Senior DevSecOps Engineer

Pantheon Data; Reston (VA); Hybrid; USD 100,000 - 150,000; Full time

Job summary

Pantheon Data in the Washington DC area is seeking a Senior DevSecOps Engineer to design, build, and operate a secure software delivery platform for ML workloads in AWS GovCloud. You will own the end-to-end GitLab CI/CD architecture, including pipelines, runners, security gating, and compliance evidence, while migrating existing repositories and pipelines to GitLab.

You will partner with Cloud Operations and Cloud Security Engineers to enforce gated controls that meet NIST 800-53, FedRAMP, and

Qualifications

• Bachelor's degree in Computer Science, Information Technology, Information Systems, Engineering, or a related technical field.
• 5+ years in DevSecOps/DevOps with production AWS environments.
• Deep, hands-on CI/CD expertise with GitLab CI/CD, GitHub Actions, or a comparable platform.
• Experience implementing gated DevSecOps controls in CI/CD.
• Deep hands-on expertise with Amazon EKS: cluster hardening, Helm, and GitOps deployment patterns.
• Proficiency in Terraform for the infrastructure behind pipelines, runners, and clusters.
• Working understanding of security compliance frameworks and their translation to technical controls.
• Scripting in Python or Bash for automation.
• AWS Certified DevOps Engineer – Professional or AWS Certified Security – Specialty.
• Ability to work in remote, cross-functional teams; meet deadlines; deliver quality work.
• Proficient in Microsoft Office applications.

Responsibilities

• Design, implement, and operate GitLab CI/CD pipelines and infrastructure.
• Configure and tune GitLab Ultimate security suite as required gates.
• Enforce policy-as-code and compliance automation across projects.
• Generate and manage SBOMs; sign and verify artifacts; ensure secure supply chain.
• Architect GitLab Runner fleets in GovCloud and implement keyless OIDC authentication.
• Manage production EKS clusters; deploy with Helm and GitOps tooling.
• Lead migration from GitHub Actions to GitLab Ultimate; translate workflows.
• Mentor engineers on secure delivery practices and document runbooks.

Skills

CI/CD expertise

AWS GovCloud

Kubernetes (EKS)

Terraform

Security compliance frameworks

Python/Bash scripting

GitLab security features

GitOps (Argo CD/Flux)

Cloud security tooling

Microsoft Office suite

Education

Bachelor's degree in CS/IT/Eng

Tools

GitLab CI/CD

GitHub Actions

AWS

EKS

Terraform

Helm

Argo CD/Flux

Job description

Pantheon Data (a Kenific Holding company) is a private, small business based in the Washington, DC, area. Pantheon Data was founded in 2011, initially providing acquisition and supply chain management services to the US Coast Guard. Our service offerings have grown in the past ten years, including infrastructure resiliency, contact center operations, information technology, software engineering, program management, strategic communications, engineering, and cybersecurity. We have also grown our customer base to include commercial clients. The company has used this experience to expand our service offerings to other agencies within the Department of Homeland Security (DHS), the Department of Defense (DoD), and other Federal Civilian Agencies.

Position Overview

Pantheon Data is seeking a Senior DevSecOps Engineer to design, build, and operate the secure software delivery platform for ML-enabled workloads and applications in AWS GovCloud that process CUI, PII, and PHI. GitLab Ultimate is our DevSecOps platform: you will own our GitLab CI/CD architecture end to end - pipelines, runners, security scanning, policy enforcement, and compliance evidence - and lead the migration of existing repositories and pipelines onto it.

The role combines secure pipeline engineering with production Amazon EKS delivery through GitOps, enforcing gated security controls that satisfy NIST 800-53, FedRAMP, and DoD SRG requirements while keeping delivery fast. You will partner closely with the Cloud Operations Engineer, who builds and runs the underlying AWS infrastructure, and the Cloud Security Engineer, who owns cloud security controls and ATO evidence. Successful candidates can walk through pipelines and platforms they have personally built - stage design, security gates, runner architecture, failure modes, and the compliance evidence they produced.

Responsibilities

• GitLab CI/CD Engineering: Design, implement, and operate enterprise-grade GitLab CI/CD pipelines, including multi-project/parent-child pipeline orchestration, environment promotion gates, protected branches and environments, and reusable pipeline templates and CI components.
• GitLab Ultimate Security Suite: Deploy, configure, and tune the full GitLab Ultimate security suite as required pipeline gates: Advanced SAST, DAST, secret detection (including push protection), dependency scanning, container scanning, IaC scanning, license compliance, and API security - with findings triaged through the vulnerability management dashboard and merge request security widgets.
• Policy-as-Code & Compliance Automation: Enforce security centrally using scan execution policies, merge request approval policies, compliance frameworks, and compliance pipelines so scanning is mandatory across all projects; provide pipeline and supply chain audit evidence to the Cloud Security Engineer for ATO, POA&M, and continuous-monitoring activities.
• Software Supply Chain Security: Generate and manage SBOMs, enforce dependency and license policies, sign and verify build artifacts and container images, and maintain a secure, traceable path from commit to production.
• Runners & Cloud Auth: Architect and operate GitLab Runner fleets in GovCloud (autoscaling, isolation, hardened images) and work with the Cloud Operations and Cloud Security Engineers to implement keyless OIDC authentication from GitLab to AWS IAM roles - no long-lived cloud credentials in CI.
• Kubernetes & GitOps: Manage lifecycle, networking, and security for production Amazon EKS clusters; orchestrate deployments with Helm and GitOps tooling (Argo CD or Flux) for declarative state management; harden registries, and OCI image workflows.
• Platform Migration: Lead the migration of repositories, pipelines, and integrations from GitHub/GitHub Actions to GitLab, including translation of workflows, secrets strategy, branch protection parity, and developer enablement.
• Team Enablement: Mentor engineers on secure delivery practices, author runbooks and pipeline documentation, and partner with the Cloud Security Engineer on control implementation and assessment support.

