Senior Azure Cloud & DevSecOps Engineer (TS SCI Cleared)

Hyertek•Washington Dc, WA

1d•$145,000 - $186,500

About The Position

HyerTek, a federal technology consulting firm, is seeking a Senior Azure Cloud & DevSecOps Engineer to design, build, secure, and operate Microsoft Azure environments and the delivery pipelines that deploy into them. The work supports DoW Impact Levels 5, 6, and 7, equivalent classification levels, and other accredited environments as required by the customer. The role owns the full lifecycle, from landing zones, networking, and identity through hardened container builds, automated security and compliance gates, and controlled releases into Azure Government. The engineer works directly with cybersecurity professionals, application teams, and Government stakeholders to turn mission requirements and security controls into technical designs and production-ready infrastructure and pipelines. Security is integrated into the platform and pipeline from the outset. The role also automates technical evidence for supporting and maintaining an Authority to Operate (ATO). Approved AI-assisted development tools and coding agents are used to accelerate infrastructure-as-code, pipeline and policy-as-code, findings triage, control documentation, and runbooks; all AI-generated output must be reviewed and validated before deployment to an accredited environment. Candidates must reside in the Washington, DC, metropolitan area. Some work takes place at customer facilities, including accredited Secure Areas and SCIFs at Fort Meade. The position requires U.S. citizenship and an active Top Secret security clearance, with eligibility to obtain and maintain SCI and any additional customer-specific access. The candidate must be authorized to work in the United States without current or future employment-based visa sponsorship. The anticipated annual salary range is $145,000–$186,500. Final compensation depends on relevant experience, technical qualifications, certifications, clearance status, and contract requirements.

Requirements

At least 5 years of hands-on cloud, infrastructure, or DevSecOps engineering experience, including responsibility for production environments and CI/CD pipelines in a regulated or security-sensitive setting.
Strong experience designing, deploying, and operating solutions in Microsoft Azure.
Hands-on experience with Azure Government or another regulated government-cloud environment.
Strong knowledge of Azure networking, identity and access management, compute, storage, security, monitoring, and governance.
Experience implementing secure landing zones, subscription structures, network segmentation, access controls, and centralized logging.
Experience with Microsoft Entra ID, Azure RBAC, managed identities, Key Vault, Azure Policy, Azure Monitor, and Log Analytics.
Proficiency with infrastructure-as-code using Terraform, Bicep/ARM, or a comparable technology.
Experience designing and maintaining CI/CD pipelines in GitHub Enterprise (GitHub Actions, reusable workflows, branch protection, and self-hosted runners) and/or Azure DevOps.
Production experience with Kubernetes platforms such as AKS or OpenShift, including secure container-image builds using hardened base images, multi-stage builds, vulnerability scanning, and non-root runtimes.
Experience integrating automated security scanning into CI/CD pipelines.
Working knowledge of secure software supply-chain practices, including SBOM generation, artifact signing, and provenance attestation.
Demonstrated experience applying DISA STIGs or comparable federal security configuration baselines in cloud or infrastructure environments.
Familiarity with the DoW Cloud Computing SRG, RMF, and NIST SP 800-53.
Working knowledge of Windows and Linux administration, including command-line troubleshooting and system hardening.
Strong scripting and automation skills using PowerShell, Azure CLI, Python, or a comparable language.
Understanding of least-privilege access, encryption, secrets management, vulnerability management, backup, and disaster recovery.
Demonstrated proficiency using AI-assisted development platforms such as OpenAI, Claude, Gemini, or Microsoft Copilot, with the judgment to review and validate AI-generated code and documentation.
Strong troubleshooting, documentation, and stakeholder communication skills.
Ability to work independently and collaboratively across multiple concurrent engagements.
DoW 8140-aligned IAT Level II certification, with Security+ CE or an approved equivalent.
Active Top Secret security clearance and eligibility to obtain and maintain SCI and any additional customer-specific access requirements.
U.S. citizenship and authorization to work in the United States without the need for employment-based visa sponsorship now or in the future.
Must reside in the Washington, DC, metropolitan area.

