JobDescription.org

Information Technology

DevSecOps Project Manager

Last updated

DevSecOps Project Managers lead the planning, coordination, and delivery of software projects where security controls are integrated into every phase of the development pipeline — not bolted on at the end. They sit at the intersection of agile delivery, security policy, and infrastructure automation, keeping cross-functional teams aligned across developers, security engineers, and platform engineers while hitting release commitments and compliance requirements simultaneously.

Role at a glance

Typical education
Bachelor's degree in CS, Information Systems, or Cybersecurity
Typical experience
5-8 years
Key certifications
PMP, PMI-ACP, CISSP, CompTIA Security+
Top employer types
Defense contractors, federal agencies, cloud-native tech companies, software vendors
Growth outlook
Growing faster than supply due to increased regulatory pressure and cloud-native complexity
AI impact (through 2030)
Augmentation — AI-assisted remediation and automated vulnerability prioritization increase delivery velocity, requiring the PM to manage a higher frequency of release cycles and increased coordination complexity.

Duties and responsibilities

  • Own sprint and release planning across blended teams of developers, security engineers, and cloud platform engineers
  • Maintain and prioritize the project backlog, translating security compliance requirements into actionable user stories and acceptance criteria
  • Facilitate daily standups, sprint reviews, and retrospectives, ensuring security findings from automated scans are triaged in each cycle
  • Coordinate SAST, DAST, SCA, and container security tool integrations into CI/CD pipelines with engineering leads
  • Track and escalate open vulnerabilities, SBOM gaps, and policy exceptions through risk register updates and weekly security review meetings
  • Manage project timelines, dependencies, and resource allocation across multiple concurrent delivery streams using Jira or Azure DevOps
  • Prepare and present security posture dashboards, sprint velocity reports, and risk status briefings to technical and executive stakeholders
  • Coordinate authorization-to-operate (ATO) activities including control documentation, evidence collection, and assessor scheduling for FedRAMP or FISMA projects
  • Drive incident-to-resolution workflows when pipeline security gates block deployments, coordinating triage between AppSec, DevOps, and product teams
  • Identify process gaps in shift-left security adoption and implement targeted improvement plans using metrics from DORA and OWASP benchmarks

Overview

The DevSecOps Project Manager exists because shipping software fast and shipping it securely used to be treated as competing priorities — one team owned velocity, another owned compliance, and they negotiated at the end of the release cycle. That model broke down as breach costs rose and compliance timelines got shorter. The DevSecOps PM's job is to make security a continuous delivery constraint, not a release gate.

In practice that means the PM runs the same agile ceremonies as any software project manager — sprint planning, backlog refinement, standups, retrospectives — but the backlog includes vulnerability remediation tickets alongside feature work, and the definition of done includes passing security pipeline gates. When a SAST scan flags a critical finding in a pull request, the PM coordinates the triage conversation between the developer who wrote the code and the application security engineer who owns the policy, and then adjusts the sprint plan to reflect whatever remediation work is required.

The coordination surface is wider than on most software projects. A typical engagement touches: product owners (who care about feature delivery), security architects (who set policy), DevOps platform engineers (who maintain the pipeline), compliance teams (who need evidence for audits), and executives (who want a clean risk dashboard). The PM is the person who keeps all those threads from tangling.

On federal programs — FedRAMP, FISMA, DoD RMF — the ATO process adds a structured compliance layer on top of the delivery work. The PM coordinates evidence collection (screenshots, policy documents, scan reports), manages assessor scheduling, and tracks Plan of Action and Milestones (POA&M) items alongside the normal sprint cadence. Missing an assessor deadline can delay a go-live by months, so this coordination is high-stakes and detail-intensive.

The best DevSecOps PMs are bilingual in a specific way: they can talk velocity and story points with developers in the morning and control inheritance and residual risk with a security assessor in the afternoon. That translation capability is rare and is the core of what makes the role worth its salary.

Qualifications

Education:

  • Bachelor's degree in computer science, information systems, cybersecurity, or a related technical field (standard expectation)
  • Master's in information security or an MBA with a technology concentration for senior and program-level roles
  • No degree with 10+ years of demonstrable delivery experience is accepted at some organizations, particularly defense contractors

Certifications most requested in job postings:

  • PMP (Project Management Professional) — the baseline credential for most PM roles
  • PMI-ACP (Agile Certified Practitioner) for teams running SAFe or Scrum at scale
  • CISSP or CISM for roles where the PM owns security program reporting
  • CompTIA Security+ (required for DoD 8570/8140 compliance)
  • AWS Security Specialty, Azure Security Engineer Associate, or GCP Professional Cloud Security Engineer for cloud-native delivery roles
  • Certified DevSecOps Professional (CDP) or equivalent for specialized postings

Experience benchmarks:

  • 5–8 years of software project management, at least 3 in a DevOps or cloud-native delivery environment
  • Direct experience integrating security tooling into CI/CD pipelines — even if not hands-on engineering
  • At least one FedRAMP, FISMA, or SOC 2 Type II delivery cycle for compliance-heavy roles
  • Track record managing cross-functional teams of 10–25 people across dev, security, and operations functions

Tools expected:

  • Project management: Jira, Azure DevOps, ServiceNow, Confluence
  • Pipeline security: Veracode, Snyk, Checkmarx, GitHub Advanced Security, Aqua Security
  • Infrastructure: Terraform, Kubernetes, Helm (familiarity expected; administration not required)
  • Compliance: XACTA, Archer, ServiceNow GRC, or equivalent ATO tracking tools
  • Metrics: DORA metrics dashboards, defect escape rate, mean time to remediate (MTTR) CVEs

Soft skills that differentiate:

  • Comfort holding engineering teams accountable to security gates without damaging the working relationship
  • Ability to translate a CVE severity score into business risk language for a non-technical executive
  • Structured escalation instinct — knowing when a blocked pipeline finding is a PM problem versus a security architecture decision

Career outlook

Demand for DevSecOps Project Managers has been growing faster than the supply of qualified candidates since roughly 2021, and the gap has not closed. Several structural forces explain why.

