Cloud Engineers, Senior Engineers, Architects & Automation Specialists (CBP)

Agile Defense•Ashburn, VA

8d•Hybrid

About The Position

U.S. Customs and Border Protection runs continuous operations across more than 300 land, air, and sea ports of entry, plus Border Patrol stations and the Air and Marine Operations Center. The applications behind that work do not get a maintenance evening. When a service is slow or unavailable, an officer is standing at a checkpoint waiting on a biometric check, or an agent is running out of time on a court-mandated processing deadline. DHS oversight reviews have documented outages that halted passenger screening applications for hundreds of hours, and processing records that arrived too late to prosecute. We are hiring cloud engineers, architects, and automation specialists to build and run the environments those applications depend on. You will work on infrastructure as code, deployment pipelines, identity and access, monitoring, resilience, and cost, alongside network engineers, security staff, and the field teams who deal with what happens at the sites themselves. Two things are worth knowing before you apply. Federal accreditation governs the pace here, so a design that cannot be explained to a security reviewer is not finished, no matter how well it runs. And the cloud is not the whole environment. A meaningful part of the job is making new services work with systems that were built long before anyone used the word cloud, and that are not going away on your schedule.

Requirements

Active CBP Background Investigation (CBP BI) and EOD strongly preferred. We can begin processing for candidates who do not hold one.
U.S. Citizenship required
You own the pipelines and tooling the rest of the team builds on. You decide how something gets automated, and when a manual step is not yet worth the cost of removing.
You own a service, an environment, or a workload. You make routine build and configuration calls yourself and bring the consequential ones to a review.
You take the problems that arrive without a clear answer, including the ones that cross into network or security. Other engineers check their approach with you before they commit to it.
You set the patterns others build against, and you are accountable when a pattern meets an operational or accreditation reality it did not anticipate.

Nice To Haves

You have run production workloads in a government cloud environment where an outage cost something beyond a missed sprint.
You have written infrastructure as code that other people used without needing you in the room to explain it.
You have taken a system through a federal authorization process and can say what you would do differently the next time.
You have integrated cloud services with legacy systems you could not replace, and can describe the compromises you made.
You hold an active CBP BI, a fitness determination at another DHS component, or an active DoD clearance. Any of these shortens your start date.
You work comfortably in more than one platform's tooling and are not dependent on a single vendor's console.
Cloud platform and security certifications are useful, but they are not a substitute for having done the work.

Responsibilities

Stand up cloud environments that hold up under continuous operational load
Services you deploy survive their first real peak without emergency intervention.
The failure of one component degrades the service rather than stopping it.
Someone on call at two in the morning can tell what broke from the telemetry, without calling you to interpret it.
Capacity and cost decisions get made before somebody escalates them.
Replace manual work with automation people are willing to trust
Environments get rebuilt from code, and the code matches what is actually running.
Deployments that used to need a person watching them now run unattended.
When automation fails, it fails visibly and leaves a trail somebody else can follow.
Engineers stop keeping private scripts, because the shared tooling does the job.
Clear accreditation without letting it become the project
Security controls are designed in rather than retrofitted after a review finds them missing.
Evidence for control assessments comes out of the pipeline instead of a documentation sprint before every deadline.
You can explain to a security reviewer what a change does and why it is safe, in terms that answer their question rather than yours.