Lead DevSecOps Engineer

DMI•Tysons, VA

1d•$121,600 - $152,000

About The Position

The Lead DevSecOps / SRE leads the program’s delivery-security function and is accountable for keeping the deployed system secure, compliant, and operational. The role also includes platform engineering responsibilities: day-to-day operation of the AWS GovCloud landing zone and administration of DynamoDB. The program, Readiness Next, is an offline-first PWA for Army personnel and equipment accountability. It deploys to AWS GovCloud in the ECMA cARMY environment, initially at DoD Impact Level 5, with an IL6 follow-on in the AWS Secret Region. Its backend consists of approximately 26 TypeScript Lambda domains using DynamoDB, EventBridge, and SQS, deployed as an AWS SAM application of 13 nested stacks. The incumbent owns CI/CD and software supply chain security across GitHub and GitLab; signed and attested builds and SBOM, CBOM, and AI-BOM gates; secrets and key management; STIG and compliance automation that feeds the RMF/cATO package; and production serverless-stack reliability. Through month 9, the role works with an AWS Professional Services ECMA engineer to build the landing zone, then assumes ownership after handoff. The role leads DevSecOps and SRE standards, maintains CI and deployment systems, automates security and compliance evidence, manages production reliability and incident response, operates and extends the GovCloud landing zone, and administers DynamoDB. It also establishes guardrails for AI-generated code and ensures pipelines and runbooks remain operable in SCIFs where AI tooling is unavailable.

Requirements

Knowledge of GitHub Actions, including reusable workflows, OIDC to AWS, and environment protection.
Knowledge of GitLab CI Ultimate, including deployment pipelines, DAST, and API fuzzing.
Experience with cosign signing and attestation, AWS Signer, and Lambda code signing.
Knowledge of SBOM, CBOM, and AI-BOM, including CycloneDX 1.7; Dependabot; and npm-workspace monorepos.
Knowledge of AWS GovCloud, including IL5 and the IL6 follow-on; IAM, KMS, Secrets Manager, and SSM.
Experience with AWS SAM and CloudFormation nested stacks; CDK or Terraform experience transfers.
Knowledge of Lambda, API Gateway, EventBridge including Scheduler, SQS, ElastiCache (Valkey), S3, WAF, LocalStack Pro, and Docker.
Knowledge of SLI/SLO design, alerting, on-call and incident command, postmortems, CloudWatch, X-Ray, CloudTrail, Lambda versioning, rollback, and staged cutover.
Working knowledge of Control Tower / Landing Zone Accelerator, Organizations, service control policies, Identity Center, AWS Config, Security Hub, GuardDuty, VPC design with endpoints and NAT, and DynamoDB capacity, indexes, TTL, Streams, point-in-time recovery and restore, on-demand backup, export to S3, and throttling diagnosis.
Knowledge of SAST, DAST, SCA, secret and container scanning, DISA STIG automation, NIST SP 800-53 control mapping, OPSEC, FIPS 140-3, and key and certificate rotation.
Scripting skills in Bash, Python, and PowerShell, and Node.js and TypeScript tooling.
Knowledge of Express and React security patterns; REST, SOAP, and SFTP integrations; and CAC/mutual TLS, OAuth2, and OIDC/JWT.
AWS Certified Security – Specialty or CISSP certification; this requirement is non-waivable for the labor category.

Nice To Haves

AWS Certified DevOps Engineer – Professional or SysOps Administrator certification, strongly preferred for the SRE responsibilities.
CKA/CKS certification.
GitLab certification.
GSEC or GCIH certification.
DoD or Army DevSecOps experience, including cARMY pipelines, DoD software factories, or Platform One.
Experience with supply-chain security frameworks such as SLSA and in-toto, and policy as code such as OPA/Conftest.
Post-quantum and CNSA 2.0 readiness, including ML-KEM and ML-DSA, and FIPS module validation.
Experience securing offline-first PWAs, including service workers, encrypted IndexedDB, and background sync.
Continuous ATO and ConMon automation experience, including OSCAL and eMASS evidence workflows.
Familiarity with the Model Context Protocol, LLM provider gating, and Zero Trust for AI.

