Regulated Research DevOps Engineer

Universities of Wisconsin•Madison, WI

8d•$115,000 - $150,000•Hybrid

About The Position

The Regulated Research team within the Research Cyberinfrastructure group at the University of Wisconsin-Madison, Division of Information Technology is hiring two DevOps Engineers for a regulated research platform. These individuals will plan, develop, and operate a compliance-ready environment for Cybersecurity Maturity Model Certification (CMMC) Level 2 (Self and C3PAO) requiring NIST 800-171 controls, and other regulated research areas over time. These roles will be responsible for defining the architecture and configurations, along with evaluating the impact of changes, to ensure we meet the security and compliance needs. This will include helping define, build, and maintain Infrastructure as Code solutions and CI/CD practices within a Microsoft Azure environment. The roles will also include development and operation of interconnections between the platform and other UW Madison platforms or systems, including those on-premise and in the cloud. You will collaborate closely with IT in schools and colleges, the Office of Cybersecurity, and technical teams in central and distributed IT to ensure alignment of environments with campus policy and researcher requirements. You will engage with researchers and their teams across the University to understand their needs for the environment and build systems to enable their research. You will be the primary contact point for converting researcher, control requirements, or other professional needs into platform architecture, Infrastructure as Code, and DevOps pipeline implementations. Applicants for this position will be considered for DevOps Engineer III (Inst) and DevOps Engineer IV (Inst) titles. The title is determined by the experience and qualifications of the finalist. The candidate selected for this position may perform a combination of on-site and remote work subject to an approved flexible work arrangement (FWA), which is reviewed and approved annually. Remote work requires successful candidates to possess their own high-speed internet and phone to perform the work on a university provided computer. Per University policy, transportation between home and assigned work location is not payable/reimbursable and will be at the expense of the employee. This position is expected to be primarily remote but will require some onsite presence for in-person meetings or design workshops. The Division of Information Technology (DoIT) is an exciting and dynamic work environment grounded in organizational principles that include family and personal life/work balance; an inclusive, respectful, and supportive work environment; professional development opportunities; innovation; and alignment with the campus's teaching, learning, and research missions. DoIT provides core IT infrastructure services to the university, develops and implements services for the university and in some cases, for the Universities of Wisconsin, plays a major role in managing the state-wide higher education network and regional networks.

Requirements

Candidates must be U.S. citizens
Professional experience in DevOps cloud engineering and Infrastructure as Code (IaC) with tools such as Terraform, Ansible, or Chef.
Hands-on experience implementing or supporting security controls aligned with NIST 800-171, NIST 800-53, HIPAA, or related frameworks.
Professional experience with multiple scripting or automation languages, such as Python, Bash, and PowerShell.
Demonstrable experience with defining (or navigating significant changes to) CI/CD pipelines that include security requirements. (required for level IV).
Professional experience with developing novel architecture approaches involving several interconnecting systems to solve specific business challenges in the cloud (required for level IV).

Nice To Haves

Professional experience with DevOps engineering in Microsoft Azure in a regulated research environment (for example, HIPAA or NIST 800-171).
Professional experience supporting an environment which undergoes external assessment for compliance with security or privacy requirements (e.g., SOC 2, ISO 97001).
Demonstrable experience in formally evaluating the impact on changes to processes with regards to security or compliance.
Professional experience collecting and presenting packages of evidence with regards to system architecture for assessment (preferred for level IV).
Professional experience with developing novel architecture approaches involving several interconnecting systems to solve specific research challenges in the cloud (preferred for level IV).

Responsibilities

Produces and gathers evidence as needed for meeting assessor requirements
Maintains documentation on the system security plan (SSP), including updating documentation as needed for changes that impact the SSP
Manages, maintains, selects, and develops automation tools and infrastructure, including security configurations
Serves as technical lead for one or more aspects of the system
Serves as a subject matter expert to internal stakeholders, providing guidance and training to staff
Develops, programs, and/or deploys automation workflows for deployment, configuration, and/or monitoring of systems/services
Performs integration, migration, configuration, and security of existing applications and services into automated infrastructures
Analyzes requirements and communicates and coordinates with staff and internal stakeholders related to the system and/or project