Senior DevSecOps Engineer

Responsibilities

• Operate and improve AWS environments, Kubernetes clusters, and CI platforms while migrating workloads into a new AWS GovCloud organization.
• Build a multi-account AWS GovCloud organization and segmented network planes using Transit Gateway, firewalls, IPAM, PrivateLink, and VPNs.
• Deliver secure environment ingress and egress and troubleshoot cross-account cloud networking.
• Own the software supply chain from commit to cluster, including CI/CD runner fleets, FIPS-validated images, signed artifacts, replicated registries, and private PKI.
• Translate NIST SP 800-171 and CMMC controls into automated guardrails and evidence while triaging and reducing security findings.
• Write design notes, merge request reviews, and runbooks and improve shared AI-assisted engineering workflows.
• Roll out and support AI developer tooling and operate MCP servers and agent runtimes.

Requirements

• 7+ years of experience in infrastructure, platform, security, or site reliability engineering, including 3+ years building on AWS with infrastructure as code.
• Bachelor's degree in Computer Science, Computer Engineering, or a related field, or equivalent practical experience.
• Production experience with Terraform or OpenTofu, including reusable modules, state management, imports, refactors, and plan review.
• Proficiency in Python and/or Go plus shell scripting and strong technical writing skills.
• Deep hands-on AWS multi-account experience with IAM policy evaluation, Organizations, service control policies, and Identity Center or equivalent federation.
• Hands-on cloud networking experience with VPCs, Transit Gateway routing and segmentation, firewalls, DNS, PrivateLink, and site-to-site VPN with BGP.
• CI/CD and container supply-chain experience covering image builds, signing and verification, secrets management, and vulnerability scanning.
• Experience operating access to hosted model services or an LLM gateway and working with AI coding agents and their security risks.
• Preferred qualifications include AWS GovCloud, FedRAMP, NIST SP 800-171, CMMC, ITAR-controlled environments, greenfield landing zones, private PKI, HSM-backed key management, mTLS, service mesh, GitOps, LLM gateway operations, MCP security, production Kubernetes, FIPS 140-3 cryptography, aerospace or defense programs, DoD or USG deployment programs, and the ability to hold and maintain a USG Security Clearance.

Benefits

• Medical, dental, and vision insurance.
• 401k retirement plan, short- and long-term disability insurance, and life insurance.
• Flexible PTO, 11 paid holidays, sick time, and paid parental leave.
• Full-time position in San Jose, California, with preference for onsite work while considering hybrid and remote candidates.