DevSecOps Security Engineer

About This Role

DevSecOps Security Engineer will join the Air Traffic Business Area within the Homeland Sector, supporting the development of the Leidos Common Automation Platform (L-CAP). L-CAP is a mission-critical, future-ready automation platform built on a hybrid cloud data mesh architecture, enabling next-generation air traffic management capabilities. This role operates within a SAFe/Agile framework as part of an Agile Release Train (ART) delivering iterative value across the program.

Responsibilities

• Build and operate automated security controls embedded in L-CAP’s delivery pipeline, including scanning, gating, signing, and hardening
• Work alongside platform and application teams to raise the security posture of every build and container image without stalling delivery
• Produce pipeline evidence that supports platform security authorization
• Implement and maintain automated security controls in CI/CD pipelines, including SAST, DAST, software composition analysis, container scanning, and infrastructure-as-code scanning
• Enforce security gates, artifact signing, provenance verification, and SBOMs (CycloneDX/SPDX) to prevent vulnerable or unverified deployments
• Drive container vulnerability remediation and hardening, including hardened minimal base images and elimination of critical/high findings
• Implement Kubernetes security controls, including pod security, network policies, RBAC, admission controls, and security context constraints
• Secure workloads through secrets management, mutual TLS (mTLS), service mesh policies, and Linux/container hardening
• Build and maintain policy-as-code and infrastructure guardrails using OPA/Rego, Kyverno, or equivalent tools
• Produce security evidence supporting authorization and continuous monitoring requirements
• Partner with platform and application teams to triage vulnerabilities, remediate findings, and support security incident response and root cause analysis
• Leverage AI-assisted development, automation, and modern engineering practices to improve security, code quality, productivity, and delivery speed

Requirements

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or related field with 4+ years of relevant experience (additional experience, education and training may be considered in lieu of degree)
• Hands-on experience integrating SAST, DAST, software composition analysis, and container scanning into CI/CD pipelines
• Experience securing Kubernetes and container environments, including pod security, network policies, RBAC, admission controls, and hardened/minimal base images
• Experience with vulnerability scanning and remediation, using tools such as Nessus, Trivy, Grype, or Qualys, including CVE triage and tracking
• Experience with secrets management (HashiCorp Vault or equivalent) and security automation using Python, Bash, or Go