Senior DevSecOps Platform Engineer

Description

The company serves the US federal government, working with defense, national security, public safety, civilian, and military health clients. It has more than 13,000 people.

The team builds and runs the cloud platform on AWS, using Kubernetes (EKS), a fully GitOps deployment model, and infrastructure defined entirely as code.

The environment is FISMA-Moderate and is moving toward a multi-account federal landing zone, so the work sits where platform engineering, security, and compliance meet.

This is a senior role on a small team built on trust. Infrastructure changes go through code and pipelines, not tickets or manual console work, and the team expects that standard from everyone.

You will own the path from a Terraform plan to a running, verified, signed workload, and that path must hold up under an ATO review.

Responsibilities

• Own Terraform across a multi-environment, multi-account AWS estate, covering modules, state, and bringing live infrastructure under code safely.
• Operate Amazon EKS clusters yourself, including networking, autoscaling, add-ons, workload identity, and cluster lifecycle.
• Run and extend the ArgoCD GitOps model, where a merge becomes a deployment, so the review gate and verification loop are reliable.
• Build and harden GitLab CI/CD pipelines with security scanning, secrets detection, policy-as-code, container image scanning and signing, and the evidence trail that goes with them.
• Strengthen security and compliance against NIST 800-53, covering least-privilege IAM, network isolation, continuous monitoring, and the artifacts needed for an Authority to Operate.
• Help design the move to a federal multi-account landing zone, including identity, cross-account networking, and promotion between environments.
• Mentor mid-level and junior engineers, and set a higher standard for change control, review discipline, and evidence-based engineering.

Requirements

• At least 7 years in infrastructure, platform, or DevOps work, with senior ownership of production systems.
• Deep hands-on Terraform experience: reusable modules, managed remote state, and resolving drift between code and live infrastructure without causing outages.
• Strong AWS skills across VPC and networking, IAM, EKS, RDS/Aurora, S3, CloudFront, and Secrets Manager.
• Experience running Kubernetes or EKS at production scale, including workload identity (Pod Identity or IRSA), Helm, autoscaling, ingress, and load balancing.
• Experience with GitOps (ArgoCD or Flux) and CI/CD pipeline engineering. GitLab CI is strongly preferred.
• Practical DevSecOps experience with SAST, container, IaC, and secrets scanning, plus policy-as-code using OPA or conftest, and the discipline to make security gates enforce.
• Nice to have: experience designing multi-account AWS landing zones with Control Tower or Organizations.
• Nice to have: working knowledge of a federal compliance framework such as FISMA, NIST 800-53, or RMF, and what it takes to support an ATO.
• Nice to have: container supply-chain security, including SBOMs, image signing with Notation or AWS Signer, and admission control.
• Nice to have: observability experience with CloudWatch, Grafana, or both.
• Nice to have: FedRAMP or GovCloud exposure.
• Nice to have: background in weather, geospatial, or scientific-data domains.

Conditions

The base pay range is $129,800 - $194,300 USD for roles in California, Colorado, Connecticut, Hawaii, Illinois, Maine, Maryland, Massachusetts, Minnesota, New Jersey, New York, Ohio, Vermont, Virginia, Washington, and the District of Columbia, as required by local law.

Final pay depends on location, role, skill set, and experience.

Applications are accepted on an ongoing basis, with no fixed deadline.

The company is committed to equal opportunity and a culture where everyone feels respected and included.

Benefits

• A broad range of benefits is offered.
• Support for growth through hands-on experience, certifications, and industry training.