{"schemaVersion":"jobsearcher.job.v1","id":"6d6dd24b9e0892326677a89b","url":"https://jobsearcher.com/jobs/6d6dd24b9e0892326677a89b","canonicalUrl":"https://jobsearcher.com/jobs/6d6dd24b9e0892326677a89b","title":"DevSecOps Manager","description":"Location: Onsite – Fairfax, VA · U.S. Citizen Required (ITAR / Government Customer Requirements)Type: Full TimeJob descriptionNextgenID is hiring an on-site, hands-on DevSecOps Manager to lead the security and platform operations for multi-cloud services running across AWS, Azure, and Google Cloud, managing a global network of identity verification stations.This is a player/coach role: you will lead daily execution while setting the security and delivery standards required for SOC 2 (12–18 months) and FedRAMP Moderate. The role has a defined growth path to Director/VP based on performance, operating maturity, and leadership impact.Role Fit & Non-NegotiablesOnsite in Fairfax, VA — remote is not available.U.S. citizen required due to ITAR and government customer obligations.Comfortable operating as an incident leader when needed, with primary operational hours generally 8am–7pm EST.Hands-on ownership of security posture and DevOps/platform execution — this is not a policy-only or advisory role.What You’ll Own (90–180 Day Outcomes)Establish an audit-ready Secure SDLC and begin the transition from Azure DevOps (ADO) to GitHub, aligned with FedRAMP expectations.Implement pragmatic CI/CD controls: SAST/SCA, secrets scanning, infrastructure-as-code scanning, environment protections, and evidence capture.Harden multi-cloud identity and access: federation/SSO, least privilege, break-glass, and periodic access reviews.Improve detection and response using Elastic; mature vulnerability management using Qualys with SLAs, dashboards, and exception governance.Strengthen Windows fleet security using our custom command center: patching strategy, rollout rings/canary, rollback, remote isolate, baseline hardening, and telemetry coverage.Stand up a repeatable operating cadence: standups, change control, incident review, postmortems, and measurable reliability/security KPIs.Key ResponsibilitiesSecurity Leadership (Hands-On)Own threat modeling and security architecture across edge, cloud, and SDLC.Lead incident response end-to-end (triage, containment, eradication, recovery, postmortem).Drive identity, encryption/key management, logging, detection engineering, and secure configuration baselines.DevOps / Platform Engineering (Hands-On)Own CI/CD pipelines and release governance across Kubernetes and VM-based workloads.Define and enforce golden paths (templates, approved patterns, environment promotion, rollback) that accelerate delivery while improving security.Select and standardize infrastructure-as-code approach (Terraform/CloudFormation/Bicep/Pulumi) and implement policy guardrails.Compliance Execution (SOC 2 & FedRAMP Moderate)Translate compliance requirements into engineering deliverables (controls, automation, evidence, continuous monitoring).Partner with GRC to prepare audit-ready artifacts without creating manual, high-friction processes.Create operational runbooks and control evidence that meets assessor scrutiny (NIST 800-53 mindset).People Leadership (Player/Coach)Lead and mentor a small SOC/NOC and DevOps team, with clear priorities and accountability.Create a culture of high standards: measurable goals, calm execution under pressure, and continuous improvement.Hire and scale the team as the platform and compliance program grow.Required Qualifications7+ years in Security Engineering, DevOps, Platform/SRE, or equivalent roles with direct production ownership.Demonstrated experience building and operating secure CI/CD and release governance; experience with Azure DevOps and/or GitHub Actions.Strong cloud security fundamentals and hands-on delivery experience in at least two of AWS/Azure/GCP (multi-cloud preferred).Practical Windows security experience; ability to harden and operate Windows 10/11 environments at scale (IoT/embedded a plus).Incident response leadership experience (performed as incident commander or equivalent).Hands-on experience with SIEM/telemetry operations (Elastic preferred) and vulnerability management (Qualys preferred).Proven ability to lead, mentor, and build a small team; able to set standards without becoming a bottleneck.Must be able to work onsite in Fairfax, VA; U.S. citizen.Preferred QualificationsFedRAMP Moderate experience (NIST 800-53 controls, SSP support, continuous