Senior DevOps/Compliance Engineer (FedRAMP 20x Continuous Compliance)

UberEther is a leader in the hyper-secure infrastructure space for Identity and Access Management (IAM) and compliance acceleration. The Senior DevOps/Compliance Engineer will build and operate CI/CD pipelines and automation for FedRAMP 20x compliance, ensuring continuous adherence to key security requirements.

Responsibilities:

• Serve as the principal DevOps authority for implementing FedRAMP 20x KSI requirements into the CI/CD and operations model
• Define and maintain the automation roadmap for operationalizing all the KSIs across the FedRAMP KSI families within the Advantage DevOps toolchain
• Lead design sessions with engineering to determine how each KSI is enforced, tested, and evidenced in the deployment pipeline
• Drive technical decision-making on pipeline gating, automated policy checks, and continuous monitoring instrumentation
• Partner with the Senior Architect and Compliance BU leadership to translate KSI mapping decisions into working DevOps procedures
• Establish DevOps standards and design patterns for KSI enforcement that can be reused across future GCP engagements
• Own the end-to-end implementation of CI/CD pipelines and automation that enforce FedRAMP 20x KSI requirements across Advantage deployments on Google Cloud Platform
• Build and maintain Infrastructure as Code (Terraform, Deployment Manager) that encodes KSI controls directly into GCP deployments
• Implement automation that continuously collects and packages compliance evidence for each of the KSIs
• Stand up container security scanning, network segmentation enforcement, and secrets management within the CI/CD pipeline
• Build and maintain GitLab CI/CD pipelines, Terraform modules, and secure deployment tooling for the environment
• Champion DevSecOps practices, ensuring KSI-aligned security gates are built into every pipeline stage from day one
• Author and maintain Standard Operating Procedures (SOPs) covering deployment, monitoring, incident response, and KSI verification for the platform
• Lead working sessions with engineering to document repeatable, auditable procedures for maintaining KSI compliance post-authorization
• Produce SOP documentation suitable for assessor review, mapping each procedure back to its corresponding KSI
• Support 3PAO assessments and FedRAMP 20x reviews by walking through operational procedures and evidence pipelines
• Translate compliance requirements into operational runbooks that align with Advantage delivery standards
• Drive continuous improvement of SOPs based on assessor feedback, CR26 verification results, and evolving FedRAMP 20x guidance
• Work closely with the Compliance Architect and SoC functions to ensure monitoring dashboards and alerting satisfy KSI evidence requirements
• Build automated KSI verification jobs that continuously confirm each of the KSI families remains in a compliant state
• Maintain remediation runbooks and system hardening procedures specific to the GCP-hosted environment
• Support 3PAO assessments and audits by producing and explaining automated evidence packages tied to each KSI
• Implement Policy as Code and machine readable/OSCAL-based evidence generation across the CI/CD pipeline
• Ensure proper integration between GCP-native security tooling, pipeline automation, and UberEther's compliance evidence model
• Foster technical collaboration between UberEther's Compliance BU, Platform Engineering, and customer engineering team
• Mentor engineers on DevSecOps practices, GCP automation, and FedRAMP 20x continuous monitoring requirements
• Lead retrospectives focused on improving pipeline reliability and KSI enforcement for future GCP engagements
• Participate in Level 10 (L10) meetings, providing DevOps insight on progress and cross-team dependencies
• Develop training content and SOP walkthroughs to help engineers operate within FedRAMP 20x continuous compliance requirements
• Serve as a technical ambassador for UberEther's DevOps and continuous compliance capabilities with Ping and future GCP customers

Requirements:

• Bachelor's degree in Computer Science, Engineering, or related technical field; equivalent experience considered
• 8+ years of experience in DevOps, site reliability engineering, or platform automation roles
• 3+ years of experience building CI/CD pipelines and automation on Google Cloud Platform (GCP)
• Proven track record of implementing security or compliance controls directly into deployment pipelines
• Experience supporting FedRAMP, DoD, or other federal compliance frameworks in an operational capacity
• Expert-level knowledge of Google Cloud Platform (GCP) services, IAM, networking, and security tooling, with relevant certifications (Professional Cloud DevOps Engineer preferred)
• Strong understanding of FedRAMP 20x Key Security Indicators (KSIs) and how they translate into pipeline and operational controls
• Deep expertise in Infrastructure as Code tools (Terraform, Deployment Manager) and GitOps workflows
• Strong experience with containerization and orchestration (Docker, Kubernetes/GKE) in secure, compliance-focused environments
• Hands-on experience with CI/CD platforms such as GitLab CI/CD, including pipeline security gating and policy enforcement
• Experience with compliance automation and evidence-generation tooling, including OSCAL and Policy as Code frameworks
• Solid understanding of FedRAMP 20x requirements, KSI families, and continuous compliance obligations
• Working knowledge of NIST 800-53 security controls and how they are operationalized in a CI/CD environment
• Experience supporting Assessment & Authorization (A&A) activities from an operations or DevOps perspective
• Experience with FISMA, FIPS 140-2, and related federal security requirements
• Proven ability to translate compliance requirements into working automation, SOPs, and evidence pipelines
• Strong communication skills with ability to document clear, assessor-ready SOPs and explain automation to technical and non-technical audiences
• Proven ability to work cross-functionally with architects, engineers, and compliance staff without direct authority
• Strong customer-facing skills with experience supporting federal customers and compliance assessors during technical reviews
• Demonstrated ability to manage multiple automation and documentation workstreams simultaneously
• Track record of driving pipeline and process improvements in fast-paced, dynamic environments
• Professional certifications: Google Professional Cloud DevOps Engineer, CKA/CKAD, AWS/GCP security certifications, or CISSP
• Prior experience supporting a FedRAMP 20x pilot engagement
• Background in writing SOPs or operational documentation for federally authorized systems
• Experience building automated OSCAL or KSI evidence pipelines
• Experience with compliance automation frameworks such as OSCAL, InSpec, or similar Policy as Code tools
• Hands-on experience operating IAM platforms such as Ping Identity, SailPoint, CyberArk, or Radiant Logic
• Track record of building internal tooling or automation that reduced manual compliance effort