Senior DevSecOps Engineer, GovCloud & Compliance

United States Digital Space LLC; United States; Remote; USD 170,000 - 185,000; Full time

Benefits offered by this job

Medical, dental, vision

Generous PTO

Remote work within United States

Job summary

United States Digital Space LLC is seeking a senior DevSecOps Engineer to own secure GovCloud deployment of our platform and drive CMMC Level 2 readiness. You will design, stand up, and harden the isolated enclave handling CUI, and build automation to sustain compliance across the environment.

The role combines hands-on infrastructure work with agentic tooling and secure CI/CD workflows, delivering scalable security posture for a GovCloud‑resident platform while collaborating with an external

Qualifications

• 9+ years of software/infrastructure engineering with lead-level DevSecOps ownership.
• Deep AWS expertise including AWS GovCloud and operation differences from commercial AWS.
• Strong infrastructure-as-code skills (Terraform) and production Kubernetes (EKS) experience.
• Hands-on CI/CD security with SAST/DAST/SCA, container scanning, and artifact signing.
• Working knowledge of NIST SP 800-171 and CMMC 2.0 Level 2 controls.
• Experience authoring or maintaining SSP and POA&M docs in a DoD/defense context preferred.
• Scripting ability (Python or Go) and familiarity with app stack (Python/FastAPI, Node/Express).
• Familiarity with IAM, OIDC/Cognito, MFA, and least-privilege design.
• Fluent use of agentic coding tools as part of workflow.
• Strong written and verbal communication to lead cross-functional efforts.

Responsibilities

• Own design and standup of an AWS GovCloud enclave for CUI protection and compliance.
• Build and maintain infrastructure-as-code for enclave resources using Terraform.
• Harden the EKS/Istio runtime with network policies, mTLS, secrets management, and least-privilege IAM.
• Architect machine-to-machine ingest paths to keep CUI within the boundary.
• Manage encryption and data-at-rest/in-transit controls per FedRAMP/DoD expectations.
• Design and own the secure CI/CD pipeline with security gates and artifact signing.
• Implement supply-chain security, SBOM, provenance, and policy controls.
• Lead CMMC Level 2 / NIST SP 800-171 implementation and liaise with external advisor.
• Support observability, incident response readiness, and cost/reliability optimization.

Skills

AWS GovCloud

Terraform

Kubernetes

Istio

CI/CD security

NIST SP 800-171

Python/Go

IAM

Agentic coding tools

Security posture

Tools

GitHub Actions

GitLab CI

CloudWatch

Trivy

Falco

Job description

About the company

the company provides the world’s only integrated go-to-customer platform that combines transformation services, industry insights, and powerful technology to enable B2B companies to protect, retain, and grow large accounts. Our platforms take an outside-in approach to improving commercial health, utilizing executive buyer insights to inform the orchestration of commercial activities that improve relationships, maximize growth, and scale beyond our engagement. We are extending this platform to serve government and defense customers operating in secure, compliance-bound environments.

Role Summary:

the company is seeking a lead-level Senior DevSecOps Engineer to own the secure deployment of our platform into a dedicated AWS GovCloud environment and to drive our path to CMMC Level 2 certification. This is a high-ownership role: you will architect, stand up, and harden the isolated enclave that handles Controlled Unclassified Information (CUI), build the security automation that keeps it compliant, and serve as the technical lead implementing the controls that an assessment depends on, working alongside an external CMMC advisor.

We pair deep hands‑on infrastructure work with a modern, LLM‑augmented workflow. On our commercial‑side infrastructure, you should use agentic coding tools like Claude Code daily as a force multiplier for infrastructure‑as‑code, policy‑as‑code, and pipeline automation (not as a novelty). The expectation is that a senior engineer armed with these tools can design, build, and harden systems at a pace and quality level that wasn’t previously possible, while retaining full ownership of architecture, correctness, and security posture.

Our platform runs as microservices on EKS with an Istio service mesh, backed by Aurora PostgreSQL. You will be responsible for translating that architecture into a GovCloud‑resident, control‑compliant deployment, and for keeping it secure, observable, and audit‑ready.

What You’ll Do

Secure GovCloud Deployment & Infrastructure

• Own the design and standup of our AWS GovCloud enclave for CUI — network isolation, account/boundary segmentation, identity, and a clearly defined authorization boundary documented for assessment.
• Build and maintain infrastructure as code (Terraform) for reproducible, reviewable, and auditable provisioning of all enclave resources.
• Harden the EKS/Istio runtime — network policy, mTLS, admission control, pod security, secrets management, and least‑privilege IAM across the cluster and AWS services.
• Architect machine‑to‑machine ingest paths that keep CUI within the boundary and minimize human exposure to sensitive data by design.
• Manage encryption, key management, and data‑at‑rest/in‑transit controls consistent with FedRAMP and DoD impact‑level expectations for the environment.

