Azure Regulated Research DevOps Engineer; CMMC

Job Summary

The Regulated Research team within the Research Cyberinfrastructure group at the University of Wisconsin-Madison, Division of Information Technology is hiring two Dev Ops Engineers for a regulated research platform. These individuals will plan, develop, and operate a compliance-ready environment for Cybersecurity Maturity Model Certification (CMMC) Level 2 (Self and C3

PAO) requiring NIST 800-171 controls, and other regulated research areas over time.

These roles will be responsible for defining the architecture and configurations, along with evaluating the impact of changes, to ensure we meet the security and compliance needs. This will include helping define, build, and maintain Infrastructure as Code solutions and CI/CD practices within a Microsoft Azure environment. The roles will also include development and operation of interconnections between the platform and other UW Madison platforms or systems, including those on‑premise and in the cloud.

You will collaborate closely with IT in schools and colleges, the Office of Cybersecurity, and technical teams in central and distributed IT to ensure alignment of environments with campus policy and researcher requirements. You will engage with researchers and their teams across the University to understand their needs for the environment and build systems to enable their research. You will be the primary contact point for converting researcher, control requirements, or other professional needs into platform architecture, Infrastructure as Code, and Dev Ops pipeline implementations.

• Produces and gathers evidence as needed for meeting assessor requirements
• Maintains documentation on the system security plan (SSP), including updating documentation as needed for changes that impact the SSP
• Manages, maintains, selects, and develops automation tools and infrastructure, including security configurations
• Serves as technical lead for one or more aspects of the system
• Serves as a subject matter expert to internal stakeholders, providing guidance and training to staff
• Develops, programs, and/or deploys automation workflows for deployment, configuration, and/or monitoring of systems/services
• Performs integration, migration, configuration, and security of existing applications and services into automated infrastructures
• Analyzes requirements and communicates and coordinates with staff and internal stakeholders related to the system and/or project

Starting salary will be based on experience and qualifications. Well qualified applicants can anticipate to earn between $115,000 -$130,000 for a Dev Ops Engineer III (Inst) and $132,000 - $150,000 for a Dev Ops Engineer IV (Inst), with final salary based on experience and qualifications.

Employees in this position can expect to receive benefits such as generous vacation, holidays, and sick leave; competitive insurances and savings accounts; retirement benefits. Benefits information can be found at (Use the "Apply for this Job" box below)..

• Candidates must be U.S. citizens
• Professional experience in Dev Ops cloud engineering and Infrastructure as Code (IaC) with tools such as Terraform, Ansible, or Chef.
• Hands‑on experience implementing or supporting security controls aligned with NIST 800-171, NIST 800-53, HIPAA, or related frameworks.
• Professional experience with multiple scripting or automation languages, such as Python, Bash, and Power Shell.
• Demonstrable experience with defining (or navigating significant changes to) CI/CD pipelines that include security requirements. (required for level IV).
• Professional experience with developing novel architecture approaches involving several interconnecting systems to solve specific business challenges in the cloud (required for level IV).

• Professional experience with Dev Ops engineering in Microsoft Azure in a regulated research environment (for example, HIPAA or NIST 800‑171).
• Professional experience supporting an environment which undergoes external assessment for compliance with security or privacy requirements (e.g., SOC 2, ISO 97001).
• Demonstrable experience in formally evaluating the impact on…