technical remediation, architecture decisions, and operational procedures necessary to sustain improvements
- Participate in technical reviews, incident response, troubleshooting, and a 24/7 engineering on-call rotation as required
QUALIFICATIONS
- Bachelor's degree and 10+ years of relevant experience, or equivalent combination of education and experience
- Significant hands-on experience in DevSecOps, cloud infrastructure, platform engineering, Site Reliability Engineering, or security engineering
- Advanced experience with AWS, preferably including experience supporting complex production cloud environments
- Strong experience designing, implementing, and maintaining CI/CD pipelines, preferably using GitHub Actions
- Experience implementing security controls through infrastructure-as-code, configuration management, automation, or software development
- Experience with vulnerability identification, prioritization, remediation, and validation
- Experience implementing or operating application and infrastructure security tooling, including SAST, DAST, SCA, secrets detection, container scanning, or comparable capabilities
- Experience with infrastructure-as-code and configuration management technologies
- Strong knowledge of cloud security, IAM, secrets management, network security, logging, monitoring, and secure configuration practices
- Experience working with containerized workloads and modern cloud-native architectures
- Proficiency with one or more scripting or programming languages used for infrastructure and security automation
- Ability to troubleshoot complex production infrastructure and security issues across multiple layers of a technology stack
- Ability to communicate technical security risks and remediation approaches to engineering, security, product, and program stakeholders
- Ability to obtain and maintain the background investigation and access required to support Department of Veterans Affairs systems
- Ability to participate in a 24/7 on-call rotation
PREFERRED QUALIFICATIONS
- Experience supporting federal systems operating under the NIST Risk Management Framework (RMF)
- Knowledge of NIST SP 800-53 Rev. 5 security controls and experience translating control requirements into technical implementations
- Experience supporting systems operating at FISMA Moderate or High impact levels.
- Experience with AWS GovCloud or VA Enterprise Cloud (VAEC) environments
- Experience with AWS Security Hub, GuardDuty, IAM, CloudTrail, CloudWatch, or comparable cloud security capabilities
- Experience developing or maintaining GitHub Actions runners and secure CI/CD execution infrastructure
- Experience with Kubernetes, containers, and container security
- Experience with Software Bill of Materials (SBOM) generation and software supply-chain security
- Experience with continuous monitoring, security telemetry, or integration with enterprise security operations capabilities
- Experience remediating findings resulting from security assessments, vulnerability scans, penetration testing, WASA/DAST, or similar activities
- Familiarity with federal ATO processes, POA&Ms, control implementation evidence, and independent controls assessments
- Experience serving as a technical lead or SME responsible for coordinating security engineering work across multiple teams
WORKING CONDITIONS
Standard Business hours are Monday through Friday. Occasional extended or weekend hours may be required based on operational needs. Travel may be required from time to time for customer meeting and industry events.
PAY RANGE
The base salary range for this position is $150,000 to $170,000 annually, depending on geographic work location, relevant experience, skills, education, internal equity, security clearance, and contract requirements. Geographic salary ranges are determined in accordance with the company's compensation practices and represent a good-faith estimate of the compensation for this position at the time of posting.
BENEFITS
Sprezzatura offers a comprehensive and flexible benefit package to include:
- Medical, Dental, and Vision
- Health Saving Account (when enrolled in eligible plan) with Company contribution
- Company paid Life, Accidental Death, Short-term & Long-term Disability
- Voluntary Accident, Hospital Indemnity, & Critical Care Insurance
- Voluntary Medical & Dependent Care Flexible Spending Accounts
- Accrued Paid Time Off & Company Paid Holidays
- 401(k) Retirement Plan with Company match
WORK AUTHORIZATION
Sprezzatura participates in E-Verify and will provide the federal government with your I-9 information to confirm that you are authorized to work in the U.S.
Sprezzatura is a mission-driven, Service-Disabled Veteran-Owned Small Business (SDVOSB) that thrives at the intersection of technology, innovation, and impact. We specialize in secure, scalable, and human-centered digital solutions that accelerate government transformation. Our work spans DevSecOps, health IT modernization, intelligent automation, benefits delivery, and digital communications. We partner with agencies ready to evolve - delivering not just strategy, but measurable execution. Rooted in operational excellence and driven by curiosity, we help our clients navigate complexity with clarity - turning ambitious ideas into real-world outcomes. No buzzwords. Just impact.
CLEARANCE REQUIREMENT
This position may require Public Trust clearance. Candidates must undergo a background investigation, including a review of employment history, education, criminal record, and financial history. The clearance process ensures that the candidate is reliable, trustworthy, and of good conduct and character. Employment offers are contingent upon successful passing a public trust clearance process.
EEO STATEMENT
Sprezzatura is an Equal Opportunity Employer. We do not discriminate on the basis of race, color, religion, sex (including pregnancy, sexual orientation, and gender identity), national origin, age, disability, genetic information, protected veteran status, or any other legally protected characteristic. Applicants have the right to discuss, disclose, or inquire about compensation without retaliation. Reasonable accommodations are available for qualified individuals with disabilities.
This job description is not intended to be an employment contract and does not guarantee employment for any specific duration.