Lead DevSecOps Engineer

The role

The Lead DevSecOps / SRE leads the program's delivery-security function and is accountable for keeping the deployed system secure, compliant and running. The role also carries a defined share of platform engineering: day-to-day operation of the GovCloud landing zone, and DynamoDB administration.

Readiness Next is an offline-first PWA for Army personnel and equipment accountability. It deploys to AWS GovCloud in the ECMA cARMY environment: production at DoD Impact Level 5 first, then an IL6 follow-on in the AWS Secret Region. The back end consists of roughly 26 TypeScript Lambda domains on DynamoDB, EventBridge and SQS, deployed as an AWS SAM application of 13 nested stacks.

The incumbent owns

the CI/CD and software supply chain across GitHub and GitLab• signed and attested builds, and the SBOM, CBOM and AI-BOM gates• secrets and key management• STIG and compliance automation that feeds the RMF/cATO package• the reliability of the production serverless stackThrough month 9, an AWS Professional Services ECMA engineer builds the landing zone with this role. This role owns the landing zone after that handoff.Major duties and responsibilitiesLeadership• Lead the DevSecOps and SRE function. Set pipeline, release and on-call standards, and review all infrastructure and pipeline changes, including AI-authored ones.• Mentor the developers who contribute CI and infrastructure code.• Own the delivery-security roadmap and give every reliability or pipeline gap a named owner.• Report pipeline health, deployment frequency, change-failure rate, mean time to restore and SLO attainment to the Technical Lead and the Government.• Serve as the primary technical liaison to the cybersecurity/RMF team.Continuous integration (GitHub)• Design and maintain GitHub Actions workflows across the npm-workspace monorepo. Lanes cover unit, browser, quality ratchets, serverless CI and deployment, client deployment, image builds, API documentation and a per-pull-request bill-of-materials gate.• Design CI to be cost-aware: expensive lanes run on demand, and live-engine suites run locally rather than in hosted service containers.• Own the container supply chain. Images are published to GitHub Container Registry on a node:26-alpine base and signed with cosign attestations. Lambda bundles are signed through AWS Signer and enforced by a code-signing configuration.• Maintain the SBOM, CBOM (CycloneDX 1.7, with a CNSA 2.0 gap analysis) and AI-BOM generators and their gates.• Manage dependencies: GitHub Packages for shared packages, Dependabot triage, and a runtime gate that confirms every Lambda-bundled dependency supports the Node 24 runtime.Deployment and dynamic testing (GitLab)• Operate the GitLab Ultimate deploy plane for the GovCloud test environments, including GitLab DAST and API fuzzing.• Carry signed artifacts built in GitHub into GitLab-run deployments, and prove at deploy time that the artifact is the one CI built.• Keep deployment a parameterized capability, so the same signed artifact deploys from GitHub, GitLab or an operator workstation.Security automation• Integrate and tune SAST, DAST, SCA, secret scanning and container image scanning. Feed findings into pull-request gates and the evidence trail.• Automate DISA STIG validation and OPSEC checks, and generate hardening evidence for RMF controls.• Manage secrets, certificates and key rotation (KMS customer-managed keys, Secrets Manager, SSM Parameter Store). This covers JWT signing keys, PII field-encryption keys, integration credentials (CAC/mutual TLS, OAuth2, API keys, SSH keys), and FIPS 140-3 posture.• Maintain AWS WAF, API Gateway request validation, and least-privilege IAM for every function.Site reliability• Define service-level indicators and objectives for the API and synchronization paths. Own the CloudWatch alarm set (about 45 alarms and 20 metric filters), SNS routing, dashboards and X-Ray tracing.• Lead incident response: on-call rotation, runbooks, blameless postmortems, and automation for common failure modes. These include dead-letter queue redrive, EventBridge archive replay, throttling and cold-start regressions.• Own release safety: Lambda versions and aliases, staged rollout, rapid rollback, and the parity cutover from the legacy service to Lambda.• Manage capacity and cost against the program cost model, and enforce the resource tagging standard.• Keep the LocalStack Pro development environment a faithful proof of the production stack.Platform engineering: landing zone• Operate and extend the GovCloud landing zone with the AWS Professional Services engineer through month 9, then own it after the handoff. This covers:o multi-account structure and account vending (Control Tower / Landing Zone Accelerator)o service control policies and IAM Identity Center federationo centralized CloudTrail, AWS Config and log archiveo Security Hub and GuardDuty findings flowo ECMA cARMY tenant tasks• Maintain the network baseline: VPC, private subnets, NAT, about 14 VPC endpoints and security groups, keeping service traffic off the public internet.• Keep account baselines defined in infrastructure as code and checked for drift. No manual changes in boundary accounts.Platform engineering: DynamoDB administration• Administer the program's tables: on-demand capacity, global secondary indexes, time-to-live, Streams (feeding the record-versioning mirror) and KMS encryption.• Own backup and recovery:o confirm 35-day point-in-time recovery on every tableo take on-demand backups before risky migrationso rehearse a point-in-time restore to a new table, with cut-overo use export to S3 for analytics and evidence• Monitor throttling, hot partitions, consumed capacity, stream iterator age and replication latency. Take access-pattern problems to the developers who own the data model.• Apply fine-grained IAM and deletion protection, and plan the use of Global Tables for multi-region production.AI-augmented delivery and compliance• Build guardrails that hold AI-generated code to the same security bar as hand-written code: review gates, test enforcement, and provenance and AI-BOM evidence.• Use AI tooling (Claude Code, Amazon Q) to author workflows, infrastructure code, STIG remediation and compliance-as-code, and review all of it before it gates a build.• Work with the RMF team to turn automated scan output into control evidence, and maintain the OSCAL/ConMon evidence feed that supports continuous ATO.• Keep pipelines and runbooks operable in SCIFs, where AI tooling is not available.

Lead DevSecOps Engineer

The role

Lead DevSecOps Engineer

The role

What you need

Nice to have

The incumbent owns

Working at DMI

* No Agencies Please *

About Careers Dminc

Similar jobs at other companies

System Requirements Engineer, In-Cabin Perception

Senior Technical Program Manager, Active Learning Loop

バックエンドエンジニア・Robot Platform Software

データエンジニア・City Data Platform Development（障害者雇用）

システム要求エンジニア・In-Cabin Perception

Backend Software Engineer, Robot Platform Software

Interview questions

Careers Dminc

The role

The role

What you need

Nice to have

The incumbent owns

Working at DMI

***************** No Agencies Please *****************

About Careers Dminc

Similar jobs at other companies

Interview questions

* No Agencies Please *