DevSecOps Engineer

ZipStaff•Chapel Hill, NC

1d•Remote

About The Position

ZipStaff is hiring a DevSecOps Engineer for a global IT services and consulting firm. This fully remote, six-month contract role focuses on building and productizing platform operations, beginning with a unified service catalog that records services, ownership, deployments, and dependencies. Security, reliability, and development teams will use the catalog as their working view of the platform. The engineer will build and extend the catalog, integrate it with source control, delivery infrastructure, and observability systems, and make it available through APIs, a CLI, chat, and web interfaces, including AI-assisted interfaces. Because the catalog handles security-sensitive information, authorization, threat modeling with security partners, and compliance-ready audit evidence are central to the work. AI coding agents are part of the daily workflow, with sound judgment expected about when to use LLMs versus deterministic code. The role includes a light on-call rotation for the catalog; it does not involve production streaming on-call.

Requirements

At least 3 years of professional software engineering experience building backend services, internal tools, or data-backed systems used by other engineers.
Strong coding skills in Python, Go, or TypeScript/Node, including testing, code review, and CI/CD practices.
Experience shipping and maintaining services, not just scripts.
Experience implementing APIs and data models using REST or GraphQL.
Experience with relational databases such as Postgres and event-driven or webhook-based integrations with third-party systems.
Working knowledge of authentication and authorization patterns such as RBAC or ABAC, least-privilege access, and secrets handling.
Use AI coding agents as part of daily work and validate their output against security, reliability, and quality standards before shipping.
Working familiarity with Git and a hosted source-control platform such as GitHub, including webhooks and APIs, CI/CD systems, GitOps, and Kubernetes.
Good judgment about when to use an LLM versus deterministic code, a scheduled job, or an integration.
Clear written communication and the ability to turn feedback from engineers who use built tools into well-scoped changes.

Nice To Haves

Experience building an in-house service catalog, asset inventory, or ownership system used by other teams.
Hands-on experience building with LLM APIs, such as a bot, agent, retrieval pipeline, or automated analysis tool, and awareness of prompt injection and other agent-specific risks.
Experience evaluating nondeterministic LLM output using evaluation harnesses, prompt regression testing, or observability for AI features.
Experience building tools or integrations for AI coding agents, such as Model Context Protocol servers, agent skills, or tool definitions.
Experience producing compliance evidence and audit-ready records for security and reliability partners.
Hands-on experience with Kubernetes, Python, and Terraform.

Responsibilities

Build and extend the unified service catalog, including its data model, APIs, and synchronization jobs for ownership, deployment, dependency, and compliance information from source control, delivery infrastructure, and observability systems.
Build integrations, webhooks, and event-driven processing, including idempotent reconciliation with external systems and clean API contracts.
Expose the catalog through CLI, chat, and web interfaces, and contribute to AI-assisted interfaces with least-privilege identities, auditable actions, and prompt-injection protections.
Implement the authorization model specified by security partners to control who can see and change catalog data across teams.
Produce compliance-ready audit evidence, including ownership, change, and access records, as a built-in catalog output.
Participate in threat modeling with security partners and implement resulting controls, such as least-privilege access, secrets hygiene, and policy checks.
Ship production-quality software with tests, CI, observability, and runbooks.
Instrument the catalog for adoption, data freshness, and manual request volume.
Write clear documentation and support teams that consume the catalog.
Participate in a light on-call rotation for the catalog.