Sr. DevSecOps Engineer

Company Overview

Enterprise Horizon Consulting Group (EHCG) is a Woman-Owned Small Business specializing in IT Consulting which has successfully delivered key capabilities to the Navy, Army, and NASA over the past 20+ years. EHCG provides best in class services to its customers in the following areas: Business Systems Services; Business Intelligence; Data Analytics and Dashboarding; Enterprise Resource Planning (SAP) Implementation; Legacy System Optimization; Digital Transformation; Cloud Migration; Integration and Modernization; and Risk Management Framework Processes (RMF).

Job Description 

Enterprise Horizon Consulting Group is seeking a highly skilled Senior DevSecOps Engineer to join our team in support of our DoD customer. The ideal candidate will combine strong technical expertise in cloud, automation, and security with proven experience aligning DevSecOps practices to DoD and NIST standards. This role is critical to designing, building, and maintaining secure CI/CD pipelines, assessing toolsets, and ensuring delivery of secure, reliable, and compliant software systems.

Key Responsibilities

• Lead the design, implementation, and optimization of secure DevSecOps pipelines in support of DoD applications and systems.
• Assess the landscape of DevSecOps tools available to the customer, propose best practices, suggest alternatives, and identify gaps.
• Integrate and deploy DevOps tools and practices in accordance with NIST 800-53 and DoD DevSecOps policies.
• Develop and manage CI/CD pipelines using AWS and Azure DevOps.
• Configure AWS IAM roles, CodePipeline, and CodeDeploy for cross-account deployments.
• Integrate security tools (SonarQube, OWASP ZAP, Nexus, Sonatype IQ) into DevOps pipelines.
• Conduct cost-benefit analysis and provided tool recommendations for security and DevOps.
• Collaborate within an Agile SAFe framework, participating in PI planning sessions and aligning DevOps efforts with strategic goals.
• Develop Python scripts to review ZAP findings and break automation if critical vulnerabilities are detected with web-hosted applications.
• Provide technical leadership and act as a point of contact between the larger team and the customer.
• Support Authority to Operate (ATO) processes through automated compliance checks, vulnerability remediation, and continuous monitoring.