Senior DevSecOps Engineer

Pantheon Data • Reston, VA

5d • $145,000 - $200,000 • Remote

About The Position

Pantheon Data is seeking a Senior DevSecOps Engineer to design, build, and operate a secure software delivery platform for ML-enabled workloads and applications in AWS GovCloud that process CUI, PII, and PHI. The engineer will own the GitLab CI/CD architecture end to end, including pipelines, runners, security scanning, policy enforcement, and compliance evidence, and lead the migration of existing repositories and pipelines to GitLab.

The position combines secure pipeline engineering with production Amazon EKS delivery through GitOps. It enforces gated security controls intended to satisfy NIST 800-53, FedRAMP, and DoD SRG requirements while maintaining efficient delivery. The engineer will work closely with the Cloud Operations Engineer, who builds and operates the underlying AWS infrastructure, and the Cloud Security Engineer, who owns cloud security controls and ATO evidence. Candidates should be able to describe platforms and pipelines they personally built, including stage design, security gates, runner architecture, failure modes, and compliance evidence.

The position is listed as remote in Reston, Virginia. Remote or hybrid employees may periodically work from a Pantheon Data office or client site. Local candidates should be prepared for an in-person interview; candidates outside the local area may be considered for a virtual interview. Candidates must be able to obtain and maintain a Secret clearance; an active Secret clearance is preferred.

Requirements

• Bachelor's degree in Computer Science, Information Technology, Information Systems, Engineering, or a related technical field from an accredited university.
• At least 5 years of DevSecOps or DevOps engineering experience with responsibility for production AWS environments.
• Hands-on CI/CD expertise with GitLab CI/CD, GitHub Actions, or a comparable platform, including large-scale pipeline design, integrated security scanning, policy-enforced approvals, and runner administration.
• Experience implementing gated DevSecOps controls in CI/CD that block on security findings, enforce approvals, and produce auditable evidence.
• Hands-on Amazon EKS expertise, including cluster hardening, OCI-compliant image management, Helm, and GitOps deployment patterns using Argo CD or Flux.
• Proficiency in Terraform for pipeline, runner, and cluster infrastructure, including modular design, state management, and multi-environment promotion.
• Working understanding of security compliance frameworks and how they translate into technical controls and pipeline security gates in cloud environments.
• Scripting proficiency in Python or Bash for operational automation and security tooling.
• Current AWS Certified DevOps Engineer – Professional or AWS Certified Security – Specialty certification.
• Ability to work effectively in remote, cross-functional teams, meet deadlines, and produce quality work with clear written communication.
• Proficiency with Microsoft Suite software, including Outlook, Word, Excel, SharePoint, and PowerPoint.
• Ability to obtain and maintain a Secret clearance.

Nice To Haves

• At least 10 years of overall experience in technology and software engineering, demonstrating senior-level breadth beyond DevSecOps.
• Direct experience with GitLab Ultimate security and compliance features, including scan execution and merge request approval policies, compliance frameworks, vulnerability management and security dashboards, and GitLab Runner administration.
• Experience administering self-managed GitLab or GitLab Dedicated for Government in GovCloud or another isolated or restricted-egress environment, including upgrades, backups, and instance hardening.
• Experience migrating organizations from GitHub or GitHub Actions, including GitHub Advanced Security, to GitLab Ultimate.
• Experience delivering software in FedRAMP High or DoD IL4/IL5 environments, including STIG- and CIS-compliant container images and pipeline controls mapped to NIST SP 800-53.
• Supply-chain security experience with SLSA, Sigstore/cosign artifact signing, SBOM management, and dependency provenance.
• Experience supporting ML/AI platforms, such as model serving, GPU workloads, Amazon Bedrock integrations, or data pipelines, in regulated environments.
• Experience with CI/CD and application secrets management using AWS Secrets Manager or HashiCorp Vault; policy-as-code tools such as OPA or Kyverno; and Kubernetes admission control.
• Additional AWS certifications such as Solutions Architect or SysOps Administrator, or Kubernetes certifications such as CKA/CKS.
• Active Secret clearance.

Responsibilities

• Design, implement, and operate enterprise-grade GitLab CI/CD pipelines, including multi-project and parent-child orchestration, environment promotion gates, protected branches and environments, and reusable templates and CI components.
• Deploy, configure, and tune GitLab Ultimate security features as pipeline gates, including SAST, DAST, secret detection and push protection, dependency and container scanning, IaC scanning, license compliance, and API security.
• Triage security findings through GitLab vulnerability management dashboards and merge request security widgets.
• Enforce centralized security using scan execution policies, merge request approval policies, compliance frameworks, and compliance pipelines.
• Provide pipeline and software supply-chain audit evidence to the Cloud Security Engineer for ATO, POA&M, and continuous-monitoring activities.
• Generate and manage SBOMs, enforce dependency and license policies, sign and verify build artifacts and container images, and maintain a traceable path from commit to production.
• Architect and operate GitLab Runner fleets in GovCloud, including autoscaling, isolation, and hardened images.
• Work with Cloud Operations and Cloud Security Engineers to implement keyless OIDC authentication from GitLab to AWS IAM roles, avoiding long-lived cloud credentials in CI.
• Manage lifecycle, networking, and security for production Amazon EKS clusters.
• Orchestrate deployments using Helm and GitOps tooling such as Argo CD or Flux; harden registries and OCI image workflows.
• Lead migration of repositories, pipelines, and integrations from GitHub and GitHub Actions to GitLab, including workflow translation, secrets strategy, branch-protection parity, and developer enablement.
• Mentor engineers on secure delivery practices, write runbooks and pipeline documentation, and partner with the Cloud Security Engineer on control implementation and assessment support.

Benefits

• Competitive salary and benefits.
• SmartBenefits through the Washington Metro Area Transportation Authority, allowing employees to direct a specified amount of pre-tax wages to a SmarTrip account.
• Tuition assistance may be available in some cases for continuing education expenses and certifications related to the position.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior