Cloud, Deployment & DevSecOps Engineer

Nominal•Washington, DC

1d•Onsite

About The Position

Nominal is hiring a Cloud, Deployment & DevSecOps Engineer to secure the platform used by hardware and defense teams to ingest, analyze, and act on test and operations data. The platform is deployed across AWS, AWS GovCloud, customer-hosted clouds, and on-premises environments. This engineer will own security controls, detection, and compliance evidence that help make deployments trustworthy, including for customers with federal requirements, and will work directly with engineering to integrate security into deployment and operations. The role is suited to someone with deep AWS security experience and hands-on cloud engineering who builds practical guardrails and automation that engineering teams adopt. The engineer will help shape the security priorities with little oversight. The position is in-office five days per week.

Requirements

Deep AWS security experience combined with hands-on cloud engineering and deployment experience.
Strong Kubernetes experience, including securing clusters and workloads.
Experience implementing cloud identity, access, and network security controls.
Experience building or operating cloud logging, monitoring, and threat detection.
Experience with infrastructure as code and security automation.
Experience working directly with engineering teams to implement and maintain production security controls.

Nice To Haves

Certified Kubernetes Security Specialist (CKS).
Experience with Azure, GCP, Oracle Cloud, or self-hosted deployments.
Experience supporting FedRAMP, AWS GovCloud, or DoD IL4/IL5 environments.
Experience with secure CI/CD, artifact signing, container security, or software supply chain controls.
Experience handling cloud security incidents or complex deployment failures.

Responsibilities

Design and implement security controls across AWS, AWS GovCloud, customer-hosted clouds, and on-premises deployments.
Develop secure cloud architecture, including landing zones, service control policies, and security boundaries.
Harden Kubernetes and EKS environments, including workload identity, network policies, and runtime security.
Build centralized logging, monitoring, dashboards, and detection capabilities across deployments.
Develop cloud detection and response workflows, triage cloud security findings, and support incident response and recovery.
Implement infrastructure-as-code guardrails, policy-as-code, drift detection, and continuous compliance automation.
Improve deployment pipeline security through artifact signing, admission policies, and software supply chain controls.
Develop container and base-image security standards, including images that meet applicable FIPS requirements.
Partner with engineering to obtain and integrate available security telemetry from customer environments.
Support FedRAMP and other federal deployment requirements through technical controls and evidence.