Remote Regulated Research DevOps Engineer; Azure, CMMC

Overview

The Regulated Research team within the Research Cyberinfrastructure group at the University of Wisconsin-Madison, Division of Information Technology, is hiring two Dev Ops Engineers for a regulated research platform. These roles will plan, develop, and operate a compliance-ready environment to meet Cybersecurity Maturity Model Certification (CMMC) Level 2 requirements (Self and C3

PAO) with NIST 800-171 controls, and other regulated research needs over time. You will define architecture and configurations, evaluate changes, and implement Infrastructure as Code and CI/CD practices within a Microsoft Azure environment. You will interconnect the platform with other UW–Madison platforms and systems, including on-premise and cloud services, and collaborate with IT units, Office of Cybersecurity, and central and distributed IT teams to align environments with campus policy and researcher requirements.

You will engage with researchers to understand their needs and translate those into platform architecture and Dev Ops pipelines. Applicants for this position will be considered for Dev Ops Engineer III (Inst) and Dev Ops Engineer IV (Inst) titles based on experience and qualifications. The role may involve a mix of on-site and remote work subject to an approved flexible work arrangement (FWA).

Remote work requires the candidate to provide their own high-speed internet and phone for work on a university-provided computer. Transportation between home and the assigned work location is not payable or reimbursable. The position is primarily remote with some on-site presence for meetings or design workshops.

• Produces and gathers evidence as needed for meeting assessor requirements
• Maintains documentation on the system security plan (SSP), updating it as changes impact the SSP
• Manages, maintains, selects, and develops automation tools and infrastructure, including security configurations
• Serves as technical lead for one or more aspects of the system
• Serves as a subject matter expert to internal stakeholders, providing guidance and training to staff
• Develops, programs, and/or deploys automation workflows for deployment, configuration, and/or monitoring of systems/services
• Performs integration, migration, configuration, and security of existing applications and services into automated infrastructures
• Analyzes requirements and coordinates with staff and internal stakeholders related to the system and/or project

Department:
Division of Information Technology, CTO Office, Research Cyberinfrastructure, Regulated Research. The Office of the Chief Technology Officer supports flexible, cohesive, and agile IT infrastructure. The Research Cyberinfrastructure unit provides services and support to researchers for data, computing, data science, and AI-based work, focusing on high-quality, reliable services while exploring new technologies. The Regulated Research group provides services to researchers with complex regulatory needs, including management of Controlled Unclassified Information (CUI), and develops a cloud-based platform with connections to UW–Madison systems as needed to support regulated research.

Required Qualifications: U.S. citizenship; professional Dev Ops cloud engineering experience;
Infrastructure as Code with tools such as Terraform, Ansible, or Chef; hands-on security control experience aligned with NIST 800-171, NIST 800-53, HIPAA, or related frameworks; scripting/automation experience with Python, Bash, and Power Shell; experience defining or navigating significant changes to CI/CD pipelines that include security requirements (required for level IV); experience developing novel architecture approaches involving several interconnecting systems in the cloud (required for level IV).

Preferred Qualifications: Dev Ops experience in Microsoft Azure within a regulated environment (e.g., HIPAA or NIST 800-171); experience supporting environments undergoing external compliance assessments (e.g., SOC 2, ISO 27001); experience evaluating impact of process changes on security or compliance; experience compiling and presenting evidence packages for…