> Markdown version of [/jobs/ext/2504614-senior-devsecops-engineer-govcloud-compliance](https://www.wearedevelopers.com/jobs/ext/2504614-senior-devsecops-engineer-govcloud-compliance). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Senior DevSecOps Engineer, GovCloud & Compliance

- **Company:** Polaris Inc
- **Location:** United States (Remote available)
- **Experience:** Expert
- **Salary:** $170,000.0 - $185,000.0
- **Contract:** Permanent contract
- **Skills:** Kubernetes Security, Agile Methodology, Artificial Intelligence, Amazon Web Services, JIRA, Software as a Service, Cloud Computing, Computer Networks, Continuous Integration, DevOps, Github, Identity and Access Management, Python (Programming Language), Key Management, PostgreSQL, Node.Js, OpenID, Tripwire, Data Logging, Information Security Management System, Istio, Delivery Pipeline, Large Language Models, Fastapi, Gitlab-ci, Kubernetes, Information Technology, Cloudwatch, Terraform, Devsecops, Plan of Action and Milestones, Static Application Security Testing, Microservices, Dynamic Application Security Testing
- **Published:** August 9, 2026
- **Apply:** https://www.indeed.com/viewjob?jk=228460be92c6e9d5

## About the Role

· Bachelor's degree in Computer Science, Engineering, or related technical field.

· 9+ years of software/infrastructure engineering experience, including significant hands-on DevSecOps, platform, or cloud infrastructure ownership at a lead level.

· Deep AWS expertise, including hands-on experience with AWS GovCloud and an understanding of how it differs operationally from commercial AWS.

· Strong infrastructure-as-code skills (Terraform) and production experience operating Kubernetes (EKS) and a service mesh (Istio) in security-sensitive environments.

· Hands-on CI/CD security - building pipelines with integrated SAST/DAST/SCA, container scanning, and artifact signing (GitHub Actions, GitLab CI, or equivalent).

· Working knowledge of NIST SP 800-171 and CMMC 2.0 Level 2 - the control families, what evidence assessors expect, and how to implement controls technically rather than only document them.

· Experience authoring or maintaining SSP and POA&M documentation in a DoD or defense-contractor context is strongly preferred.

· Solid scripting/automation ability (Python or Go) and comfort reasoning about the application stack (Python/FastAPI, Node/Express) you're deploying.

· Familiarity with identity and access tooling - IAM, OIDC/Cognito, MFA enforcement, and least-privilege design.

· Fluent, daily use of agentic coding tools (Claude Code, Codex, or similar) as an integrated part of how you work.

· Strong written and verbal communication, with the ability to lead a cross-functional effort and represent technical posture to leadership and external assessors.

· U.S. citizenship is required for this role due to the handling of Controlled Unclassified Information and applicable export-control (ITAR/EAR) and federal contracting requirements.

Preferred Qualifications

AWS certifications (e.g., DevOps Engineer - Professional, Security - Specialty).

· Prior experience taking an organization through a CMMC or FedRAMP assessment.

· Experience with PostgreSQL/Aurora operations - performance, backup, and security configuration.

· Familiarity with runtime and container security tooling (e.g., Falco, Trivy) and WAF/edge protections.

· Background building and operating high-availability SaaS platforms.

Work Authorization Requirement

Candidates must be legally authorized to work in the United States on a full-time, ongoing basis without the need for current or future employer sponsorship (for example, we are not able to sponsor employment visas now or in the future).

Work Expectations

Work Hours: This is a full-time position that requires employees to be online and actively engaged during standard business hours, and available for occasional after-hours support.

Conflict of Interest: You are expected to devote your full professional time and attention to Polaris I/O and not take on other employment or contract work that interferes with your responsibilities, competes with the company, or creates a potential conflict of interest.

Remote Work: This position is fully remote and all work must be performed within the United States. Candidates must be legally authorized to work in the United States. Regular working hours will align with the time zone., * Software/infrastructure engineering : 9 years (Required)

## Description

Polaris I/O is seeking a lead-level Senior DevSecOps Engineer to own the secure deployment of our platform into a dedicated AWS GovCloud environment and to drive our path to CMMC Level 2 certification. This is a high-ownership role: you will architect, stand up, and harden the isolated enclave that handles Controlled Unclassified Information (CUI), build the security automation that keeps it compliant, and serve as the technical lead implementing the controls that an assessment depends on, working alongside an external CMMC advisor.

We pair deep hands-on infrastructure work with a modern, LLM-augmented workflow. On our commercial-side infrastructure, you should use agentic coding tools like Claude Code daily as a force multiplier for infrastructure-as-code, policy-as-code, and pipeline automation (not as a novelty). The expectation is that a senior engineer armed with these tools can design, build, and harden systems at a pace and quality level that wasn't previously possible, while retaining full ownership of architecture, correctness, and security posture.

