Engineer, Software

Our Core Values Our core values define who we are as an organization and serve as the foundation of our code of ethics. We expect them to be technically solid in their area of expertise and for those researching to demonstrate scientific rigor. Dedication: Our team achieves success because of our dedication to carrying out high-quality work and delivering trusted results. The DevSecOps Engineer designs, builds, secures and operates the cloud infrastructure that hosts federal research data platforms, including public websites, request management applications, searchable data catalogs and data processing pipelines. The role combines cloud and DevOps engineering with information security engineering. It owns the infrastructure, deployment automation, monitoring, backup and disaster recovery for each environment, and it implements and continuously monitors the security controls required by NIH, HHS and federal standards (FISMA, NIST SP 800-53 Moderate, HIPAA and the NIH security standards for controlled-access data repositories). The ideal candidate combines hands-on Amazon Web Services (AWS) engineering skills (compute, storage, databases, networking, identity and serverless services), infrastructure as code and CI/CD pipeline automation with practical security engineering experience in threat detection, vulnerability management, security documentation and audit readiness. Cloud infrastructure and operations Design, provision and maintain secure, scalable AWS environments that host public websites, web applications, APIs and data platforms, using services such as Amazon EC2 behind Elastic Load Balancing, Amazon S3 (with lifecycle policies to S3 Glacier), Amazon RDS for PostgreSQL, Amazon OpenSearch Service, Amazon API Gateway, AWS Lambda and Amazon CloudFront. Maintain separate development, test and production environments with environment-specific configurations that provide accurate connectivity to compute, data and integrated resources. Architect for high availability, elastic scaling and performance as data volumes, file sizes and user demand grow, including large digital image collections (e.g., DICOM radiology images and digital pathology slides) and multi-modal omics datasets. Build and operate secure data ingestion and distribution services, including secure upload portals, SFTP and AWS Transfer Family endpoints, AWS Lambda validation workflows, and controlled S3 download services for approved investigators. Host and support the infrastructure for metadata search and indexing (Amazon OpenSearch Service), secure APIs, and large language model services (e.g., Amazon Bedrock) used for natural-language search. Support integration with external NIH platforms and systems (e.g., NHLBI BioData Catalyst, the BSI II Biospecimen Inventory and the NHLBI Data Repository) through secure APIs and automated ETL pipelines, including handoff to secure cloud workspaces for analyze-in-place workflows. Manage operating system and software patching (e.g., AWS Systems Manager) and configuration baselines across all servers and services. Leverage AI (e.g. DevOps and CI/CD automation Build and maintain continuous integration/continuous delivery (CI/CD) pipelines that automatically build, test, scan and release code to each environment, supporting daily development and test releases and production releases every two weeks under an Agile process. Terraform or AWS CloudFormation) so that environments are repeatable, version controlled and auditable. Manage source code and infrastructure code in private GitHub repositories owned by the client, with branch protection, code review and secrets management. Work with developers who use AI-assisted development tools to make sure generated code passes automated testing and security scanning before release. Lead the technical side of contract transitions: provision and configure environments, install applications and databases, configure interfaces, integrate external resources, migrate and validate data, execute cutover, and complete production release within compressed timelines (e.g., Leverage AI (e.g. Claude Code) as both a tool to aid DevOps and a component for CI/CD solutions, following organizational guidance and controls. Implement layered administrative, technical and physical safeguards in a FedRAMP-aligned cloud environment that meets FISMA, NIST SP 800-53 (Moderate), HIPAA and NIH/NHLBI security requirements. Design and enforce network security, including virtual private clouds, subnets, security groups, firewalls, intrusion detection, and a multi-zoned architecture that isolates management, application and data environments, with additional project-specific segmentation for sensitive datasets. Administer identity and access management with AWS IAM and Amazon Cognito, including role-based access control, least-privilege authorization, multifactor authentication, federated login (e.g., NIH and institutional credentials) and secure remote access. Encrypt data at rest and in transit with AWS Key Management Service (KMS), and manage keys, secrets and certificates. Deploy, configure and tune AWS security services, including AWS WAF in front of web applications and APIs, Amazon GuardDuty for continuous threat detection, Amazon Macie for discovery and classification of sensitive data in S3 (supporting validation of de-identification controls), and AWS Security Hub for centralized security posture, prioritized remediation and audit-ready reporting. Configure centralized logging and monitoring with AWS CloudTrail and Amazon CloudWatch, generate alerts for operational and security events, and investigate and respond to security incidents. Perform