{"id":803292,"url":"https://alion.io/job/triallibrary-devsecops-cloud-engineer","title":"DevSecOps / Cloud Engineer","company":{"id":689956,"name":"Trial Library","domain":"triallibrary.com","url":"https://alion.io/company/triallibrary","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Lever","truth_index":{"grade":"A","score":94,"open_postings":4,"ghost_share":0,"stale_share":0.25,"repost_share":0,"time_to_fill_p50_days":46,"computed_at":"2026-11-14T05:58:10Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["San Francisco, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":168000,"max":205000,"currency":"USD","period":"year","gross":null,"usd_annual":205000},"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Amazon Aurora","optional":false},{"name":"Amazon CloudWatch","optional":false},{"name":"Amazon S3","optional":false},{"name":"AWS","optional":false},{"name":"AWS Bedrock","optional":false},{"name":"AWS Lambda","optional":false},{"name":"CloudFormation","optional":false},{"name":"GitHub","optional":false},{"name":"GitHub Actions","optional":false},{"name":"HIPAA","optional":false},{"name":"IAM","optional":false},{"name":"Least Privilege","optional":false},{"name":"LLM Guardrails","optional":false},{"name":"PostgreSQL","optional":false},{"name":"SOC 2","optional":false},{"name":"Terraform","optional":false},{"name":"Threat Modeling","optional":false},{"name":"VPN","optional":false},{"name":"LLM","optional":true},{"name":"NIST 800-53","optional":true},{"name":"Python","optional":true},{"name":"TypeScript","optional":true}],"status":"live","first_seen_at":"2026-08-19T18:10:41Z","employer_posted_date":"2026-08-19","last_verified_at":"2026-11-15T04:18:05Z","board_verified":true,"closed_at":null,"days_open":87,"trust":{"level":"ok","repost_count":1,"flags":[],"days_open":86},"description":"About the role\nJoin our small, high-trust Infrastructure team as its second engineer, reporting to the Director of Infrastructure and partnering closely with our product engineering team. You will drive two key initiatives: building a cohesive AWS foundation with Terraform, Control Tower, and AFT, and owning end-to-end security engineering for our production PHI and Bedrock AI workloads. Just as important, you'll build the paved paths, self-service tooling, and guardrails that let our engineers ship quickly.\nAI is deeply embedded in how we work. We use it across coding, testing, and operations, not because of a mandate but because we've seen what it unlocks. We're looking for someone who already builds this way and is curious about what AI-augmented practice looks like in infrastructure and security work. We value fast decisions, open feedback, and empowered engineers.\nYour Responsibilities\nWhat you'll own\nInfrastructure as code. The Terraform codebase - module design, state strategy, drift detection, plan review discipline - and the migration of our CloudFormation/Serverless footprint where it delivers real leverage, without stalling product delivery.\n\nThe AWS landing zone. Multi-account structure via Control Tower and AFT: account vending, customizations, service control policies, and OU design.\n\nSecurity engineering. Security Hub, GuardDuty, Inspector, and Config as living detection tooling: triage findings, tune signals, and run the vulnerability lifecycle from discovery through verified fix. Coordinate penetration tests and own remediation.\n\nPipeline and supply chain security. Secure the commit-to-production path in GitHub Actions: least-privilege OIDC deployment roles, secrets scanning, SAST and dependency/container gates, branch protection, and artifact integrity.\n\nDeveloper enablement. Paved-path tooling, self-service infrastructure, and secure defaults that let product engineers move fast without filing tickets.\n\nDisaster recovery and backup. Backup strategy, RPO/RTO targets, Aurora point-in-time recovery, and regular DR testing to satisfy HIPAA contingency planning requirements.\n\nCompliance as code. SOC 2 and HIPAA controls encoded into the platform - encryption, KMS, CloudTrail/Config coverage, log retention - with automated evidence collection.\n\nIdentity and access governance. IAM Identity Center, cross-account roles, SSO, periodic access reviews, and joiner/mover/leaver deprovisioning, alongside network foundations: VPC design, WAF, and Client VPN.