Senior DevSecOps Platform Engineer

Location: Washington, DC

Department: 60004433 - AFS Cloud Platform Engineering I

We’re building and operating the cloud platform that runs on AWS with Kubernetes (EKS), a fully GitOps deployment model, and infrastructure defined entirely as code. We’re a FISMA-Moderate environment actively maturing toward a multi-account federal landing zone, so this role sits right at the intersection of platform engineering, security, and compliance — where the interesting problems are. You’ll be a senior hand on a small, high-trust team. We move real infrastructure through code and pipelines, not tickets and click-ops, and we hold each other to that standard. If you like owning the whole path from a Terraform plan to a running, verified, signed workload and doing it in a way that stands up to an ATO review then this is the job for you.

Job Responsibilities:

• Own Terraform for a multi-environment, multi-account AWS estate - modules, state, and the safe reconciliation of live infrastructure into code
• Operate Amazon EKS clusters (not just consume them): networking, autoscaling, add-ons, workload identity, and cluster lifecycle
• Run and extend our GitOps delivery model (ArgoCD) where a merge is a deployment, so the review gate and the verification loop matter
• Build and harden CI/CD pipelines in GitLab: security scanning, secrets detection, policy-as-code, container image scanning and signing, and the evidence trail behind them
• Advance our security and compliance posture against NIST 800-53 - least-privilege IAM, network isolation, continuous monitoring, and the artifacts that support an Authority to Operate
• Help design the migration to a federal multi-account landing zone: identity, cross-account networking, and promotion between environments
• Mentor mid and junior engineers, and raise the bar on change control, review discipline, and “prove it with evidence” engineering

Here's What You Need:

• 7+ years in infrastructure / platform / DevOps, with senior ownership of production systems
• Deep, hands-on Terraform — you’ve written reusable modules, managed remote state, and untangled drift between code and live infrastructure without breaking things
• Strong AWS depth: VPC and networking, IAM, EKS, RDS/Aurora, S3, CloudFront, Secrets Manager
• Kubernetes / EKS operated at production scale — workload identity (Pod Identity / IRSA), Helm, autoscaling, ingress and load balancing
• GitOps experience (ArgoCD or Flux) and CI/CD pipeline engineering (GitLab CI strongly preferred)
• DevSecOps in practice: security scanning (SAST, container, IaC, secrets), policy-as-code (OPA / conftest), and the discipline to make gates actually gate
• Working knowledge of a federal compliance framework — FISMA / NIST 800-53 / RMF and what it takes to support an ATO

Would Be Nice To Have:

• Multi-account AWS landing zone / Control Tower / Organizations design experience
• Container supply-chain security: SBOMs, image signing (Notation / AWS Signer), admission control
• Observability with CloudWatch and/or Grafana
• FedRAMP or GovCloud exposure
• Weather, geospatial, or scientific-data domain background