DevSecOps Engineer Job Description

A DevSecOps Engineer owns the security of the software delivery pipeline: the source repositories, build servers, artifact registries, infrastructure templates and deployment tooling that turn a commit into a running service. The job title is also posted as DevOps Security Engineer or DevSecOps Specialist. The premise of the role is that a security review at the end of a release cycle cannot keep up with teams that deploy several times a day, so the checks have to live inside the pipeline and run on every change.

The Defense Department's Cyber Workforce Framework gives a useful plain definition. Its work role 627, DevSecOps Specialist, selects, deploys and maintains the continuous integration and continuous deployment tools and processes a development team uses, or maintains the deployed software product, and ensures observability and security across the lifecycle.

The pipeline gates

The visible part of the work is a chain of automated gates. Static analysis tools such as CodeQL, Semgrep or SonarQube read source code for injection flaws and unsafe calls. Software composition analysis compares every open source dependency against vulnerability databases. Secrets scanners look for API keys and tokens before they reach the main branch. Policy engines such as Open Policy Agent or Checkov reject Terraform plans and Kubernetes manifests that open a storage bucket to the internet or run a container as root. Container image scanners check base images, and signing tools such as Sigstore's cosign attach provenance so a deployment can prove where an artifact came from.

Each gate is only as good as its tuning. A scanner that blocks builds on low-value findings can end up bypassed, so much of the engineer's week goes to suppressing false positives, setting severity thresholds and writing clear failure messages that tell a developer what to change.

Supply chain and evidence

Software supply chain security is a core part of the job. OWASP's Top 10:2025 list for web applications places Software Supply Chain Failures third, after broken access control and security misconfiguration. In practice that means producing a software bill of materials for each build, locking down who can change pipeline definitions, and pinning third-party build actions to known versions. The same pipeline records double as audit evidence: scan histories, approvals and deployment logs answer customer security questionnaires and compliance reviews without a manual hunt.

People work

The rest of the job is persuasion. The engineer sits in design reviews to sketch threat models, explains to a product owner why a critical dependency flaw blocks a release, and writes runbooks for on-call engineers. When a widely used library discloses a serious vulnerability, the DevSecOps Engineer is the one who queries the SBOM inventory to find every affected service and tracks the patch to closure.

There is no single entry route. As a rough guide, people reach the title after three to six years in software development, DevOps or site reliability engineering, or security operations, and they bring the half of the job they did not learn on the way in. A developer who moves over has to learn threat modeling and vulnerability triage; a security analyst who moves over has to learn to write and debug pipeline code.

Education: BLS lists a bachelor's degree as the typical entry-level education for information security analysts, the nearest occupation it reports. A degree in computer science, software engineering, information systems or cybersecurity is the usual path. A candidate without a degree can make the case with public code.

Technical foundation:

• One general-purpose language, typically Python or Go, plus enough shell to automate build steps
• CI/CD systems such as GitHub Actions, GitLab CI, Jenkins or Azure Pipelines, including how runners, caches and credentials work
• Infrastructure as code with Terraform or CloudFormation, and Kubernetes manifests and Helm charts
• At least one public cloud's identity and access model in depth, including how pipelines obtain short-lived credentials
• Common vulnerability classes, read from the OWASP lists, and how to verify a scanner finding by hand

Certifications: Pick credentials that match the stack you will secure.

• Certified Kubernetes Security Specialist (CKS), from the Cloud Native Computing Foundation
• AWS Certified Security - Specialty, from Amazon Web Services, or the matching Microsoft or Google cloud security credential
• GIAC Cloud Security Automation (GCSA), from GIAC
• Certified Secure Software Lifecycle Professional (CSSLP), from ISC2
• CompTIA Security+, from CompTIA, for candidates coming from outside security

None of these is a legal requirement in commercial work. Defense Department positions are a different case, so check the qualification requirements attached to the specific position.

A portfolio counts. A public repository with a working pipeline that scans, signs and generates an SBOM for a small application is direct evidence of the job. So is a merged contribution to an open source security tool, or a write-up of a misconfiguration you found and fixed.

