Network/Cloud Engineer (DevSecOps/Security)

Description

What You'll Get to Do as a Network/Cloud Engineer (DevSecOps/Security):

• Evaluate cloud hosting architectures across AWS, Azure, and hybrid environments including compute, storage, networking, and managed services utilization
• Assess cloud-native design patterns, serverless adoption, containerization maturity, and platform-as-a-service (PaaS) opportunities
• Review multi-region and multi-availability zone strategies for high availability and disaster recovery
• Evaluate environment design across development, test, staging, and production including environment parity and configuration drift
• Identify cloud cost optimization opportunities including rightsizing, reserved capacity, and architectural efficiency
• Assess alignment with FedRAMP requirements, cloud security best practices, and DHS cloud policies

CI/CD Pipeline & DevSecOps Maturity Evaluation:

• Review Continuous Integration/Continuous Deployment (CI/CD) pipelines including build automation, testing frameworks, and deployment orchestration
• Assess artifact management practices, container registries, and software composition analysis
• Evaluate deployment strategies including blue-green deployments, canary releases, rolling updates, and  rollback procedures
• Review test automation coverage  including unit testing, integration testing, security testing (SAST/DAST), and performance testing
• Assess DevSecOps maturity including security integration within development workflows, shift-left security practices, and automated compliance validation
• Identify pipeline bottlenecks, manual handoffs, and opportunities to accelerate delivery velocity while  maintaining security and quality

Infrastructure-as-Code & Configuration Management:

• Evaluate Infrastructure-as-Code (IaC) adoption using tools such as Terraform, CloudFormation, ARM templates, or similar platforms
• Assess configuration management practices, version control discipline, and code review processes for infrastructure
• Review environment provisioning  automation, infrastructure testing, and policy-as-code implementation
• Evaluate immutable infrastructure patterns, container orchestration (Kubernetes, ECS, AKS), and declarative configuration approaches
• Identify opportunities to reduce configuration drift, improve environment consistency, and enhance infrastructure reliability through automation

Cybersecurity Controls & Authorization Posture:

• Assess Identity and Access Management (IAM) patterns, role-based access control (RBAC), and least-privilege implementation
• Evaluate Multi-Factor Authentication (MFA) enforcement, privileged access management (PAM), and secrets management practices
• Review Security Information and Event Management (SIEM) integration, centralized logging coverage, and log retention compliance
• Assess alerting mechanisms, threat detection capabilities, and Security Orchestration, Automation and  Response (SOAR) maturity
• Evaluate incident response preparedness, playbook documentation, and security operations center (SOC) integration
• Review vulnerability management practices including scanning frequency, remediation workflows, and patch management automation
• Assess compliance with NIST SP 800-53 security controls, Risk Management Framework (RMF) requirements, and continuous monitoring practices

Legacy Technology Risk & Remediation Strategy:

• Identify risks stemming from unsupported legacy technologies including end-of-life operating systems, bsolete middleware, and deprecated frameworks
• Assess compensating controls, vulnerability exposure, and attack surface associated with legacy components
• Recommend remediation strategies  including containerization, platform upgrades, refactoring, or replacement
• Develop migration roadmaps that balance security risk reduction with operational stability and resource constraints
• Advise on interim security measures and risk mitigation during transition periods

Performance, Scalability & Resilience Engineering:

• Assess performance monitoring, observability platforms, and application performance management (APM) implementation
• Evaluate auto-scaling configurations,  capacity planning practices, and surge handling capabilities
• Review continuity strategies including  multi-region architectures, failover mechanisms, and disaster recovery  automation
• Assess backup strategies, recovery  testing practices, and Recovery Time Objective (RTO)/Recovery Point Objective (RPO) alignment
• Identify performance bottlenecks, scalability constraints, and opportunities for architectural optimization

Modern Architecture Enablers & Integration Patterns:

• Recommend adoption of API gateways for centralized API management, traffic control, and security policy enforcement
• Evaluate service mesh opportunities  (Istio, Linkerd, AWS App Mesh) to improve microservices observability, security, and resilience
• Assess automation platforms and orchestration tools that can improve operational efficiency and reduce manual toil
• Identify opportunities to leverage  managed services, serverless computing, and event-driven architectures
• Recommend container orchestration,  service discovery, and distributed tracing implementations
• Advise on interoperability improvements through standardized APIs, event streaming, and asynchronous messaging patterns

Zero Trust & Modern Identity Architecture:

• Evaluate alignment with zero-trust security principles including continuous verification, least-privilege access, and micro-segmentation
• Assess software-defined perimeter implementations, identity-based access controls, and context-aware  authentication
• Review encryption at rest and in transit, certificate management, and cryptographic key management practices
• Recommend modern identity architectures including federated identity, single sign-on (SSO), and attribute-based access control (ABAC)

Documentation & Technical Narrative Development:

• Support documentation of hosting and technical environment findings with clear, evidence-based analysis
• Draft modernization engineering  narratives that translate technical assessments into strategic recommendations
• Create architecture diagrams, pipeline  visualizations, and security control mappings
• Contribute to assessment profiles with DevSecOps and cloud maturity inputs
• Provide technical recommendations  accessible to both engineering teams and executive audiences

Requirements

• Bachelor's degree and 15+ years of  infrastructure, cloud, and security engineering experience across hybrid cloud and on-premises environments
• Hands-on experience architecting and implementing solutions on AWS and/or Azure including core services (compute, storage, networking, databases, security)
• Demonstrated expertise designing and implementing CI/CD pipelines, DevSecOps workflows, and automated deployment strategies
• Proficiency with Infrastructure-as-Code tools (Terraform, CloudFormation, ARM templates, Ansible, or similar)
• Deep understanding of security control implementation across cloud and hybrid environments
• Experience assessing technical maturity, identifying gaps, and recommending practical modernization strategies
• Strong analytical skills with the ability to evaluate complex technical environments and distill findings into actionable recommendations
• Ability to obtain DHS Entry on Duty (EOD) clearance

Desired Qualifications:  

• FedRAMP authorization experience including security assessment, continuous monitoring, and compliance documentation
• Familiarity with NIST Risk Management Framework (RMF), Authority to Operate (ATO) processes, and federal security control baselines
• Knowledge of DHS cloud policies, Trusted Internet Connection (TIC) 3.0 requirements, and DHS Enterprise Architecture standards
• Experience implementing zero-trust architecture principles including software-defined perimeter, micro-segmentation, and identity-centric security
• Hands-on experience with container  orchestration platforms (Kubernetes, Docker, ECS, AKS)
• Background with service mesh  architectures (Istio, Linkerd, Consul) and API gateway platforms (Kong, Apigee, AWS API Gateway)
• Proficiency with observability and  monitoring tools (Prometheus, Grafana, Datadog, Splunk, ELK stack)
• Experience with security automation tools including SAST/DAST scanners, dependency scanning, and compliance-as-code platforms
• Cloud certifications: AWS Solutions Architect, AWS DevOps Engineer, Azure Solutions Architect, Azure DevOps      Engineer, or equivalent
• Security certifications: CISSP, CCSP,  or cloud security specialty certifications
• DevOps/DevSecOps certifications or demonstrable expertise
• Experience supporting federal IT  modernization programs or cloud migration initiatives
• Background in Site Reliability Engineering (SRE) practices and chaos engineering principle