continuous monitoring, vulnerability scanning, container and dependency scanning, and static and dynamic application security testing, and track findings to remediation. Develop and maintain the Information System Security Plan (ISSP) and related security documentation (risk assessments, contingency, configuration management and incident response plans), review and update the ISSP quarterly, and support security assessment and authorization (ATO) activities and agency security reviews. Operate controlled-access data workflows in compliance with the NIH Required Security and Operational Standards for Controlled-Access Data Repositories (NOT-OD-25-159), including centralized access logging, periodic access reviews, support for data access renewals, and investigation of potential non-compliance. Maintain a complete, tamper-resistant audit trail of system access, requests, approvals and data distributions to support program management and federal data sharing compliance. Conduct periodic quality assurance audits of security controls, access permissions and audit logs, and routine checks of encryption status, user access privileges and backup completion; report security and data integrity metrics. Leverage AI (e.g. Backup, disaster recovery and continuity Implement automated daily backups of all changes to electronic resources and weekly encrypted cross-region replication to a geographically remote location using AWS Backup and S3 replication. Monitor and validate backup jobs for completion and data integrity, and regularly test restoration and disaster recovery procedures. Document backup, recovery and business continuity procedures within the ISSP and related standard operating procedures. Work with software developers, data managers, business analysts and project managers to translate application and data requirements into secure infrastructure designs. PIV credentials) and comply with associated agency policies. Provide security guidance, Security Rules of Behavior briefings and role-based security awareness training (e.g., incident response and contingency roles) to project staff. Additional duties for those serving in a technical lead capacity Serve as technical lead for cloud infrastructure and security on one or more projects. Set infrastructure, deployment and security standards and review the work of other engineers and programmers. Coordinate with members from other teams to ensure project requirements are met. Formulate written infrastructure and security plans that tie technical tasks to project scope. Cloud compute, storage and data AWS EC2, Elastic Load Balancing, S3 and S3 Glacier, RDS (PostgreSQL), OpenSearch Service, CloudFront, Transfer Family/SFTP Serverless, APIs and AI services AWS Lambda, Amazon API Gateway, Amazon Bedrock AWS IAM, Amazon Cognito, federated identity (SAML/OIDC), multifactor authentication AWS WAF, Amazon GuardDuty, Amazon Macie, AWS Security Hub, AWS KMS, AWS Secrets Manager, Amazon Inspector Logging and monitoring AWS CloudTrail, Amazon CloudWatch, centralized log management or SIEM tools AWS Backup, cross-region replication, snapshot and restore testing Infrastructure as code and configuration Terraform, AWS CloudFormation, AWS Systems Manager Git and GitHub, GitHub Actions or AWS CodePipeline, Agile ticketing (e.g., Docker, Amazon ECS or EKS, AWS Fargate Security testing Vulnerability scanning (e.g., SonarQube, OWASP ZAP), dependency and container scanning Python, Bash, PowerShell FISMA, NIST SP 800-53, NIST Risk Management Framework, FedRAMP, HIPAA Security Rule, NIH NOT-OD-25-159 Bachelor's degree in computer science, computer engineering, information security or a related field, with at least eight (8) years of progressively more responsible experience in systems engineering, cloud infrastructure, DevOps or security engineering. At least three (3) years of hands-on experience designing and operating production workloads on AWS (e.g., EC2, S3, RDS, IAM, VPC networking, Lambda, CloudWatch). Experience building and maintaining CI/CD pipelines and infrastructure as code (e.g., Demonstrated experience implementing security controls for cloud-hosted applications and data, including identity and access management, multifactor authentication, encryption and key management, network segmentation, and logging and monitoring. Working knowledge of federal security frameworks, including FISMA, NIST SP 800-53, the NIST Risk Management Framework and the HIPAA Security Rule. Experience implementing and testing backup and disaster recovery procedures. Proficiency in at least one scripting language (e.g., Python, Bash or PowerShell). Experience with version control (Git) in a collaborative, Agile workflow. AWS certification (e.g., AWS Certified Security - Specialty, AWS Certified Solutions Architect or AWS Certified DevOps Engineer) or security certification (e.g., Experience operating NIH controlled-access data repositories or other systems handling sensitive health research data, and familiarity with NOT-OD-25-159. Experience configuring AWS WAF, GuardDuty, Macie and Security Hub. Experience with Amazon OpenSearch Service and Amazon Bedrock or other large language model services. Experience managing large imaging data (e.g., DICOM or digital pathology) and secure file transfer services. Experience with Section 508 and WCAG requirements for federal websites. Experience supporting federal contracts and contract transitions; Remote Overnight Travel: Base Compensation also includes various individual factors unique to each candidate such as job level, prior experience, skill set, certifications, and education, which may impact the compensation structure.