DevSecOps Engineer

Cognizant; Phoenix (AZ); On-site; USD 100,000 - 155,000; Full time

Benefits offered by this job

Medical/Dental/Vision/Life Insurance

Paid holidays

401(k) plan

Paid Time Off

Employee Stock Purchase Plan

Parental Leave

Job summary

Cognizant is seeking a DevSecOps Engineer to lead infrastructure-as-code and CI/CD deliverables for the AIM project. You will design Terraform modules, manage HCP Terraform workspaces, and enforce least-privilege across AWS resources.

Responsibilities include building secure pipelines, managing secrets with Vault or AWS Secrets Manager, and conducting security reviews of infrastructure code. Strong emphasis on AI-assisted development tooling and human-in-the-loop practices.

Qualifications

• 5+ years hands-on Terraform experience including module writing and remote backends.
• HCP Terraform (Terraform Cloud) experience with VCS-driven workflows and plan/PRs.
• Experience with HCP Terraform private registry for internal modules.
• Strong AWS IAM knowledge: policies, roles, trust relationships, and SCPs.
• Experience with at least one secrets management platform: Vault or AWS Secrets Manager.
• Solid understanding of OIDC and federated identity in CI/CD and cloud access.
• Proven experience building CI/CD pipelines in GitHub Actions or GitLab CI/CD with environment promotion gates.
• Security-first mindset with emphasis on least-privilege and auditable controls.
• Experience with AI coding assistants (e.g., Amazon Q, GitHub Copilot) with validation practices.
• Commitment to human-in-the-loop processes and formal production gates

Responsibilities

• Design, build, and maintain reusable Terraform modules with clear interfaces and documentation.
• Manage and optimize HCP Terraform workspaces using VCS-driven workflows, variable sets, and run controls.
• Provision and manage AWS resources following least-privilege access and security best practices.
• Manage secrets and sensitive configuration with Vault or AWS Secrets Manager.
• Build and maintain CI/CD pipelines (GitHub Actions) integrated with HCP Terraform workflows.
• Conduct security reviews of infrastructure code and pipeline configurations.

Skills

Terraform

HCP Terraform

AWS IAM

Secrets management

OIDC / federated identity

CI/CD pipelines

GitHub Actions

GitLab CI/CD

Security-first mindset

AI coding assistants

Tools

HashiCorp Vault

AWS Secrets Manager

GitHub Actions

Terraform Cloud / HCP

Job description

DevSecOps Engineer Experience: 12+ years

Job Summary

We are looking for a DevSecOps Engineer who can lead our infrastructure-as-code and CICD deliverables for the AIM project and raise the bar on security across the AIM program. You will design and maintain Terraform modules consumed by multiple teams build secure CI/CD pipelines and ensure every provisioned resource follows least-privilege principles. You will work within HCP Terraform using VCS-driven workflows and help shape how the team adopts AI-assisted development tooling responsibly.

Responsibilities

What You’ll Do

• Design, build, and maintain reusable Terraform modules with clear interfaces, versioning, and documentation so other teams can self-serve infrastructure safely.
• Manage and optimize HCP Terraform workspaces using VCS-driven workflows — including workspace design, variable sets, run triggers and policy enforcement.
• Provision and manage cloud resources (primarily AWS) following least-privilege access patterns and security best practices.
• Manage secrets and sensitive configuration using HashiCorp Vault and/or AWS Secrets Manager.
• Build and maintain CI/CD pipelines (GitHub Actions) with proper gating, scanning, testing, and promotion workflows that integrate with HCP Terraform VCS-driven run model.
• Conduct security reviews of infrastructure code and pipeline configurations.

What You Bring

Must Have

• 5+ years of hands-on Terraform experience including writing modules with proper state management remote backends and provider configuration.
• Hands-on Experience with HCP Terraform (Terraform Cloud) specifically VCS-driven workflows — workspace configuration, speculative plans on PRs, run approvals and managing workspace variables/variable sets.
• Experience with HCP Terraform private registry for publishing and consuming internal modules.
• Strong understanding of AWS IAM — policies, roles, trust relationships, permission boundaries and service control policies.
• Hands-on Experience with at least one secrets management platform: HashiCorp Vault or AWS Secrets Manager.
• Solid understanding of OIDC and federated identity — how trust is established, token exchange, and practical application in CI/CD and cloud access.
• Proven experience building and maintaining CI/CD pipelines in GitHub Actions or GitLab CI/CD including environment promotion approval gates and artifact management.
• Security-first mindset — you default to deny scope permissions tightly and can articulate why.
• Hands-on Experience using AI coding assistants (Amazon Q, Kiro, GitHub Copilot or similar) with a clear understanding of when to trust, verify and override AI-generated output.
• Commitment to human-in-the-loop practices, code review, manual approval gates for production and treating AI output as a draft — never as the final word.

Nice to Have

• Experience with Sentinel within HCP Terraform.
• Knowledge of infrastructure testing tools.
• Contributions to internal developer platforms or self-service infrastructure tooling.

Benefits

• Medical/Dental/Vision/Life Insurance
• Paid holidays plus Paid Time Off
• 401(k) plan and contribution
• Long-term/Short-term Disability
• Paid Parental Leave
• Employee Stock Purchase Plan

The annual salary for this position is between $100,000- $155,000 depending on experience and other qualifications of the successful candidate.

This position is also eligible for Cognizant’s discretionary annual incentive program, based on performance and is subject to the terms of Cognizant’s applicable plans.

Disclaimer: The salary, other compensation, and benefits information is accurate as of the date of this posting. Cognizant reserves the right to modify this information at any time, subject to applicable law.

Cognizant is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to sex, gender identity, sexual orientation, race, color, religion, national origin, disability, protected Veteran status, age, or any other characteristic protected by law.