Senior Platform Engineer

EMPLOYER IS A CONTRACTOR FOR THE U.S. GOVERNMENT. THIS POSITION WILL REQUIRE U.S. CITIZENSHIP AND AN ACTIVE TOP SECRET CLEARANCE.

Role Description

Defense Unicorns is seeking a senior DevSecOps Engineer to embed with a government team and its technology partners building an emerging AI-powered engineering ecosystem.

This role sits at the intersection of platform engineering, cybersecurity, compliance, and software delivery. The engineer will help establish secure, automated, and repeatable pipelines that allow software, AI models, and agentic capabilities to move rapidly from development into operational environments while identifying cybersecurity and compliance risks early—before formal security testing.

The ideal candidate is a hands-on DevSecOps engineer with deep experience in Kubernetes, cloud infrastructure, CI/CD, NIST 800-53, and the RMF/ATO process. They should be comfortable working directly with government personnel and multiple commercial technology partners, troubleshooting across technical boundaries, and translating security requirements into practical engineering controls rather than treating compliance as a downstream gate.

This is an embedded engineering role—not a traditional security or compliance staff-augmentation position. The engineer will help the team move quickly, build security into the development lifecycle, and create repeatable patterns that can scale from the initial prototype environment into higher-classification operational environments.

Responsibilities

• Design, implement, and continuously improve secure CI/CD and GitOps pipelines for cloud-native software, AI models, and agentic applications.
• Work hands-on with Kubernetes and Red Hat OpenShift/OpenShift AI environments to automate secure build, test, promotion, deployment, and lifecycle workflows.
• Translate NIST SP 800-53 controls and RMF requirements into practical engineering controls, policies, pipeline checks, and automated evidence collection.
• Identify cybersecurity, compliance, configuration, and supply-chain risks early in the development lifecycle—before formal security testing or authorization activities.
• Support the end-to-end ATO/RMF lifecycle, including control implementation, technical evidence generation, security artifacts, remediation tracking, and preparation for assessment.
• Build and maintain automated security checks across source code, dependencies, container images, infrastructure, configurations, and deployment pipelines.
• Implement software supply-chain security practices including SBOM generation, provenance, artifact signing, vulnerability scanning, policy enforcement, and controlled artifact promotion.
• Develop Infrastructure as Code using Terraform, Pulumi, Ansible, or similar technologies to make environments consistent, auditable, and repeatable.
• Configure and improve GitLab CI/CD pipelines, runners, registries, and automated workflows across multiple environments.
• Integrate identity, secrets management, policy enforcement, logging, monitoring, and security tooling into the broader engineering platform.
• Collaborate with platform, data, AI/agent, and architecture engineers to ensure security and compliance requirements are designed into the system rather than bolted on later.
• Work directly with commercial technology partners to resolve cross-platform security, deployment, identity, networking, and integration issues.
• Help establish repeatable approaches for promoting software and AI capabilities across security domains and into classified operational environments.
• Develop security automation and compliance-as-code patterns that reduce manual effort and accelerate authorization decisions.
• Create and maintain architecture decision records, security documentation, technical standards, runbooks, and implementation guidance.
• Continuously identify recurring security and compliance work that can be standardized, automated, or productized rather than solved manually for each environment.
• Operate effectively in a fast-moving, ambiguous environment where requirements and architecture will continue to evolve.

Travel / Onsite Expectations: Must be local to the National Capital Region and able to work onsite at the government campus in Springfield, VA as mission requirements evolve. The initial prototype environment may support a hybrid schedule, but the role should be prepared for increasing onsite and SCIF interaction as the effort transitions to higher-classification environments.

Minimum Experience and Qualifications

• Active TS/SCI clearance.
• Must reside in or be local to the National Capital Region with the ability to work onsite in Springfield, VA as required.
• Deep hands-on experience with Kubernetes and containerized application environments.
• Experience deploying and operating workloads on Red Hat OpenShift and/or enterprise Kubernetes platforms.
• Strong experience with GitLab CI/CD or comparable software delivery platforms.
• Strong working knowledge of NIST SP 800-53 and the Risk Management Framework (RMF).
• Practical understanding of the government ATO process, including control implementation, security evidence, POA&M/remediation, assessment, and authorization activities.
• Experience identifying and remediating security risks in software and infrastructure before formal security testing.
• Experience developing and managing Infrastructure as Code using Terraform, Pulumi, Ansible, or similar technologies.
• Strong experience with Helm, Kubernetes manifests, GitOps, and declarative configuration management.
• Experience with cloud environments such as AWS, including networking, IAM, compute, storage, and Kubernetes services.
• Strong Linux systems knowledge and ability to troubleshoot across application, container, Kubernetes, network, and infrastructure layers.
• Experience with container security, vulnerability management, artifact repositories/registries, and software supply-chain controls.
• Strong scripting or programming ability using Python, Go, Bash, or similar languages.
• Ability to work directly with government personnel and multiple technology vendors to diagnose and resolve complex technical and security issues.
• Ability to operate with significant autonomy and turn loosely defined mission objectives into working technical solutions.

