Senior SecDevOps Engineer - Cloud Cyber Unicorn

Zearch Ltd; Washington (District of Columbia); On-site; USD 140,000 - 180,000; Full time

Job summary

Zearch Ltd. is seeking a senior SecDevOps/Cloud Security Engineer to design, automate, and maintain secure cloud infrastructure and CI/CD pipelines across AWS, Azure, and GCP.

You will implement Zero Trust architectures, manage secrets with Vault, and enforce least privilege with federated identities. You’ll deploy multi-tenant Terraform configurations, build secure CI/CD pipelines, and ensure FedRAMP/NIST controls are met.

Qualifications

• 5-7 years in SecDevOps, Cloud Security Engineering, DevOps or Platform Engineering.
• Hands-on production experience with at least one hyperscaler (Azure or GCP), plus working exposure to AWS
• High proficiency in Terraform and strong scripting (Python, Bash or PowerShell)
• Practical experience with enterprise identity (Okta, Entra ID) and secrets management (Vault, AWS KMS, Azure Key Vault)
• Experience operating EDR, CSPM or vulnerability tools such as CrowdStrike, Wiz or Qualys
• Experience building and troubleshooting Docker and Kubernetes environments
• A working understanding of FedRAMP, NIST 800-53 or SOC 2
• Sole U.S. citizenship (dual citizens cannot be considered)

Responsibilities

• Design, automate and maintain secure cloud infrastructure and CI/CD pipelines.
• Operate Zero Trust architectures (Zscaler ZPA / PRA), including app connectors and privileged remote access.
• Own the secrets lifecycle in HashiCorp Vault, with automated credential flows and programmatic rotation.
• Integrate federated identity (Okta, Entra ID, AWS IAM Identity Center), supporting multi-cloud identity migrations and enforcing least privilege.
• Building multi-tenant infrastructure in Terraform (CloudFormation as needed), with networking, IAM and security groups mapped to FedRAMP IL4 controls.
• Developing secure CI/CD pipelines (GitLab CI, Azure DevOps, Jenkins) with OPA or Azure Policy gates and embedded SAST, SCA and container scanning.
• Deploying and troubleshooting workloads on EKS, AKS and GKE via Helm, ArgoCD or Kustomize.
• Automating FedRAMP ConMon audit evidence (CM-2, CM-6, AU-2, SC-12) and driving remediation through NIST 800-53 controls.
• Leading changes through ServiceNow CAB / eCAB and Technical Change Reviews.
• Building observability in Grafana, Prometheus and CloudWatch, owning SLIs and SLOs, and joining on-call (PagerDuty) for P1 war rooms and root-cause analysis

Skills

Terraform

Python

Bash

PowerShell

Okta

Entra ID

Kubernetes

GitLab CI

Jenkins

Tools

HashiCorp Vault

AWS

GCP

Azure

CloudFormation

Helm

ArgoCD

Kustomize

Job description

Zearch are delighted to be hiring on behalf of one of the largest managed cloud. They build and run secure cloud and AI environments for key customers.

These are environments that cannot fail. Speed, rigor and trust matter, and your expertise is relied on from day one.

This is a senior role built for an engineer who already brings deep expertise in Zero Trust, automated compliance engineering and multi-cloud security. If you have 5-7 years in SecDevOps, cloud security or platform engineering and want your work protecting missions that cannot fail, this could be the role for you.

Why this role:

You’ll build security into the deployment fabric itself, using Infrastructure as Code and Policy-as-Code across AWS, Azure and GCP. It suits a proven mid-level engineer ready for broader architecture scope, or an experienced practitioner who wants direct operational impact.

What you'll be doing

You’ll design, automate and maintain secure cloud infrastructure and CI/CD pipelines, keeping federal environments secure, compliant and repeatable.

Day-to-day, that means:

• Operating Zero Trust architectures (Zscaler ZPA / PRA), including app connectors, privileged remote access and private application boundaries
• Owning the secrets lifecycle in HashiCorp Vault, with automated credential flows and programmatic rotation
• Integrating federated identity (Okta, Entra ID, AWS IAM Identity Center), supporting multi-cloud identity migrations and enforcing least privilege
• Building multi-tenant infrastructure in Terraform (CloudFormation as needed), with networking, IAM and security groups mapped to FedRAMP IL4 controls
• Developing secure CI/CD pipelines (GitLab CI, Azure DevOps, Jenkins) with OPA or Azure Policy gates and embedded SAST, SCA and container scanning
• Deploying and troubleshooting workloads on EKS, AKS and GKE via Helm, ArgoCD or Kustomize
• Automating FedRAMP ConMon audit evidence (CM-2, CM-6, AU-2, SC-12) and driving remediation through NIST 800-53 controls
• Leading changes through ServiceNow CAB / eCAB and Technical Change Reviews
• Building observability in Grafana, Prometheus and CloudWatch, owning SLIs and SLOs, and joining on-call (PagerDuty) for P1 war rooms and root-cause analysis

What we're looking for

• 5-7 years in SecDevOps, Cloud Security Engineering, DevOps or Platform Engineering
• Hands-on production experience with at least one hyperscaler (ideally Azure or GCP), plus working exposure to AWS
• High proficiency in Terraform and strong scripting (Python, Bash or PowerShell)
• Practical experience with enterprise identity (Okta, Entra ID) and secrets management (Vault, AWS KMS, Azure Key Vault)
• Experience operating EDR, CSPM or vulnerability tools such as CrowdStrike, Wiz or Qualys
• Experience building and troubleshooting Docker and Kubernetes environments
• A working understanding of FedRAMP, NIST 800-53 or SOC 2
• Sole U.S. citizenship (dual citizens cannot be considered)

Nice to Have

• HashiCorp Terraform Associate
• AWS SysOps Administrator or Solutions Architect (Associate)
• Security+, CISSP or an equivalent security credential

Why Apply

• Mission-critical work securing some of the most sensitive government environments in the country
• Real architecture scope across all three major clouds, at federal scale
• A senior seat where your expertise is relied on and the impact is immediate and measurable