DevSecOps Engineer

Title:

The DevSecOps Engineer is responsible for integrating security practices into the software development lifecycle to enable secure, scalable, and compliant delivery of applications. This role leverages enterprise DevSecOps platforms-including Azure DevOps, GitHub, SonarQube, Sonatype, Fortify, Katalon, and OpenShift-to embed automated security, code quality, and compliance controls while supporting high-velocity software delivery. The role also supports platform evolution through repository and pipeline migrations and ongoing DevSecOps toolchain modernization.

Key Responsibilities

• Integrate security controls and best practices into CI/CD pipelines using Azure DevOps and GitHub Actions
• Configure and enforce code quality and security gates leveraging SonarQube and Fortify
• Implement Software Composition Analysis (SCA) using Sonatype to detect and remediate open-source vulnerabilities
• Embed vulnerability detection, secrets scanning, and policy enforcement into development workflows
• Collaborate with development teams to remediate security findings and improve secure coding practices
• Establish and maintain governance controls and branch protection policies in GitHub and Azure DevOps
• Support containerization and platform engineering practices using OpenShift, including image scanning and runtime security
• Implement and maintain cloud-native and hybrid security controls across Azure environments
• Monitor, triage, and respond to vulnerabilities identified across SDLC tooling and pipelines

Migration & Platform Transformation

• Plan and execute migration of source code repositories between platforms (e.g., Azure DevOps to GitHub), ensuring integrity, history preservation, and minimal disruption
• Design, migrate, and optimize CI/CD pipelines to align with enterprise standards and target platforms
• Consolidate and rationalize DevSecOps toolchains during migrations to improve efficiency and reduce duplication

Tool Lifecycle & Continuous Modernization

• Manage lifecycle of DevSecOps tools, including version upgrades, patching, and feature adoption across SonarQube, Sonatype, Fortify, Katalon, GitHub, and Azure DevOps
• Evaluate and implement new capabilities, integrations, and enhancements across the DevSecOps platform stack
• Ensure compatibility, performance, and security posture are maintained during tool upgrades and platform changes
• Develop reusable pipeline templates, automation scripts, and security standards for enterprise adoption
• Ensure compliance with internal governance, security policies, and regulatory requirements
• Drive continuous improvement of DevSecOps maturity, automation, and toolchain integration

Qualifications:

• Bachelor’s degree in Computer Science, Information Security, or related field, or equivalent experience
• 5+ years of experience in DevOps, DevSecOps, or software engineering
• Hands-on experience with CI/CD platforms including Azure DevOps and GitHub
• Experience with application security and quality tools including SonarQube, Fortify, and Sonatype
• Experience executing repository and CI/CD pipeline migrations across platforms
• Experience implementing automated testing frameworks (Katalon or similar)
• Strong understanding of secure coding practices and common vulnerabilities (OWASP Top 10)
• Experience with container platforms such as OpenShift or Kubernetes
• Experience working in cloud environments, preferably Microsoft Azure
• Proficiency in scripting or programming (PowerShell, Python, Bash, or similar)

Preferred Qualifications

• Experience with GitHub Advanced Security and enterprise governance controls
• Experience leading large-scale DevSecOps platform migrations or transformations
• Familiarity with policy-as-code tools such as Open Policy Agent or Azure Policy
• Security certifications such as CISSP, CSSLP, or CEH
• Knowledge of regulatory and compliance frameworks (NIST, ISO 27001, SOC 2)

Belong. Connect. Grow. with KBR!