Soft skills that matter here: explaining risk in terms of the release a team cares about, saying no to a launch with a clear reason and an alternative, and writing documentation developers can follow without a meeting. The job depends on developers actually adopting the tools, so treat them as customers.

The closest federal data point is the information security analyst occupation. BLS's Occupational Outlook Handbook projects employment of information security analysts to grow 21 percent from 2025 to 2035, which it describes as much faster than the average for all occupations, and it projects about 14,100 openings a year on average over the decade. In May 2025 the occupation employed 190,650 people nationally. Those figures cover the whole occupation, from security operations analysts to engineers, so they describe the field a DevSecOps Engineer works in rather than the title itself.

Pay

Within the occupation, May 2025 median pay was $132,410 in computer systems design and related services and $131,220 in credit intermediation, the banking and lending industry group. Because O*NET files DevOps Engineer under software developers, a DevSecOps role that leans toward platform engineering may be benchmarked against that occupation, which had a national median of $135,980.

Regulation and standards that shape the work

Federal software supply chain guidance also shapes the job. On July 29, 2026, CISA, the National Security Agency, the FBI and international partners released the 2026 Minimum Elements for a Software Bill of Materials, which updates and replaces the minimum elements the National Telecommunications and Information Administration published in 2021. The new guidance incorporated feedback from a 2025 public comment period. For a DevSecOps Engineer that means checking whether the SBOM tooling in the pipeline produces the fields the new guidance lists, and whether customers will start asking for them.

In defense work, the official performing the duties of the Defense Department's chief information officer signed a memo on April 24, 2025 titled "Accelerating Secure Software," establishing the Software Fast Track (SWFT) Initiative to reform how the department acquires, tests and authorizes secure software.

AI and automation

AI coding agents add a new source of code passing through the pipeline. In a June 9, 2026 changelog entry, GitHub said third-party coding agents, including Claude and OpenAI Codex, can work directly in repositories, and that code they generate is now automatically analyzed with CodeQL, checked for new dependencies against the GitHub Advisory Database, and run through secret scanning. If the analysis finds issues, the agent attempts to resolve them before finalizing the pull request.

That is a vendor describing its own product, but it shows the pattern: when an agent writes code, the pipeline's automated checks are the control that applies to it. OWASP's AI Security Verification Standard, in its appendix on AI-assisted secure coding, says automated security testing should run on every pull request containing AI-generated code, covering SAST, IAST, DAST, secret scanning, IaC scanning and SCA. The judgment calls remain human work: deciding which findings matter, what an agent is allowed to change, and when a release stops.

Where the career goes

Possible next steps from this title include staff or principal security engineer, application security lead, platform security architect, or a manager of a product security team. Engineers who also understand compliance evidence can move toward security architecture for regulated customers.

Dear Hiring Manager,

I am applying for the DevSecOps Engineer position on your platform security team. For the past four years I have worked as a site reliability engineer at a mid-sized logistics software company, and for the last two of those years I have been the person my team sends to fix anything involving the build pipeline and its security checks.

When I took that on, our pipeline ran a dependency scanner that failed roughly one build in five on findings nobody could act on, and developers had learned to rerun jobs until they passed. I rebuilt the configuration so that builds fail only on reachable, fixable issues above a severity we agreed with the engineering leads, and every failure message now links to the exact package version that resolves it. Developers stopped rerunning jobs, and the security team stopped chasing tickets that sat open for months.

I also moved our Terraform reviews into the pipeline with Open Policy Agent rules, so public storage buckets and overly broad IAM roles are rejected before a plan is applied. Last spring I added SBOM generation and artifact signing to our release jobs. When a serious flaw appeared in a logging library our services used, I found every affected service from the SBOM inventory in under an hour and tracked each fix through deployment.

Your posting mentions securing pull requests from AI coding agents. I have started treating agent-authored changes as their own review category in our repositories, with the same scanning gates and a required human approver, and I would like to help your team build that into a standard practice.

I would welcome the chance to talk about your pipeline and where you want it to be in a year.

Sincerely, Jordan Alvarez