DevSecOps Project Lead (Sr DevSecOps Engineer)

DEFCON AI is an insights company that leverages artificial intelligence, mathematical optimization, data analytics, and software engineering for resilient optimization of complex systems. The DevSecOps Project Lead will build and operate the delivery platform for a new AI-enabled program in a government cloud environment, overseeing the CI/CD pipeline, infrastructure, and security controls while leading a team of engineers.

Responsibilities:

• Own the initial platform deployment into the government IL-5 environment, which is the program's first contract deliverable and lands early
• Build and prove the pipeline and infrastructure as code on our own cloud first, using portable templates, so deployment into the government environment is a port rather than a build
• Deploy early and deliberately to surface the real network, security, and interface constraints while there is still time to design around them
• Track and drive the government-side prerequisites this deliverable depends on: account and boundary provisioning, network path, certificates, approved service list, approved base-image source, container registry access, scanning-tool approvals, and package-repository egress policy
• Own the CI/CD pipeline end to end: build, test, static and dynamic security analysis, software composition analysis, container and infrastructure-as-code scanning, SBOM generation, and gated promotion to production
• Establish and operate development, test, and production environments in AWS GovCloud at IL-5
• Build the platform so it is reusable across programs rather than rebuilt for each one
• Make the architecture calls for the delivery platform: account and boundary structure, network path, identity integration, container strategy, and hardened base images
• Work within an approved-service list and an approved base-image source, and drive those decisions to closure with the customer's cloud and security staff
• Design for zero-downtime deployment and rehearsed rollback
• Build observability into the platform: metrics, logging, tracing, and alerting sufficient to find and fix problems in production before users report them
• Integrate CAC / PIV authentication and role-based access control
• Implement security controls from week one and produce the control evidence continuously from the pipeline
• Own the security artifact package: System Security Plan inputs, SBOMs, STIG and SCAP results, scan results, test coverage, audit trails, and pipeline gate definitions
• Serve as the engineering counterpart to the customer's security and accreditation staff, and support the authorization decision on their timeline
• Drive an evidence-based authorization approach in which the assessment consumes pipeline output directly rather than requiring the same information reassembled by hand
• Absorb cyber and RMF responsibility for the program, with support from dedicated cyber staff as the team grows
• Own the release cadence, from capability intake through production deployment, on both commercial and government timelines
• Establish and report delivery and reliability metrics: deployment frequency, lead time for change, change failure rate, and time to restore service
• Secure standing release approval or an automated-change exemption so continuous delivery is operationally real and not just technically true
• Integrate monitoring and alerting with the customer's network and security operations centers
• Direct a small group of platform, cloud, and DevOps engineers as the program ramps, including partner and subcontractor staff
• Set the standards the rest of engineering builds against: environment parity, branching, release hygiene, secrets handling, and infrastructure as code
• Communicate clearly about status, risk, and tradeoffs, and escalate blockers early

Requirements:

• 8+ years of DevOps and DevSecOps engineering experience, including at least one production pipeline owned end to end at scale
• 3+ years working in DoW or federal cloud environments at IL-4 or IL-5, or an equivalent authorized environment. AWS GovCloud strongly preferred
• Hands-on keyboard while leading. You make the architecture calls and you build. This role is not a coordination or oversight function
• Cloud and infrastructure depth: containers and orchestration (Docker, Kubernetes or equivalent), infrastructure as code (Terraform, CloudFormation, or similar), and CI/CD tooling on at least one major cloud, including hardened base images and image promotion
• Observability practice: you instrument what you build and use metrics and logs to drive improvements, rather than waiting on incident reports
• Security built into delivery: you treat security scanning, compliance validation, and evidence generation as normal pipeline stages
• Direct experience supporting an ATO, cATO, or equivalent authorization, including producing the artifacts an assessor actually accepts
• A track record of standing something up under a hard deadline, in an environment where access, approvals, and accounts were outside your control. You have shipped a first deployment into a government environment on a fixed date, and you know what has to be in motion beforehand to make that possible
• Ready on day one. The first deliverable comes early, so we need someone who arrives with a pipeline pattern they already know works and adapts it, rather than researching an approach from scratch
• An owner: you drive work to done, communicate status and risk plainly, and do not need to be managed through the details
• US Citizenship Required
• Active US Secret clearance. The work is performed in a controlled government cloud environment and requires a favorable investigation and CAC eligibility from the start
• Willingness to travel up to 25% to customer sites, DEFCON AI HQ, and vendor facilities as required
• Active TS/SCI Clearance
• Experience taking a program from an empty government cloud account to a deployed, authorized production system
• Hands-on experience managing a complete ATO or cATO pathway in production, and familiarity with continuous authorization models
• Working knowledge of DoW impact-level boundaries and the Cloud Computing SRG
• Iron Bank container certification experience, and familiarity with STIG and SCAP tooling, ACAS, OpenSCAP, and FIPS requirements
• Experience with AWS Bedrock or comparable managed inference services inside a government boundary, including model enablement and boundary constraints
• Familiarity with government secure-software platforms such as Second Front (Game Warden), Stormbreaker, or Black Pearl
• Experience integrating with enterprise ICAM or IdP services and DoD PKI
• Experience working alongside partner or subcontractor engineering pods
• Experience delivering into a high-volume federal case-processing or workflow environment handling sensitive personal data