monitoring, assessor engagement) and/or SOC 2 readiness delivery.Kubernetes security experience (RBAC, admission control, network policy, image policy, workload identity) plus VM hardening experience.Software supply chain maturity: SBOM, signed artifacts/provenance, dependency governance, runner hardening, secretless authentication (OIDC).Device fleet operations: staged rollouts, canary rings, rollback safety, remote isolation, and resilience under intermittent connectivity.PKI/credential management exposure: certificate lifecycle (issue/renew/revoke), CRL/OCSP concepts, HSM/KMS custody patterns, and separation of duties.Signals We Look ForYou can explain how you prevent CI/CD credential theft and guarantee artifact integrity (OIDC/short-lived creds, signing/provenance, environment protections).You have led real incidents and can describe decisions, containment steps, and postmortem-driven improvements — not just tool lists.You think in terms of guardrails and golden paths: standardization that increases velocity while improving security and reliability.You can operate across Windows edge realities (physical exposure, patching/rings, remote isolate) and cloud control planes.What Success Looks LikeSecurity controls are implemented as automated guardrails, not manual gates; delivery speed improves while risk decreases.Incidents are handled predictably with documented playbooks and measurable improvements (MTTD/MTTR, recurrence reduction).SOC 2 and FedRAMP readiness progress with high-quality evidence capture and continuous monitoring, minimizing manual audit churn.The team becomes independent and scalable, enabling a Director-level operating model.","company":"Nextgenid","rawCompany":"nextgenid","city":"Virginia","state":"IL","isRemote":false,"isActive":false,"createdAt":"2026-05-24T07:27:12.768Z","occupations":[{"code":"15-1299.08","title":"Computer Systems Engineers/Architects","slug":"computer-systems-engineers-architects"},{"code":"15-1244.00","title":"Network and Computer Systems Administrators","slug":"network-and-computer-systems-administrators"},{"code":"15-1299.05","title":"Information Security Engineers","slug":"information-security-engineers"}],"industries":[{"code":"541512","title":"Computer Systems Design Services","slug":"computer-systems-design-services"},{"code":"541511","title":"Custom Computer Programming Services","slug":"custom-computer-programming-services"},{"code":"513210","title":"Software Publishers","slug":"software-publishers"}],"jobPosting":{"@context":"https://schema.org","@type":"JobPosting","title":"DevSecOps Manager","description":"Location: Onsite – Fairfax, VA · U.S. Citizen Required (ITAR / Government Customer Requirements)Type: Full TimeJob descriptionNextgenID is hiring an on-site, hands-on DevSecOps Manager to lead the security and platform operations for multi-cloud services running across AWS, Azure, and Google Cloud, managing a global network of identity verification stations.This is a player/coach role: you will lead daily execution while setting the security and delivery standards required for SOC 2 (12–18 months) and FedRAMP Moderate. The role has a defined growth path to Director/VP based on performance, operating maturity, and leadership impact.Role Fit & Non-NegotiablesOnsite in Fairfax, VA — remote is not available.U.S. citizen required due to ITAR and government customer obligations.Comfortable operating as an incident leader when needed, with primary operational hours generally 8am–7pm EST.Hands-on ownership of security posture and DevOps/platform execution — this is not a policy-only or advisory role.What You’ll Own (90–180 Day Outcomes)Establish an audit-ready Secure SDLC and begin the transition from Azure DevOps (ADO) to GitHub, aligned with FedRAMP expectations.Implement pragmatic CI/CD controls: SAST/SCA, secrets scanning, infrastructure-as-code scanning, environment protections, and evidence capture.Harden multi-cloud identity and access: federation/SSO, least privilege, break-glass, and periodic access reviews.Improve detection and response using Elastic; mature vulnerability management using Qualys with SLAs, dashboards, and exception governance.Strengthen Windows fleet security using our custom command center: patching strategy, rollout rings/canary, rollback, remote isolate, baseline hardening, and telemetry coverage.Stand up a repeatable operating cadence: standups, change control, incident review, postmortems, and measurable reliability/security KPIs.Key