The DevSecOps Senior Engineer at EY will play a crucial role in enhancing the security and delivery maturity of applications within the Government and Infrastructure sector. This position involves working with a diverse team of cybersecurity professionals to assess, improve, and build secure pipelines for software delivery. The engineer will ensure that security is integrated into the software development lifecycle and will mentor junior engineers in secure practices. This role is essential for helping government clients achieve their mission outcomes while maintaining high security standards.

• Bachelor's degree in computer science, software engineering, information systems, computer engineering or a related field, or equivalent practical experience.
• 3-6+ years of experience in DevOps, software engineering or security engineering.
• Hands-on CI/CD pipeline engineering experience with Jenkins, GitHub Actions, GitLab CI or Azure DevOps.
• Experience with at least one application security scanning tool such as Fortify, Checkmarx, SonarQube, Snyk, Trivy or OWASP ZAP.
• Working knowledge of containers and Infrastructure-as-Code.
• Scripting experience in Python, PowerShell or Bash.
• Understanding of the NIST Risk Management Framework, NIST SP 800-53 and secure software development lifecycle practices.
• Must be able to obtain and maintain a secret level clearance.
• Must be comfortable with working in-person as needed in the Washington, DC area.

• Assess each application's delivery toolchain and practices to identify manual release processes and gaps.
• Assess application security posture as an input to rationalization, including open vulnerabilities and outdated dependencies.
• Design, build and maintain secure CI/CD pipelines with integrated security testing and quality gates.
• Implement policy-as-code and automated evidence collection to support continuous Authorization to Operate.
• Harden container images and environments against applicable security configuration benchmarks.
• Integrate governance gates for AI-assisted development and ensure traceability of AI-generated code.
• Define reference DevSecOps patterns and reusable pipeline templates for future modernization waves.
• Support vulnerability triage and remediation guidance in collaboration with client cybersecurity stakeholders.
• Own the DevSecOps architecture and toolchain standards for the team.
• Lead the security-posture assessment methodology and ensure consistent scoring across the portfolio.
• Serve as the primary security engineering contact for client cybersecurity stakeholders.
• Mentor the Staff DevSecOps engineer and promote secure engineering practices across the team.

• Ernst & Young (EY) offers a comprehensive and competitive benefits package designed to support the well-being of its employees across various dimensions.