Job Description Mid-Level DevSecOps Engineer

Location: Washington, DC 20105 | Ashburn, VA 20147 | Manassas, VA 20109 remote with client sites visits

Department: Engineering / Infrastructure Modernization

Reporting To: CBO Engineering Leads / IRM Leadership

Role Overview

The Mid-Level DevSecOps Engineer will join CBO s hybrid cloud engineering team to enhance infrastructure automation, CI/CD pipelines, container orchestration, and secure software delivery practices. This role focuses on extending established DevSecOps frameworks, ensuring compliance with federal mandates, and strengthening security integration across the software lifecycle.

Key Responsibilities

• Infrastructure as Code: Maintain and improve Terraform/Open Tofu modules, manage state files, refactor legacy configurations.
• Configuration as Code: Develop and maintain Ansible playbooks for system configuration, compliance enforcement, and patch management.
• CI/CD Pipelines: Build and optimize GitHub Actions workflows with integrated security gates (SAST, dependency scanning, secrets detection, policy-as-code).
• Container Management: Author Docker files, manage Kubernetes manifests/Helm charts, enforce RBAC, and ensure vulnerability-free container images.
• Security Integration: Implement shift-left security practices, enforce CIS benchmarks, support NIST SP 800-53/FISMA compliance, and produce audit-ready documentation.
• Participate in sprint planning, stand-ups, and peer reviews.
• Adhere to CBO s change management, documentation, and security policies.
• Deliver structured knowledge transfer sessions and finalize production-ready repositories.

Required Qualifications & Experience

• Hands-on expertise with Terraform/OpenTofu (modules, remote state, workspaces).
• Proficiency in Ansible (playbooks, roles, dynamic inventories, Ansible Vault).
• Strong experience with GitHub Actions (matrix builds, reusable workflows, security integration).
• Working knowledge of Docker and Kubernetes (image hardening, Helm charts, RBAC).
• Familiarity with SAST tools (Semgrep, Checkov, tfsec), secrets scanning (Gitleaks, Detect-Secrets), and policy-as-code (OPA/Rego).
• Proficiency with Git workflows (branching, pull requests, protected branches).

Preferred Skills

• Experience in federal or highly regulated environments.
• Knowledge of NIST SP 800-53, FISMA, FedRAMP compliance.
• Cloud platform experience (AWS).
• Familiarity with Hashi Corp Vault or equivalent secrets management tools.
• Scripting proficiency in Python and Bash.

Deliverables & Phases

• Phase 1 (Onboarding & Discovery): Access setup, discovery sessions, 90-day roadmap.
• Phase 2 (Active Development): IaC modules, Ansible playbooks, CI/CD workflows, container configs.
• Phase 3 (Optimization & Hardening): Refactor code, compliance reviews, pipeline validation.
• Phase 4 (Knowledge Transfer & Closeout): Documentation, runbooks, final sign-off.

Performance Metrics

• Timely delivery of sprint/phase deliverables.
• Quality of code contributions (peer-reviewed).
• Compliance with CBO engineering/security baselines.
• Reduction in manual configuration drift and pipeline failures.