Title: DevSecOps Engineer - Geospatial Solutions
Duration: 6 Months - Long Term
Location: Washington, DC 20433
Hybrid Onsite: 4 days per week from Day 1, with a full transition to 100% onsite anticipated soon.
Position overview:
DevSecOps Engineer for its Geospatial Solutions portfolio. The engineer will serve as the primary application security and DevSecOps resource across multiple geospatial solution teams, strengthening the security, resilience, and reliability of digital products that support location-based analysis and country engagement. The role combines hands-on software development and vulnerability remediation with secure pipeline engineering, container and cloud security, and close collaboration with product and engineering teams. The engineer will remediate vulnerabilities in frontend and API codebases, operate and tune security scanning tools, harden container images and cloud workloads, and embed security controls into delivery pipelines, providing clear evidence of security posture and release risk. This is a software-engineering-focused security role: candidates must be able to read, write, and refactor application code and resolve breaking changes from dependency and framework upgrades, not just run scanners or forward reports.
Responsibilities:
- Application security ownership: Serve as the primary application security and DevSecOps resource for the Geospatial Solutions portfolio, owning vulnerability management, secure software delivery, and security guidance across multiple solution teams. Contribute to threat modeling and security reviews of new features and architectural changes.
- Vulnerability remediation in code: Remediate vulnerabilities in frontend (e.g., JavaScript/TypeScript, Angular/React) and API (Python/Node) codebases, including upgrading libraries and frameworks and refactoring application code to address breaking changes, deprecated APIs, and syntax changes introduced by major-version upgrades.
- Remediation without an upstream fix: Resolve vulnerabilities where no fixed upstream version is available, using dependency overrides and version pinning, patching or forking open-source libraries, or building custom dependency versions from source and publishing them to the internal corporate repository. Track these exceptions until an upstream fix is adopted.
- Security tooling and triage: Operate and tune security scanning tools across the software development lifecycle, including Wiz, Dependabot, SAST, SCA, secrets scanning, and container image scanning; where appropriate, dynamic (DAST) and infrastructure-as-code scanning. Triage findings, eliminate false positives, and prioritize remediation by severity, exploitability, and exposure.
- Container security: Build, upgrade, and harden Docker images, including updating base images, remediating OS and package-level vulnerabilities, and minimizing attack surface (e.g., multi-stage builds, minimal base images, non-root users). Publish approved images to container registries such as Azure Container Registry and Amazon ECR.
- Secure CI/CD and supply chain: Integrate security controls into CI/CD pipelines (Azure DevOps, Jenkins), including scanning gates, dependency and image policy enforcement, secrets management, and software bill of materials (SBOM) generation, so that releases meet defined security standards before promotion to production. Support dependency provenance and artifact integrity practices.
- Cloud security posture: Identify and remediate security misconfigurations in cloud workloads across Microsoft Azure and Amazon Web Services (AWS), using cloud security posture findings (e.g., Wiz) to address excessive Official Use Only permissions, exposed services, and insecure storage or network settings, applying least-privilege and secureby-default principles.
- Metrics, reporting, and risk management: Define and track remediation metrics and service-level targets (e.g., time to remediate by severity); report security posture to product owners and leadership; and manage risk acceptance and exception processes. Support responses to security incidents, audits, and compliance reviews as needed.
- Secure coding guidance: Provide secure coding guidance to software engineers, review code and dependency changes for security impact, and promote practices aligned with the OWASP Top 10 and organizational security standards.
- Release management and Azure DevOps administration: Support release management and Azure DevOps administration (repositories, pipelines, access controls, and environments), with a focus on secure configuration, least-privilege access, branch protection, and auditability.
- Agile collaboration and documentation: Participate in Program Increment (PI) Planning and SAFe Agile ceremonies in coordination with the Release Train Engineer (RTE), ensuring security work and remediation commitments are planned and prioritized. Maintain documentation for security controls, remediation decisions (including custom or patched dependencies), and secure pipeline configurations.
Expected deliverables
- A working development and pipeline setup, with access to the scanning tools, repositories, registries, and cloud environments needed for the role.
