Mid-Level DevSecOps Engineer
GRVTY · Herndon, VA · 2 wk ago
Engineering$150k–$250k/yrFull-time
We need to output HTML fragment with sections: headings for sections like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We must only include sections when posting has real specific content. We need to parse the posting.
The posting includes:
- Intro: "What Impact You'll Have" description. Could be "About the role" maybe. We'll treat as About the role.
- "What You'll Be Owning": list of duties/responsibilities.
- "What You Must Have": requirements/qualifications.
- "What Would Be Nice To Have": nice-to-have (maybe Skills? but we can treat as Skills or Additional Qualifications). Could be "Preferred Qualifications".
- Pay Range: includes Virginia Pay Range $150,000-$250,000 USD (duplicate). So we need Pay section.
- Benefits: described in "Why Choose GRVTY" includes benefits list: Robust health plan..., Health Savings Account..., Annual Paid Time Off..., Paid Parental Leave, 401k..., Training..., Award Programs..., Variety of Company Sponsored Events. Also earlier mention: comprehensive benefits, etc. So we can include Benefits section.
- Schedule: mention "Must be able and willing to work 40 hours per week in a SCIF in Herndon, Virginia." That's schedule info (40 hrs/week). So we can include Schedule.
- Also location: Herndon, VA. Could be included in About the role or maybe as meta. Not required as separate heading.
We must not repeat job title as heading. No Job ID.
We must remove boilerplate: EEO statement, application instructions, etc. Also remove duplicated lines (the Pay Range appears twice). Keep only once.
We must not create sections with filler like "commensurate with experience". Not present.
We need to use
for sections like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We must only include sections when posting has real specific content. We need to parse the posting.
The posting includes:
- Intro: "What Impact You'll Have" description. Could be "About the role" maybe. We'll treat as About the role.
- "What You'll Be Owning": list of duties/responsibilities.
- "What You Must Have": requirements/qualifications.
- "What Would Be Nice To Have": nice-to-have (maybe Skills? but we can treat as Skills or Additional Qualifications). Could be "Preferred Qualifications".
- Pay Range: includes Virginia Pay Range $150,000-$250,000 USD (duplicate). So we need Pay section.
- Benefits: described in "Why Choose GRVTY" includes benefits list: Robust health plan..., Health Savings Account..., Annual Paid Time Off..., Paid Parental Leave, 401k..., Training..., Award Programs..., Variety of Company Sponsored Events. Also earlier mention: comprehensive benefits, etc. So we can include Benefits section.
- Schedule: mention "Must be able and willing to work 40 hours per week in a SCIF in Herndon, Virginia." That's schedule info (40 hrs/week). So we can include Schedule.
- Also location: Herndon, VA. Could be included in About the role or maybe as meta. Not required as separate heading.
We must not repeat job title as heading. No Job ID.
We must remove boilerplate: EEO statement, application instructions, etc. Also remove duplicated lines (the Pay Range appears twice). Keep only once.
We must not create sections with filler like "commensurate with experience". Not present.
We need to use for section headings. Use - for any list of duties/requirements/benefits. Use
for prose.
We need to preserve all substantive information; do not invent or summarize away detail. So we need to keep details like specific tools, etc.
We'll structure:
About the role
... (the impact description).
Responsibilities
- ... each bullet from "What You'll Be Owning".
Requirements
- ... each bullet from "What You Must Have".
Preferred Qualifications
- ... each bullet from "What Would Be Nice To Have".
Benefits
- ... each benefit from "Why Choose GRVTY".
Pay
Virginia Pay Range $150,000—$250,000 USD
Schedule
40 hours per week, on‑site in a SCIF in Herndon, Virginia.
We must ensure we don't include any fluff like "commensurate with experience". Not present.
Check that we didn't miss any substantive info: The "What Impact You'll Have" includes details about supporting development, integration, cybersecurity compliance, etc. We'll put that in About the role.
