Sr DevSecOps Security Specialist

Job Description

About Science and Technology Corporation

About Science and Technology Corporation (STC): STC is a U.S. government contractor providing scientific, engineering, and technical support to federal agencies, with deep roots in NOAA, NASA, and DoD programs. Founded in 1979 and headquartered in Hampton, VA, STC staff support a growing number of operational missions that monitor the Earth through Earth-observing systems and satellite platforms and through direct field research. STC also researches and investigates leading-edge observing technologies and assesses their applicability to operational missions. STC's NOAA Programs team supports a broad range of operational meteorological, environmental, and geospatial programs.

About the AWIPS HIVE Program

STC is seeking candidates to support the National Weather Service (NWS) on the AWIPS Application Environment contract (commonly referred to as HIVE). AWIPS (Advanced Weather Interactive Processing System) is the mission-critical platform used by forecasters at National Weather Service sites nationwide to analyze environmental data and issue the forecasts, watches, and warnings that protect lives and property. Under the HIVE modernization initiative, STC provides engineering and technical talent in direct support of a major cloud transformation effort to move AWIPS from a legacy desktop system to a modern, cloud-native web application built on Amazon Web Services (AWS). The program operates in a collaborative Agile environment and involves migrating complex operational meteorological workflows, tools, and data visualization capabilities to a microservices-based architecture with a React/TypeScript frontend and Java/Spring Boot microservices backend.

About This Role

STC is hiring a Senior DevSecOps Security Specialist to embed directly in the HIVE program's delivery teams as a hands-on security engineering and compliance traceability owner. This is a pure individual contributor role: no PM, no management. You will write code, review merge requests in GitLab, and connect what is actually built to the control language that auditors and authorizing officials need to see. It is an ideal move for someone shifting from security and compliance into a technical DevSecOps role, or for an engineer ready to grow into cybersecurity configuration and federal security leadership.

Specific Duties Will Include

• Embed in delivery teams as a contributing engineer, writing code and reviewing merge requests in GitLab

• Translate technical implementations into NIST 800-53 control evidence and defend those mappings to assessors

• Drive ATO efforts across the RMF lifecycle from control selection through continuous monitoring

• Operate CNAPP and other security tooling hands-on to triage findings and lead remediation

• Apply automation and AI to resolve program security-traceability questions quickly, consistently, and defensibly

• Communicate clearly in writing and manage your own priorities in a fast-paced delivery environment

Job Requirements

• Bachelor's degree in Computer Science, Information Security, or related field

• 5+ years of total experience including hands-on time as an individual contributor in a DevSecOps role

• Strong DevSecOps fundamentals: CI/CD security, IaC, shift-left security practices

• Deep Linux expertise

• Hands-on GitLab; contributing code and reviewing MRs within active delivery teams

• 5+ years AWS experience including EKS

• 2+ years of ATO experience with solid command of the RMF lifecycle

• Fluency in the NIST 800-53 taxonomy, with the ability to trace an implementation to a specific control

• Hands-on CNAPP platform experience

• Excellent written and verbal communication and self-sufficient workload ownership

Preferred Qualifications

• CISSP certification

• DoD or federal security background

• Experience applying automation and/or AI to compliance and traceability workflows

• RMF audit experience as an auditor or auditee, with the perspective to think on both sides

• Multi-account AWS environment experience

• FedRAMP or GovCloud exposure

Work Arrangement

Fully remote.

Citizenship Requirement

US Citizenship or Permanent Resident status required.