Description
Leidos is seeking a DevSecOps Security Engineer to join the Air Traffic Business Area within the Homeland Sector, supporting the development of the Leidos Common Automation Platform (L-CAP).
L-CAP is a mission-critical, future-ready automation platform built on a hybrid cloud data mesh architecture, enabling next-generation air traffic management capabilities.
In this role, you will build and operate the automated security controls embedded in L-CAP's delivery pipeline , the scanning, gating, signing, and hardening that make security continuous rather than periodic.
Responsibilities
- Implement and maintain automated security controls in CI/CD pipelines, including SAST, DAST, software composition analysis, container scanning, and infrastructure-as-code scanning.
- Enforce security gates, artifact signing, provenance verification, and SBOMs (CycloneDX/SPDX) to prevent vulnerable or unverified deployments.
- Drive container vulnerability remediation and hardening, including hardened minimal base images and elimination of critical/high findings.
- Implement Kubernetes security controls, including pod security, network policies, RBAC, admission controls, and security context constraints.
- Secure workloads through secrets management, mutual TLS (mTLS), service mesh policies, and Linux/container hardening.
- Build and maintain policy-as-code and infrastructure guardrails using OPA/Rego, Kyverno, or equivalent tools.
- Produce security evidence supporting authorization and continuous monitoring requirements.
- Partner with platform and application teams to triage vulnerabilities, remediate findings, and support security incident response and root cause analysis.
- Leverage AI-assisted development, automation, and modern engineering practices to improve security, code quality, productivity, and delivery speed.
Core Technical Qualifications
- Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or related field with 4+ years of relevant experience.
- Hands-on experience integrating SAST, DAST, software composition analysis, and container scanning into CI/CD pipelines.
- Experience securing Kubernetes and container environments, including pod security, network policies, RBAC, admission controls, and hardened/minimal base images.
- Experience with vulnerability scanning and remediation, using tools such as Nessus, Trivy, Grype, or Qualys, including CVE triage and tracking.
- Experience with secrets management (HashiCorp Vault or equivalent) and security automation using Python, Bash, or Go.
- Experience with Git-based workflows and CI/CD tooling, such as GitLab CI, GitHub Actions, or Jenkins.
- Working knowledge of NIST 800-53, automated security evidence, and AWS or Azure cloud security.
- Understanding of network security, including segmentation and default-deny policies.
- U.S. citizenship required, with the ability to obtain and maintain a Public Trust and meet government background investigation requirements.
- Must meet FAA facility and information system access requirements, including continuous U.S. residency for at least 3 of the prior 5 years.
Benefits
No specific benefits mentioned.
Pay Range: $87,100.00 - $157,450.00