Lead DevSecOps Engineer
Digital Management, LLC3 days ago
McLean, VA, USAStaff+
Base Salary
$122k - $152k/yr
Responsibilities
- Lead the DevSecOps and SRE function, establishing pipeline, release, on-call, reliability, and infrastructure-change standards.
- Own GitHub Actions and GitLab CI/CD delivery planes, reusable workflows, signed artifacts, container supply chain controls, and SBOM, CBOM, and AI-BOM gates.
- Operate SAST, DAST, SCA, secret scanning, container scanning, DISA STIG validation, OPSEC checks, and RMF compliance evidence automation.
- Manage secrets, certificates, KMS keys, IAM permissions, WAF, API Gateway validation, and FIPS 140-3 security posture.
- Define SLI/SLO targets and operate CloudWatch alarms, dashboards, X-Ray tracing, incident response, runbooks, postmortems, rollback, and staged Lambda releases.
- Operate and extend the AWS GovCloud landing zone, including multi-account governance, Control Tower, Landing Zone Accelerator, networking, centralized logging, Security Hub, and GuardDuty.
- Administer DynamoDB capacity, indexes, TTL, Streams, encryption, backups, point-in-time recovery, exports, throttling, and replication planning.
- Mentor developers, report delivery and reliability metrics, liaise with cybersecurity and RMF teams, and maintain operable pipelines and runbooks in SCIF environments.
Requirements
- AWS Certified Security – Specialty or CISSP certification is required and non-waivable for the labor category.
- Hands-on knowledge of GitHub Actions, GitLab CI Ultimate, cosign, AWS Signer, Lambda code signing, SBOM/CBOM/AI-BOM, CycloneDX, Dependabot, and npm workspace monorepos is required.
- Experience with AWS GovCloud, IAM, KMS, Secrets Manager, SSM Parameter Store, AWS SAM, CloudFormation nested stacks, Lambda, API Gateway, EventBridge, SQS, ElastiCache, S3, WAF, LocalStack Pro, and Docker is required.
- Experience with SLI/SLO design, alerting, on-call operations, incident command, postmortems, CloudWatch, X-Ray, CloudTrail, Lambda versioning, rollback, and staged cutovers is required.
- Working knowledge of Control Tower, Landing Zone Accelerator, AWS Organizations, service control policies, IAM Identity Center, AWS Config, Security Hub, GuardDuty, VPC endpoints, NAT, and DynamoDB operations is required.
- Knowledge of SAST, DAST, SCA, secret and container scanning, DISA STIG automation, NIST SP 800-53, OPSEC, FIPS 140-3, and key and certificate rotation is required.
- Scripting experience with Bash, Python, PowerShell, Node.js, and TypeScript tooling is required, along with familiarity with Express, React security patterns, REST, SOAP, SFTP, CAC/mutual TLS, OAuth2, OIDC, and JWT.
- Preferred qualifications include AWS Certified DevOps Engineer – Professional, AWS SysOps Administrator, CKA/CKS, GitLab certification, GSEC/GCIH, DoD or Army DevSecOps experience, SLSA, in-toto, OPA/Conftest, CNSA 2.0, ML-KEM, ML-DSA, OSCAL, eMASS, Model Context Protocol, and Zero Trust for AI.
- Applicants may be subject to a government security investigation and must meet eligibility requirements for access to classified information; US citizenship may be required for some positions.
Benefits
- Benefits include virtual health visits, commuter perks, pet insurance, entertainment discounts, tuition assistance, internal career growth, 401(k) matching, life and disability insurance, financial wellness tools, awards, referral bonuses, healthcare coverage, wellness programs, flu shots, and biometric screenings.
- DMI is headquartered in Tysons Corner, Virginia; the role involves AWS GovCloud, classified-environment, and SCIF operating requirements when applicable.
Tech Stack
About Digital Management, LLC
Digital Management, LLC (DMI) delivers managed IT and digital services—managed mobility, cloud, cybersecurity, network operations, application development, data, and customer experience—to public-sector agencies and commercial enterprises. The privately held firm is headquartered in McLean, Virginia, and builds and operates mission‑critical systems for U.S. federal clients, including the Department of Defense. Its business centers on long‑term managed services, systems integration, and modernization projects across mobile and cloud environments.