We are looking for a mid-level Azure DevSecOps Engineer to build security and automated testing into every phase of the software delivery lifecycle for federal systems. Java and Terraform are central to this position: the engineer will work across Java application codebases and Terraform-managed infrastructure to design, build, and troubleshoot secure CI/CD pipelines in a hybrid environment spanning on-prem and multiple clouds. The role involves close collaboration with developers, operations, security teams, and product stakeholders to integrate scanning and testing tools, enforce quality gates, and help teams catch vulnerabilities early. This position is expected to start at the end of December 2026. Federal Compliance Identity verification will happen at multiple stages of the interview process to adhere to federal compliance This role is based in the US for a US work-authorized person Required Must be a U.S. citizen or green card holder Must be based in the Washington metropolitan area (DC, Maryland, or Virginia) 4+ years of experience across software development, IT operations, and security (DevSecOps, DevOps, SRE, or similar roles) Hands-on Java development experience, including building, testing, and securing Java applications Hands-on Terraform experience provisioning and managing cloud infrastructure as code Experience building and maintaining CI/CD pipelines with integrated security scanning, versioning, and automated testing Experience working in hybrid environments (on-prem plus one or more cloud platforms) Working knowledge of security frameworks and principles such as Zero Trust, AppSec, NIST 800-53 control families, and audit and logging requirements (OMB M-21-31) Strong written and verbal communication skills, including experience briefing senior-level stakeholders Bachelor's degree in computer science, engineering, or a related field, or an equivalent combination of education and experience Ability to pass a background check and obtain a public trust security clearance

Key Responsibilities

Design, build, configure, and monitor the DevSecOps toolchain and CI/CD pipelines for Java applications. Provision and manage cloud and on-prem infrastructure using Terraform, applying security best practices. Integrate security testing tools (SAST, DAST, SCA, fuzz testing) into pipelines to detect vulnerabilities early. Help define and carry out the automated testing strategy across pipelines, covering functional, performance, and security tests. Define and implement test coverage metrics, quality gates, and pass/fail criteria that enforce security and compliance standards. Enable product teams to create and maintain their own test plans, test data, and test cases, and drive "shift-left" testing practices. Maintain traceability between work items, code, test cases, security requirements, risk mitigations, and releases. Document test processes, test data management, automated test infrastructure, and standard operating procedures. Report on testing outcomes, vulnerabilities, and quality trends to engineers, oversight managers, and leadership. Research emerging DevSecOps tools and practices and share them with the team and wider development community. Nice to Haves: Experience with additional languages or technology stacks beyond Java Experience with IT Service Management (ITSM) practices alongside Agile delivery Experience with container and Kubernetes security scanning Experience with observability and logging platforms (Splunk, Elastic, Grafana, Prometheus) Experience using agentic coding tools (Claude Code, Codex, GitHub Copilot) for applications or infrastructure automation Security, cloud, or Terraform certifications (Security+, CISSP, AWS, Azure, HashiCorp)