DevSecOps - Classified Compute

Oak Ridge National Laboratory•Oak Ridge, TN

About The Position

The Field Intelligence Operations Division in the National Security Sciences Directorate at Oak Ridge National Laboratory is seeking an experienced DevSecOps Engineer/Architect to design, implement, automate, and sustain secure software and infrastructure delivery capabilities supporting classified national security missions. The role establishes modern DevSecOps practices in highly controlled computing environments where security, configuration management, traceability, reliability, and mission availability are essential. The position works across software development, infrastructure engineering, high-performance computing, cybersecurity, Information Assurance, and mission teams to create secure, repeatable methods for building, testing, deploying, configuring, and sustaining systems and applications. It must address classified-environment constraints such as restricted connectivity, disconnected or air-gapped networks, controlled software introduction, security accreditation, configuration baselines, vulnerability management, and rigorous change control. The position requires an active TS, Q, or TS/SCI clearance for consideration and the ability to obtain and maintain a Department of Energy SCI clearance. It is a Workplace Substance Abuse Program testing-designated position, requiring a pre-placement drug test and ongoing random drug testing; random polygraph testing may also apply. Visa sponsorship is not available. ORNL is an equal opportunity employer.

Requirements

Bachelor’s degree in computer science, computer engineering, cybersecurity, software engineering, information technology, or a related technical field, plus relevant professional experience; equivalent combinations of education and experience may be considered.
Active TS, Q, or TS/SCI clearance is required for consideration.
Ability to obtain and maintain a Sensitive Compartmented Information (SCI) clearance from the Department of Energy.
Demonstrated experience with DevOps, DevSecOps, software engineering, systems engineering, or infrastructure automation.
Strong Linux administration and scripting experience.
Experience developing or administering CI/CD pipelines.
Experience with source control and Git-based development workflows.
Experience with infrastructure automation and configuration-management technologies.
Working knowledge of containers and modern application deployment practices.
Understanding of cybersecurity principles, including least privilege, vulnerability management, system hardening, secrets management, logging, and secure configuration.
Demonstrated ability to automate repeatable technical processes using Python, Bash, PowerShell, or similar technologies.
Ability to pass a pre-placement drug test and participate in ongoing random drug testing; random polygraph testing may also apply due to SCI requirements.
Ability to exercise discretion and sound judgment when handling sensitive personnel and security matters.
Ability to work independently and collaboratively in highly controlled environments while following disciplined configuration management, documentation, and change-control processes.

Nice To Haves

Familiarity with GitLab, GitHub Enterprise, or comparable source-control platforms.
Experience with CI/CD pipelines using GitLab CI/CD, Jenkins, GitHub Actions, or comparable technologies.
Experience with infrastructure automation and configuration-management tools such as Ansible, Terraform, Puppet, or Chef.
Experience with Docker, Podman, or Apptainer/Singularity.
Familiarity with Kubernetes, OpenShift, or other container orchestration platforms.
Experience with artifact and container repositories such as Nexus, Artifactory, or Harbor.
Familiarity with static and dynamic application security testing.
Experience with software composition analysis and dependency management.
Familiarity with Software Bills of Materials (SBOMs) and associated tooling.
Familiarity with container and artifact signing and secrets-management technologies.
Experience with automated STIG and security compliance validation.
Experience with observability and monitoring technologies such as Prometheus, Grafana, ELK/OpenSearch, or Splunk.
Experience with Red Hat Enterprise Linux or comparable enterprise Linux platforms.
Familiarity with HPC and scientific computing environments.
Experience supporting GPU-accelerated computing and AI/ML infrastructure.
Familiarity with security frameworks, policies, and compliance requirements, including NIST security controls, RMF, ICD 503, STIGs, FIPS, DOE and DoW security requirements, and classified-system accreditation processes.
Previous experience in an SCI or SAP environment or supporting SCI operations.
Strong organizational skills, attention to detail, and ability to manage multiple priorities, deadlines, and documentation requirements.
Strong written and verbal communication skills, including technical documentation and communication with engineering, cybersecurity, project, and mission stakeholders.
Experience developing or maintaining SOPs, process documentation, metrics, or workflow improvements.
Demonstrated ability to provide responsive customer service while maintaining security and compliance requirements.

Responsibilities

Design and implement secure DevSecOps architectures for classified applications, infrastructure, and computational environments.
Develop and maintain CI/CD pipelines integrating software development, testing, security validation, deployment, and configuration management.
Design DevSecOps solutions for disconnected, restricted-connectivity, and air-gapped environments.
Automate software builds, testing, artifact management, security scanning, release management, and deployment.
Integrate security controls and testing throughout the software and infrastructure lifecycle.
Implement Infrastructure as Code and configuration-as-code practices to improve repeatability, traceability, consistency, and recovery.
Develop automated system provisioning and configuration capabilities using tools such as Ansible, Terraform, Git-based workflows, or comparable platforms.
Implement automated compliance validation and configuration enforcement where appropriate.
Integrate vulnerability scanning, software composition analysis, static analysis, container scanning, secrets detection, and other security capabilities into delivery pipelines.
Support secure container development and deployment, including image creation, scanning, registry management, signing, validation, and lifecycle management.
Establish secure artifact repositories and processes for transferring, validating, approving, and distributing software in classified environments.
Design solutions for software supply-chain security, provenance, integrity verification, dependency management, and controlled software introduction.
Develop standardized deployment patterns for Linux servers, HPC environments, containers, applications, and supporting infrastructure.
Implement automated testing and validation to reduce deployment risk and configuration drift.
Develop monitoring, logging, observability, and alerting capabilities for operational and cybersecurity requirements.
Partner with Information Assurance and cybersecurity personnel to map automated technical controls and evidence to RMF and ATO requirements.
Support repeatable evidence-generation processes for security assessments, configuration reviews, vulnerability management, and continuous monitoring.
Assist engineering teams in implementing STIGs, security baselines, hardened configurations, and approved technical standards.
Participate in architecture and security reviews, change-control processes, technical interchange meetings, and deployment readiness reviews.
Develop documentation, standard operating procedures, reference architectures, pipeline standards, and reusable automation.
Mentor developers, systems engineers, administrators, and other technical personnel in secure development and automation practices.
Evaluate emerging DevSecOps technologies and recommend solutions suitable for classified and mission-critical environments.
Align behaviors, priorities, and interactions with ORNL’s core values of Impact, Integrity, Teamwork, Safety, and Service, and promote a respectful workplace and equal opportunity.