DevSecOps Project Lead (Sr DevSecOps Engineer)

As DevSecOps Lead you will build and operate the delivery platform for a new AI-enabled program in a government cloud environment: the CI/CD pipeline, the infrastructure it runs on, the security controls built into it, and the artifacts that pipeline produces to support authorization. The work spans modern commercial DevOps practice and the realities of DoW deployment at IL-5, and requires sound decisions across government networks, cloud environments, and container strategy.

This is a lead role that stays hands on keyboard. You will make the architecture calls and you will also build them. Security is engineered in from the first week rather than added at the end: the pipeline enforces hardened baselines, runs the scans, and generates control evidence on every commit. As the program ramps you will direct a small group of platform, cloud, and cyber engineers, and you will be the engineering counterpart to the customer's security and accreditation staff.

We need someone who can move immediately. An early deliverable puts a working platform into the government environment on a fixed date, and cloud accounts, network access, credentials, and approved service and image lists all arrive on the government's timeline rather than ours. This is a fully remote role with occasional travel (up to 25%) to DEFCON AI HQ, customer sites, and vendor facilities as required.

Key Responsibilities 

First Deliverable: Platform Into the Government Environment

• Own the initial platform deployment into the government IL-5 environment, which is the program's first contract deliverable and lands early.
• Build and prove the pipeline and infrastructure as code on our own cloud first, using portable templates, so deployment into the government environment is a port rather than a build.
• Deploy early and deliberately to surface the real network, security, and interface constraints while there is still time to design around them.
• Track and drive the government-side prerequisites this deliverable depends on: account and boundary provisioning, network path, certificates, approved service list, approved base-image source, container registry access, scanning-tool approvals, and package-repository egress policy.

Platform and Pipeline Ownership

• Own the CI/CD pipeline end to end: build, test, static and dynamic security analysis, software composition analysis, container and infrastructure-as-code scanning, SBOM generation, and gated promotion to production.
• Establish and operate development, test, and production environments in AWS GovCloud at IL-5.
• Build the platform so it is reusable across programs rather than rebuilt for each one.

Cloud and Infrastructure Architecture

• Make the architecture calls for the delivery platform: account and boundary structure, network path, identity integration, container strategy, and hardened base images.
• Work within an approved-service list and an approved base-image source, and drive those decisions to closure with the customer's cloud and security staff.
• Design for zero-downtime deployment and rehearsed rollback.
• Build observability into the platform: metrics, logging, tracing, and alerting sufficient to find and fix problems in production before users report them.
• Integrate CAC / PIV authentication and role-based access control.

Security Engineering and Authorization Support

• Implement security controls from week one and produce the control evidence continuously from the pipeline.
• Own the security artifact package: System Security Plan inputs, SBOMs, STIG and SCAP results, scan results, test coverage, audit trails, and pipeline gate definitions.
• Serve as the engineering counterpart to the customer's security and accreditation staff, and support the authorization decision on their timeline.
• Drive an evidence-based authorization approach in which the assessment consumes pipeline output directly rather than requiring the same information reassembled by hand.
• Absorb cyber and RMF responsibility for the program, with support from dedicated cyber staff as the team grows.

Release Management and Delivery Performance

• Own the release cadence, from capability intake through production deployment, on both commercial and government timelines.
• Establish and report delivery and reliability metrics: deployment frequency, lead time for change, change failure rate, and time to restore service.
• Secure standing release approval or an automated-change exemption so continuous delivery is operationally real and not just technically true.
• Integrate monitoring and alerting with the customer's network and security operations centers.

Technical Leadership

• Direct a small group of platform, cloud, and DevOps engineers as the program ramps, including partner and subcontractor staff.
• Set the standards the rest of engineering builds against: environment parity, branching, release hygiene, secrets handling, and infrastructure as code.
• Communicate clearly about status, risk, and tradeoffs, and escalate blockers early.

Required Qualifications 

• 8+ years of DevOps and DevSecOps engineering experience, including at least one production pipeline owned end to end at scale.
• 3+ years working in DoW or federal cloud environments at IL-4 or IL-5, or an equivalent authorized environment. AWS GovCloud strongly preferred.
• Hands-on keyboard while leading. You make the architecture calls and you build. This role is not a coordination or oversight function.
• Cloud and infrastructure depth: containers and orchestration (Docker, Kubernetes or equivalent), infrastructure as code (Terraform, CloudFormation, or similar), and CI/CD tooling on at least one major cloud, including hardened base images and image promotion
• Observability practice: you instrument what you build and use metrics and logs to drive improvements, rather than waiting on incident reports.
• Security built into delivery: you treat security scanning, compliance validation, and evidence generation as normal pipeline stages.
• Direct experience supporting an ATO, cATO, or equivalent authorization, including producing the artifacts an assessor actually accepts.
• A track record of standing something up under a hard deadline, in an environment where access, approvals, and accounts were outside your control. You have shipped a first deployment into a government environment on a fixed date, and you know what has to be in motion beforehand to make that possible.
• Ready on day one. The first deliverable comes early, so we need someone who arrives with a pipeline pattern they already know works and adapts it, rather than researching an approach from scratch.
• An owner: you drive work to done, communicate status and risk plainly, and do not need to be managed through the details.
• US Citizenship Required
• Active US Secret clearance. The work is performed in a controlled government cloud environment and requires a favorable investigation and CAC eligibility from the start.
• Willingness to travel up to 25% to customer sites, DEFCON AI HQ, and vendor facilities as required.

Preferred Qualifications

• Active TS/SCI Clearance
• Experience taking a program from an empty government cloud account to a deployed, authorized production system.
• Hands-on experience managing a complete ATO or cATO pathway in production, and familiarity with continuous authorization models.
• Working knowledge of DoW impact-level boundaries and the Cloud Computing SRG.
• Iron Bank container certification experience, and familiarity with STIG and SCAP tooling, ACAS, OpenSCAP, and FIPS requirements.
• Experience with AWS Bedrock or comparable managed inference services inside a government boundary, including model enablement and boundary constraints.
• Familiarity with government secure-software platforms such as Second Front (Game Warden), Stormbreaker, or Black Pearl.
• Experience integrating with enterprise ICAM or IdP services and DoD PKI.
• Experience working alongside partner or subcontractor engineering pods.
• Experience delivering into a high-volume federal case-processing or workflow environment handling sensitive personal data.

What Success Looks Like 

• A hardened pipeline deploying end to end within the first month, with security gates active and authorization evidence generating automatically, on our own infrastructure and ready to port.
• The platform deployed into the government IL-5 environment on schedule, with network, security, and integration constraints surfaced and worked rather than discovered later.
• Authorization evidence accepted by the customer's assessor as it is produced, rather than assembled into a package at the end.
• Zero critical or high vulnerabilities at delivery, with the pipeline enforcing that standard on every build.
• Application teams never blocked on environment or deployment, because the platform was ready before they needed it.
• A platform and a set of practices that get reused on the next program instead of rebuilt.