DevSec Ops Engineer

SOFT's client located Remotely is looking for a DevSec Ops Engineer for a long term contract assignment.

Required
• Bachelor’s degree in Information Security, Computer Science, or a related field.
• 5–7 years of experience in information security, application development, risk management, audit, or cyber operations.
• Advanced knowledge of security principles, assessment methodologies, and cloud environments (AWS/Azure).
• Hands-on experience with automation platforms, continuous monitoring tools, and analytics technologies.
• Strong analytical, communication, facilitation, and negotiation skills.
Preferred
• Professional certifications (CISSP, CISA, CRISC).
• Demonstrated success enabling DevSecOps at scale, including security testing automation and policy development.
• Experience administering code repositories and build systems across CI/CD pipelines.
• Experience building and deploying AI agents (RAG, orchestration, tool/function calling) in regulated environments.
• Direct experience with NIST SP 800-53 Rev 5 and FedRAMP, including OSCAL artifact management and GRC ingestion.
Technical Proficiencies
• AWS and Azure cloud platforms.
• Source control and developer platforms.
• Vulnerability, compliance, and quality scanning tools.
• SAST/DAST and infrastructure-as-code tooling.

Responsibilities:
• Design, build, and operationalize AI agents for evidence triage, control mapping, and developer support.
• Enforce secure prompt and skill management, role-based access controls, and audit trails.
• Integrate agents with enterprise systems (ticketing, CI/CD, knowledge bases) via secure APIs.
• Map automated controls and agent workflows to priority NIST SP 800-53 Rev 5 and FedRAMP requirements.
• Deliver FedRAMP-ready artifacts and processes, including continuous monitoring and compliance dashboards.
- Design, build and implement secure-by-design practices across DevSecOps pipelines.
• Assess automation opportunities, build and integrate security automation, and deliver data-driven risk insights.
• Partner with engineering to implement SAST/DAST, infrastructure-as-code checks, and vulnerability scanning within CI/CD.
• Develop APIs to orchestrate security scanning workflows and automate evidence capture.
• Manage private certificate authorities and automate code signing for secure build and release processes.
• Translate technical findings into decision-ready insights for leadership and risk committees.
• Co-design automated, analytics-driven processes to reduce manual effort and enhance transparency.

Please refer to the Position ID when inquiring about a job posting or sending in your resume.

***INDEPENDENT CONSULTANTS ONLY! NO THIRD PARTIES/NO SUB CONTRACTORS***