Lead DevSecOps Engineer

About DMI

DMI is a leading provider of digital services and technology solutions, headquartered in Tysons Corner, VA. With a focus on end-to-end managed IT services, including managed mobility, cloud, cybersecurity, network operations, and application development, DMI supports public sector agencies and commercial enterprises around the globe. Recognized as a Top Workplace, DMI is committed to delivering secure, efficient, and cost-effective solutions that drive measurable results. Learn more at www.dminc.com

About the Opportunity

The Lead DevSecOps / SRE leads the program's delivery-security function and is accountable for keeping the deployed system secure, compliant and running. The role also carries a defined share of platform engineering: day-to-day operation of the GovCloud landing zone, and DynamoDB administration.

Readiness Next is an offline-first PWA for Army personnel and equipment accountability. It deploys to AWS GovCloud in the ECMA cARMY environment: production at DoD Impact Level 5 first, then an IL6 follow-on in the AWS Secret Region. The back end consists of roughly 26 TypeScript Lambda domains on DynamoDB, EventBridge and SQS, deployed as an AWS SAM application of 13 nested stacks.

The incumbent owns:

• the CI/CD and software supply chain across GitHub and GitLab
• signed and attested builds, and the SBOM, CBOM and AI-BOM gates
• secrets and key management
• STIG and compliance automation that feeds the RMF/cATO package
• the reliability of the production serverless stackThrough month 9, an AWS Professional Services ECMA engineer builds the landing zone with this role. This role owns the landing zone after that handoff.Major duties and responsibilitiesLeadership
• Lead the DevSecOps and SRE function. Set pipeline, release and on-call standards, and review all infrastructure and pipeline changes, including AI-authored ones.
• Mentor the developers who contribute CI and infrastructure code.
• Own the delivery-security roadmap and give every reliability or pipeline gap a named owner.
• Report pipeline health, deployment frequency, change-failure rate, mean time to restore and SLO attainment to the Technical Lead and the Government.
• Serve as the primary technical liaison to the cybersecurity/RMF team.Continuous integration (GitHub)
• Design and maintain GitHub Actions workflows across the npm-workspace monorepo. Lanes cover unit, browser, quality ratchets, serverless CI and deployment, client deployment, image builds, API documentation and a per-pull-request bill-of-materials gate.
• Design CI to be cost-aware: expensive lanes run on demand, and live-engine suites run locally rather than in hosted service containers.
• Own the container supply chain. Images are published to GitHub Container Registry on a node:26-alpine base and signed with cosign attestations. Lambda bundles are signed through AWS Signer and enforced by a code-signing configuration.
• Maintain the SBOM, CBOM (CycloneDX 1.7, with a CNSA 2.0 gap analysis) and AI-BOM generators and their gates.
• Manage dependencies: GitHub Packages for shared packages, Dependabot triage, and a runtime gate that confirms every Lambda-bundled dependency supports the Node 24 runtime.Deployment and dynamic testing (GitLab)
• Operate the GitLab Ultimate deploy plane for the GovCloud test environments, including GitLab DAST and API fuzzing.
• Carry signed artifacts built in GitHub into GitLab-run deployments, and prove at deploy time that the artifact is the one CI built.
• Keep deployment a parameterized capability, so the same signed artifact deploys from GitHub, GitLab or an operator workstation.Security automation
• Integrate and tune SAST, DAST, SCA, secret scanning and container image scanning. Feed findings into pull-request gates and the evidence trail.
• Automate DISA STIG validation and OPSEC checks, and generate hardening evidence for RMF controls.
• Manage secrets, certificates and key rotation (KMS customer-managed keys, Secrets Manager, SSM Parameter Store). This covers JWT signing keys, PII field-encryption keys, integration credentials (CAC/mutual TLS, OAuth2, API keys, SSH keys), and FIPS 140-3 posture.
• Maintain AWS WAF, API Gateway request validation, and least-privilege IAM for every function.Site reliability
• Define service-level indicators and objectives for the API and synchronization paths. Own the CloudWatch alarm set (about 45 alarms and 20 metric filters), SNS routing, dashboards and X-Ray tracing.
• Lead incident response: on-call rotation, runbooks, blameless postmortems, and automation for common failure modes. These include dead-letter queue redrive, EventBridge archive replay, throttling and cold-start regressions.
• Own release safety: Lambda versions and aliases, staged rollout, rapid rollback, and the parity cutover from the legacy service to Lambda.
• Manage capacity and cost against the program cost model, and enforce the resource tagging standard.
• Keep the LocalStack Pro development environment a faithful proof of the production stack.Platform engineering: landing zone
• Operate and extend the GovCloud landing zone with the AWS Professional Services engineer through month 9, then own it after the handoff. This covers:o multi-account structure and account vending (Control Tower / Landing Zone Accelerator)o service control policies and IAM Identity Center federationo centralized CloudTrail, AWS Config and log archiveo Security Hub and GuardDuty findings flowo ECMA cARMY tenant tasks
• Maintain the network baseline: VPC, private subnets, NAT, about 14 VPC endpoints and security groups, keeping service traffic off the public internet.
• Keep account baselines defined in infrastructure as code and checked for drift. No manual changes in boundary accounts.Platform engineering: DynamoDB administration
• Administer the program's tables: on-demand capacity, global secondary indexes, time-to-live, Streams (feeding the record-versioning mirror) and KMS encryption.
• Own backup and recovery:o confirm 35-day point-in-time recovery on every tableo take on-demand backups before risky migrationso rehearse a point-in-time restore to a new table, with cut-overo use export to S3 for analytics and evidence
• Monitor throttling, hot partitions, consumed capacity, stream iterator age and replication latency. Take access-pattern problems to the developers who own the data model.
• Apply fine-grained IAM and deletion protection, and plan the use of Global Tables for multi-region production.AI-augmented delivery and compliance
• Build guardrails that hold AI-generated code to the same security bar as hand-written code: review gates, test enforcement, and provenance and AI-BOM evidence.
• Use AI tooling (Claude Code, Amazon Q) to author workflows, infrastructure code, STIG remediation and compliance-as-code, and review all of it before it gates a build.
• Work with the RMF team to turn automated scan output into control evidence, and maintain the OSCAL/ConMon evidence feed that supports continuous ATO.
• Keep pipelines and runbooks operable in SCIFs, where AI tooling is not available.