- A baseline inventory of open vulnerabilities across in-scope geospatial solutions, prioritized by severity, exploitability, and exposure, with an agreed remediation plan.
- Merged code, dependency, and Docker image changes that remediate prioritized vulnerabilities, including documented and tracked exceptions for fixes without an upstream release and any custom or patched dependencies.
- Security gates in Azure DevOps and Jenkins pipelines (SAST, SCA, secrets, and image scanning; SBOM generation; policy enforcement), with clear and actionable results.
- Remediation of prioritized cloud security posture findings in Azure and AWS, and hardened, approved base images published to the designated container registries.
- Regular reporting on vulnerability metrics, remediation service-level performance, and risk acceptances for product owners and leadership.
- Documentation of security controls, secure pipeline configurations, remediation decisions, and runbooks or guidance for engineering teams.
At the start of the engagement, the engineer and team will agree on in-scope solutions, priority vulnerabilities and findings, target environments, remediation service-level targets, and measurable acceptance criteria for these deliverables.
Required qualifications
- Hands-on software development experience in frontend and API/backend technologies (e.g., JavaScript/TypeScript, Python, Node), including diagnosing and fixing breaking changes caused by dependency and framework upgrades.
- Demonstrated experience fixing security vulnerabilities through code and dependency changes, including transitive dependencies, cases with no available upstream fix, and builds that use patched or custom dependencies.
- Experience with industry-standard application and cloud security tools such as Wiz, Dependabot, GitHub Advanced Security/CodeQL, Veracode, SonarQube, Snyk, Trivy, or similar, including tuning tools and triaging findings.
- Strong knowledge of application security principles, including the OWASP Top 10, secure coding practices, CVE/CVSS-based risk prioritization, and software supply chain security (e.g., SBOMs, dependency provenance).
- Strong working knowledge of Docker and container security, including writing and hardening Dockerfiles, base image management, image vulnerability remediation, and container registry operations.
- Experience identifying and remediating security risks in Microsoft Azure and/or AWS environments, including identity and access management and cloud security posture management.
- Experience building and maintaining CI/CD pipelines (Azure DevOps and/or Jenkins) with embedded security controls, and working knowledge of Git, code reviews, branching strategies, and secrets management.
- Familiarity with Agile methodologies and SAFe practices, including Program Increment (PI) Planning and Agile Release Train (ART) activities.
- Proven ability to propose solutions to moderately complex technical challenges involving application security, vulnerability remediation, and secure software delivery.
- Strong analytical, communication, collaboration, and documentation skills, with the ability to explain security risks and provide technical guidance to engineers and non-technical stakeholders; clear written and spoken English and the ability to work effectively with a distributed delivery team.
- Ability to manage multiple priorities simultaneously while maintaining high standards of quality, security, and operational excellence.
Preferred qualifications
- Relevant certifications such as CISSP, CSSLP, GIAC (e.g., GWEB, GCSA), Certified Kubernetes Security Specialist (CKS), Azure Security Engineer, AWS Security Specialty, or equivalent.
- Experience with infrastructure as code (e.g., Terraform, Bicep, ARM, CloudFormation) and its security scanning and policy-as-code enforcement; familiarity with Kubernetes security.
- Experience with dynamic and API security testing (DAST), penetration test remediation, threat modeling, and knowledge of frameworks such as NIST SSDF, OWASP ASVS, SLSA, or CIS Benchmarks.
- Experience with secrets and key management solutions (e.g., Azure Key Vault, AWS Secrets Manager, HashiCorp Vault), artifact repositories and package feeds, and image signing.
- Experience with geospatial or GIS applications, map services, and spatial APIs, and an understanding of their security considerations.
- Familiarity with security monitoring, logging, and incident response, and with compliance and audit requirements for security controls.
- Experience mentoring engineers on secure development, and the ability to assess and use AI-assisted development or security tools responsibly, subject to applicable team and organizational requirements.
“Mindlance is an Equal Opportunity Employer and does not discriminate in employment on the basis of – Minority/Gender/Disability/Religion/LGBTQI/Age/Veterans.”
