DevSecOps Engineer - RMF

About the role

NetImpact Strategies is seeking a DevSecOps Engineer to support secure cloud infrastructure and applications within a Department of Defense environment. This hands-on role combines DevSecOps engineering with cybersecurity and Risk Management Framework support. The ideal candidate will have experience with cloud platforms, Kubernetes, CI/CD pipelines, Linux administration, infrastructure automation, vulnerability remediation, and RMF/ATO documentation. This individual will partner with engineering and cybersecurity teams to implement secure solutions and produce the technical evidence required to obtain and maintain an Authorization to Operate.

NetImpact Strategies Inc. (NetImpact) has been a Trusted Advisor driving impact through digital transformation for the Federal Government for over a decade. We solve complex problems with innovation and agility to create meaningful, transformative, and enduring change. As Trusted Advisors, NetImpact professionals partner with customer agencies to deliver solutions that empower them to not only meet their missions but also realize their strategic vision through agile, outcome-focused solutions addressing both strategic and tactical requirements. We design and implement comprehensive, tailored solutions that are both mindful of the client's culture and organizational dynamics. NetImpact’s core values and commitment to a customer and results-oriented delivery approach has propelled our growth and enabled us to deliver impactful value across Strategic Consulting, Process Automation, Cloud, DevSecOps , Data and Analytics, and Cyber Security for the Federal Government.

Responsibilities

• Design, deploy, maintain, and troubleshoot secure cloud infrastructure and applications across development, testing, and production environments.
• Administer Docker and Kubernetes environments, including deployments, networking, configuration, storage, scaling, and upgrades.
• Develop and maintain CI/CD pipelines that automate application builds, testing, security scanning, and deployment.
• Implement Infrastructure as Code using Terraform, CloudFormation, Ansible, or comparable technologies.
• Administer Linux systems and troubleshoot issues across applications, containers, networks, operating systems, and cloud services.
• Implement monitoring, logging, alerting, backup, recovery, and operational automation capabilities.
• Apply security baselines, DISA STIGs, patching requirements, least-privilege access, and secure configuration practices.
• Identify, prioritize, remediate, and document vulnerabilities and security findings.
• Support DoD RMF and ATO activities by developing and maintaining SSPs, POA&Ms, architecture diagrams, inventories, data flows, PPSM documentation, and remediation evidence.
• Work with ISSOs, ISSMs, engineers, developers, and assessors to document NIST SP 800-53 control implementations and maintain accurate authorization packages.

Qualifications

Required Qualifications

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, Engineering, or a related field.
• Four or more years of experience in DevOps, DevSecOps, cloud engineering, systems engineering, or a related discipline.
• Hands-on experience with Linux, Docker, Kubernetes, Git, and AWS, Microsoft Azure, or another major cloud platform.
• Experience developing CI/CD pipelines and implementing Infrastructure as Code using Terraform, CloudFormation, or comparable tools.
• Knowledge of cloud networking, identity and access management, secrets management, encryption, monitoring, vulnerability management, patching, and system hardening.
• Familiarity with DoD RMF, the ATO lifecycle, NIST SP 800-53, DISA STIGs, security-control documentation, and POA&Ms.
• Strong troubleshooting, technical-writing, communication, and collaboration skills.

Preferred Qualifications

• Experience supporting DoD or other federal information systems, including eMASS and RMF/ATO documentation.
• Experience with AWS GovCloud and Kubernetes platforms such as EKS, AKS, Rancher/RKE2, or Red Hat OpenShift.
• Experience with security and compliance tools such as Fortify, SonarQube, Snyk, Trivy, Nessus, ACAS, AWS Inspector, or SCAP.
• Security+, CISSP, SecurityX, AWS, Azure, CKA, CKS, or another relevant certification.

Benefits

• Comprehensive medical, dental, & vision insurance that starts the first of the month after you join the team.
• 401(k) Plan – Immediately vested employer contributions; no matching required.
• Generous Paid Time Off (PTO) policy, one (1) additional day of paid wellness leave per calendar year, and observance of ten (10) federal holidays.
• Pet Insurance.
• Tuition reimbursement, internal training programs,