We need to ensure we don't duplicate content. Also we need to include the TS/SCI and CI polygraph requirement, etc. Those are in Requirements.
Let's extract bullets.
From "What You'll Be Owning":
- Deploy and manage highly available applications to ensure system reliability and scalability.
- Implement and maintain HashiCorp Nomad and Kubernetes clusters for workload orchestration.
- Execute DNS configuration, management, and performance tuning for enterprise-grade systems.
- Develop and implement Infrastructure-as-Code (IaC) solutions using tools like Terraform, Ansible, or similar.
- Build and manage multiple CI/CD pipelines with GitLab or equivalent tools to automate deployments and streamline development workflows for rapid development and integration
- Perform system monitoring, logging, and troubleshooting to proactively identify and resolve issues.
- Automate security testing and monitoring within the DevOps workflows using ACAS and Trivy.
- Analyze cybersecurity scan findings and work with the cybersecurity team to identify false positives.
- Assist the cybersecurity team in assembling the required Body of Evidence for False Positive exceptions.
- Assist the cybersecurity team in assembling the required Body of Evidence to submit containerized and non-containerized software packages for enterprise software approval.
- Integrate static code analysis tools such as GitLab SAST, Fortify, or SonarQube and other security mechanisms into CI/CD pipelines.
- Build and maintain software tools that automate cybersecurity analysis and correlation workflows as compliance requirements evolve.
- Perform cybersecurity remediation on DevSecOps-managed virtual machines, including OS patching, OS STIG implementation, and software package updates.
- Build, maintain, and monitor configuration management of release products.
- Troubleshoot and resolve issues in networks, automation pipelines, and infrastructure.
That's a lot; we keep them.
From "What You Must Have":
- Active TS/SCI and be willing and able to pass a CI polygraph
- Must be able and willing to work 40 hours per week in a SCIF in Herndon, Virginia.
- At least 3 years of industry experience in software development or software engineering.
- At least 5 years of industry experience in DevSecOps, with a bachelor’s degree in Computer Science, Information Systems, or a related field; or a master’s degree and at least 3 years of relevant experience.
- Demonstrated professional software development experience is required. Candidates must be able to design, write, test, debug, and maintain software using at least one language such as Python, Go, Java, C#, or similar.
- Experience building automation tools, APIs, or applications is central to this role.
- Strong expertise in cloud environments, including deployment, optimization, and troubleshooting.
- Proven track record in building and operating Cloud Native Applications using tools like Kubernetes and Docker.
- In-depth experience with IaC tools such as Terraform, Ansible, or equivalent.
- Solid experience in creating and managing CI/CD build pipelines using GitLab or similar tools (e.g., Jenkins, Azure DevOps).
- Strong software automation skills using Python, Bash, or equivalent languages; Python or comparable application development experience is required.
- Excellent problem-solving skills with attention to detail and the ability to thrive in a fast-paced environment.
- Experience applying security best practices in DevSecOps pipelines (e.g., Trivy, Grype, GitLab SAST, or SonarQube).
- Familiarity with monitoring tools like Prometheus, Grafana, or ELK Stack.
- Strong knowledge of networking and load balancing technologies.
- Experience with source control tools such as Git, including collaborative development workflows.
- Experience with automated deployment technologies such as Cloud Formation, Ansible, Puppet or Chef.
- Experience deploying and maintaining open-source and custom applications.
- Moderate Linux system administration experience (Red Hat, Rocky Linux, AlmaLinux, or similar).
- Working knowledge of Linux and Windows operating systems, web services, and SQL databases.
- Experience working in an Agile environment.
Note: The 40 hours per week also appears; we might duplicate in Schedule. It's okay to have it in Requirements as well, but we could keep it there and also in Schedule. The instruction: preserve ALL substantive information; we can keep duplicate but maybe better to keep only once? It says preserve ALL substantive information; not forbid duplication. But we could keep it in Requirements and also Schedule; it's okay. However we might want to avoid redundancy but it's not prohibited. I'd keep it in Requirements as is, and Schedule just summarizing.
