DevSecOps - Intermediate

POSITION TITLE: DevSecOps Engineer (Intermediate) CLEARANCE REQUIREMENT: Must be eligible to obtain a Public Trust Tier 2 clearance or hold an active DoD security clearance POSITION OVERVIEW: IMRI is seeking a motivated and technically proficient DevSecOps Engineer to support a hybrid cloud environment within a federal program. This role focuses on advancing secure infrastructure automation, enhancing CI/CD pipelines, and integrating security throughout the software delivery lifecycle. The ideal candidate will build upon an established DevSecOps framework-leveraging existing tools, standards, and processes-to improve automation, strengthen security posture, and support scalable, resilient application and infrastructure delivery. KEY RESPONSIBILITIES: Infrastructure Automation (IaC)Maintain and enhance infrastructure as code using Terraform and OpenTofuDevelop modular, reusable configurations aligned with existing engineering standardsManage state files, remote backends, and workspace configurationsRefactor legacy infrastructure code to improve performance, scalability, and maintainabilityExecute infrastructure changes through approved change management processes Configuration Management (CaC)Develop and maintain Ansible playbooks and roles to automate system configuration and deploymentSupport patch management, compliance enforcement, and infrastructure consistency across environmentsAdhere to established role structures, variable conventions, and inventory management practices CI/CD Pipeline EngineeringBuild, maintain, and enhance GitHub Actions workflows for automated build, test, and deployment processesIntegrate security controls within pipelines, including:Static application security testing (SAST)Dependency and vulnerability scanningSecrets detectionPolicy-as-code validationEnsure all pipeline changes follow peer review, version control, and approval workflows Containerization & OrchestrationSupport containerized application environments using Docker and KubernetesDevelop and maintain Dockerfiles aligned with secure image build practicesManage Kubernetes manifests and Helm charts to support application deployment and orchestrationAssist with cluster operations, including performance monitoring and troubleshootingEnsure container images are scanned for vulnerabilities prior to deployment Security Integration & ComplianceIntegrate security practices across the development lifecycle (Shift-Left security)Implement and support security scanning tools, including SAST, secrets scanning, and infrastructure security validationEnforce infrastructure and container hardening standards aligned with CIS benchmarks and federal security baselinesSupport compliance activities aligned with NIST SP 800-53, FISMA, and related frameworksProduce audit-ready documentation to support assessments and compliance reviews Collaboration & Engineering PracticesWork closely with cross-functional engineering teams in an Agile/Scrum environment, participating in stand-ups, sprint planning, and technical reviewsFollow established version control, peer review, and change management workflowsEnsure all updates to production systems are properly reviewed and approved through formal processesMaintain clear and accurate documentation of changes to shared codebases, pipelines, and infrastructure Key DeliverablesInfrastructure as Code modules and documentationAnsible playbooks, roles, and execution logsGitHub Actions workflow configurations and pipeline documentationDockerfiles, Kubernetes manifests, and Helm chartsSecurity scanning configurations and compliance documentationChange logs and technical documentation supporting audit readiness REQUIRED QUALIFICATIONS:Hands-on experience with Terraform and/or OpenTofu, including module development and state managementProficiency with Ansible, including playbooks, roles, and automation workflowsExperience designing and maintaining CI/CD pipelines using GitHub ActionsWorking knowledge of Docker and Kubernetes for containerized environmentsFamiliarity with security tools and practices, including:SAST tools (e.g., Semgrep, Checkov, tfsec or similar)Secrets detection tools (e.g., Gitleaks, Detect-Secrets)Policy-as-code frameworks (e.g., OPA/Rego)Proficiency with Git-based version control, including branching, pull requests, and protected branch workflowsExperience working within structured change management and documentation processes PREFERRED QUALIFICATIONS:Experience supporting federal or highly regulated environmentsFamiliarity with NIST SP 800-53, FISMA, and FedRAMP compliance requirementsExperience working within AWS cloud environmentsFamiliarity with secrets management solutions such as HashiCorp VaultScripting experience in Python and/or Bash IMRI offers top-tier benefits that include: medical coverage through nationally recognized carriers, ancillary coverages, paid vacation and sick leave in compliance with all state and local laws, 401(k) with company match, company paid life insurance and LTD, and several additional voluntary coverages. Pay will be commensurate with the experience, skills, and qualifications that the candidate brings to the position. Equal Employment Opportunity Statement IMRI is an Equal Employment Opportunity employer. IMRI prohibits unlawful discrimination and harassment and provides equal employment opportunity to all applicants and employees consistent with applicable federal, state, and local laws. Employment decisions are based on qualifications, merit, business needs, and other lawful job-related factors without regard to race, color, religion, sex, national origin, age, disability, protected veteran status, genetic information, or any other characteristic protected by law. As a federal contractor, IMRI complies with Section 503 of the Rehabilitation Act and VEVRAA and takes affirmative action with respect to qualified individuals with disabilities and protected veterans as required by law.