Skip to content

Software Engineering · Work role code 627

DevSecOps Specialist

Selects/Deploys/Maintains the set of Continuous Integration/Continuous Deployment (CI/CD) tools and processes used by the development team and/or maintains the deployed software product and ensures observability and security across the lifecycle.

From DoD DCWF Tool v5.3 (2026-09-25)

Tasks

From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id

Free · DoD DCWF Tool v5.3 (2026-09-25)
  • 412AAnalyze the results of software, hardware, or interoperability testing.Core
  • 420Apply security policies to meet security objectives of the system.Core
  • 421AApply security architecture principles to meet organization’s confidentiality, integrity, and availability requirements.Core
  • 452Conduct functional and connectivity testing to ensure continuing operability.Core
  • 559BAnalyze and report system security posture trends.Core
  • 568Employ secure configuration management processes.Core
  • 571Ensure all systems security operations and maintenance activities are properly documented and updated as necessary.Additional
  • 572Ensure application of security patches for commercial products integrated into system design meet the timelines dictated by the management authority for the intended operational environment.Core
  • 576Ensure cybersecurity-enabled products or other compensating security control technologies reduce identified risk to an acceptable level.Core
  • 653BImplement security measures to mitigate or remediate vulnerabilities and security deficiencies, and provide justification for acceptance of residual risk.Core
  • 661AImplement system security measures in accordance with established procedures to ensure confidentiality, integrity, availability, authentication, and non-repudiation.Core
  • 708AMitigate/correct security deficiencies identified during security/certification testing and/or recommend risk acceptance for the appropriate senior leader or authorized representative.Core
  • 717AAssess and monitor cybersecurity related to system implementation and testing practices.Additional
  • 726Oversee and make recommendations regarding configuration management.Core
  • 729AVerify minimum security requirements are in place for all applications.Core
  • 754Perform cybersecurity testing of developed applications and/or systems.Core
  • 765Perform security reviews, identify gaps in security architecture, and develop a security risk management plan.Additional
  • 795Properly document all systems security implementation, operations and maintenance activities and update as necessary.Additional
  • 806AProvides cybersecurity recommendations to leadership based on significant threats and vulnerabilities.Additional
  • 809Provide input to the Risk Management Framework process activities and related documentation (e.g., system life-cycle support plans, concept of operations, operational procedures, and maintenance training materials).Additional
  • 876Verify and update security documentation reflecting the application/system security design features.Additional
  • 880AWork with stakeholders to resolve computer security incidents and vulnerability compliance.Core
  • 938AProvide advice and input for Disaster Recovery, Contingency, and Continuity of Operations Plans.Additional
  • 2054Assess the effectiveness of security controls.Core
  • 5050Assess all the configuration management (change configuration/release management) processes.Additional
  • 5939Choose and deploy the appropriate automated application security testing tools.Core
  • 5940Work with designers and developers throughout the design, development and testing process.Core
  • 5941Utilize tools and techniques like risk assessment, threat modeling, and cybersecurity to detect and analyze the threats.Core
  • 5942Work with Security Engineers to ensure that all security threats are dealt with during the development phase.Core
  • 5943Work with Automation tools are used to identify the vulnerabilities.Core
  • 5944Identify and implement tooling for controlling the steps in a continuous integration (CI) and continuous deployment (CD) pipeline.Core
  • 5945Develop and implement automated test tools in a CI/CD pipeline, which could include Static Application Security Test (SAST) tools, Dynamic Application Security Test (DAST) tools, Unit Test tools, Static Code Analysis (SCA) tools, etc.Core
  • 5946Develop code within a CI/CD Pipeline.Core
  • 5947Select appropriate language and coding standards for software application for appropriate Continuous Integration/Continuous Deployment (CI/CD) framework.Core
  • 5948Apply testing activities, understand fault vs. failures, conduct basic test planning, develop test selection or adequacy criteria, craft test documentation, ensure test coverage, and conduct automated testing.Core
  • 5949Transition embedded and non-embedded software developed and sustained using traditional software methods into a DevSecOps environment.Additional
  • 5950Develop and deploy software using continuous integration methods, processes, and tools, including test case writing against completion criteria (for each release, capability, micro-service, or component), build automation, and build processes.Core
  • 5951Select and implement telemetry within the CI/CD pipeline and Ops software to support metrics and problem discovery and resolution.Additional
  • 5953Provide DevSecOps guidance to leadership.Core
  • 5954Build test interfaces and perform complex integration.Additional
  • 5955Work closely with development teams to provide and support the environment needed to deliver an organizations services.Core

