Cloud Engineer

Mechanicode; Washington (District of Columbia, MD); Hybrid; USD 130,000 - 180,000; Full time

Job summary

Mechanicode is seeking a mid-level Azure DevSecOps Engineer to weave security into the SDLC for federal systems. You will work across Java applications and Terraform-managed infrastructure to design, build, and troubleshoot secure CI/CD pipelines in a hybrid on-prem/cloud environment.

Responsibilities include integrating SAST/DAST/SCA, enforcing quality gates, and collaborating with developers, operations, security, and product stakeholders to catch vulnerabilities early while maintaining strong

Qualifications

• 4+ years across software development, IT operations, and security (DevSecOps, DevOps, SRE, or similar)
• Hands-on Java development experience
• Hands-on Terraform experience provisioning and managing cloud infrastructure as code
• Experience building and maintaining CI/CD pipelines with integrated security scanning, versioning, and automated testing
• Experience working in hybrid environments (on-prem plus one or more cloud platforms)
• Working knowledge of security frameworks and principles such as Zero Trust, AppSec, NIST 800-53 control families, and audit and logging requirements (OMB M-21-31)
• Strong written and verbal communication skills, including experience briefing senior-level stakeholders
• Bachelor's degree in computer science, engineering, or a related field, or an equivalent combination of education and experience
• Ability to pass a background check and obtain a public trust security clearance

Responsibilities

• Design, build, configure, and monitor the DevSecOps toolchain and CI/CD pipelines for Java applications.
• Provision and manage cloud and on-prem infrastructure using Terraform, applying security best practices.
• Integrate security testing tools (SAST, DAST, SCA, fuzz testing) into pipelines to detect vulnerabilities early.
• Help define and carry out the automated testing strategy across pipelines, covering functional, performance, and security tests.
• Define and implement test coverage metrics, quality gates, and pass/fail criteria that enforce security and compliance standards.
• Enable product teams to create and maintain their own test plans, test data, and test cases, and drive "shift-left" testing practices.
• Maintain traceability between work items, code, test cases, security requirements, risk mitigations, and releases.
• Document test processes, test data management, automated test infrastructure, and standard operating procedures.
• Report on testing outcomes, vulnerabilities, and quality trends to engineers, oversight managers, and leadership.
• Research emerging DevSecOps tools and practices and share them with the team and wider development community.

Skills

DevSecOps experience

Java development

Security concepts

Strong communication

Education

Bachelor's degree in CS/Engineering or equivalent

Tools

Terraform

SAST

DAST

SCA

Fuzz testing

CI/CD tooling

Kubernetes security scanning

Logging/Observability tools

Job description

We are looking for a mid-level Azure DevSecOps Engineer to build security and automated testing into every phase of the software delivery lifecycle for federal systems. Java and Terraform are central to this position: the engineer will work across Java application codebases and Terraform-managed infrastructure to design, build, and troubleshoot secure CI/CD pipelines in a hybrid environment spanning on-prem and multiple clouds. The role involves close collaboration with developers, operations, security teams, and product stakeholders to integrate scanning and testing tools, enforce quality gates, and help teams catch vulnerabilities early.

This position is expected to start at the end of December 2026.

• Identity verification will happen at multiple stages of the interview process to adhere to federal compliance
• This role is based in the US for a US work-authorized person

Required

• Must be a U.S. citizen or green card holder
• Must be based in the Washington metropolitan area (DC, Maryland, or Virginia)
• 4+ years of experience across software development, IT operations, and security (DevSecOps, DevOps, SRE, or similar roles)
• Hands-on Java development experience, including building, testing, and securing Java applications
• Hands-on Terraform experience provisioning and managing cloud infrastructure as code
• Experience building and maintaining CI/CD pipelines with integrated security scanning, versioning, and automated testing
• Experience working in hybrid environments (on-prem plus one or more cloud platforms)
• Working knowledge of security frameworks and principles such as Zero Trust, AppSec, NIST 800-53 control families, and audit and logging requirements (OMB M-21-31)
• Strong written and verbal communication skills, including experience briefing senior-level stakeholders
• Bachelor's degree in computer science, engineering, or a related field, or an equivalent combination of education and experience
• Ability to pass a background check and obtain a public trust security clearance

Key Responsibilities

• Design, build, configure, and monitor the DevSecOps toolchain and CI/CD pipelines for Java applications.
• Provision and manage cloud and on-prem infrastructure using Terraform, applying security best practices.
• Integrate security testing tools (SAST, DAST, SCA, fuzz testing) into pipelines to detect vulnerabilities early.
• Help define and carry out the automated testing strategy across pipelines, covering functional, performance, and security tests.
• Define and implement test coverage metrics, quality gates, and pass/fail criteria that enforce security and compliance standards.
• Enable product teams to create and maintain their own test plans, test data, and test cases, and drive "shift-left" testing practices.
• Maintain traceability between work items, code, test cases, security requirements, risk mitigations, and releases.
• Document test processes, test data management, automated test infrastructure, and standard operating procedures.
• Report on testing outcomes, vulnerabilities, and quality trends to engineers, oversight managers, and leadership.
• Research emerging DevSecOps tools and practices and share them with the team and wider development community.

Nice to Haves:

• Experience with additional languages or technology stacks beyond Java
• Experience with IT Service Management (ITSM) practices alongside Agile delivery
• Experience with container and Kubernetes security scanning
• Experience with observability and logging platforms (Splunk, Elastic, Grafana, Prometheus)
• Experience using agentic coding tools (Claude Code, Codex, GitHub Copilot) for applications or infrastructure automation
• Security, cloud, or Terraform certifications (Security+, CISSP, AWS, Azure, HashiCorp)