Government and Infrastructure - Cybersecurity - DevSecOps Senior Engineer

About the role

At EY, we’re all in to shape your future with confidence. We’ll help you succeed in a globally connected powerhouse of diverse teams and take your career wherever you want it to go. Join EY and help to build a better working world. Government and Infrastructure – Technology Consulting - Cybersecurity – DevSecOps Senior Engineer - Senior Consultant. From strategy to execution, the Government & Infrastructure of Ernst & Young provides a full range of consulting and audit services to help our Federal, State, Local and Education clients implement new ideas to help achieve their mission outcomes. We deliver real change and measurable results through our diverse, high‑performing teams, quality work at the highest professional standards, operational know‑how from across our global organization, and creative and bold ideas that drive innovation. We enable our government clients to achieve their mission of protecting the nation and serving the people; increasing public safety; improving healthcare for our military, veterans and citizens; delivering essential public services; and helping those in need. EY is ready to help our government build a better working world.

The opportunity: Our cybersecurity professionals possess diverse industry knowledge, along with unique technical expertise and specialized skills. The team works together in planning, pursuing, delivering and managing engagements to assess, improve, build, and in some cases operate integrated security operations for our clients. We will support you with career‑long training and coaching to develop your skills. As EY is a global leading service provider in this space, you will be working with the best of the best in a collaborative environment. So, whenever you join, however long you stay, the exceptional EY experience lasts a lifetime.

Responsibilities

• The DevSecOps Senior Engineer assesses the delivery and security maturity of each application in the portfolio and builds the secure pipelines, controls and automated evidence that the modernization factory runs on. This role ensures that security is built into how software is delivered — not added afterwards — and that rationalization recommendations reflect each application's true security posture and delivery risk.
• Assess each application's delivery toolchain and practices — source control, build and release automation (for example, Jenkins and Bitbucket), artifact management (Artifactory), code quality (SonarQube), Infrastructure-as-Code and configuration management (Terraform, Ansible) and monitoring (Datadog) — and identify manual release processes and gaps.
• Assess application security posture as an input to rationalization, including open vulnerabilities, outdated or vulnerable dependencies, software bill of materials (SBOM) availability, secrets handling, authentication patterns and open plans of action and milestones (POA&Ms).
• Design, build and maintain secure CI/CD pipelines for the modernization factory with integrated static and dynamic application security testing (