Automate secure environment provisioning, configuration, and deployments across development, test, and production AWS accounts, in line with cyber and IT risk management requirements.
Implement monitoring, logging, and alerting (CloudWatch, CloudTrail, centralized logging) to support secure, observable, and auditable delivery pipelines.
Integrate identity and access management, encryption, secrets management, vulnerability scanning, and compliance controls into CI/CD workflows as part of DevSecOps practices.
Ensure CI/CD pipelines and AWS solutions comply with applicable contractual and regulatory requirements (e.g., NIST 800‑53/171, CMMC, FedRAMP, ISO 27001) and internal cyber standards.
Collaborate with application development, cloud platform, cyber security, IT risk, and operations teams to ensure architectures are “DevSecOps-ready” and align with secure development standards.
Provide technical leadership, coaching, and documentation for project teams adopting DevSecOps and secure CI/CD practices; develop reusable secure pipeline templates and patterns.
Support proposals, technical reviews, and risk assessments where secure CI/CD, cloud security, and DevSecOps capabilities are required, including input to labor category mapping and staffing.
Basic Qualifications
Bachelor’s degree in Computer Science, Information Systems, Engineering, Cyber Security, or related field; or equivalent experience.
Typically 8+ years of relevant IT experience, with significant experience in DevOps/DevSecOps and CI/CD for production systems.
Hands‑on experience with AWS services (e.g., EC2, ECS/EKS, S3, IAM, VPC, CloudWatch/CloudTrail) in security‑sensitive or regulated environments.
Proven experience designing and operating CI/CD pipelines using one or more modern platforms (AWS CodePipeline/CodeBuild, Jenkins, GitLab CI, GitHub Actions, Azure DevOps).
Strong experience with infrastructure‑as‑code (e.g. CloudFormation, Terraform) and secure configuration management and automation.
Demonstrated experience promoting signed builds into an air-gapped, classified, or otherwise network-isolated target environment, including artifact transfer procedures and post-deployment verification.
Experience with containers and orchestration (e.g. Docker, ECS, EKS, Kubernetes) including security aspects (image scanning, runtime security, least privilege).
