DevSecOps Project Lead (Sr DevSecOps Engineer)

Red Cell Partners is an incubation firm focused on building and investing in technology-led companies in healthcare, cyber, and national security. The DevSecOps Project Lead will be responsible for building and operating a delivery platform for an AI-enabled program in a government cloud environment, ensuring security is integrated from the start and leading a team of engineers.

Responsibilities:

• Own the initial platform deployment into the government IL-5 environment, which is the program's first contract deliverable and lands early
• Build and prove the pipeline and infrastructure as code on our own cloud first, using portable templates, so deployment into the government environment is a port rather than a build
• Deploy early and deliberately to surface the real network, security, and interface constraints while there is still time to design around them
• Track and drive the government-side prerequisites this deliverable depends on: account and boundary provisioning, network path, certificates, approved service list, approved base-image source, container registry access, scanning-tool approvals, and package-repository egress policy
• Own the CI/CD pipeline end to end: build, test, static and dynamic security analysis, software composition analysis, container and infrastructure-as-code scanning, SBOM generation, and gated promotion to production
• Establish and operate development, test, and production environments in AWS GovCloud at IL-5
• Build the platform so it is reusable across programs rather than rebuilt for each one
• Make the architecture calls for the delivery platform: account and boundary structure, network path, identity integration, container strategy, and hardened base images
• Work within an approved-service list and an approved base-image source, and drive those decisions to closure with the customer's cloud and security staff
• Design for zero-downtime deployment and rehearsed rollback
• Build observability into the platform: metrics, logging, tracing, and alerting sufficient to find and fix problems in production before users report them
• Integrate CAC / PIV authentication and role-based access control
• Implement security controls from week one and produce the control evidence continuously from the pipeline
• Own the security artifact package: System Security Plan inputs, SBOMs, STIG and SCAP results, scan results, test coverage, audit trails, and pipeline gate definitions
• Serve as the engineering counterpart to the customer's security and accreditation staff, and support the authorization decision on their timeline
• Drive an evidence-based authorization approach in which the assessment consumes pipeline output directly rather than requiring the same information reassembled by hand
• Absorb cyber and RMF responsibility for the program, with support from dedicated cyber staff as the team grows
• Own the release cadence, from capability intake through production deployment, on both commercial and government timelines
• Establish and report delivery and reliability metrics: deployment frequency, lead time for change, change failure rate, and time to restore service
• Secure standing release approval or an automated-change exemption so continuous delivery is operationally real and not just technically true
• Integrate monitoring and alerting with the customer's network and security operations centers
• Direct a small group of platform, cloud, and DevOps engineers as the program ramps, including partner and subcontractor staff
• Set the standards the rest of engineering builds against: environment parity, branching, release hygiene, secrets handling, and infrastructure as code
• Communicate clearly about status, risk, and tradeoffs, and escalate blockers early

Requirements:

• 8+ years of DevOps and DevSecOps engineering experience, including at least one production pipeline owned end to end at scale
• 3+ years working in DoW or federal cloud environments at IL-4 or IL-5, or an equivalent authorized environment. AWS GovCloud strongly preferred
• Hands-on keyboard while leading. You make the architecture calls and you build. This role is not a coordination or oversight function
• Cloud and infrastructure depth: containers and orchestration (Docker, Kubernetes or equivalent), infrastructure as code (Terraform, CloudFormation, or similar), and CI/CD tooling on at least one major cloud, including hardened base images and image promotion
• Observability practice: you instrument what you build and use metrics and logs to drive improvements, rather than waiting on incident reports
• Security built into delivery: you treat security scanning, compliance validation, and evidence generation as normal pipeline stages
• Direct experience supporting an ATO, cATO, or equivalent authorization, including producing the artifacts an assessor actually accepts
• A track record of standing something up under a hard deadline, in an environment where access, approvals, and accounts were outside your control. You have shipped a first deployment into a government environment on a fixed date, and you know what has to be in motion beforehand to make that possible
• Ready on day one. The first deliverable comes early, so we need someone who arrives with a pipeline pattern they already know works and adapts it, rather than researching an approach from scratch
• An owner: you drive work to done, communicate status and risk plainly, and do not need to be managed through the details
• US Citizenship Required
• Active US Secret clearance. The work is performed in a controlled government cloud environment and requires a favorable investigation and CAC eligibility from the start
• Willingness to travel up to 25% to customer sites, DEFCON AI HQ, and vendor facilities as required
• Active TS/SCI Clearance
• Experience taking a program from an empty government cloud account to a deployed, authorized production system
• Hands-on experience managing a complete ATO or cATO pathway in production, and familiarity with continuous authorization models
• Working knowledge of DoW impact-level boundaries and the Cloud Computing SRG
• Iron Bank container certification experience, and familiarity with STIG and SCAP tooling, ACAS, OpenSCAP, and FIPS requirements
• Experience with AWS Bedrock or comparable managed inference services inside a government boundary, including model enablement and boundary constraints
• Familiarity with government secure-software platforms such as Second Front (Game Warden), Stormbreaker, or Black Pearl
• Experience integrating with enterprise ICAM or IdP services and DoD PKI
• Experience working alongside partner or subcontractor engineering pods
• Experience delivering into a high-volume federal case-processing or workflow environment handling sensitive personal data