Knowledge

From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id

Free · DoD DCWF Tool v5.3 (2026-09-25)
  • 21Knowledge of computer algorithms.Additional
  • 22* Knowledge of computer networking concepts and protocols, and network security methodologies.Core
  • 25BKnowledge of encryption algorithms.Additional
  • 27AKnowledge of cryptology.Additional
  • 34Knowledge of database systems.Core
  • 58Knowledge of known vulnerabilities from alerts, advisories, errata, and bulletins.Core
  • 75BKnowledge of statistics.Additional
  • 94Knowledge of parallel and distributed computing concepts.Additional
  • 108* Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).Core
  • 130Knowledge of systems testing and evaluation methods.Core
  • 130AKnowledge of systems security testing and evaluation methods.Core
  • 142AKnowledge of the operations and processes for incident, problem, and event management.Core
  • 144Knowledge of the systems engineering process.Core
  • 1037AKnowledge of information technology (IT) risk management policies, requirements, and procedures.Core
  • 1040AKnowledge of relevant laws, policies, procedures, or governance related to critical infrastructure.Additional
  • 1139AKnowledge of implementing enterprise key escrow systems to support data-at-rest encryption.Additional
  • 1141AKnowledge of an organization's information classification program and procedures for information compromise.Additional
  • 1157* Knowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurity.Core
  • 1158* Knowledge of cybersecurity principles.Core
  • 1159* Knowledge of cyber threats and vulnerabilities.Core
  • 3642Knowledge of various types of computer architectures.Additional
  • 6240Knowledge of critical protocols (e.g., IPSEC, AES, GRE, IKE).Additional
  • 6900* Knowledge of specific operational impacts of cybersecurity lapses.Core
  • 6935* Knowledge of cloud computing service models Software as Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS).Core
  • 6938* Knowledge of cloud computing deployment models in private, public, and hybrid environment and the difference between on-premises and off-premises environments.Core
  • 7087Knowledge of programming languages.Core
  • 7088Knowledge of continuous integration/continuous deployment (CI/CD) processes and pipeline tools.Core
  • 7089Knowledge of portable, extensible, open source platform for managing containerized workloads and services.Core
  • 7090Knowledge of cloud hosting providers.Core
  • 7091Knowledge of threat modeling, risk assessment techniques, code reviews, current best practices and the latest cybersecurity threats.Core
  • 7092Knowledge of how security impacts each development phase and the services.Core
  • 7093Knowledge of a Continuous Integration/Continuous Deployment (CI/CD) environment and processes.Core
  • 7094Knowledge of the steps for release to higher levels of integration testing, certification activities, and/or operations using testbeds, modeling and simulation to synchronize software releases with the development of an operations environment(s) to ensure compatibility.Core
  • 7095Knowledge of every stage in the software project lifecycle, from initial design and build to rollout and maintenance.Core
  • 7111* Knowledge of Zero Trust Security Model Principles.Core

Skills

From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id

Free · DoD DCWF Tool v5.3 (2026-09-25)
  • 3BSkill in conducting vulnerability scans and recognizing vulnerabilities in information systems and networks.Core
  • 3CSkill in recognizing vulnerabilities in information and/or data systems.Core
  • 190Skill in developing operations-based testing scenarios.Core
  • 220Skill in systems integration testing.Additional
  • 225ASkill in the use of penetration testing tools and techniques, including specialized tools for non-traditional systems and networks (e.g., control systems).Additional
  • 238ASkill in writing code in a currently supported programming language (e.g., Java, C++).Core
  • 3822Skill in managing client relationships, including determining client needs/requirements, managing client expectations, and demonstrating commitment to delivering quality results.Core

Abilities

From DoD DCWF Tool v5.3 (2026-09-25), in the tool's order, with the DCWF KSAT id

Free · DoD DCWF Tool v5.3 (2026-09-25)
  • 4Ability to identify systemic security issues based on the analysis of vulnerability and configuration data.Core
  • 3030Ability to conduct vulnerability scans and recognize vulnerabilities in security systems.Core
  • 6090Ability to develop curriculum for use within a virtual environment.Core

Workforce Automation analysis, not part of the source

O*NET jobs

WFA · Part of the paid plan when accounts open

Jobs the ETO-CSET NICE/O*NET crosswalk (2024) maps to this role’s NICE equivalents, with the share of each job’s detailed work activities (DWAs) that has a mapped AI skill.

No O*NET jobs reach this role.

    Equivalents

    NICE work roles

    From DoD DCWF Tool v5.3 (2026-09-25), linked from published ids only, never from titles

    Free · DoD DCWF Tool v5.3 (2026-09-25)

    No published NICE equivalent.

    O*NET jobs it reaches

    Through its NICE equivalents, by the ETO-CSET NICE/O*NET crosswalk (2024); jobs from O*NET 30.3

    Free · O*NET 30.3

    No O*NET job reaches this role.