Qualifications

Required knowledge, skills and abilities

• CI/CD and supply chain: GitHub Actions (reusable workflows, OIDC to AWS, environment protection); GitLab CI Ultimate (deploy pipelines, DAST, API fuzzing); cosign signing and attestation; AWS Signer and Lambda code signing; SBOM, CBOM and AI-BOM (CycloneDX 1.7); Dependabot; npm workspace monorepos
• Cloud and infrastructure as code: AWS GovCloud (IL5, IL6 follow-on); IAM, KMS, Secrets Manager, SSM; AWS SAM and CloudFormation nested stacks (CDK or Terraform experience transfers); Lambda, API Gateway, EventBridge (including Scheduler), SQS, ElastiCache (Valkey), S3, WAF; LocalStack Pro; Docker
• Site reliability: SLI/SLO design, alerting, on-call and incident command, postmortems; CloudWatch (alarms, metric filters, Logs Insights), X-Ray, CloudTrail; Lambda versioning, rollback and staged cutover
• Landing zone and DynamoDB (working knowledge): Control Tower / Landing Zone Accelerator, Organizations, service control policies, Identity Center, AWS Config, Security Hub, GuardDuty; VPC design with endpoints and NAT; DynamoDB capacity, indexes, TTL, Streams, point-in-time recovery and restore, on-demand backup, export to S3, throttling diagnosis
• Security automation: SAST, DAST, SCA, secret and container scanning; DISA STIG automation; NIST SP 800-53 control mapping; OPSEC; FIPS 140-3; key and certificate rotation
• Scripting: Bash, Python and PowerShell; Node.js and TypeScript tooling
• Application context: Express and React security patterns; REST, SOAP and SFTP integrations; CAC/mutual TLS, OAuth2 and OIDC/JWT

Required certification

AWS Certified Security - Specialty or CISSP. This requirement is non-waivable for the labor category.

Preferred qualifications

• AWS Certified DevOps Engineer - Professional or SysOps Administrator (strongly preferred for the SRE responsibilities); CKA/CKS; GitLab certification; GSEC or GCIH
• DoD or Army DevSecOps experience, including cARMY pipelines, DoD software factories or Platform One
• Supply-chain security frameworks (SLSA, in-toto) and policy as code (OPA/Conftest)
• Post-quantum and CNSA 2.0 readiness (ML-KEM, ML-DSA) and FIPS module validation
• Securing offline-first PWAs: service workers, encrypted IndexedDB, background sync
• Continuous ATO and ConMon automation, OSCAL and eMASS evidence workflows
• Familiarity with the Model Context Protocol, LLM provider gating and Zero Trust for AI

Minimum Salary Rate

Median Salary Rate

Working at DMI

DMI is a diverse, prosperous, and rewarding place to work. Our culture is shaped by five core values that guide how we work, grow, and succeed together:

• Do What’s Right - We lead with honesty and integrity.
• Own the Outcome - We take responsibility and deliver.
• Deliver for Our Customers - We are relentless about delivering value.
• Think Bold, Act Smart - We innovate with purpose.
• Win Together - We collaborate and celebrate our success.

These values aren’t just ideals-they show up in how we support every part of your well-being:

• Convenience/Concierge - Virtual health visits, commuter perks, pet insurance, and entertainment discounts that make life easier.
• Development - Annual performance reviews, tuition assistance, and internal career growth opportunities to help you thrive.
• Financial - Generous 401(k) matches, life and disability insurance, and financial wellness tools to support your future.
• Recognition - Annual awards, service anniversaries, referral bonuses, and peer-to-peer shoutouts that spotlight your achievements.
• Wellness - Healthcare coverage, wellness programs, flu shots, and biometric screenings to support your health.

DMI values employees for their talents and contributions, and we take pride in helping our customers achieve their goals. Because when we live our values, we all win together.

***************** No Agencies Please *****************

Applicants selected may be subject to a government security investigation and must meet eligibility requirements for access to classified information. US citizenship may be required for some positions.