Staff DevSecOps Engineer

• Implement and maintain SAST, DAST, software composition analysis, container image scanning, secret scanning, and SBOM generation within pipelines.

• Configure quality and security gates, and work with development teams to triage and resolve findings rather than simply reporting them.

• Manage build-time secrets, signing, and artifact provenance in line with Areté's security requirements.

• Automate platform, build, and remediation tasks using Bash, Python, or PowerShell; manage infrastructure and configuration with IaC and deployment tooling.

• Maintain DevSecOps procedures, system documentation, and standard operating procedures; support change management, audit readiness, and compliance-aligned workflows.

• Track and report metrics on build times, pipeline reliability, and security posture, and drive measurable improvement.

• Other duties, as assigned.

• Bachelor's Degree in Computer Science, Information Technology, Cybersecurity, or a related discipline, or an additional 2 years of relevant work experience in lieu of a degree.

• Minimum of 3 years of hands-on DevOps or DevSecOps experience with modern CI/CD pipelines

• Demonstrated ability to build, debug, and optimize GitLab CI pipelines — .gitlab-ci.yml authoring, CI/CD components and templates, and diagnosing failures across build, test, packaging, and deployment stages. Experience with self-hosted GitLab, as an administrator or advanced user, is strongly preferred.

• Proficiency in Linux system administration (RHEL, Rocky, or Ubuntu), including networking fundamentals, system services, logging, and certificate management.

• Hands-on experience with Docker and container lifecycle management — image creation, registries, and image tagging/promotion.

• Experience automating tasks with Bash, Python, or PowerShell.

• Experience integrating at least one class of security tooling into pipelines — SAST, DAST, software composition analysis, secret scanning, or container image scanning.

• Demonstrated ability to support developers directly — resolving CI/CD and Git workflow issues, teaching Git fundamentals (branching, rebasing, merge conflict resolution, repository hygiene), writing clear documentation and runbooks, and explaining technical issues to engineers and non-technical stakeholders alike.

• Must hold an active Top Secret security clearance, or be eligible to obtain and maintain one.

• Must have or be able to obtain a CompTIA Security+ CE certification within 120 days of employment, in accordance with DoDM 8140.03 and DFARS 252.239-7001.

• Active Top Secret security clearance; TS/SCI with polygraph is a plus.

• Experience administering self-hosted GitLab — Runner configuration and scaling, project and group permissions, integrations, and registries.

• Experience with an enterprise artifact repository — JFrog Artifactory preferred; Sonatype Nexus or the GitLab Package/Container Registry comparable; administration experience a plus.

• Working experience with Infrastructure-as-Code (Terraform or Azure Bicep) and configuration management or deployment packaging tools such as Ansible or Helm.

• Experience with Kubernetes or OpenShift.

• Experience with container security practices — image signing, SBOM generation, and policy enforcement.

• Familiarity with secure SDLC practices, OWASP Top 10, and compliance frameworks such as NIST 800-53, NIST 800-171, FedRAMP, JSIG, or ITAR.

• Experience supporting development in classified, airgapped, or otherwise disconnected environments, including offline dependency and artifact management.

• Experience with GitOps deployment patterns, Azure DevOps, or cloud-native CI/CD services.

• Certifications such as GitLab Certified CI/CD Associate or Specialist, Docker or Kubernetes certifications (CKA/CKAD), or cloud associate certifications.