DevSecOps Engineer

Arbor Research Collaborative for Health•Ann Arbor, MI

5d•$92,000 - $149,500•Remote

About The Position

The DevSecOps Engineer designs, builds, secures, and operates cloud infrastructure for federal research data platforms, including websites, request management applications, searchable data catalogs, and data-processing pipelines. The role combines AWS cloud and DevOps engineering with information security engineering, and is responsible for infrastructure, deployment automation, monitoring, backups, disaster recovery, and security controls required by NIH, HHS, and federal standards including FISMA, NIST SP 800-53 Moderate, HIPAA, and NIH standards for controlled-access data repositories. The engineer creates and operates AWS environments and services, automates infrastructure and software delivery, integrates external platforms, and supports large and sensitive research datasets. The position also implements security protections throughout the delivery lifecycle, performs monitoring and vulnerability management, maintains security documentation and audit readiness, and supports controlled-access data workflows. The role collaborates with developers, data managers, analysts, project managers, government sponsors, and auditors. Those serving as technical leads additionally set standards, review engineering work, coordinate teams, and develop infrastructure and security plans. This is a remote position. Candidates must be physically located in Colorado, Washington, D.C., Georgia, Maryland, Michigan, Minnesota, North Carolina, or Virginia. The position is 40 hours per week, reports to the Program Director, does not supervise others, and involves minimal overnight travel of no more than 5%.

Requirements

Bachelor's degree in computer science, computer engineering, information security, or a related field.
At least 8 years of progressively responsible experience in systems engineering, cloud infrastructure, DevOps, or security engineering.
At least 3 years of hands-on experience designing and operating production workloads on AWS.
Experience building and maintaining CI/CD pipelines and infrastructure as code, such as Terraform or CloudFormation.
Demonstrated experience implementing cloud security controls, including identity and access management, multifactor authentication, encryption and key management, network segmentation, and logging and monitoring.
Working knowledge of FISMA, NIST SP 800-53, the NIST Risk Management Framework, and the HIPAA Security Rule.
Experience with vulnerability management, patching, and incident response.
Experience implementing and testing backup and disaster recovery procedures.
Proficiency in at least one scripting language, such as Python, Bash, or PowerShell.
Experience with Git in a collaborative Agile workflow.
Strong written documentation skills, including security plans and standard operating procedures.
Excellent organizational, analytical, and communication skills, and ability to work as part of a team.

Nice To Haves

AWS certification, such as AWS Certified Security - Specialty, AWS Certified Solutions Architect, or AWS Certified DevOps Engineer, or a security certification such as CompTIA Security+, CISSP, or CCSP.
Experience supporting ATO, FedRAMP-aligned environments, or NIST SP 800-53 Moderate system security plans.
Experience operating NIH controlled-access data repositories or other systems handling sensitive health research data, and familiarity with NOT-OD-25-159.
Experience configuring AWS WAF, GuardDuty, Macie, and Security Hub.
Experience with Amazon Cognito and federated authentication, such as NIH login or institutional credentials.
Experience with Amazon OpenSearch Service and Amazon Bedrock or other large language model services.
Experience managing large imaging data, such as DICOM or digital pathology, and secure file transfer services.
Experience with containers and container security, such as Docker, ECS, EKS, or Fargate.
Experience supporting Section 508 and WCAG requirements for federal websites.
Experience supporting federal contracts and contract transitions; health research background.
Non-profit experience.

Responsibilities

Design, provision, and maintain secure, scalable AWS environments for public websites, applications, APIs, and data platforms.
Maintain separate development, test, and production environments with appropriate environment-specific configurations.
Architect infrastructure for high availability, elastic scaling, and performance as data volumes and user demand grow, including large imaging and multimodal omics datasets.
Build and operate secure data ingestion and distribution services, including upload portals, SFTP and AWS Transfer Family endpoints, Lambda validation workflows, and controlled S3 downloads.
Host and support metadata search and indexing, secure APIs, and large language model services used for natural-language search.
Integrate with external NIH platforms and systems through secure APIs and automated ETL pipelines, including handoff to secure cloud workspaces for analyze-in-place workflows.
Monitor system health, capacity, availability, and cost using CloudWatch, and tune resources to meet service levels.
Manage operating-system and software patching and configuration baselines across servers and services.
Use AI tools and incorporate AI into solutions in accordance with organizational guidance and controls.
Build and maintain CI/CD pipelines that build, test, scan, and release code across environments.
Define infrastructure as code so environments are repeatable, version controlled, and auditable.
Manage client-owned private GitHub repositories, including branch protection, code review, and secrets management.
Help ensure AI-generated code passes automated testing and security scanning before release.
Lead technical contract transitions, including provisioning environments, installing applications and databases, configuring interfaces, integrating resources, migrating and validating data, executing cutover, and completing production releases.
Implement layered safeguards in a FedRAMP-aligned cloud environment that meets applicable federal, health, and NIH/NHLBI security requirements.
Design and enforce network security, including VPCs, subnets, security groups, firewalls, intrusion detection, and segmentation of management, application, data, and sensitive-dataset environments.
Administer AWS IAM and Amazon Cognito identity and access controls, including role-based and least-privilege access, multifactor authentication, federated login, and secure remote access.
Encrypt data at rest and in transit using AWS KMS and manage keys, secrets, and certificates.
Deploy, configure, and tune AWS security services, including WAF, GuardDuty, Macie, and Security Hub.
Configure centralized logging and monitoring, generate operational and security alerts, and investigate and respond to security incidents.
Perform continuous monitoring, vulnerability scanning, container and dependency scanning, and static and dynamic application security testing; track findings through remediation.
Develop and maintain the Information System Security Plan and related security documentation, update the ISSP quarterly, and support ATO activities and agency security reviews.
Operate controlled-access data workflows under NIH requirements, including access logging and reviews, data access renewals, and investigation of potential non-compliance.
Maintain tamper-resistant audit trails of system access, requests, approvals, and data distributions.
Conduct periodic quality assurance audits of controls, permissions, and logs; check encryption, access privileges, and backup completion; and report security and data-integrity metrics.
Implement automated daily backups and weekly encrypted cross-region replication to a geographically remote location.
Monitor and validate backups, test restoration and disaster recovery procedures, and document backup, recovery, and continuity procedures.
Work with software developers, data managers, business analysts, and project managers to translate application and data requirements into secure infrastructure designs.
Prepare paperwork for access to government systems, such as PIV credentials, and comply with agency policies.
Provide security guidance, Rules of Behavior briefings, and role-based security awareness training to project staff.
Communicate technical and security approaches clearly to technical and non-technical audiences, including government sponsors and auditors.
Maintain a professional and exemplary work and research ethic.
When serving as technical lead, lead cloud infrastructure and security for projects, set standards, review other engineers' and programmers' work, coordinate teams, and formulate written infrastructure and security plans tied to project scope.