Preferred Experience and Qualifications

• Experience supporting production systems at Secret or TS/SCI classification levels.
• Experience implementing NIST 800-53 controls in Kubernetes or cloud-native environments.
• Experience with continuous authorization / continuous ATO (cATO) approaches and automated compliance evidence.
• Experience with Red Hat OpenShift AI or similar enterprise AI platforms.
• Experience with AI/ML infrastructure, model serving, GPU-enabled environments, MLOps, or agentic AI systems.
• Experience securing AI/agent workloads, including model provenance, tool access, data access, guardrails, and policy enforcement.
• Experience with GitOps tooling such as Flux or Argo CD.
• Experience with security and compliance tools such as Kyverno, OPA/Gatekeeper, SonarQube, Trivy, Snyk, Anchore, or comparable technologies.
• Experience with SBOM, SLSA/provenance, artifact signing, and software supply-chain security frameworks.
• Experience with identity and access management platforms such as Keycloak or comparable enterprise IAM technologies.
• Experience with observability and telemetry tooling such as Prometheus, Grafana, OpenTelemetry, ELK, or similar platforms.
• Experience moving software, images, or artifacts across multiple security domains or into disconnected/air-gapped environments.
• Familiarity with UDS, Zarf, Pepr, Iron Bank, or similar secure software delivery technologies.
• Department of Defense or Intelligence Community experience working on an operational ATO’d system.
• Experience working on multidisciplinary teams consisting of government engineers, FDEs, OEM professional services teams, and multiple technology vendors.
• Demonstrated ability to turn security and compliance requirements into automated engineering patterns that can be reused across environments.

What Success Looks Like

The successful engineer makes security an accelerator rather than a gate. They help the team identify risk early, automate compliance and evidence wherever practical, keep the delivery pipeline moving, and establish secure patterns that can be reproduced as the environment scales from prototype to classified operations.

Full compensation packages are based on candidate experience. Compensation ranges are established using national benchmarking data and apply across all geographic locations within the United States.

Remote - USA

$148,750 - $201,250 USD

Who We Are

Defense Unicorns delivers mission value by streamlining software delivery so our customers can focus on the most important challenges. We share a vision of freedom and security for the advancement of progress and innovation. Our commitment to this vision, and to our mission-driven customers, means a commitment to speed, user experience and optionality, without compromising security. Our team is composed of innovators, software engineers, and veterans with decades of experience delivering technology programs across the federal market.

What We Do

We create and deliver secure solutions for continuous software integration and delivery. Defense Unicorns consolidates the best practices for security pipelines, testing, and deployment automation in order to meet the high security requirements valued by mission owners. Our solutions are agnostic by design and we believe that growing a robust ecosystem of secure, cloud-native software solutions can help enterprise customers inside and outside the federal market buy and integrate software more easily.

Who We Serve

Defense Unicorns’ customers are mission-focused leaders across public and private enterprises. We proudly support defense and civil agencies across the U.S. government and we work closely with the creators of leading-edge software solutions to deliver value to the mission-owner by improving the security and consumability of commercial software products.

What We Work On

• Cloud Environments (AWS/GCP and Azure)
• Continuous Delivery and automation tooling
• GitOps
• Containers
• CNCF projects and open source products and packages
• Building and improving security delivery
• Building Kubernetes and cloud native applications

Benefits Our Unicorns Enjoy

Health:

• Premiums are 100% Company Paid
• Health Savings Account
• Life Insurance
• Disability Insurance
• 401k Retirement Plan
• Company Stock Options
• Home Office Budget

Leave:

• We offer all full-time Unicorns Flexible Time Off (FTO) plus all Federal Holidays, one week for Thanksgiving, and two weeks for Christmas and New Year’s

Learning:

• Reimbursement for approved trainings/subscriptions
• Conferences (travel, lodging, and fees)

Don’t have all the preferred experience or qualifications? Studies show that underrepresented groups like women and people of color are less likely to apply to jobs if they don't meet every requirement listed.

At Defense Unicorns, we're committed to diversity. If you're enthusiastic about the role but don't match every criteria, we encourage you to apply. You could be the perfect fit for this or another role! Defense Unicorns is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, disability, sex, sexual orientation, gender identity or expression, age, national origin, veteran status, genetic information, union status and/or beliefs, or any other characteristic protected by federal, state, or local law.

Voluntary Self-Identification

For government reporting purposes, we ask candidates to respond to the below self‑identification survey. Completion of the form is entirely voluntary. Whatever your decision, it will not be considered in the hiringprocess or thereafter. Any information that you do provide will be recorded and maintained in aconfidential file.

As set forth in Defense Unicorns’s Equal Employment Opportunity policy,we do not discriminate on the basis of any protected group status under any applicable law.

If you believe you belong to any of the categories of protected veterans listed below, please indicate by making the appropriate selection.As a government contractor subject to the Vietnam Era Veterans Readjustment Assistance Act (VEVRAA), we request this information in order to measurethe effectiveness of the outreach and positive recruitment efforts we undertake pursuant to VEVRAA. Classification of protected categoriesis as follows:

A "disabled veteran" is one of the following: a veteran of the U.S. military, ground, naval or air service who is entitled to compensation (or who but for the receipt of military retired pay would be entitled to compensation) under laws administered by the Secretary of Veterans Affairs; or a person who was discharged or released from active duty because of a service-connected disability.

A "recently separated veteran" means any veteran during the three-year period beginning on the date of such veteran's discharge or release from active duty in the U.S. military, ground, naval, or air service.

An "active duty wartime or campaign badge veteran" means a veteran who served on active duty in the U.S. military, ground, naval or air service during a war, or in a campaign or expedition for which a campaign badge has been authorized under the laws administered by the Department of Defense.

An "Armed forces service medal veteran" means a veteran who, while serving on active duty in the U.S. military, ground, naval or air service, participated in a United States military operation for which an Armed Forces service medal was awarded pursuant to Executive Order 12985.