Senior DevSecOps Engineer

Mbi Llc; Mechanicsburg (Cumberland County); On-site; USD 100,000 - 130,000; Full time

Job summary

A cybersecurity solutions provider is looking for a specialist in AWS security automation with significant experience in CI/CD authoring using GitHub Actions and Azure DevOps. Your primary responsibility will include authoring AWS CDK constructs and CloudFormation templates, ensuring compliance with CJIS and NIST standards, and facilitating evidence exports for audit readiness. You will play a critical role in shaping security practices within the organization and coaching teams on adopted templates.

Qualifications

• 5+ years of AWS security automation and DevOps experience.
• Proficient with AWS CDK and CloudFormation; working knowledge of Terraform.
• Experience in CI/CD authoring in GitHub Actions and Azure DevOps.

Responsibilities

• Author and maintain AWS CDK constructs and CloudFormation templates.
• Conduct AWS Config conformance and Security Hub standards.
• Create reusable GitHub/Azure DevOps templates with enforcement gates.

Skills

AWS security automation

AWS CDK

CloudFormation

Terraform

CI/CD authoring

Python

Bash

PowerShell

Java

C#

Knowledge of CJIS and NIST

Tools

GitHub Actions

Azure DevOps

OPA/Conftest

Checkov

Trivy

Inspector

CodeQL

Job description

Overview

Hands‑on security automation for AWS delivery. Build secure‑by‑default CDK constructs and CloudFormation templates, wire them into CI/CD, and enforce compliance checks that map to CJIS and NIST. Azure support is a future consideration, not a core day‑one duty. Does not own enterprise AWS Organizations or SCP operations. Designs and builds reference guardrails and enforcement patterns that can be deployed by enterprise teams. Focuses on preventive controls and compliance automation, not incident response.

What you will deliver

• Pipeline security templates in GitHub Actions and Azure DevOps with SAST, SCA, IaC, container, and secret scanning gates.
• Compliance as code in reference accounts: AWS Config rules and Security Hub standards aligned to CJIS and NIST 800‑53, with exceptions workflow documented.
• IaC reference modules using AWS CDK and CloudFormation for IAM least privilege, KMS, Secrets Manager, logging, and network baselines; Terraform equivalents provided where teams require them.
• Evidence exports tying checks to control IDs and producing auditor‑ready artifacts.

Ongoing

• Harden CDK/CFT modules and pipeline templates as compliance needs evolve.
• Coach pilot teams to adopt templates.
• Raise gaps to enterprise teams for org‑level enforcement.

Day‑to‑day responsibilities

• Author and maintain AWS CDK constructs and CloudFormation templates; provide Terraform versions as secondary.
• AWS Config conformance, Security Hub standards, and GuardDuty routing in reference accounts.
• Wire scanning in CI/CD for app code, containers, and IaC.
• Create reusable GitHub/Azure DevOps templates with enforcement gates and exception handling.
• Generate posture and evidence reports mapped to CJIS and NIST controls.

Required skills

• 5+ years AWS security automation and DevOps.
• Strong with AWS CDK and CloudFormation; working proficiency in Terraform.
• CI/CD authoring in GitHub Actions and Azure DevOps.
• Proficient in Python and Bash, with PowerShell for Windows automation.
• Able to read Java and C# to integrate and tune SAST/SCA.
• Practical knowledge of CJIS and NIST 800‑53 control families and how to automate checks and evidence.

Nice to have

• OPA/Conftest, Checkov, Trivy, Inspector, CodeQL or equivalent.
• Basic Azure security automation for future phases.

Decision rights

Independent on design and build within standards; proposes guardrails and reference patterns; escalates enterprise‑wide changes.