From "What Would Be Nice To Have":
- Security+ or comparable certification for privileged user access.
- Experience with distributed processing methods and tools, such as REST APIs, microservices, IaaS/PaaS services.
- Experience developing and deploying web services.
- Experience in implementing Docker STIGs
- Experience with CONMON cybersecurity remediation.
- RHCSA/LPIC 1/2, CKA, or Docker Certified Associate certification.
From Benefits (Why Choose GRVTY):
- Robust health plan including medical, dental, and vision
- Health Savings Account with company contribution
- Annual Paid Time Off and Paid Holidays
- Paid Parental Leave
- 401k with generous company match
- Training and Development Opportunities
- Award Programs
- Variety of Company Sponsored Events
Also earlier mention: comprehensive benefits, etc. But we have list.
Pay: Virginia Pay Range $150,000—$250,000 USD (note the dash is an em dash? We'll keep as "$150,000-$250,000 USD").
Schedule: 40 hours per week, on‑site in a SCIF in Herndon, Virginia.
Now we need to output HTML fragment only, no /, no markdown fences.
We'll produce:
About the role
GRVTY is seeking a Mid-level DevSecOps Engineer with a TS/SCI to join one of our top projects in Herndon, VA, to support the development, integration, and cybersecurity compliance of intelligence capabilities in Development and Production environments. This is a software engineering-focused DevSecOps role. The primary focus is designing, coding, testing, and maintaining software and automation tools that streamline Cyber Security workflows and improve the reliability of our platforms. We are looking for a candidate with a software development background who can build scalable, reliable systems and developer tools, and contribute to DevSecOps pipelines that integrate and deploy components across multiple networks into private cloud infrastructures hosted for our government customer. As a GRVTY team member, you will closely support our mission partners, and your work will have direct mission impact. You will work with DevSecOps engineers, software developers, infrastructure technicians, and cybersecurity professionals to use open-source technology to create and maintain the full stack of a High-Performance Computing (HPC) system that hosts applications for thousands of users.
Responsibilities
- Deploy and manage highly available applications to ensure system reliability and scalability.
- Implement and maintain HashiCorp Nomad and Kubernetes clusters for workload orchestration.
- Execute DNS configuration, management, and performance tuning for enterprise-grade systems.
- Develop and implement Infrastructure-as-Code (IaC) solutions using tools like Terraform, Ansible, or similar.
- Build and manage multiple CI/CD pipelines with GitLab or equivalent tools to automate deployments and streamline development workflows for rapid development and integration
- Perform system monitoring, logging, and troubleshooting to proactively identify and resolve issues.
- Automate security testing and monitoring within the DevOps workflows using ACAS and Trivy.
- Analyze cybersecurity scan findings and work with the cybersecurity team to identify false positives.
- Assist the cybersecurity team in assembling the required Body of Evidence for False Positive exceptions.
- Assist the cybersecurity team in assembling the required Body of Evidence to submit containerized and non-containerized software packages for enterprise software approval.
- Integrate static code analysis tools such as GitLab SAST, Fortify, or SonarQube and other security mechanisms into CI/CD pipelines.
- Build and maintain software tools that automate cybersecurity analysis and correlation workflows as compliance requirements evolve.
- Perform cybersecurity remediation on DevSecOps-managed virtual machines, including OS patching, OS STIG implementation, and software package updates.
- Build, maintain, and monitor configuration management of release products.
- Troubleshoot and resolve issues in networks, automation pipelines, and infrastructure.
Requirements
- Active TS/SCI and be willing
- for any list of duties/requirements/benefits. Use
for prose. We need to preserve all substantive information; do not invent or summarize away detail. So we need to keep details like specific tools, etc. We'll structure:
About the role
... (the impact description).
Responsibilities
- ... each bullet from "What You'll Be Owning".
Requirements
- ... each bullet from "What You Must Have".
