DevSecOps - Classified Compute

Requisition Id 17301 An active TS, Q, or TS/SCI clearance is required for consideration. Overview: The Field Intelligence Operations Division in the National Security Sciences Directorate at the Oak Ridge National Laboratory is seeking qualified applicants for an experienced DevSecOps Engineer/Architect to design, implement, automate, and sustain secure software and infrastructure delivery capabilities supporting classified national security missions.This position will help establish modern DevSecOps practices within highly controlled computing environments where security, configuration management, traceability, reliability, and mission availability are essential.The successful candidate will work across software development, infrastructure engineering, HPC, cybersecurity, Information Assurance, and mission teams to develop secure and repeatable methods for building, testing, deploying, configuring, and sustaining systems and applications.Unlike traditional DevOps positions, this role must account for the unique operational constraints of classified environments, including restricted connectivity, disconnected or air-gapped networks, controlled software introduction, security accreditation requirements, configuration baselines, vulnerability management, and rigorous change control.Major Duties/Responsibilities: Design and implement secure DevSecOps architectures supporting classified applications, infrastructure, and computational environments.Develop and maintain CI/CD pipelines that integrate software development, testing, security validation, deployment, and configuration management.Design DevSecOps solutions capable of operating in disconnected, restricted-connectivity, and air-gapped environments.Develop automated processes for software build, testing, artifact management, security scanning, release management, and deployment.Integrate security controls and security testing throughout the software and infrastructure lifecycle.Implement Infrastructure as Code (IaC) and configuration-as-code practices to improve repeatability, traceability, consistency, and recovery.Develop automated system provisioning and configuration capabilities using technologies such as Ansible, Terraform, Git-based workflows, or comparable platforms.Implement automated compliance validation and configuration enforcement where appropriate.Integrate vulnerability scanning, software composition analysis, static analysis, container scanning, secrets detection, and other security capabilities into delivery pipelines.Support secure container development and deployment, including image creation, scanning, registry management, signing, validation, and lifecycle management.Establish secure artifact repositories and processes for transferring, validating, approving, and distributing software within classified environments.Design solutions supporting software supply-chain security, provenance, integrity verification, dependency management, and controlled software introduction.Develop standardized deployment patterns for Linux servers, HPC environments, containers, applications, and supporting infrastructure.Implement automated testing and validation to reduce deployment risk and configuration drift.Develop monitoring, logging, observability, and alerting capabilities supporting operational and cybersecurity requirements.Partner with Information Assurance and cybersecurity personnel to map automated technical controls and evidence to RMF and ATO requirements.Support the development of repeatable evidence-generation processes for security assessments, configuration reviews, vulnerability management, and continuous monitoring.Assist engineering teams in implementing STIGs, security baselines, hardened configurations, and approved technical standards.Participate in architecture reviews, security reviews, change-control processes, technical interchange meetings, and deployment readiness reviews.Develop documentation, standard operating procedures, reference architectures, pipeline standards, and reusable automation.Mentor software developers, systems engineers, administrators, and other technical personnel in secure development and automation practices.Evaluate emerging DevSecOps technologies and recommend solutions appropriate for classified and mission-critical environments.Deliver ORNL’s mission by aligning behaviors, priorities, and interactions with our core values of Impact, Integrity, Teamwork, Safety, and Service. Promote equal opportunity by fostering a respectful workplace – in how we treat one another, work together, and measure success.Basic Qualifications:BS degree in computer science, computer engineering, cybersecurity, software engineering, information technology, or a related technical field and relevant professional experience. Equivalent combinations of education and experience may be considered.Demonstrated experience with DevOps, DevSecOps, software engineering, systems engineering, or infrastructure automation.Strong Linux administration and scripting experience.Experience developing or administering CI/CD pipelines.Experience with source-control and Git-based development workflows.Experience with infrastructure automation and configuration-management technologies.Working knowledge of containers and modern application deployment practices.Understanding of cybersecurity principles including least