The DevSecOps Engineer at EY will play a critical role in enhancing the security and delivery maturity of applications within the Government and Infrastructure sector. This position involves working with a diverse team of cybersecurity professionals to assess and improve security operations for clients. The focus is on integrating security into the software delivery process and ensuring that security measures are proactive rather than reactive. The role offers opportunities for career-long training and collaboration with top industry experts.

• Bachelor's degree in computer science, software engineering, information systems, computer engineering or a related field, or equivalent practical experience.
• 2+ years of experience in DevOps, software engineering or security engineering.
• Hands-on CI/CD pipeline engineering experience with Jenkins, GitHub Actions, GitLab CI or Azure DevOps.
• Experience with at least one application security scanning tool such as Fortify, Checkmarx, SonarQube, Snyk, Trivy or OWASP ZAP.
• Working knowledge of containers and Infrastructure-as-Code.
• Scripting experience in Python, PowerShell or Bash.
• Understanding of the NIST Risk Management Framework, NIST SP 800-53 and secure software development lifecycle practices.
• Must be able to obtain and maintain a secret level clearance.
• Must be comfortable with working in-person as needed in the Washington, DC area.

• Assess each application's delivery toolchain and practices to identify manual release processes and gaps.
• Assess application security posture as an input to rationalization, including open vulnerabilities and outdated dependencies.
• Design, build and maintain secure CI/CD pipelines with integrated security testing and quality gates.
• Implement policy-as-code and automated evidence collection to support continuous Authorization to Operate.
• Harden container images and environments against applicable security configuration benchmarks.
• Integrate governance gates for AI-assisted development, ensuring traceability of AI-generated code.
• Define reference DevSecOps patterns and reusable pipeline templates for future modernization waves.
• Support vulnerability triage and remediation guidance while collaborating with client cybersecurity stakeholders.

• Ernst & Young (EY) offers a comprehensive and competitive benefits package designed to support the well-being of its employees across various dimensions.