Senior DevSecOps Lead

United States Digital Space LLC; United States; Remote; USD 150,000 - 170,000; Full time

Job summary

United States Digital Space LLC is seeking a Senior DevSecOps Lead for CMS/Federal projects. The role is fully remote, full-time, and focused on implementing and evolving shared DevSecOps capabilities across the Medicare Payment System Environment.

You will lead pipelines, IaC, security integration, engage with CMS Agile Delivery Organizations, and align with stakeholders while preparing for proposal participation if contract is awarded.

Qualifications

• Senior-level DevSecOps engineering experience, including leadership or ownership of major work.
• Ability to serve as technical lead or team lead.
• Strong experience implementing and operating CI/CD pipelines and automation.
• Experience with cloud technologies and Agile delivery.
• Experience with Infrastructure as Code and automation.
• Experience integrating security, vulnerability remediation, and compliance into delivery.
• Experience supporting production systems and incident management.
• Ability to translate stakeholder requirements into reusable technical capabilities.

Responsibilities

• Lead centralized and reusable DevSecOps services across product teams.
• Design, implement, and maintain CI/CD pipelines for faster, reliable delivery.
• Lead tooling and remediation approaches across multiple Agile Delivery Organizations.
• Support cloud infrastructure and CMS environment.
• Automate infrastructure deployment with IaC.
• Embed security across the software development lifecycle with automated scans and remediation.
• Develop reusable services and utilities to reduce duplication.
• Support testing, deployment automation, and release management.
• Support monitoring, reliability, and operational engineering.

Skills

Senior DevSecOps engineering

Technical leadership

CI/CD pipelines

Cloud technologies

Security integration

Tools

Jenkins

GitHub

IaC

Job description

Senior DevSecOps Lead — CMS / Federal

Location: Fully Remote

Job Type: Full-time

Opportunity Status: Federal contract pursuit; contingent upon contract award

Role Status: Proposed 100% dedicated Key Personnel

About the company

the company is a Service-Disabled Veteran-Owned Small Business focused on AI, data analytics, and technical solutions. We are recruiting a Senior DevSecOps Lead to serve as proposed key personnel for a Centers for Medicare & Medicaid Services (CMS) federal contract pursuit supporting the Medicare Payment System Modernization (MPSM) environment.

Position Overview

The Senior DevSecOps Lead will serve as the senior technical lead responsible for helping implement, operate, and evolve shared DevSecOps capabilities across the Medicare Payment System Environment (MPSE).

This is not a general DevOps administration position. We are looking for a senior, team-lead-caliber engineer who has performed comparable work before and can lead the implementation of technical fixes, pipelines, automation, and common tooling across multiple delivery organizations.

The environment includes CMS Agile Delivery Organizations (ADOs) operating at different levels of technical maturity. A major part of the role is therefore not only building strong technical solutions, but understanding stakeholder needs, gathering requirements, building consensus, and helping teams adopt reusable tooling even when there is no direct authority to mandate its use.

The successful candidate must combine strong hands-on technical judgment with the ability to explain technical decisions and tradeoffs clearly to both technical and nontechnical stakeholders.

What You’ll Do

• Lead the implementation and continuous improvement of centralized and reusable DevSecOps services across MPSE product teams.

• Design, implement, maintain, and improve CI/CD pipelines that reduce manual intervention and support faster, more reliable software delivery.

• Lead implementation of shared DevSecOps tooling and technical remediation approaches across multiple Agile Delivery Organizations.

• Support cloud infrastructure and platform engineering within the CMS environment.

• Automate infrastructure deployment using Infrastructure as Code (IaC).

• Embed security throughout the software development lifecycle, including automated security scanning, vulnerability management, compliance validation, and security remediation.

• Develop and support reusable services, utilities, and automation that reduce duplication across ADO teams.

• Support automated testing, deployment automation, release management, and production-readiness activities.

• Support system and application monitoring, reliability, performance, and operational engineering.

• Identify, triage, resolve, and participate in root-cause analysis and postmortems for system, security, and operational incidents.

• Support production deployment planning, including runbooks, rollback plans, launch planning, and feature-management approaches.

• Support disaster-recovery planning and testing.

• Collaborate with the ISSO and other security stakeholders on vulnerability remediation, compliance findings, ATO-related requirements, and technical security implementation.

• Gather requirements from ADOs and other CMS stakeholders and translate those requirements into reusable technical capabilities.

• Work with teams at different levels of technical maturity to understand their pain points and identify practical approaches for adoption of shared tooling.

• Build consensus and influence adoption of common DevSecOps capabilities without relying on formal organizational authority.

• Participate in architectural reviews and provide technical guidance related to cloud-native design, DevSecOps, software delivery, and reusable services.

• Participate in the team’s shared on-call production-support rotation.

• Participate in proposal preparation, mock sessions, team preparation, and the CMS oral-presentation process as proposed key personnel.