Required Skills And Experience

• Bachelor's degree in Computer Science, Information Technology, Information Systems, Engineering, or a related technical field, from an accredited university.
• 5+ years in DevSecOps/DevOps engineering with responsibility for production AWS environments.
• Deep, hands-on CI/CD expertise with GitLab CI/CD, GitHub Actions, or a comparable platform: pipeline design at scale, integrated security scanning (SAST/DAST/secret detection/dependency/container/IaC), policy-enforced approvals, and runner administration.
• Experience implementing gated DevSecOps controls in CI/CD - pipelines that block on security findings, enforce approvals, and produce auditable evidence.
• Deep hands-on expertise with Amazon EKS: cluster hardening, OCI-compliant image management, Helm, and GitOps deployment patterns (Argo CD or Flux).
• Proficiency in Terraform for the infrastructure behind pipelines, runners, and clusters: modular design, state management, and multi-environment promotion.
• Working understanding of security compliance frameworks and how they translate into technical controls and pipeline security gates in cloud environments.
• Scripting proficiency in Python or Bash for operational automation and security tooling.
• Current AWS Certified DevOps Engineer – Professional or AWS Certified Security – Specialty.
• Ability to work effectively in remote, cross-functional teams; meet deadlines; and produce quality work with clear written communication.
• Proficient in Microsoft Suite software including Outlook, Word, Excel, SharePoint, and PowerPoint.

Preferred Skills And Experience

• 10+ years of overall experience in technology and software engineering, demonstrating senior-level breadth beyond DevSecOps.
• Direct experience with GitLab Ultimate security and compliance features: scan execution and merge request approval policies, compliance frameworks, vulnerability management and security dashboards, and GitLab Runner administration.
• Experience administering self-managed GitLab (or GitLab Dedicated for Government) in GovCloud or another isolated/restricted-egress environment, including upgrades, backups, and instance hardening.
• Experience migrating organizations from GitHub/GitHub Actions (including GitHub Advanced Security) to GitLab Ultimate.
• Experience delivering software in FedRAMP High or DoD IL4/IL5 environments, including STIG- and CIS-compliant container images and pipeline controls mapped to NIST SP 800-53.
• Supply-chain security depth: SLSA, Sigstore/cosign artifact signing, SBOM management, and dependency provenance.
• Experience supporting ML/AI platforms (model serving, GPU workloads, Amazon Bedrock integrations, or data pipelines) in regulated environments.
• CI/CD and application secrets management with AWS Secrets Manager or HashiCorp Vault; policy-as-code tools such as OPA/Kyverno; and admission control for Kubernetes.
• Additional AWS certifications such as Solutions Architect or SysOps Administrator; Kubernetes certifications (CKA/CKS).

Clearance Requirements

Applicants selected will be subject to a security investigation and may need to meet eligibility requirements. Candidates must have the ability to obtain and maintain a Secret clearance; an active Secret clearance is preferred.

Work Location

• Our company prioritizes the benefits of flexibility and collaboration, whether that happens in person or remotely.
• If the position is remote or hybrid, you may periodically work from a Pantheon Data office location or client site.
• If this position is assigned to a Pantheon Data office location or client site, you'll work with colleagues and clients in person, as needed for specific client requirements.

Interview Requirement

Candidates who are local to the area should be prepared to participate in an in-person interview as part of the selection process. Candidates outside the local area may be considered for a virtual interview.

Compensation

The salary range for this position is $100,000 - $150,000. This is not, however, a guarantee of compensation or salary. Rather, salary will be set based on experience, geographic location and possibly contractual requirements and could fall outside of this range.

Benefits Overview

We are always looking for good people! Pantheon Data is committed to providing its employees with competitive salaries and benefits in order to increase employee satisfaction and productivity. In addition to our benefits, we also offer SmartBenefits through the Washington Metro Area Transportation Authority, where you specify an amount of your pre-tax wages be paid directly to your SmarTrip account. In some cases, tuition assistance may be available for continuing education expenses and certifications related to their position. Additional details may be found at https://pantheon-data.com/careers/

Pantheon Data Important Information

All qualified applicants will be considered for employment without regard to disability, status as a protected veteran, or any other status protected by applicable federal, state, local, or international law.

As part of the application process, you are expected to be on camera during interviews and assessments. We reserve the right to take your picture to verify your identity and prevent fraud.

If you require reasonable accommodation in completing this application, interviewing, completing any pre-employment testing, or otherwise participating in the employee selection process, please direct your inquiries to our Talent Team at [e-mail] or by phone [phone].

This company uses E-Verify to confirm each employee's work authorization. For more information, click here E-Verify Participation Poster

Salary: $100000 - $150000 per year