DevSecOps Engineer - VA

Connected Logistics; United States; On-site; USD 135,000 - 145,000; Full time

Benefits offered by this job

Health insurance

Dental insurance

Vision insurance

Life insurance

Disability insurance

401(k) plan

Paid time off

Job summary

Connected Logistics is seeking a DevSecOps Engineer to join a platform engineering team supporting the VA CAIO. You will build and operate AKS-based cloud infrastructure, CI/CD pipelines, and containerization workflows that scale for AI/ML pilot programs.

Work includes reusable GitHub Actions, Pulumi TypeScript IaC, and security-first automation. You will containerize tenant apps, enable multi-tenant onboarding, and ensure compliance across the pipeline while collaborating with engineers to

Qualifications

• U.S. Citizen for VA clearance.
• BS degree with 7+ years experience.
• Independent with drive for self-learning and resourcefulness.
• Strong communication and customer-facing polish.
• Ability to produce lightweight documentation of system design and automation

Responsibilities

• Author and maintain a reusable GitHub Actions workflow library.
• Build and execute CI/CD pipelines for Azure environments; expand Pulumi IaC patterns.
• Deploy and maintain AKS clusters and related networking components.
• Containerize tenant applications and deploy via automated pipelines.
• Integrate security scanning (SAST/SCA) and SBOM generation in CI workflows.
• Automate multi-tenant onboarding: namespaces, RBAC, and service routing.
• Manage container registries and release automation.
• Contribute to observability and monitoring for cloud platforms.
• Collaborate with software engineers to containerize apps for prod deployment.
• Follow DevSecOps best practices and produce documentation

Skills

GitHub Actions CI/CD

Container image build

Kubernetes

Security scanning

IaC Pulumi TypeScript

Istio service mesh

RBAC & multi-tenant

Documentation

Education

BS degree

Tools

Pulumi

Istio

Cosign/Sigstore

Job description

Job Type

Full-time

Description

Connected Logistics is seeking a DevSecOps Engineer to join a platform engineering team supporting the Department of Veterans Affairs Chief AI Office (CAIO), building and operating the cloud infrastructure, CI/CD pipelines, and containerization workflows that support AI/ML and software delivery for pilot programs. The platform runs on Azure Kubernetes Service (AKS), automated via GitHub Actions reusable workflows, with infrastructure-as-code being stood up in Pulumi (TypeScript). You'll own key parts of the lifecycle - from reusable workflow libraries and container build/scan pipelines to multi-tenant AKS platform operations and federal security compliance.

What You'll Get to Do as a DevSecOps Engineer

• Author and maintain a reusable GitHub Actions workflow library consumed by tenant application repositories to build, scan, sign, and deploy.
• Build and execute CI/CD pipelines that deploy a self-service platform into customer Azure environments; help establish and expand Pulumi (TypeScript) IaC patterns from the current baseline.
• Deploy and maintain cloud platform infrastructure: AKS clusters, load balancers, node pools, NSGs, and Istio service mesh routing.
• Containerize tenant applications using multi-stage Docker builds and deploy them to AKS through automated pipelines.
• Integrate and maintain a security scanning pipeline using Semgrep (SAST), Grype/Snyk (SCA), and Trivy (container image scanning), plus SBOM generation and image signing (Cosign/Sigstore), enforcing quality gates in all CI workflows.
• Automate multi-tenant platform onboarding: namespace provisioning, RBAC role bindings, and virtual service creation via scripted workflows.
• Manage container image registries (GHCR or equivalent), versioning, and release automation (e.g., Release Please, Dependabot).
• Help stand up and maintain observability infrastructure for platform and AI/ML workloads.
• Support the AI/ML platform stack (models running on Kubernetes; Azure AI Foundry and Azure ML Workspaces as the platform matures).
• Collaborate with software engineers to containerize their applications for production deployment.
• Follow DevSecOps best practices for security integration, IaC, SRE, and operational visibility.
• Produce lightweight but useful documentation of systems, infrastructure, and automation mechanisms.

Requirements

• Must be a U.S. Citizen to obtain VA clearance.
• BS degree with 7+ years of experience
• Independent, with a mindset toward continuous learning, drive for self-study, and resourcefulness
• Strong communication skills and a customer-facing level of polish
• Able to produce lightweight but useful documentation of system design and automation mechanisms

Core experience (5+ years across the following):

• GitHub Actions CI/CD, including reusable workflow authorship (primary requirement)
• Container image build (multi-stage Dockerfiles), scanning, and registry management (GHCR or equivalent), including versioning and release automation
• Security scanning toolchain: SAST (Semgrep or equivalent), SCA (Grype/Snyk/equivalent), container vulnerability scanning (Trivy or equivalent); SBOM generation and image signing (Cosign/Sigstore) a plus
• Kubernetes cluster operations: node pools, namespaces, RBAC, health probes, resource limits, autoscaling (HPA/VPA), rolling deployments
• Federal application security: OWASP, Zero Trust principles, encryption at rest and in transit, FISMA High controls; handling of PII/PHI in cloud environments
• Agile delivery (Kanban, Scrum, SAFe, or similar)

Required technology domains (production experience):

• Azure cloud services: AKS, Key Vault, VNet/NSG networking, Azure Blob Storage
• Multi-tenant Kubernetes platform operations

Valued / a plus

• Infrastructure-as-code (Terraform or Pulumi). Pulumi with TypeScript strongly preferred. The team is actively standing this up, so the ability to establish and mature Pulumi patterns from a discovery baseline is valued more than prior years in Pulumi specifically.
• Istio service mesh: VirtualService/Gateway configuration, mTLS, and multi-tenant routing (familiarity required; hands-on multi-tenant routing a strong plus)
• Policy management: Kyverno / OPA Gatekeeper

Preferred Qualifications:

• Prior work on a VA, DoD, or other federal FISMA High system with ATO experience
• Azure AI/ML platform services: Azure AI Foundry, Azure ML Workspaces
• GPU node pool provisioning and AI/ML workload scheduling on Kubernetes
• Familiarity with Python (FastAPI) and Node.js/React containerization patterns
• Experience standing up observability/monitoring and logging for cloud platforms

Total Rewards Statement:

We believe in fairness and clarity throughout our hiring process. The anticipated salary range for this position is $135,000 to $145,000 USD. This is a good-faith range based on factors such as your experience, geographic location, and any applicable contractual requirements, and may vary slightly. Beyond salary, we provide a robust benefits package and encourage ongoing professional development, because your growth and well-being matter to us. We're excited to support you in building a rewarding career with us!

Connected Logistics respects the need for confidentiality for all applicants.

Connected Logistics has been named a 2026 WTOP Top Workplace in the medium sized business category. Our mission is clear: we deliver mission-focused IT, cybersecurity, logistics, and enterprise modernization support to federal agencies. When we invest in our people and create an environment where they feel valued and empowered, we deliver stronger outcomes for our clients and the missions we support.

Connected Logistics offers an excellent benefits package that includes health, dental, vision, life, and disability insurance, a great 401(k) package, and generous Paid Time Off.

EOE/Disability/Veterans