Staff DevSecOps Engineer

Location: US - remote with travel (up to 50%). 

Clearance: Active US Department of War (DoW) or Intelligence TS required.

Legion Intelligence is the agent workspace where national security work comes back done. Legion runs on the systems and networks mission teams already use, including classified networks and places with no connection at all.

Each Legion Pack is set up for a specific job, so the reports, plans, and work orders teams build by hand arrive finished and ready to approve. People decide who can act, on what data, and when. Agents do the work. You stay in charge.

We’re looking for a Staff DevSecOps Engineer who will set technical direction across Platform DevOps and customer delivery. You will shape the engineering systems and practices that take Legion from development to dependable operation, enabling teams to deliver improvements faster and customers to realize mission value sooner.

Job Description:

This position requires a US DoW or Intelligence TS/SCI clearance.

As a Staff DevSecOps Engineer on the Mission Engineering team, which also owns Platform DevOps, you will provide technical leadership across internal build and release systems, platform operations, and customer deployments. You will work directly with customer mission owners, IT teams, and security stakeholders to understand their needs, achieve technical alignment, and deliver Legion into their operating environments. You will define the architecture and improvement roadmap for this domain and lead complex initiatives from problem definition through deployment, adoption, and measured results. Your scope includes internal CI/CD, observability and alerting, vulnerability posture, deployment automation, and production reliability. You will translate mission needs and operating constraints into technical decisions, resolve tradeoffs across teams, and turn recurring delivery barriers into durable improvements to Legion. You will remain hands-on in delivering the platform to customers while guiding engineers and establishing practices that make the whole team more effective.

Responsibilities:

• Set and drive the technical roadmap for Platform DevOps and customer deployment engineering. Identify the constraints that most limit delivery of mission value, build the case for investment, and lead improvements with clear outcomes for delivery speed, reliability, and security.
• Own technical alignment with customer stakeholders throughout delivery. Lead architecture and readiness discussions with mission owners, IT teams, and security reviewers; agree on deployment approach, integration requirements, responsibilities, and acceptance criteria; and resolve technical disagreements and dependencies with clear decisions and follow-through.decisions, integrations, and accelerate implementation.
• Define the architecture and standards for repeatable deployment and lifecycle automation across internal and customer environments. Lead adoption of reusable approaches for provisioning, configuration, upgrades, backups, and patching using Kubernetes, Flux, Terraform, Helm, Docker, and related technologies.
• Lead the architecture for integration with customer identity and access systems. Resolve complex authentication and authorization requirements with customer and product engineering stakeholders, and establish patterns that future deployments can reuse.
• Own the technical direction and effectiveness of internal CI/CD and release infrastructure. Lead improvements to build reliability, automated validation, artifact integrity, and release promotion so engineering teams can deliver changes safely and consistently.
• Own the technical strategy for vulnerability posture across platform infrastructure, deployment artifacts, and third-party containers and dependencies. Establish risk-based prioritization, remediation expectations, and visibility into outstanding exposure; drive fixes with engineering and security owners and verify their closure.
• Provide technical leadership during complex incidents and investigations. Guide diagnosis across system boundaries, coordinate customer and engineering stakeholders, and ensure root-cause findings lead to lasting architectural and operational improvements.
• Lead the technical approach to deployment authorization and security evidence. Translate Authorization to Operate (ATO), Certification to Field (CTF), and Risk Management Framework (RMF) requirements into engineering work, and establish repeatable ways to produce and maintain the required evidence.

Qualifications:

• An active US DoW or Intelligence TS/SCI clearance.
• A BS degree or higher in Computer Science, Engineering, or related fields.
• CompTIA Security+ Certification.
• 6+ years of experience in DevOps, DevSecOps, or software engineering, with demonstrated technical leadership of complex initiatives. Ability to set architectural direction, guide engineers across teams, and translate customer and engineering needs into delivery priorities and measurable outcomes. 
• Proven experience engaging directly with customer technical and mission stakeholders, explaining architectural tradeoffs, achieving agreement on delivery plans, and taking hands-on responsibility for deploying software into customer environments.
• 4+ years of experience deploying software and/or managing software deployments in US Government classified networks.
• Strong working knowledge of cloud infrastructure and infrastructure as code (e.g., Terraform), including networking, load balancing, IAM, compute, and storage in those environments.
• Deep production experience with Kubernetes, Linux, and Helm. Ability to lead diagnosis and architectural decisions across cluster networking, storage, RBAC, operators and CRDs, upgrades, availability, and resource constraints.
• Experience designing and evolving GitOps delivery systems using tools such as FluxCD and Kustomize, including reconciliation, environment configuration, release promotion, rollback, and drift management.
• Experience owning internal CI/CD infrastructure, such as GitLab pipelines, self-hosted runners, and container registries. Ability to establish reusable pipelines, protect releases and credentials, and coordinate delivery across services.
• Experience designing secure, reproducible container builds using Docker and tools such as BuildKit or Buildx, including AMD64/ARM64 builds, image digests, build caching, and artifact promotion.
• Experience defining and improving software supply-chain security and vulnerability posture. Ability to integrate code, dependency, container, secret, and infrastructure scanning into software development lifecycles, prioritize remediation, and establish SBOM, signing, and attestation practices.
• Strong understanding of secure service networking and access controls. Ability to diagnose ingress, service communication, DNS, and TLS using technologies such as Istio and Kubernetes Gateway API; secure configuration and enforce least privilege through tools such as SOPS, Kyverno, and cloud IAM.
• Strong working knowledge of operating stateful services such as PostgreSQL, Elasticsearch, Qdrant, and S3-compatible storage. Ability to guide capacity planning, persistence, migrations, backups, restoration, upgrades, and failure recovery.
• Proficiency building maintainable automation in Python or Bash, with fluency in Git and YAML/JSON configuration. Ability to debug across infrastructure and application boundaries and turn recurring problems into reusable engineering improvements.
• Strong working knowledge of metrics, logs, traces, and incident diagnosis using tools such as Grafana, Prometheus, and OpenTelemetry. Ability to define service-level objectives, own actionable alerting, and guide improvements based on operational evidence.
• Strong working knowledge of authentication and identity federation using technologies such as Keycloak and OIDC/OAuth2, including token validation and service authorization. Ability to resolve identity issues across customer, platform, and application boundaries.
• Must be eligible to work in the US without sponsorship.

Preferred Qualifications:

• Experience designing packaging and delivery for restricted or disconnected environments using tools such as Defense Unicorns UDS Core or Zarf, including dependency bundles, SBOMs, attestations, and controlled publishing.
• Experience operating GPU workloads and model-serving infrastructure using technologies such as NVIDIA GPU Operator or vLLM, including scheduling, driver compatibility, GPU memory constraints, and inference capacity. 
• Experience applying these skills in a startup environment is also valuable.

Why Join Us: You will shape the engineering foundation that helps Legion reach customers and deliver mission value. Your work will influence both how our engineers build and release the product and how customers operate it on their own networks. This is a hands-on technical leadership role with room to drive architectural decisions, develop other engineers, and deliver improvements whose impact extends across deployments. We offer competitive compensation and benefits and support professional growth and development.