ResponsibilitiesSecurity Leadership (Hands-On)Own threat modeling and security architecture across edge, cloud, and SDLC.Lead incident response end-to-end (triage, containment, eradication, recovery, postmortem).Drive identity, encryption/key management, logging, detection engineering, and secure configuration baselines.DevOps / Platform Engineering (Hands-On)Own CI/CD pipelines and release governance across Kubernetes and VM-based workloads.Define and enforce golden paths (templates, approved patterns, environment promotion, rollback) that accelerate delivery while improving security.Select and standardize infrastructure-as-code approach (Terraform/CloudFormation/Bicep/Pulumi) and implement policy guardrails.Compliance Execution (SOC 2 & FedRAMP Moderate)Translate compliance requirements into engineering deliverables (controls, automation, evidence, continuous monitoring).Partner with GRC to prepare audit-ready artifacts without creating manual, high-friction processes.Create operational runbooks and control evidence that meets assessor scrutiny (NIST 800-53 mindset).People Leadership (Player/Coach)Lead and mentor a small SOC/NOC and DevOps team, with clear priorities and accountability.Create a culture of high standards: measurable goals, calm execution under pressure, and continuous improvement.Hire and scale the team as the platform and compliance program grow.Required Qualifications7+ years in Security Engineering, DevOps, Platform/SRE, or equivalent roles with direct production ownership.Demonstrated experience building and operating secure CI/CD and release governance; experience with Azure DevOps and/or GitHub Actions.Strong cloud security fundamentals and hands-on delivery experience in at least two of AWS/Azure/GCP (multi-cloud preferred).Practical Windows security experience; ability to harden and operate Windows 10/11 environments at scale (IoT/embedded a plus).Incident response leadership experience (performed as incident commander or equivalent).Hands-on experience with SIEM/telemetry operations (Elastic preferred) and vulnerability management (Qualys preferred).Proven ability to lead, mentor, and build a small team; able to set standards without becoming a bottleneck.Must be able to work onsite in Fairfax, VA; U.S. citizen.Preferred QualificationsFedRAMP Moderate experience (NIST 800-53 controls, SSP support, continuous monitoring, assessor engagement) and/or SOC 2 readiness delivery.Kubernetes security experience (RBAC, admission control, network policy, image policy, workload identity) plus VM hardening experience.Software supply chain maturity: SBOM, signed artifacts/provenance, dependency governance, runner hardening, secretless authentication (OIDC).Device fleet operations: staged rollouts, canary rings, rollback safety, remote isolation, and resilience under intermittent connectivity.PKI/credential management exposure: certificate lifecycle (issue/renew/revoke), CRL/OCSP concepts, HSM/KMS custody patterns, and separation of duties.Signals We Look ForYou can explain how you prevent CI/CD credential theft and guarantee artifact integrity (OIDC/short-lived creds, signing/provenance, environment protections).You have led real incidents and can describe decisions, containment steps, and postmortem-driven improvements — not just tool lists.You think in terms of guardrails and golden paths: standardization that increases velocity while improving security and reliability.You can operate across Windows edge realities (physical exposure, patching/rings, remote isolate) and cloud control planes.What Success Looks LikeSecurity controls are implemented as automated guardrails, not manual gates; delivery speed improves while risk decreases.Incidents are handled predictably with documented playbooks and measurable improvements (MTTD/MTTR, recurrence reduction).SOC 2 and FedRAMP readiness progress with high-quality evidence capture and continuous monitoring, minimizing manual audit churn.The team becomes independent and scalable, enabling a Director-level operating model.","datePosted":"2026-05-24T07:27:12.768Z","dateModified":"2026-05-24T07:27:12.768Z","hiringOrganization":{"@type":"Organization","name":"Nextgenid","sameAs":"https://jobsearcher.com"},"jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"Virginia","addressRegion":"IL","addressCountry":"US"}},"identifier":{"@type":"PropertyValue","name":"JobSearcher","value":"6d6dd24b9e0892326677a89b"},"url":"https://jobsearcher.com/jobs/6d6dd24b9e0892326677a89b"}}