privilege, vulnerability management, system hardening, secrets management, logging, and secure configuration.Demonstrated ability to automate repeatable technical processes using languages such as Python, Bash, PowerShell, or similar technologies.An active TS, Q, or TS/SCI clearance is required for consideration.Preferred Qualifications: Familiarity with GitLab, GitHub Enterprise, or comparable source-control platforms.Experience with CI/CD pipelines using GitLab CI/CD, Jenkins, GitHub Actions, or comparable technologies.Experience with infrastructure automation and configuration management tools, such as Ansible, Terraform, Puppet, or Chef.Experience with container technologies, such as Docker, Podman, or Apptainer/Singularity.Familiarity with container orchestration platforms, such as Kubernetes or OpenShift.Experience with artifact and container repositories, such as Nexus, Artifactory, or Harbor.Familiarity with static and dynamic application security testing.Experience with software composition analysis and dependency management.Familiarity with Software Bills of Materials (SBOMs) and associated tooling.Familiarity with container and artifact signing and secrets-management technologies.Experience with automated STIG and security compliance validation.Experience with observability and monitoring technologies, such as Prometheus, Grafana, ELK/OpenSearch, or Splunk.Experience with Red Hat Enterprise Linux or comparable enterprise Linux platforms.Familiarity with HPC and scientific computing environments.Experience supporting GPU-accelerated computing and AI/ML infrastructure.Familiarity with applicable security frameworks, policies, and compliance requirements, including NIST security controls, RMF, ICD 503, STIGs, FIPS, DOE and DoW security requirements, and classified-system accreditation processes.Previous experience working in an SCI or SAP environment or supporting SCI operations.Strong organizational skills, attention to detail, and the ability to manage multiple priorities, deadlines, and documentation requirements.Strong written and verbal communication skills, including the ability to develop clear technical documentation and communicate effectively with engineering, cybersecurity, project, and mission stakeholders.Ability to exercise discretion and sound judgment when handling sensitive personnel and security matters.Ability to work independently and collaboratively in highly controlled environments, adhering to disciplined configuration management, documentation, and change-control processes.Experience developing or maintaining SOPs, process documentation, metrics, or workflow improvements.Demonstrated ability to provide responsive customer service while maintaining security and compliance requirements.Special Requirements:This position requires the ability to obtain and maintain a Sensitive Compartmented Information (SCI) clearance from the Department of Energy. As such, this position is a Workplace Substance Abuse (WSAP) testing designated position. WSAP positions require passing a pre-placement drug test and participation in an ongoing random drug testing program. In addition, due the SCI, you may also be subject to random polygraph testing. Visa sponsorship is not available for this position.About ORNL:As a U.S. Department of Energy (DOE) Office of Science national laboratory, ORNL has an impressive 80-year legacy of addressing the nation’s most pressing challenges. Our team is made up of over 7,000 dedicated and innovative individuals! Our goal is to create an environment where a variety of perspectives and backgrounds are valued, ensuring ORNL is known as a top choice for employment. These principles are essential for supporting our broader mission to drive scientific breakthroughs and translate them into solutions for energy, environmental, and security challenges facing the nation.ORNL offers competitive pay and benefits programs to attract and retain individuals who demonstrate exceptional work behaviors. The laboratory provides a range of employee benefits, including medical and retirement plans and flexible work hours, to support the well-being of you and your family. Employee amenities such as on-site fitness, banking, and cafeteria facilities are also available for added convenience.Other benefits include the following: Prescription Drug Plan, Dental Plan, Vision Plan, 401(k) Retirement Plan, Contributory Pension Plan, Life Insurance, Disability Benefits, Generous Vacation and Holidays, Parental Leave, Legal Insurance with Identity Theft Protection, Employee Assistance Plan, Flexible Spending Accounts, Health Savings Accounts, Wellness Programs, Educational Assistance, Relocation Assistance, and Employee Discounts.This position will remain open for a minimum of 5 days after which it will close when a qualified candidate is identified and/or hired.We accept Word (.doc, .docx), Adobe (unsecured .pdf), Rich Text Format (.rtf), and HTML (.htm, .html) up to 5MB in size. Resumes from third party vendors will not be accepted; these resumes will be deleted and the candidates submitted will not be considered for employment.If you have trouble applying for a position, please email View email address on click.appcast.io is an equal opportunity employer. All qualified applicants, including individuals with disabilities and protected veterans, are encouraged to apply. UT-Battelle is an E-Verify employer.