Nice To Haves

Direct experience with Azure Government Secret, Top Secret, or other classified cloud environments.
Experience supporting DoW IL5, IL6, or IL7 (or equivalent), ICD 503, JSIG, or SAP workloads.
Experience with Azure Landing Zones, Secure Azure Computing Architecture (SACA), or DoW Secure Cloud Computing Architecture (SCCA).
Experience with hybrid connectivity, ExpressRoute, network virtual appliances, boundary protection, enterprise DNS, or cross-domain solutions.
Experience with GitHub Enterprise Server in disconnected or air-gapped environments, and transferring software artifacts into air-gapped or cross-domain environments.
Experience with Iron Bank, Platform One, or comparable hardened-container programs.
Experience with Kubernetes policy tools such as OPA/Gatekeeper or Kyverno.
Experience automating STIG validation, configuration compliance, or continuous-monitoring evidence pipelines.
Experience supporting RMF authorization, remediation, or continuous ATO initiatives.
Experience with production secrets rotation, SIEM integration, and audit-log retention.
Microsoft certifications such as Azure Administrator Associate, Azure Solutions Architect Expert, Azure Security Engineer Associate, Azure Network Engineer Associate, or DevOps Engineer Expert.
CISSP, CASP+, or another advanced security certification.
An active TS/SCI clearance is strongly preferred.

Responsibilities

Build, configure, and maintain secure Microsoft Azure and Azure Government environments supporting IL5, IL6, IL7, or equivalent workloads, following approved architectures, contract requirements, and security controls.
Implement cloud landing zones, subscriptions, resource organization, network boundaries, identity controls, centralized logging, and governance policies.
Configure Azure networking, including VNets, subnets, routing, private endpoints, DNS, Azure Firewall, load balancers, NSGs, and hybrid connectivity.
Implement identity and access controls using Microsoft Entra ID, Azure RBAC, managed identities, privileged-access controls, and Azure Key Vault.
Deploy and operate Azure compute, storage, database, and container services, including AKS, in accordance with approved architectures and security requirements.
Deploy and operate in disconnected, air-gapped, or classified environments where public-cloud services and external dependencies are limited.
Design, maintain, and improve secure CI/CD pipelines using GitHub Actions and Azure DevOps across multiple repositories and environments, including air-gapped deployments.
Build and maintain hardened containerized applications for Kubernetes platforms such as AKS and OpenShift.
Integrate automated security checks for source code, dependencies, secrets, containers, and infrastructure-as-code into pipelines; identify, evaluate, and remediate critical findings before release.
Implement secure artifact management, including SBOMs, artifact signing, provenance attestation, and controlled promotion between environments.
Manage secrets and environment-specific configuration using approved vault and configuration-management solutions.
Establish reusable pipeline patterns, templates, and automation to keep security and deployment practices consistent across projects.
Deploy and manage Azure infrastructure using Terraform, Bicep, ARM templates, or comparable IaC tools.
Automate cloud operations, compliance validation, and evidence collection using PowerShell, Azure CLI, Python, or comparable languages.
Apply Azure Policy, security baselines, DISA STIGs, encryption requirements, and configuration standards in partnership with cybersecurity teams.
Implement, validate, and maintain DISA STIGs and security configuration baselines, remediate findings, and automate compliance validation.
Automate compliance evidence, configuration monitoring, audit logging, and security reporting in support of RMF authorization, assessment, and continuous ATO activities.
Collaborate with cybersecurity and development teams to remediate vulnerabilities, security findings, configuration deviations, and compliance deficiencies.
Support security assessments, audits, and customer reviews with accurate configurations, technical documentation, and required evidence.
Implement monitoring, alerting, audit logging, and dashboards using Azure Monitor, Log Analytics, Defender for Cloud, and Microsoft Sentinel as applicable.
Troubleshoot infrastructure, networking, identity, pipeline, container registry, and deployment issues across development, test, and production.
Develop, test, and maintain backup, recovery, continuity-of-operations, and disaster-recovery procedures with documented recovery objectives.
Produce infrastructure diagrams, configuration documentation, operational runbooks, and customer-handoff materials.
Review and validate AI-generated code and documentation before deployment to an accredited environment.