CI/CD Security & Automation

• Design and own the secure CI/CD pipeline with enforced security gates: SAST, DAST, dependency/SCA scanning, container image scanning, and signed, traceable artifacts.
• Implement supply‑chain security — SBOM generation, provenance, and controls over what reaches the protected environment.
• Build compliance and configuration as code so that control enforcement and evidence collection are automated, continuous, and demonstrable rather than manual.

CMMC Level 2 / Compliance Engineering

• Serve as the technical lead for CMMC Level 2 / NIST SP 800‑171 implementation, translating the 110 controls into concrete, enforced technical safeguards across the enclave.
• Partner with our external CMMC advisor to scope, prepare for, and pass assessment — you own the technical implementation and evidence, the advisor guides strategy and readiness.
• Support and maintain compliance documentation — System Security Plan (SSP), Plans of Action & Milestones (POA&M), the control responsibility matrix, and SPRS scoring inputs.
• Build the evidence pipeline: automated logging, monitoring, and artifact collection that proves controls are operating, not just defined.

Platform Operations & Observability

• Stand up observability inside the enclave using AWS‑native tooling (e.g., CloudWatch in GovCloud) for metrics, logs, audit trails, and alerting.
• Own incident response readiness — detection, runbooks, and recovery for the protected environment.
• Optimize cost, reliability, and performance of the GovCloud deployment as workloads scale.

Overall

• Use agentic coding tools (Claude Code and similar) as a primary part of your workflow for commercial‑side infrastructure, IaC, and automation, directing them with precision, catching when they go wrong, and overriding them with your own expertise. Note: these tools are used on non‑CUI infrastructure work only; in‑boundary AI usage is restricted to approved, FedRAMP‑authorized services.
• Collaborate across engineering on GitHub, follow Agile practices in Jira, and lead by setting the security and deployment standards others build against.
• Act as the connective tissue between platform engineering, leadership, and the compliance effort. That means communicating risk, status, and tradeoffs clearly to both technical and non‑technical stakeholders.

Required Job Qualifications

• 9+ years of software/infrastructure engineering experience, including significant hands‑on DevSecOps, platform, or cloud infrastructure ownership at a lead level.
• Deep AWS expertise, including hands‑on experience with AWS GovCloud and an understanding of how it differs operationally from commercial AWS.
• Strong infrastructure‑as‑code skills (Terraform) and production experience operating Kubernetes (EKS) and a service mesh (Istio) in security‑sensitive environments.
• Hands‑on CI/CD security — building pipelines with integrated SAST/DAST/SCA, container scanning, and artifact signing (GitHub Actions, GitLab CI, or equivalent).
• Working knowledge of NIST SP 800‑171 and CMMC 2.0 Level 2 — the control families, what evidence assessors expect, and how to implement controls technically rather than only document them.
• Experience authoring or maintaining SSP and POA&M documentation in a DoD or defense‑contractor context is strongly preferred.
• Solid scripting/automation ability (Python or Go) and comfort reasoning about the application stack (Python/FastAPI, Node/Express) you’re deploying.
• Familiarity with identity and access tooling — IAM, OIDC/Cognito, MFA enforcement, and least‑privilege design.
• Fluent, daily use of agentic coding tools (Claude Code, Codex, or similar) as an integrated part of how you work.
• Strong written and verbal communication, with the ability to lead a cross‑functional effort and represent technical posture to leadership and external assessors.
• U.S. citizenship is required for this role due to the handling of Controlled Unclassified Information and applicable export‑control (ITAR/EAR) and federal contracting requirements.

Preferred Qualifications

AWS certifications

• Prior experience taking an organization through a CMMC or FedRAMP assessment.

• Experience with PostgreSQL/Aurora operations — performance, backup, and security configuration.
• Familiarity with runtime and container security tooling (e.g., Falco, Trivy) and WAF/edge protections.
• Background building and operating high‑availability SaaS platforms.

Work Authorization Requirement

Candidates must be legally authorized to work in the United States on a full‑time, ongoing basis without the need for current or future employer sponsorship (for example, we are not able to sponsor employment visas now or in the future).

Work Expectations

Work Hours:

This is a full‑time position that requires employees to be online and actively engaged during standard business hours, and available for occasional after‑hours support.

Conflict of Interest:

You are expected to devote your full professional time and attention to the company and not take on other employment or contract work that interferes with your responsibilities, competes with the company, or creates a potential conflict of interest.

Remote Work:

This position is fully remote and all work must be performed within the United States. Candidates must be legally authorized to work in the United States. Regular working hours will align with the time zone.

Benefits

the company offers a competitive salary, a comprehensive benefit package including medical, dental, and vision coverage, a generous PTO plan, and opportunities for professional growth and development.

Equal Opportunity:

the company is an Equal Opportunity Employer. We consider all qualified applicants without regard to anycharacteristicprotected by applicable federal, state, or local law.

Pay: $170,000.00 - $185,000.00 per year

Benefits:

• Dental insurance
• Health insurance
• Paid time off
• Vision insurance

Application Question(s):

• This position requires U.S. citizenship due to contract requirements. Do you meet this requirement?
• Do you have experience in security and governance.

Experience:

• Software/infrastructure engineering : 9 years (Required)

Work Location: Remote