Senior DevSecOps Engineer

ComPsych is modernizing its software delivery practices by moving to the cloud and standardizing CI/CD. The Senior DevSecOps Engineer will lead infrastructure and CI/CD design across application teams, direct and validate AI-built automation, establish secure engineering standards, support observability and production operations, and coach teams on effective use of AI.

Responsibilities:

• Own CI/CD and infrastructure design across the teams you support. Architecture, deployment strategy (blue/green, canary, feature flags), and the specs that direct AI-built pipelines, infrastructure code, and automation — coding yourself when it counts
• Decide what needs verification and prove it does the job. Pipeline tests, policy-as-code, and security gates are a design decision, not a default — you validate that they actually prove what they claim
• Build shared standards with the rest of DevSecOps, not one-off fixes per team. Work with your DevSecOps peers on the common patterns, tooling, and practices that make every team you support faster and safer, and contribute your own experience back into what the group builds
• Own application observability and unblock teams in production. Instrument the services you support, tie alerting to product SLOs, and help engineers across teams debug and resolve issues quickly when something breaks
• Keep judgment and accountability human. Reviews, deployment calls, on-call response, and what an incident teaches you stay yours, regardless of who or what wrote the code
• Raise the bar for how the teams you support work with AI, coaching engineers on specifying, delegating, and validating rather than treating DevSecOps as someone else's problem

Requirements:

• You already work this way. Agentic AI is your primary surface for planning and building CI/CD and infrastructure — you write specs it can execute against and catch what it gets subtly wrong, not just what fails a test
• You've built and operated production CI/CD and cloud infrastructure at real scale (AWS or Azure), including carrying on-call load, so you know what good looks like independent of who, or what, writes the code
• You treat testing, security, and observability as designed-in requirements, not something a separate function catches later. In a system that carries behavioral health data, “it works” and “it's safe” are the same bar
• You work effectively across multiple application teams and with your DevSecOps peers, building practices that generalize rather than solving the same problem differently each time — judgment AI doesn't replace
• You have hands-on depth building application CI/CD and deployment automation: containers and Kubernetes for application workloads (Helm or similar), serverless functions, and one or more IaC tools (Terraform, CloudFormation, or ARM) used in production, plus fluency in at least one modern language (for example, Python or Java)
• You build security in, shift-left by default. SAST/DAST/SCA and secrets scanning in the pipeline, least-privilege IAM, and encryption in transit and at rest are the norm, built within the compliance frameworks we operate under, including HIPAA/HITRUST and SOC 2