Mid Level DevSecOps Engineer - Public Trust Tier 2 clearance

Job Description

Job Description

Job Description

Clearance: Public Trust Tier 2 clearance level is required

Objectives

CBO maintains a hybrid cloud infrastructure environment supported by established DevSecOps practices, security baselines, and federal compliance frameworks. To advance its modernization initiatives, CBO seeks DevSecOps Engineering Services to augment existing engineering staff and expand upon established infrastructure automation, CI/CD pipeline capabilities, container orchestration, and security-hardened delivery practices. The objective is to extend and mature its existing infrastructure automation and secure software delivery capabilities.

Scope of Work

• The Contractor shall provide qualified personnel to integrate seamlessly with CBO’s engineering team, build upon established procedures and guidelines, and contribute meaningfully across the following areas:
• • Infrastructure as Code (IaC) using Terraform and OpenTofu
  • Configuration as Code (CaC) using Ansible
  • CI/CD pipeline development and maintenance using GitHub Actions
  • Container build, management, and orchestration using Docker and Kubernetes
  • Security integration and compliance hardening aligned with CBO baselines and federal mandates
• The Contractor will not be expected to design from scratch; rather, the engineer(s) will inherit existing patterns, adhere to CBO engineering standards, and incrementally enhance capabilities within an active production environment.
• The Contractor personnel shall attend applicable stand-ups, sprint planning, and technical review sessions.
• The Contractor shall work within CBO's established version control, change management, and peer review workflows. No changes shall be pushed to production environments without following CBO's change advisory process. The Contractor shall follow CBO's documentation standards for all deliverables and maintain clear records of changes made to shared codebases and pipelines.
• The Contractor shall adhere to all CBO security policies, including but not limited to, access control requirements, acceptable use policies, and data handling procedures.

The scope of work includes, but is not limited to, the following activities:

Infrastructure as Code (IaC) — Terraform / OpenTofu

The Contractor shall maintain, extend, and improve existing Terraform and OpenTofu codebases used to provision and manage CBO's cloud and hybrid infrastructure. This includes writing modular, reusable configurations; managing state files and remote backends; performing plan/apply workflows within

Attachment J6 CB26-RFQ0012

approved change control processes; and refactoring legacy configurations to align with current engineering standards. The Contractor shall not introduce new tooling without prior CBO IRM approval.

Configuration as Code (CaC) — Ansible

The Contractor shall develop and maintain Ansible playbooks and roles to automate system configuration, compliance enforcement, patch management, and application deployment across CBO's server and network infrastructure. All playbooks shall adhere to CBO's existing role structure, variable conventions, and inventory management standards.

CI/CD Pipeline Development — GitHub Actions

The Contractor shall build, maintain, and improve GitHub Actions workflows to automate build, test, security scanning, and deployment processes for CBO software and infrastructure pipelines. Pipelines shall incorporate security gates including static analysis (SAST), dependency scanning, secrets detection, and policy-as-code validation. All workflow changes shall be peer-reviewed and comply with CBO's branching and approval standards.

Container Management — Docker and Kubernetes

The Contractor shall support containerized application delivery using Docker for image builds and Kubernetes for orchestration. Responsibilities include writing and maintaining Dockerfiles following image hardening best practices, managing Kubernetes manifests and Helm charts, supporting namespace and RBAC configuration, and assisting with cluster health monitoring and troubleshooting. All container images shall be scanned for vulnerabilities prior to deployment.

Security Integration and Compliance Hardening

The Contractor shall integrate security practices throughout the software delivery lifecycle (Shift-Left security). This includes incorporating SAST/DAST scanning tools into pipelines, enforcing CIS benchmarks and CBO security baselines on infrastructure and container configurations, supporting NIST SP 800-53 and FISMA compliance requirements, and producing documentation to support audit and assessment activities.

Required Technical Skills

• Infrastructure as Code: Hands-on experience with Terraform and OpenTofu, including module development, remote state management, and workspace management
• Configuration as Code: Proficiency with Ansible, including playbook and role development, dynamic inventories, and Ansible Vault for secrets management
• CI/CD: Demonstrated experience designing and maintaining GitHub Actions workflows, including reusable workflows, matrix builds, and security gate integration
• Containers: Working knowledge of Docker image authoring and hardening, Kubernetes manifest and Helm chart management, and container security scanning tools (e.g., Trivy, Grype, or equivalent)
• Security Integration: Familiarity with SAST tools (e.g., Semgrep, Checkov, tfsec), secrets scanning (e.g., Gitleaks, Detect-Secrets), and policy-as-code frameworks (e.g., OPA/Rego)
• Version Control: Proficiency with Git-based workflows including branching strategies, pull request reviews, and protected branch enforcement

Preferred Skills

• Experience in a federal or highly regulated environment
• Familiarity with NIST SP 800-53, FISMA, and FedRAMP compliance requirements
• Cloud platform experience (AWS)
• Experience with secrets management tools (e.g., HashiCorp Vault)
• Scripting proficiency in Python and Bash

Ohm Systems, Inc. specializes in IT and Healthcare staffing services, dedicated to linking highly skilled professionals with our public and private clients across the United States. Our track record showcases our commitment to delivering outstanding staffing and consultancy solutions to our clients. We prioritize diversity and inclusivity and take pride in being an employer that promotes equal opportunities and affirmative action. Our goal is to foster an inclusive work environment that embraces individuals from all backgrounds, irrespective of their gender, race, or orientation.

Company Description

Ohm Systems, Inc. specializes in IT and Healthcare staffing services, dedicated to linking highly skilled professionals with our public and private clients across the United States. Our track record showcases our commitment to delivering outstanding staffing and consultancy solutions to our clients. We prioritize diversity and inclusivity and take pride in being an employer that promotes equal opportunities and affirmative action. Our goal is to foster an inclusive work environment that embraces individuals from all backgrounds, irrespective of their gender, race, or orientation.