Dev/Sec Ops Engineer

All Native Group; Washington (District of Columbia); On-site; USD 120,000 - 165,000; Full time

Job summary

All Native Group is seeking a Mid-Level DevSecOps Engineer to augment the Congressional Budget Office's engineering team and mature its automation, CI/CD, and security-driven delivery practices. You will work in a production, hybrid-cloud environment and extend existing patterns while adhering to change control.

The role emphasizes infrastructure as code, container orchestration, and policy-based security across the delivery lifecycle, with emphasis on compliance and documentation.

Qualifications

• 5+ years of DevSecOps or infrastructure automation experience.
• Hands-on experience with Terraform/OpenTofu, Ansible, and GitHub Actions.
• Working experience with Docker, Kubernetes, Helm, and container security scanning.
• Experience with SAST tooling, secrets scanning, and policy tooling (OPA/Rego).
• Federal or highly regulated environment experience preferred.

Responsibilities

• Maintain, extend, and refactor Terraform/OpenTofu codebases and modular configurations.
• Develop and maintain Ansible playbooks for configuration, compliance, and deployment.
• Build and improve GitHub Actions workflows with security gates (SAST, secret scanning).
• Support container delivery using Docker and Kubernetes; create hardened images and Helm charts.
• Enforce CIS benchmarks and NIST 800-53 in the delivery lifecycle; support audits.
• Follow change advisory process; document runbooks and compliance artifacts.
• Participate in stand-ups, sprints, and knowledge transfer with staff.

Skills

IaC/Configuration-as-Code

CI/CD with security gates

Container hardening

Policy-as-code & secrets

Collaborative engineering

Education

Bachelor's degree in CS/IT or related field

Tools

Terraform

OpenTofu

Ansible

GitHub Actions

Docker

Kubernetes

Helm

Trivy/Grype

Semgrep/Checkov

Job description

Summary

All Native Group, a division of Ho Chunk, Incorporated, is seeking an exceptional Mid‑Level DevSecOps Engineer to augment the Congressional Budget Office's (CBO) engineering team and mature its infrastructure automation, CI/CD pipeline, container orchestration, and security‑hardened delivery practices. The engineer inherits established patterns and incrementally enhances capabilities within an active production, hybrid‑cloud environment.

Essential Functions

• Maintain, extend, and refactor Terraform and OpenTofu codebases, including modular configurations, remote state, and backend management within approved change control.
• Develop and maintain Ansible playbooks and roles for configuration, compliance enforcement, patch management, and application deployment.
• Build and improve GitHub Actions workflows with security gates including SAST, dependency scanning, secrets detection, and policy‑as‑code validation.
• Support containerized delivery using Docker and Kubernetes, authoring hardened images, manifests, and Helm charts, with vulnerability scanning prior to deployment.
• Integrate Shift‑Left security throughout the delivery lifecycle, enforcing CIS benchmarks and CBO baselines and supporting NIST SP 800-53 and FISMA compliance.
• Work within CBO's version control, change management, and peer review workflows; push no changes to production without following the change advisory process.
• Produce and maintain documentation, runbooks, and compliance artifacts to support audits and assessments.
• Participate in stand‑ups, sprint planning, and technical reviews, and conduct knowledge transfer with CBO engineering staff.

Competencies

• Strong Infrastructure‑as‑Code and Configuration‑as‑Code skills.
• CI/CD pipeline engineering with integrated security gates.
• Container hardening and orchestration proficiency.
• Familiarity with policy‑as‑code and secrets management.
• Collaborative, standards‑driven engineering approach.

Experience

• Minimum of 5 years of DevSecOps or infrastructure automation experience.
• Hands‑on experience with Terraform/OpenTofu, Ansible, and GitHub Actions.
• Working experience with Docker, Kubernetes, Helm, and container security scanning (Trivy, Grype, or equivalent).
• Experience with SAST tooling (Semgrep, Checkov, tfsec), secrets scanning (Gitleaks, Detect‑Secrets), and OPA/Rego.
• Federal or highly regulated environment experience preferred.

Education

Bachelor's degree in Computer Science, Information Technology, or a related field, or equivalent professional experience.

Additional Eligibility Qualifications

No specific certification is required. Certified Kubernetes Administrator (CKA) or HashiCorp Terraform Associate is preferred.

Security Clearance

Must be a U.S. citizen or permanent resident. Position requires a Public Trust Tier 2 clearance, obtained through a U.S. Capitol Police background check, prior to accessing the CBO network.

AAP/EEO Statement

All Native Group is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or status as a protected veteran. However, preference may be extended to persons of Indian descent in accordance with applicable laws.