DevOps Engineer

ISTI is hiring a Senior Dev Sec Ops  Engineer to help our team secure, build, deploy, and operate the SPIDOR platform and its dependent services.

This is a remote hands‑on engineering role on a small, tight‑knit team — you’ll maintain Git Lab CI/CD pipelines, harden containerized workloads in AWS, drive the monthly vulnerability scanning and remediation cycle, and help us meet the compliance bar required for DoD environments.

The most important thing we’re looking for is someone who works well with others, brings a can‑do attitude, and is genuinely willing to dig in and learn when they hit something they haven’t seen before. Dev Sec Ops  at AFTAC moves across a wide surface area — cloud, containers, pipelines, databases, security tooling, compliance — and nobody walks in knowing all of it.

We want someone who treats “I haven’t done that yet” as the start of a good investigation, not a blocker.

NOTE:
While position is remote, candidate will be required to complete an in‑person interview.

• Partnering every day with application developers, program managers, designers, and customer‑side security reviewers — the job only works if the team is moving together.
• Pairing with teammates on tricky problems, reviewing each other’s pipeline and infrastructure changes, and share what you learn so the whole team levels up.
• Communicating clearly in tickets, pull requests, and stand‑ups: flag blockers early, asking for help before you’re stuck for a day, and offering help when you see someone else spinning.
• When something new lands on the team — a tool, a compliance requirement, a customer ask — being one of the people who volunteers to go learn it and bring it back to the group.
• Owning and extending Git Lab CI/CD pipelines for SPIDOR and its dependent software projects — build, test, scan, package, and publish.
• Integrating security gates directly into pipelines:
  Fortify (SAST), OWASP ZAP (DAST), Snyk (SCA), Twistlock (container scanning), and SBOM generation.
• Managing Git Lab runners, optimize build performance, debug pipeline failures, and keep the pipeline reliable enough that developers trust it and use it.
• Building, tagging, and publishing runtime container images to AFTAC’s Harbor registry; coordinating image promotion across development, test, and production tiers.
• Deploying and operating containerized workloads on AWS ECS and EC2; managing supporting services (RDS/Oracle, EFS, VPC, S3, load balancers).
• Maintaining and extending Infrastructure‑as‑Code in Terraform; prototyping Helm charts and evaluating Kubernetes/Istio options for future orchestration — and bringing the team along on those decisions.
• Troubleshooting runtime issues in ECS (container exits, authz failures, resource pressure); instrument health checks and run load tests before major releases.
• Provisioning and decommissioning AWS resources deliberately, with an eye on cost and configuration drift.
• Running the monthly Fortify cycle and quarterly scanning campaigns across every dependent software project; aggregating findings, triaging by severity, and driving closure together with the developers who own the code.
• Generating vulnerability reports and SBOM artifacts for each project as part of the standard release deliverable package.
• When a scanner flags something you don’t fully understand yet, figuring it out — reading the CVE, reproducing the finding, talking to the developer, and coming back with a clear recommendation.
• Deploying SPIDOR onto FIPS 140-2 validated, DISA STIG‑hardened Red Hat servers; validating compliance posture before delivery.
• Owning TLS, certificate, and PKI configuration across services; handling credentials and secrets through an approved secret‑management pattern (e.g., Hashi Corp Vault).
• Authoring and…