Required Qualifications

• Demonstrated senior-level DevSecOps engineering experience, including experience leading or substantially owning comparable technical work.

• Demonstrated ability to serve in a technical lead or team-lead capacity.

• Strong hands-on experience implementing and operating CI/CD pipelines and software-delivery automation.

• Experience with cloud technologies and Agile delivery environments.

• Experience with Infrastructure as Code and infrastructure automation.

• Experience integrating security, vulnerability remediation, automated testing, and compliance considerations into software-delivery processes.

• Experience supporting production systems, operational reliability, incident response, deployment, or release-management activities.

• Ability to design, implement, or support reusable technical services and shared tooling used across multiple teams.

• Ability to gather technical and operational requirements from multiple stakeholders and translate them into implementable solutions.

• Ability to work effectively with teams that have different technical maturity levels, priorities, and operational constraints.

• Strong written and verbal communication skills, including the ability to explain complex technical issues to nontechnical stakeholders.

• Ability to build consensus, influence without direct authority, and help stakeholders adopt common technical solutions.

• Ability to reason through ambiguous technical scenarios, articulate tradeoffs, and collaborate effectively with security, delivery, product, and program leadership.

• Willingness and ability to be proposed as key personnel, participate in proposal and oral-presentation preparation, and perform the role if the contract is awarded.

• Willingness to participate in a shared on-call production-support rotation.

• Ability to satisfy applicable CMS/HHS suitability, background-investigation, identity-proofing, and credentialing requirements.

Technical Environment

The program environment includes technologies, practices, and operational capabilities such as:

• AWS / CMS Cloud

• Jenkins

• CI/CD

• Infrastructure as Code

• Automated unit, integration, and end-to-end testing

• Automated security scanning and vulnerability remediation

• GitHub

• Jira

• Confluence

• Microsoft Teams

• Slack

• VictorOps

• Snyk

• Wiz

• GuardDuty

• Monitoring and observability

• Release management

• Feature flags

• API-first integration approaches

• Reusable platform services and shared utilities

• AI-assisted software delivery and operational automation

Experience with every individual tool listed above is not required. This list reflects the program’s technical and operational environment.

Stakeholder Collaboration & Adoption

A significant part of this role involves working across multiple CMS Agile Delivery Organizations.

The DevSecOps team may not have direct authority to require individual ADOs to adopt a common tool or process. The successful candidate therefore must be able to understand stakeholder pain points, gather requirements, explain the value of shared approaches, address legitimate technical concerns, and make adoption as practical and effective as possible.

This role requires a technical leader who can operate effectively both inside the engineering details and in conversations with program, product, security, and nontechnical stakeholders.

Key Personnel & CMS Oral Presentation

This position is intended to be proposed as 100% dedicated key personnel.

The selected candidate must be comfortable representing the proposed team in CMS’s remote, interview-style oral-presentation process.

The Government may provide core questions and hypothetical technical or operational scenarios and ask the team to develop a solution in real time. CMS may evaluate both the technical substance of the response and how the team collaborates, reasons through uncertainty, and reaches its conclusions.

The candidate must be able to think on their feet, explain technical tradeoffs clearly, work collaboratively with other proposed key personnel, and communicate effectively to nontechnical government stakeholders.

Selected candidates should expect to participate in proposal preparation, mock oral sessions, and team preparation before the Government presentation.

Personnel Security & Eligibility

An active security clearance is not currently listed as a requirement for this role.

The selected candidate must be authorized to work in the United States and able to satisfy applicable CMS/HHS suitability, background-investigation, identity-proofing, and credentialing requirements, including HSPD-12/PIV requirements where applicable.

Place of Performance

The position is fully remote for normal performance.

The underlying CMS requirement identifies primary performance as off-site and allows for meetings at CMS facilities in the Baltimore/Washington metropolitan area. Occasional travel or in-person meetings may therefore be required.

Performance of contract work outside the United States or its territories requires prior Government approval.

Contingent-Award Notice

This position supports a federal contract pursuit and is contingent upon contract award. Selection for proposal participation or designation as proposed key personnel does not constitute a guarantee of employment or contract award.

Pay: $150,000.00 - $170,000.00 per year

People with a criminal record are encouraged to apply

Application Question(s):

• Are you willing to be proposed as 100% dedicated key personnel and perform as the DevSecOps Lead if the contract is awarded?

• Do you have senior-level experience leading or substantially owning DevSecOps, CI/CD, cloud, or platform-engineering implementations?

• Do you have hands-on experience working with AWS or a comparable enterprise cloud environment?

• Are you willing to participate in proposal preparation, mock sessions, and a remote CMS oral presentation where you may be asked to solve technical scenarios in real time?

• Are you able to satisfy applicable CMS/HHS suitability, background-investigation, identity-proofing, and credentialing requirements?

• Describe a situation where you had to get multiple technical teams to adopt a common tool, pipeline, or platform when you did not have direct authority over those teams.

Work Location: Remote