Remote AWS DevSecOps Engineer – Security & Automation

PhoenixTeam; Arlington (VA); Remote; USD 140,000 - 190,000; Full time

Job summary

PhoenixTeam seeks an AWS DevSecOps Engineer to design, secure, and operate cloud environments and automated delivery pipelines for internal and client apps. This hands-on role spans IaC, container deployment, CI/CD, security controls, reliability, and incident recovery.

The engineer applies least-privilege access, implements security tooling, and collaborates with engineers, Platform, and security stakeholders to ensure auditable, compliant releases from prototype to production.

Qualifications

• 5+ years hands-on DevOps/DevSecOps experience with production responsibility.
• Strong AWS experience spanning VPC/networking, IAM, ECS/EKS, RDS, KMS, CloudWatch, and CloudTrail.
• Experience deploying containerized workloads with Docker and building production infrastructure as code using Terraform, AWS CDK, or CloudFormation.
• Experience owning CI/CD pipelines as code, including automated testing, security gates, release promotion, troubleshooting, and rollback.
• Hands-on experience integrating SAST, DAST, SCA/dependency, container, and infrastructure-as-code security checks into delivery workflows.
• Ability to script automation in Python, Bash, or Go and independently validate generated scripts and infrastructure configurations.
• Practical understanding of least-privilege access, encryption, secure credential handling, and NIST SP 800-53 or a comparable security-control framework.
• Ability to supervise and verify AI-assisted engineering workflows with independent judgment; clear written and verbal communication with technical and non-technical partners.

Responsibilities

• Build and operate AWS infrastructure using Terraform, AWS CDK, or CloudFormation, including VPC networking, IAM, ECS/Fargate or EKS, RDS, load balancing, KMS, Secrets Manager, S3, and CloudWatch.
• Implement application infrastructure within shared Platform patterns; support multi-account controls using AWS Organizations, Control Tower, service control policies, or comparable guardrails.
• Own build, test, approval, and deployment pipelines as code using GitHub Actions, Forgejo Actions, AWS CodePipeline, or comparable tools; create reusable, documented workflows.
• Embed SAST, DAST, software-composition/dependency, container-image, and infrastructure-as-code scanning in release stages; maintain blocking criteria and elevate risk acceptance and exceptions to authorized decision-makers.
• Apply least-privilege IAM, encryption, secrets handling, network isolation, and controlled production access; constrain what automation and AI agents can access or change.
• Design and verify agent-executable playbooks for hardening, testing, provisioning, and deployment; independently review and test generated code, infrastructure definitions, and security evidence.
• Support blue/green or canary deployment and tested rollback; use lead time, deployment frequency, failure rate, and recovery metrics to improve reliable release delivery.
• Implement logs, metrics, tracing, health checks, alerts, and cost visibility; participate in a rotating on-call schedule, respond to incidents, and contribute to post-incident reviews and runbooks.
• Use AWS security and audit tooling such as Security Hub, GuardDuty, Config, CloudTrail, Inspector, and IAM Access Analyzer as applicable; remediate findings and support relevant evidence needs.
• Work with application engineers, Platform, QA/verification, and client security stakeholders to support secure handoffs and explain deployment decisions, controls, and human verification.

Skills

DevSecOps

AWS specialist

IaC (Terraform)

CI/CD pipelines

Security testing tools

Scripting: Python/Bash/Go

Least-privilege

AI-assisted workflows

Tools

Terraform

AWS CDK

CloudFormation

Docker

GitHub Actions

Forgejo Actions

CodePipeline

Job description

PhoenixTeam seeks an AWS DevSecOps Engineer to design, secure, and operate cloud environments and automated delivery pipelines for internal and client apps. This hands-on role spans IaC, container deployment, CI/CD, security controls, reliability, and incident recovery.

The engineer applies least-privilege access, implements security tooling, and collaborates with engineers, Platform, and security stakeholders to ensure auditable, compliant releases from prototype to production.