DevSecOps Engineer, AWS

OpenTalent; Washington; On-site; USD 120,000 - 180,000; Full time

Job summary

Peregrine Advisors seeks a hands-on DevOps engineer to own secure CI/CD pipelines for federal systems, with security gates and automated evidence for RMF authorization.

You will work in AWS or client on-prem environments, building reproducible environments, containerization, vulnerability scanning, and progressive delivery with blue/green and canary strategies.

Qualifications

• Hands-on CI/CD (AWS-native or comparable) with security gates and automated testing.
• Experience with infrastructure-as-code and reproducible environments.
• Proficiency in containerization, vulnerability scanning, and secure deployment practices.

Responsibilities

• Own secure delivery path for federal systems and RMF authorization evidence.
• Build and maintain CI/CD pipelines with integrated security checks and policy-as-code.
• Manage infrastructure-as-code and containerized environments in AWS or client on-prem.
• Develop automation scripts (Python/Bash) to augment tooling and pipelines.

Skills

CI/CD

Security testing

Infrastructure as code

Containerization

Cloud AWS

Scripting Python

Tools

Terraform

Docker

Kubernetes

SAST

DAST

SCA

Python

Bash

Job description

Peregrine Advisors is a firm founded on a simple conviction: the best solutions come from the people closest to the problem, given real ownership and the tools to deliver. We are a data and technology innovation hub and a Benefit Corporation working at the center of the federal government's mission to deliver for client stakeholders and the US public, looking for highly motivated contributors who thrive when trusted to own a hard problem and equipped to deliver the solution.

Your first assignment is to own a secure delivery path for federal systems: continuous integration and delivery (CI/CD) pipelines with security gates built in, infrastructure-as-code that makes environments reproducible, and the automation, monitoring, and evidence that support Risk Management Framework (RMF) authorization and continuous monitoring. You will work in Amazon Web Services (AWS) or in a client-managed, on-premises environment, and what you build will carry real systems into production. The work is real, hard, and it matters. It is also where you start, not the shape of your career here: we hire people, not seats, and we move our best to where the hardest problems are.

• CI/CD pipelines with security built into the path: automated security testing (SAST, DAST, SCA), policy-as-code checks, and controlled promotion, so a release passes review because the pipeline enforced the required controls and produced evidence for review.
• The infrastructure under them, as code: reproducible environments with containerization and container-image scanning, least-privilege access, secrets management, and encryption as defaults rather than add-ons.
• The operational fabric: monitoring, logging, and vulnerability scanning; progressive delivery and low-downtime deployment strategies, including blue/green and canary deployments, with automated health checks and rollback; incident response; pipeline reliability and software-delivery performance metrics; and the evidence that supports an Authority to Operate (ATO) and continuous monitoring.
• In time, the firm itself: new capabilities, tools, and lines of business you help spin up.

You treat security and reliability as part of the build, not a gate at the end, because in a federal environment they cannot be an afterthought. You automate what others do by hand and you leave an audit trail behind you. You experiment, fail, learn, and repeat quickly. You would rather own an outcome than be handed a task.

• Hands-on CI/CD (AWS-native or comparable), infrastructure-as-code, and containerization for deploying real systems in AWS or in a client-managed, on-premises environment.
• The security craft around the pipeline: automated security testing (SAST, DAST, SCA), vulnerability scanning, secrets management, and least-privilege design.
• The scripting to automate what the tools do not: Python or Bash beyond pipeline configuration.