\n\nWhere you'll contribute\nAlongside the Director of Infrastructure and the Dev Team:\nSecurity architecture for Bedrock AI workloads: access controls, guardrails, PHI data boundaries\n\nProduction incident response (reliability and security) and recurrence prevention\n\nObservability and cost visibility: CloudWatch, alarms, dashboards, tagging\n\nPartnership with application engineers on Lambda, Aurora PostgreSQL, and Bedrock workloads\n\nLightweight threat modeling and security review of new features and third-party integrations touching PHI, including sponsor/CRO data-handling requirements\n\nYour Requirements\n5+ years in DevSecOps, security, platform, or infrastructure engineering, operating production systems you were accountable for\n\nDemonstrated security ownership: you have run vulnerability management, remediated real findings, and participated in incident response - not just deployed tooling\n\nDeep Terraform proficiency: module hierarchies, multi-environment state, drift and refactors, critical plan review\n\nHands-on AFT and Control Tower experience - you have vended accounts through AFT and customized the pipeline, not adjacent familiarity\n\nBroad AWS depth: IAM, Organizations, VPC, Lambda, RDS/Aurora, S3, KMS, CloudTrail, Config, Security Hub, GuardDuty, Secrets Manager\n\nGitHub Actions as a daily environment, including pipeline hardening and secrets management\n\nSOC 2 Type II and HIPAA experience in a real PHI-handling environment - you have owned controls, produced evidence, and sat in front of an auditor\n\nChange and release discipline: you think about blast radius before you apply, have owned deployment and rollback strategies in production, and move quickly inside regulated-environment constraints rather than treating them as obstacles\n\nHands-on, autonomous, and clear: you write code daily, take ambiguous problems to documented decisions, and can explain security tradeoffs to non-security people\n\nYou use AI coding and automation tools as a daily part of how you work, and you actively explore how they change infrastructure and security practices\n\nGenuine interest in improving clinical trial access and health equity\n\nNice to Have\nCompliance automation platforms (Drata, Vanta) including evidence automation\n\nCloudFormation/CDK/Serverless-to-Terraform migration experience\n\nGitHub EMU, SCIM, and SAML SSO administration\n\nAurora PostgreSQL operations and schema migration coordination\n\nPython or TypeScript for automation\n\nHITRUST, NIST 800-53, or CSA STAR exposure\n\nSecuring LLM workloads","description_format":"text","description_chars":5026,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Equity"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["DevSecOps","Clinical Trial Sites & Recruitment"],"lifecycle":[{"event":"open","at":"2026-09-12T08:42:45Z"},{"event":"close","at":"2026-10-26T21:59:49Z"},{"event":"reopen","at":"2026-11-09T22:48:57Z"}],"visa":[],"liveness":{"score":20,"band":"cold","label":"Long shot","p_open":1,"p_active":0.546,"p_room":0.36,"age_days":86,"expected_fill_days":46,"reasons":["conf:2","win:tail","crowd:"],"computed_at":"2026-11-14T05:58:10Z"},"pay":{"stated_usd_annual":205000,"is_top_pay":true},"html_url":"https://alion.io/job/triallibrary-devsecops-cloud-engineer","json_url":"https://alion.io/job/triallibrary-devsecops-cloud-engineer.json","meta":{"generated_at":"2026-11-15T06:18:07Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":33,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-16T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":689956},"rest":"https://alion.io/mcp/rest/get_company?id=689956"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ftriallibrary-devsecops-cloud-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"free","price":{"credits":0,"usd":0},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ftriallibrary-devsecops-cloud-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ftriallibrary-devsecops-cloud-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/triallibrary-devsecops-cloud-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ftriallibrary-devsecops-cloud-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":803292}},{"tool":"search_jobs","arguments":{"company":"triallibrary.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":803292},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}