DevOps Engineer

What You’ll Do

• Design, build, and maintain secure cloud infrastructure and platforms for classified DoD systems, incorporating security controls at every layer (network, compute, storage, application)
• Develop and deploy infrastructure-as-code (IaC) using secure, version-controlled approaches (Terraform, CloudFormation, Ansible); implement security controls and compliance requirements through code
• Implement and maintain security hardening standards for Kubernetes clusters, Docker containers, Linux/Windows servers, and cloud resources in accordance with DISA STIGs, NIST guidelines, and DoD security baselines
• Manage network security controls including firewalls, WAF (Web Application Firewalls), network segmentation, access controls (ACLs), and encryption for data in transit and at rest
• Design and implement secrets management solutions (HashiCorp Vault, cloud-native secret managers) to protect credentials, API keys, certificates, and sensitive configuration data
• Design, implement, and maintain secure CI/CD pipelines that enforce security controls throughout the build, test, and deployment process
• Implement automated security scanning at multiple pipeline stages: static application security testing (SAST), dynamic application security testing (DAST), interactive application security testing (IAST), container scanning, and infrastructure-as-code scanning
• Conduct software composition analysis (SCA) to identify and remediate vulnerable dependencies and track open-source license compliance
• Ensure system architecture and configurations comply with DoD security requirements, including DISA Risk Management Framework (RMF), NIST security controls, FISMA requirements, and system security plans (SSPs)
• Implement continuous monitoring and compliance scanning to detect security misconfigurations, unauthorized changes, and control violations in near-real-time
• Configure and manage Security Information and Event Management (SIEM) systems and security monitoring tools to provide visibility into infrastructure and application security events
• Serve as a subject matter expert in incident response for infrastructure and application security incidents; investigate security events and coordinate remediation efforts
• Provide technical support for application development teams, assisting with deployment issues, troubleshooting, and operational runbooks
• Develop and maintain comprehensive technical documentation including architecture diagrams, runbooks, standard operating procedures (SOPs), and security configurations
• Collaborate with security teams, software developers, systems architects, and IT operations to integrate security into development and operations processes