Our platform runs as microservices on EKS with an Istio service mesh, backed by Aurora PostgreSQL. You will be responsible for translating that architecture into a GovCloud-resident, control-compliant deployment, and for keeping it secure, observable, and audit-ready.

What You'll Do

Secure GovCloud Deployment & Infrastructure

· Own the design and standup of our AWS GovCloud enclave for CUI - network isolation, account/boundary segmentation, identity, and a clearly defined authorization boundary documented for assessment.

· Build and maintain infrastructure as code (Terraform) for reproducible, reviewable, and auditable provisioning of all enclave resources.

· Harden the EKS/Istio runtime - network policy, mTLS, admission control, pod security, secrets management, and least-privilege IAM across the cluster and AWS services.

· Architect machine-to-machine ingest paths that keep CUI within the boundary and minimize human exposure to sensitive data by design.

· Manage encryption, key management, and data-at-rest/in-transit controls consistent with FedRAMP and DoD impact-level expectations for the environment.

CI/CD Security & Automation

· Design and own the secure CI/CD pipeline with enforced security gates: SAST, DAST, dependency/SCA scanning, container image scanning, and signed, traceable artifacts.

· Implement supply-chain security - SBOM generation, provenance, and controls over what reaches the protected environment.

· Build compliance and configuration as code so that control enforcement and evidence collection are automated, continuous, and demonstrable rather than manual.

CMMC Level 2 / Compliance Engineering

· Serve as the technical lead for CMMC Level 2 / NIST SP 800-171 implementation, translating the 110 controls into concrete, enforced technical safeguards across the enclave.

· Partner with our external CMMC advisor to scope, prepare for, and pass assessment - you own the technical implementation and evidence, the advisor guides strategy and readiness.

· Support and maintain compliance documentation - System Security Plan (SSP), Plans of Action & Milestones (POA&M), the control responsibility matrix, and SPRS scoring inputs.

· Build the evidence pipeline: automated logging, monitoring, and artifact collection that proves controls are operating, not just defined.

Platform Operations & Observability

· Stand up observability inside the enclave using AWS-native tooling (e.g., CloudWatch in GovCloud) for metrics, logs, audit trails, and alerting.

· Own incident response readiness - detection, runbooks, and recovery for the protected environment.

· Optimize cost, reliability, and performance of the GovCloud deployment as workloads scale.

Overall

· Use agentic coding tools (Claude Code and similar) as a primary part of your workflow for commercial-side infrastructure, IaC, and automation, directing them with precision, catching when they go wrong, and overriding them with your own expertise. Note: these tools are used on non-CUI infrastructure work only; in-boundary AI usage is restricted to approved, FedRAMP-authorized services.

· Collaborate across engineering on GitHub, follow Agile practices in Jira, and lead by setting the security and deployment standards others build against.

· Act as the connective tissue between platform engineering, leadership, and the compliance effort. That means communicating risk, status, and tradeoffs clearly to both technical and non-technical stakeholders.


## Related Videos

- [Improving quality with Agentic AI with Rovo Dev and Xray](https://www.wearedevelopers.com/videos/2005-improving-quality-with-agentic-ai-with-rovo-dev-and-xray)
- [Rate-limiting using eBPF and Istio: How to protect your SaaS customers from themselves](https://www.wearedevelopers.com/videos/100220-rate-limiting-using-ebpf-and-istio-how-to-protect-your-saas-customers-from-themselves)
- [Keeping applications secure by evolving OAuth 2.0 and OpenID Connect](https://www.wearedevelopers.com/videos/100152-keeping-applications-secure-by-evolving-oauth-2-0-and-openid-connect)
- [Hosting a modern justice system](https://www.wearedevelopers.com/videos/332-hosting-a-modern-justice-system)
- [Get started with securing your cloud-native Java microservices applications](https://www.wearedevelopers.com/videos/123-get-started-with-securing-your-cloud-native-java-microservices-applications)
- [Collaboration Quantified: Lessons from Open Source Developer Networks](https://www.wearedevelopers.com/videos/1422-collaboration-quantified-lessons-from-open-source-developer-networks)

## Related Articles

- [Fully Remote Software Engineer Jobs](https://www.wearedevelopers.com/magazine/447-fully-remote-software-engineer-jobs)
- [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again)
- [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated)
- [Highest Paying Tech Companies for Developers](https://www.wearedevelopers.com/magazine/220-highest-paying-tech-companies-for-developers)
- [Dev Digest 121 - AI goes offline](https://www.wearedevelopers.com/magazine/456-dev-digest-121-ai-goes-offline)
- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)