DevSecOps Engineer - Physical AI

Applied Intuition, Inc. is powering the future of physical AI. Founded in 2017 and now valued at $15 billion, the Silicon Valley company is creating the digital infrastructure needed to bring intelligence to every moving machine on the planet. Applied Intuition services the automotive, defense, trucking, construction, mining and agriculture industries in three core areas: tools and infrastructure, operating systems, and autonomy.

Eighteen of the top 20 global automakers, as well as the United States military and its allies, trust the company’s solutions to deliver physical intelligence. Applied Intuition is headquartered in Sunnyvale, California, with offices in Washington, D.C.;
San Diego;
Ft. Walton Beach, Florida;
Ann Arbor, Michigan;
London;
Stuttgart;
Munich;
Stockholm;
Bangalore;
Seoul; and Tokyo. Learn more at

We are an in-office company, and our expectation is that full-time employees primarily work from their Applied Intuition office 5 days a week. However, we also recognize the importance of flexibility and trust our employees to manage their schedules responsibly. This may include occasional remote work, starting the day with morning meetings from home before heading to the office, or leaving earlier when needed to accommodate family commitments.

This in-office expectation does not apply to contractor positions

We are seeking a highly skilled Dev Sec Ops  Engineer to own secure code integration across our software delivery lifecycle. The Dev Sec Ops  Engineer will require a Security Clearance and will work directly with developers to ensure software is securely built, tested, packaged, and deployed into Government and customer environments, including classified and air-gapped systems. This engineer moves our pipeline from scanning to enforcement: defining promotion gates, severity thresholds, and a documented exception path, and doing it without stalling delivery.

Partners with the ISSM and Cyber Security Engineer to translate NIST, DISA, and DoD security requirements into automated engineering controls and repeatable deployment workflows.

• