AWS DevSecOps Engineer

Phoenix Oversight Group LLC•Arlington, VA

5d•Remote

About The Position

The AWS DevSecOps Engineer builds, secures, and operates AWS environments and automated delivery pipelines for PhoenixTeam’s internal and client applications. This hands-on production engineering role spans infrastructure as code, container deployment, CI/CD, release-integrated security controls, reliability, and incident recovery. The engineer applies shared Platform patterns to make deployments repeatable rather than relying on one-off application setups. Agentic orchestration is a primary delivery approach. The engineer designs, supervises, and verifies AI-assisted workflows for testing, hardening, containerization, infrastructure provisioning, and deployment. The role requires independent AWS, DevSecOps, and security judgment, particularly when generated scripts or configurations are incorrect. The objective is to improve delivery speed and reliability from prototype through production without bypassing security reviews or release controls. This is a full-time, W2 employee position, not a contract or 1099 role. The arrangement is remote-first, with flexible arrangements and collaboration across engineering and client teams. Participation in a rotating on-call schedule for production systems and incident response is required; coverage details will be discussed during hiring. Travel of up to 10% may be required based on business or client needs.

Requirements

At least 5 years of hands-on DevOps, DevSecOps, site reliability, or platform engineering experience, including production responsibility, infrastructure automation, and deployment or incident recovery.
Strong production AWS experience spanning VPC/networking, IAM, ECS or EKS, RDS, KMS, secrets management, CloudWatch, and CloudTrail.
Experience deploying containerized workloads with Docker and building production infrastructure as code using Terraform, AWS CDK, or CloudFormation.
Experience owning CI/CD pipelines as code, including automated testing, security gates, release promotion, troubleshooting, and rollback.
Hands-on experience integrating SAST, DAST, SCA/dependency, container, and infrastructure-as-code security checks into delivery workflows.
Ability to script automation in Python, Bash, or Go and independently validate generated scripts and infrastructure configurations.
Practical understanding of least-privilege access, encryption, secure credential handling, and NIST SP 800-53 or a comparable security-control framework.
Ability to supervise and verify AI-assisted engineering workflows with independent judgment.
Clear written and verbal communication with technical and non-technical partners.

Nice To Haves

Experience with LLM-assisted or multi-agent engineering automation, including Amazon Bedrock or comparable orchestration tools.
AWS multi-account landing-zone expertise; policy-as-code or guardrails using OPA, Checkov, cfn-guard, SCPs, or comparable controls.
Experience supporting SOC 2 or other applicable commercial security assessments and automated audit evidence.
Relevant AWS professional, cloud security, or security engineering certification.
Client-facing delivery in mortgage, financial services, or another regulated industry.
Experience mentoring engineers in reliable pipeline practices.

Responsibilities

Build and operate AWS infrastructure using Terraform, AWS CDK, or CloudFormation, including networking, identity and access management, compute, databases, load balancing, encryption, secrets, storage, and monitoring.
Implement application infrastructure within shared Platform patterns and support multi-account controls and guardrails.
Own build, test, approval, and deployment pipelines as code; create reusable, documented workflows.
Integrate SAST, DAST, software-composition and dependency, container-image, and infrastructure-as-code scanning into release stages; maintain blocking criteria and escalate risk acceptance and exceptions to authorized decision-makers.
Apply least-privilege IAM, encryption, secure secrets handling, network isolation, and controlled production access; limit what automation and AI agents can access or change.
Design and verify agent-executable playbooks for hardening, testing, provisioning, and deployment; independently review and test generated code, infrastructure definitions, and security evidence.
Support blue/green or canary deployments and tested rollback; use delivery and recovery metrics to improve reliable releases.
Implement logs, metrics, tracing, health checks, alerts, and cost visibility.
Participate in a rotating on-call schedule, respond to incidents, and contribute to post-incident reviews and runbooks.
Use AWS security and audit tooling as applicable, remediate findings, and support evidence needs.
Collaborate with application engineers, Platform, QA/verification, and client security stakeholders to support secure handoffs and explain deployment decisions, controls, and human verification.