Senior Technical Lead

Job Summary We are seeking an experienced Senior DevSecOps / Security Automation Engineer to design, build, and automate hardened infrastructure baselines and security compliance controls for enterprise deployments. The engineer will be responsible for creating repeatable hardened OVA images for RHEL 8, RHEL 9, and Windows Server 2022, automating DISA STIG/SRG controls, integrating compliance scanning into deployment workflows, and generating security evidence required to support ATO activities. Key Responsibilities Hardened Base Image Engineering Design, build, and maintain automated pipelines for hardened OVA base images for: RHEL 8 RHEL 9 Windows Server 2022 Develop repeatable image-build processes that provide standardized foundations for component deployments. Apply applicable DISA STIG controls during the image-build process. Generate DISA STIG Viewer CKL compliance artifacts for each image release. Build component-ready OVAs containing required application/component prerequisites where appropriate. Implement image versioning, checksum generation, signing/hashing, and release traceability. Maintain release records covering image versions, STIG releases, CKLs, and approved/known exceptions. Rebuild hardened images based on applicable DISA STIG and OS vendor patch releases as prioritized through the work backlog. Security Controls & Compliance Automation Develop and maintain a STIG Applicability Matrix mapping operating systems and application components to applicable DISA STIGs and SRGs. Identify appropriate DISA SRGs when a product-specific STIG is unavailable. Automate implementation of applicable security controls across operating system and application layers. Develop reusable automation for infrastructure and security configuration, preferably using Ansible and related automation technologies. Automate compliance scans using tools such as SCAP Compliance Checker (SCC) and/or OpenSCAP. Generate CKL evidence for OS and component instances as part of deployment and upgrade workflows. Identify and document STIG/SRG controls that cannot be implemented or that adversely affect application functionality. Document technical justification, mitigation/compensating controls, and recommended POA&M entries for identified exceptions. Develop mechanisms to detect and report configuration drift against approved hardened baselines. Apply CIS Benchmarks as supplemental guidance only where appropriate and approved. Skill Requirements Strong hands-on experience with RHEL 8/9 security hardening Experience with Windows Server 2022 hardening and configuration Strong experience with Ansible and infrastructure/configuration automation Experience building or maintaining VMware OVA/virtual machine images Practical understanding of: DISA STIG DISA SRG STIG Viewer and CKL files SCAP OpenSCAP and/or SCAP Compliance Checker POA&M Security baselines and configuration drift Experience developing automated, repeatable CI/CD or image-build pipelines Experience with scripting and automation using Python, PowerShell, Bash, or equivalent technologies Understanding of version control and automated release management using Git-based workflows Ability to troubleshoot security hardening controls that conflict with OS or application functionality. Preferred Skills Experience supporting environments subject to ATO/security authorization requirements Experience automating security evidence collection and compliance reporting. Experience with application-layer security hardening in addition to OS hardening. Knowledge of CIS Benchmarks and their relationship to organizational security baselines. Experience integrating security validation into CI/CD or deployment pipelines. Experience with enterprise VMware environments and automated VM/image deployment. Other Requirements Looking for U.S. citizens for this role and prefer to work from Fortcollins, USA, but any other locations in USA is also fine.