AWS DevSecOps Engineer

PhoenixTeam; United States; Remote; USD 140,000 - 180,000; Full time

Job summary

PhoenixTeam in the United States is seeking an AWS DevSecOps Engineer to build, secure, and operate AWS environments and automated delivery pipelines across client and internal apps. This is a hands-on production engineering role spanning infrastructure as code, container deployment, CI/CD, security controls integrated into releases, reliability, and incident recovery.

The engineer uses shared Platform patterns to make deployment repeatable rather than relying on one-off application setups.

Qualifications

• 5+ years of hands-on DevOps/DevSecOps experience with production responsibility.
• Strong AWS production experience (VPC, IAM, ECS/EKS, RDS, CloudWatch).
• Experience deploying containerized workloads with Docker and IaC using Terraform, CDK, or CloudFormation.
• Proven CI/CD pipelines ownership with automated testing, security gates, release promotion, debugging, and rollback.
• Experience integrating SAST/DAST/ SCA into delivery workflows.
• Scripting in Python, Bash, or Go and validating generated scripts.
• Knowledge of least-privilege, encryption, secret handling, and NIST 800-53 or similar controls.
• Ability to supervise AI-assisted engineering workflows with clear communication.

Responsibilities

• Build and operate AWS infrastructure using Terraform, CDK, or CloudFormation.
• Implement platform patterns and multi-account guardrails.
• Own CI/CD pipelines as code with GitHub Actions, CodePipeline, etc.
• Embed security checks (SAST, DAST, SCA) into release stages.
• Apply least-privilege access and secret management.
• Design playbooks for hardening, testing, provisioning, deployment.
• Support blue/green and canary deployments with rollout metrics.
• Maintain logs, metrics, health checks, alerts, and on-call readiness.
• Collaborate with engineers, QA, and client security teams to explain decisions.

Skills

AWS

DevSecOps

CI/CD

SRE practices

Scripting

Security controls

Communication

Education

AWS certification

Tools

Terraform

AWS CDK

CloudFormation

Docker

GitHub Actions

CodePipeline

Job description

Overview

The AWS DevSecOps Engineer builds, secures, and operates the AWS environments and automated delivery pipelines that PhoenixTeam uses for internal and client applications. This is a hands-on production engineering role spanning infrastructure as code, container deployment, CI/CD, security controls integrated into releases, reliability, and incident recovery. The engineer uses shared Platform patterns to make deployment repeatable rather than relying on one-off application setups.

Overview

The AWS DevSecOps Engineer builds, secures, and operates the AWS environments and automated delivery pipelines that PhoenixTeam uses for internal and client applications. This is a hands-on production engineering role spanning infrastructure as code, container deployment, CI/CD, security controls integrated into releases, reliability, and incident recovery. The engineer uses shared Platform patterns to make deployment repeatable rather than relying on one-off application setups. Agentic orchestration is a primary delivery approach: the engineer designs, supervises, and verifies AI-assisted workflows for testing, hardening, containerization, infrastructure provisioning, and deployment. Success depends on independent AWS, DevSecOps, and security judgment—especially when generated scripts or configurations are wrong. The goal is to improve speed and reliability from prototype through production without bypassing security reviews or release controls.

Key Functions

• Build and operate AWS infrastructure using Terraform, AWS CDK, or CloudFormation, including VPC networking, IAM, ECS/Fargate or EKS, RDS, load balancing, KMS, Secrets Manager, S3, and CloudWatch.
• Implement application infrastructure within shared Platform patterns; support multi-account controls using AWS Organizations, Control Tower, service control policies, or comparable guardrails.
• Own build, test, approval, and deployment pipelines as code using GitHub Actions, Forgejo Actions, AWS CodePipeline, or comparable tools; create reusable, documented workflows.
• Embed SAST, DAST, software-composition/dependency, container-image, and infrastructure-as-code scanning in release stages; maintain blocking criteria and accelerate risk acceptance and exceptions to authorized decision-makers.
• Apply least-privilege IAM, encryption, secrets handling, network isolation, and controlled production access; constrain what automation and AI agents can access or change.
• Design and verify agent-executable playbooks for hardening, testing, provisioning, and deployment; independently review and test generated code, infrastructure definitions, and security evidence.
• Support blue/green or canary deployment and tested rollback; use lead time, deployment frequency, failure rate, and recovery metrics to improve reliable release delivery.
• Implement logs, metrics, tracing, health checks, alerts, and cost visibility; participate in a rotating on-call schedule, respond to incidents, and contribute to post-incident reviews and runbooks.
• Use AWS security and audit tooling such as Security Hub, GuardDuty, Config, CloudTrail, Inspector, and IAM Access Analyzer as applicable; remediate findings and support relevant evidence needs.
• Work with application engineers, Platform, QA/verification, and client security stakeholders to support secure handoffs and explain deployment decisions, controls, and human verification.

Minimum Qualifications

• 5+ years of hands-on DevOps, DevSecOps, site reliability, or platform engineering experience, including production responsibility, infrastructure automation, and deployment or incident recovery.
• Strong production AWS experience spanning VPC/networking, IAM, ECS or EKS, RDS, KMS, secrets management, CloudWatch, and CloudTrail.
• Experience deploying containerized workloads with Docker and building production infrastructure as code using Terraform, AWS CDK, or CloudFormation.
• Experience owning CI/CD pipelines as code, including automated testing, security gates, release promotion, troubleshooting, and rollback.
• Hands‑on experience integrating SAST, DAST, SCA/dependency, container, and infrastructure-as-code security checks into delivery workflows.
• Ability to script automation in Python, Bash, or Go and independently validate generated scripts and infrastructure configurations.
• Practical understanding of least‑privilege access, encryption, secure credential handling, and NIST SP 800-53 or a comparable security‑control framework.
• Ability to supervise and verify AI‑assisted engineering workflows with independent judgment; clear written and verbal communication with technical and non‑technical partners.

Preferred Qualifications Or Skills

• Experience with LLM‑assisted or multi‑agent engineering automation, including Amazon Bedrock or comparable orchestration tools.
• AWS multi‑account landing‑zone expertise; policy‑as‑code or guardrails using OPA, Checkov, cfn‑guard, SCPs, or comparable controls.
• Experience supporting SOC 2 or other applicable commercial security assessments and automated audit evidence.
• Relevant AWS professional, cloud security, or security engineering certification.
• Client‑facing delivery in mortgage, financial services, or another regulated industry; experience mentoring engineers in reliable pipeline practices.

Position Details

• Employment type: Full‑Time, W2 employee; not a contract or 1099 position.
• Work arrangement: Remote‑first, with flexible arrangements and collaboration across engineering and client teams.
• On‑call: Participation in a rotating schedule to support production systems and incident response is required; coverage details will be discussed during hiring.
• Travel: Up to 10% may be required based on business or client needs.

About PhoenixTeam

PhoenixTeam partners with organizations to deliver real results across GenAI, data, product, and technology. We help clients modernize legacy systems, redesign complex workflows, and move practical AI and digital solutions into production in regulated environments.

PhoenixTeam is an Equal Opportunity Employer. We consider qualified applicants without regard to race, color, religion, sex, national origin, age, disability, genetic information, protected veteran status, or any other status protected by applicable law.