Responsibilities

Lead the DevSecOps and SRE function; set pipeline, release, and on-call standards, and review infrastructure and pipeline changes, including AI-authored changes.
Mentor developers contributing CI and infrastructure code; own the delivery-security roadmap and assign ownership for reliability and pipeline gaps.
Report pipeline health, deployment frequency, change-failure rate, mean time to restore, and SLO attainment to the Technical Lead and Government.
Serve as the primary technical liaison to the cybersecurity/RMF team.
Design and maintain GitHub Actions workflows across the npm-workspace monorepo, covering testing, quality ratchets, serverless and client deployment, image builds, API documentation, and per-pull-request bills-of-materials gates.
Design cost-aware CI, with expensive lanes run on demand and live-engine suites run locally rather than in hosted service containers.
Own the container supply chain, including publishing images to GitHub Container Registry and signing them with cosign attestations; manage AWS Signer signing and enforcement for Lambda bundles.
Maintain SBOM, CBOM (CycloneDX 1.7, including CNSA 2.0 gap analysis), and AI-BOM generators and gates.
Manage GitHub Packages, Dependabot triage, and runtime checks that verify Lambda-bundled dependencies support Node 24.
Operate the GitLab Ultimate deploy plane for GovCloud test environments, including GitLab DAST and API fuzzing.
Carry signed artifacts built in GitHub into GitLab-run deployments and verify at deployment that each artifact is the one built by CI.
Maintain deployment as a parameterized capability so the same signed artifact can be deployed from GitHub, GitLab, or an operator workstation.
Integrate and tune SAST, DAST, SCA, secret scanning, and container image scanning; route findings into pull-request gates and the evidence trail.
Automate DISA STIG validation and OPSEC checks, and generate hardening evidence for RMF controls.
Manage secrets, certificates, and key rotation, including KMS customer-managed keys, Secrets Manager, and SSM Parameter Store for signing keys, encryption keys, and integration credentials; maintain FIPS 140-3 posture.
Maintain AWS WAF, API Gateway request validation, and least-privilege IAM for every function.
Define service-level indicators and objectives for API and synchronization paths; own CloudWatch alarms and metric filters, SNS routing, dashboards, and X-Ray tracing.
Lead incident response, including the on-call rotation, runbooks, blameless postmortems, and automation for common failure modes such as dead-letter queue redrive, EventBridge archive replay, throttling, and cold-start regressions.
Own release safety through Lambda versions and aliases, staged rollout, rapid rollback, and parity cutover from the legacy service to Lambda.
Manage capacity and cost against the program cost model, enforce resource tagging, and keep LocalStack Pro faithful to the production stack.
Operate and extend the GovCloud landing zone with an AWS Professional Services engineer through month 9, then assume ownership after handoff.
Manage multi-account structure and account vending with Control Tower / Landing Zone Accelerator, service control policies, IAM Identity Center federation, centralized CloudTrail, AWS Config and log archive, Security Hub and GuardDuty findings flow, and ECMA cARMY tenant tasks.
Maintain the network baseline, including VPCs, private subnets, NAT, approximately 14 VPC endpoints, and security groups, keeping service traffic off the public internet.
Maintain account baselines as infrastructure as code, check for drift, and avoid manual changes in boundary accounts.
Administer DynamoDB tables, including on-demand capacity, global secondary indexes, TTL, Streams, and KMS encryption.
Own DynamoDB backup and recovery: verify 35-day point-in-time recovery on each table, take on-demand backups before risky migrations, rehearse point-in-time restores to new tables with cutover, and use export to S3 for analytics and evidence.
Monitor DynamoDB throttling, hot partitions, consumed capacity, stream iterator age, and replication latency; bring access-pattern issues to developers responsible for data models.
Apply fine-grained IAM and deletion protection, and plan Global Tables for multi-region production.
Build guardrails so AI-generated code meets the same security bar as hand-written code, including review gates, test enforcement, provenance, and AI-BOM evidence.
Use Claude Code and Amazon Q to author workflows, infrastructure code, STIG remediation, and compliance-as-code, and review the work before it gates a build.
Work with the RMF team to turn automated scan output into control evidence and maintain the OSCAL/ConMon evidence feed supporting continuous ATO.
Keep pipelines and runbooks operable in SCIFs where AI tooling is unavailable.