Preferred Qualifications
- ... each bullet from "What Would Be Nice To Have".
Benefits
- ... each benefit from "Why Choose GRVTY".
Pay
Virginia Pay Range $150,000—$250,000 USD
Schedule
40 hours per week, on‑site in a SCIF in Herndon, Virginia.
We must ensure we don't include any fluff like "commensurate with experience". Not present. Check that we didn't miss any substantive info: The "What Impact You'll Have" includes details about supporting development, integration, cybersecurity compliance, etc. We'll put that in About the role. We need to ensure we don't duplicate content. Also we need to include the TS/SCI and CI polygraph requirement, etc. Those are in Requirements. Let's extract bullets. From "What You'll Be Owning": - Deploy and manage highly available applications to ensure system reliability and scalability. - Implement and maintain HashiCorp Nomad and Kubernetes clusters for workload orchestration. - Execute DNS configuration, management, and performance tuning for enterprise-grade systems. - Develop and implement Infrastructure-as-Code (IaC) solutions using tools like Terraform, Ansible, or similar. - Build and manage multiple CI/CD pipelines with GitLab or equivalent tools to automate deployments and streamline development workflows for rapid development and integration - Perform system monitoring, logging, and troubleshooting to proactively identify and resolve issues. - Automate security testing and monitoring within the DevOps workflows using ACAS and Trivy. - Analyze cybersecurity scan findings and work with the cybersecurity team to identify false positives. - Assist the cybersecurity team in assembling the required Body of Evidence for False Positive exceptions. - Assist the cybersecurity team in assembling the required Body of Evidence to submit containerized and non-containerized software packages for enterprise software approval. - Integrate static code analysis tools such as GitLab SAST, Fortify, or SonarQube and other security mechanisms into CI/CD pipelines. - Build and maintain software tools that automate cybersecurity analysis and correlation workflows as compliance requirements evolve. - Perform cybersecurity remediation on DevSecOps-managed virtual machines, including OS patching, OS STIG implementation, and software package updates. - Build, maintain, and monitor configuration management of release products. - Troubleshoot and resolve issues in networks, automation pipelines, and infrastructure. That's a lot; we keep them. From "What You Must Have": - Active TS/SCI and be willing and able to pass a CI polygraph - Must be able and willing to work 40 hours per week in a SCIF in Herndon, Virginia. - At least 3 years of industry experience in software development or software engineering. - At least 5 years of industry experience in DevSecOps, with a bachelor’s degree in Computer Science, Information Systems, or a related field; or a master’s degree and at least 3 years of relevant experience. - Demonstrated professional software development experience is required. Candidates must be able to design, write, test, debug, and maintain software using at least one language such as Python, Go, Java, C#, or similar. - Experience building automation tools, APIs, or applications is central to this role. - Strong expertise in cloud environments, including deployment, optimization, and troubleshooting. - Proven track record in building and operating Cloud Native Applications using tools like Kubernetes and Docker. - In-depth experience with IaC tools such as Terraform, Ansible, or equivalent. - Solid experience in creating and managing CI/CD build pipelines using GitLab or similar tools (e.g., Jenkins, Azure DevOps). - Strong software automation skills using Python, Bash, or equivalent languages; Python or comparable application development experience is required. - Excellent problem-solving skills with attention to detail and the ability to thrive in a fast-paced environment. - Experience applying security best practices in DevSecOps pipelines (e.g., Trivy, Grype, GitLab SAST, or SonarQube). - Familiarity with monitoring tools like Prometheus, Grafana, or ELK Stack. - Strong knowledge of networking and load balancing technologies. - Experience with source control tools such as Git, including collaborative development workflows. - Experience with automated deployment technologies such as Cloud Formation, Ansible, Puppet or Chef. - Experience deploying and maintaining open-source and custom applications. - Moderate Linux system administration experience (Red Hat, Rocky Linux, AlmaLinux, or similar). - Working knowledge of Linux and Windows operating systems, web services, and SQL databases. - Experience