Regulatory pressure is accelerating. The White House Executive Order on Improving the Nation's Cybersecurity (EO 14028) established software supply chain security requirements for federal vendors that cascaded into commercial procurement standards. NIST SSDF adoption, SBOM mandates, and FedRAMP Moderate/High authorization requirements have all increased the compliance workload on software delivery teams — and compliance workload is project management workload.

Cloud-native complexity raises the coordination surface. Microservices architectures, Kubernetes deployments, and multi-cloud environments generate security findings at a rate that overwhelmed legacy security review processes. Organizations that have tried to handle DevSecOps coordination with general project managers or with security engineers who don't have delivery management skills have found both approaches failing. The specialized hybrid role is increasingly recognized as necessary rather than optional.

The cleared talent shortage is acute. Federal agencies and their contractors are under Congressional and OMB pressure to modernize software delivery while maintaining strict security controls. The population of PMs who hold active clearances, understand CI/CD pipelines, and have ATO delivery experience is genuinely small, and agencies are competing for them directly with defense contractors offering substantial compensation packages.

AI tools are raising the bar, not replacing the role. Automated vulnerability prioritization and AI-assisted remediation suggestions are reducing the time between finding and fix — which means delivery cycles are getting shorter and the PM's job is managing more release cycles per year, not fewer. The coordination complexity increases with velocity.

Career progression from DevSecOps PM typically runs toward: Senior DevSecOps PM managing a program with multiple workstreams, Director of DevSecOps or Application Security Program Manager, then VP or CISO-adjacent roles for those who continue building the security governance side of their experience. Total compensation for Directors in this space at mid-size tech companies and defense contractors runs $180K–$220K with equity or performance bonus.

Sample cover letter

Dear Hiring Manager,

I'm applying for the DevSecOps Project Manager position at [Company]. I've spent the past six years managing software delivery programs where security integration wasn't optional — first at a federal systems integrator running FedRAMP High authorizations, and most recently at [Company] managing three simultaneous Scrum teams delivering a cloud-native platform under SOC 2 Type II continuous compliance.

The work I'm most experienced in is exactly the coordination problem this role involves: keeping development velocity up while security pipeline gates and compliance evidence requirements are running in parallel. On our FedRAMP Moderate delivery last year, I owned the POA&M alongside the standard sprint backlog, coordinated the 3PAO assessment scheduling, and built a lightweight dashboard in Jira that gave our ISSO and the program director the same real-time view of open findings. We hit our ATO date with two weeks of buffer — the first time that program had made a deadline in three cycles.

I hold an active PMP, CompTIA Security+, and AWS Security Specialty certification. My teams have used Snyk, Veracode, and Aqua Security for container scanning; I'm not an engineer but I can read a SARIF report and I know what a critical severity finding means for a sprint plan.

What I'm looking for is a program with more engineering depth on the platform side — I've been PM-side for cloud security for six years and want to deepen my exposure to infrastructure-as-code security tooling in practice. [Company]'s platform engineering investment looks like that environment.

I'd welcome a conversation about the role.

[Your Name]

Frequently asked questions

What certifications are most valuable for a DevSecOps Project Manager?
PMP or PMI-ACP covers the project management baseline. For the security dimension, CISSP, CISM, or CompTIA Security+ are the most commonly required, depending on whether the role is commercial or federal. DoD positions under 8570/8140 typically require Security+ at minimum. Certified DevSecOps Professional (CDP) from the DevOps Institute is increasingly requested by large enterprise clients.
Do DevSecOps Project Managers need to write code?
Not routinely, but they need enough technical literacy to read pipeline configurations, understand what a SAST finding means in context, and follow a pull request conversation without needing everything translated. PMs who can't engage at that level lose credibility with engineering teams quickly. A background in software development or systems administration is a common prerequisite — not a nice-to-have.
How is AI and automation changing this role in 2026?
AI-assisted vulnerability triage tools (GitHub Advanced Security, Snyk's AI features, Veracode Fix) are reducing the manual effort of turning raw scan output into prioritized backlog items — work that previously consumed significant PM coordination time. DevSecOps PMs increasingly configure and govern these automation layers rather than manually managing the queues they produce. The result is faster cycles but a higher bar for understanding the tooling well enough to spot when automation is wrong.
What is the difference between a DevSecOps Project Manager and a DevSecOps Engineer?
A DevSecOps Engineer builds and maintains the security toolchain — writing pipeline YAML, configuring scanners, hardening container images. A DevSecOps Project Manager coordinates the people and processes that use that toolchain to deliver software. The PM doesn't build the pipeline but is accountable for whether the team ships on time with acceptable risk posture. Strong candidates for the PM role often have an engineering background they've pivoted from.
Is a security clearance required for most DevSecOps PM positions?
Not for most commercial roles, but federal government and defense contractor positions frequently require Secret or Top Secret/SCI clearance. The cleared market pays a premium and has chronically short supply. Candidates who already hold an active clearance and have DevSecOps delivery experience are among the most sought-after professionals in the federal IT market.

More in Information Technology

See all Information Technology jobs →