Dev/Sec Ops Engineer

Overview In this role you support the Congressional Budget Office’s engineering team by maturing infrastructure automation, CI/CD pipelines, container orchestration, and security-hardened delivery practices. You work in a production, hybrid-cloud environment, extending established patterns while adhering to change control and audit requirements. You collaborate with cross-functional teams to implement shift-left security, CIS/NIST baselines, and compliant delivery workflows. This position offers meaningful impact through secure, scalable infrastructure and regulated project delivery. ResponsibilitiesMaintain, extend, and refactor Terraform/OpenTofu codebases with modular configurations, remote state, and backend managementDevelop and maintain Ansible playbooks and roles for configuration, compliance, patch management, and application deploymentEnhance GitHub Actions workflows with security gates (SAST, dependency scanning, secrets detection, policy-as-code)Support containerized delivery using Docker and Kubernetes; author hardened images, manifests, and Helm charts with vulnerability scanningEnforce shift-left security, CIS benchmarks, and NIST SP 800-53/FISMA compliance throughout deliveryFollow change advisory processes; operate within CBO version control, change management, and peer review workflowsProduce and maintain documentation, runbooks, and compliance artifacts for auditsParticipate in stand-ups, sprint planning, and knowledge transfer with CBO staff Key requirementsMinimum of 5 years of DevSecOps or infrastructure automation experienceHands-on experience with Terraform/OpenTofu, Ansible, and GitHub ActionsWorking experience with Docker, Kubernetes, Helm, and container security scanning (Trivy, Grype, or equivalent)Experience with SAST tooling (Semgrep, Checkov, tfsec), secrets scanning (Gitleaks, Detect-Secrets), and OPA/RegoFederal or highly regulated environment experience preferredBachelor's degree in Computer Science, Information Technology, or related field or equivalent professional experienceCollaborativeStandards-drivenStrong communicationInfrastructure-as-Code (Terraform, OpenTofu)Configuration-as-Code (Ansible)CI/CD with security gates (GitHub Actions)