working in an Agile environment. Note: The 40 hours per week also appears; we might duplicate in Schedule. It's okay to have it in Requirements as well, but we could keep it there and also in Schedule. The instruction: preserve ALL substantive information; we can keep duplicate but maybe better to keep only once? It says preserve ALL substantive information; not forbid duplication. But we could keep it in Requirements and also Schedule; it's okay. However we might want to avoid redundancy but it's not prohibited. I'd keep it in Requirements as is, and Schedule just summarizing. From "What Would Be Nice To Have": - Security+ or comparable certification for privileged user access. - Experience with distributed processing methods and tools, such as REST APIs, microservices, IaaS/PaaS services. - Experience developing and deploying web services. - Experience in implementing Docker STIGs - Experience with CONMON cybersecurity remediation. - RHCSA/LPIC 1/2, CKA, or Docker Certified Associate certification. From Benefits (Why Choose GRVTY): - Robust health plan including medical, dental, and vision - Health Savings Account with company contribution - Annual Paid Time Off and Paid Holidays - Paid Parental Leave - 401k with generous company match - Training and Development Opportunities - Award Programs - Variety of Company Sponsored Events Also earlier mention: comprehensive benefits, etc. But we have list. Pay: Virginia Pay Range $150,000—$250,000 USD (note the dash is an em dash? We'll keep as "$150,000-$250,000 USD"). Schedule: 40 hours per week, on‑site in a SCIF in Herndon, Virginia. Now we need to output HTML fragment only, no /, no markdown fences. We'll produce:About the role
GRVTY is seeking a Mid-level DevSecOps Engineer with a TS/SCI to join one of our top projects in Herndon, VA, to support the development, integration, and cybersecurity compliance of intelligence capabilities in Development and Production environments. This is a software engineering-focused DevSecOps role. The primary focus is designing, coding, testing, and maintaining software and automation tools that streamline Cyber Security workflows and improve the reliability of our platforms. We are looking for a candidate with a software development background who can build scalable, reliable systems and developer tools, and contribute to DevSecOps pipelines that integrate and deploy components across multiple networks into private cloud infrastructures hosted for our government customer. As a GRVTY team member, you will closely support our mission partners, and your work will have direct mission impact. You will work with DevSecOps engineers, software developers, infrastructure technicians, and cybersecurity professionals to use open-source technology to create and maintain the full stack of a High-Performance Computing (HPC) system that hosts applications for thousands of users.
Responsibilities
- Deploy and manage highly available applications to ensure system reliability and scalability.
- Implement and maintain HashiCorp Nomad and Kubernetes clusters for workload orchestration.
- Execute DNS configuration, management, and performance tuning for enterprise-grade systems.
- Develop and implement Infrastructure-as-Code (IaC) solutions using tools like Terraform, Ansible, or similar.
- Build and manage multiple CI/CD pipelines with GitLab or equivalent tools to automate deployments and streamline development workflows for rapid development and integration
- Perform system monitoring, logging, and troubleshooting to proactively identify and resolve issues.
- Automate security testing and monitoring within the DevOps workflows using ACAS and Trivy.
- Analyze cybersecurity scan findings and work with the cybersecurity team to identify false positives.
- Assist the cybersecurity team in assembling the required Body of Evidence for False Positive exceptions.
- Assist the cybersecurity team in assembling the required Body of Evidence to submit containerized and non-containerized software packages for enterprise software approval.
- Integrate static code analysis tools such as GitLab SAST, Fortify, or SonarQube and other security mechanisms into CI/CD pipelines.
- Build and maintain software tools that automate cybersecurity analysis and correlation workflows as compliance requirements evolve.
- Perform cybersecurity remediation on DevSecOps-managed virtual machines, including OS patching, OS STIG implementation, and software package updates.
- Build, maintain, and monitor configuration management of release products.
- Troubleshoot and resolve issues in networks, automation pipelines, and infrastructure.
Requirements
- Active TS/SCI and be willing