DevSecOps Engineer
XCell is a digital services company that uses the power of design to transform organizations and strengthen the communities around us. We work in small, fast-paced agile teams supporting Government, Non-Profit, and Educational clients — and we're hiring a DevSecOps Engineer to join a federal engineering team supporting the Congressional Budget Office in Washington, DC.Heads up before you read further: • On-site in Washington, DC — not remote, not hybrid • U.S. citizenship required • Must pass a federal background investigation • Contract position • Senior-level bar — 5+ years required, 7+ preferredABOUT THE ROLEThis is not a build-from-scratch gig, and this is not a role for someone who needs hand-holding. You'll walk into an active production environment, read an existing codebase, and start shipping within your first sprint. You'll extend infrastructure automation, CI/CD pipelines, container orchestration, and secure delivery — inheriting existing patterns, following the team's standards, and raising the bar from day one. We're small, high-trust, and growing in the federal space. We need a professional we can trust to run their lane without supervision.
WHAT YOU'LL DO:
- Infrastructure as code — maintain, extend, and refactor Terraform and OpenTofu (modular configs, remote state, workspaces)
- Configuration as code — build Ansible playbooks and roles with dynamic inventories and Ansible Vault
- CI/CD — develop GitHub Actions workflows with security gates: SAST, dependency and secrets scanning, policy-as-code
- Containers — author and harden Dockerfiles, manage Kubernetes manifests and Helm charts, support namespace/RBAC, image scanning
- Security integration — embed SAST/DAST, enforce CIS benchmarks and customer baselines, support NIST and FISMA compliance
- Team delivery — work within version control, change management, and peer-review workflows; participate in stand-ups, sprint planning, and tech reviewsWHAT WE'RE LOOKING FOR
- 5+ years of hands-on DevSecOps, platform, or infrastructure engineering (7+ preferred)
- Demonstrated breadth across the full toolchain — IaC, CI/CD, containers, and security integration, not just one slice
- Hands-on Terraform and OpenTofu (module development, remote state, workspaces)
- Ansible proficiency — playbooks, roles, dynamic inventories, Vault
- GitHub Actions experience — reusable workflows, matrix builds, security-gate integration
- Docker image authoring and hardening; Kubernetes and Helm; container scanning (Trivy or Grype)
- SAST familiarity (Semgrep, Checkov, tfsec), secrets scanning (Gitleaks, Detect-Secrets), policy-as-code (OPA/Rego)
- Strong Git workflow — branching strategies, PR reviews, protected branches
- Proven track record working inside an established team's change-control and peer-review process
- Ability to walk into an existing federal codebase, read it, and ship within your first sprint with minimal onboardingNICE TO HAVE
- Federal or highly regulated environment experience
- NIST SP 800-53, FISMA, FedRAMP familiarity
- AWS experience
- HashiCorp Vault or similar secrets management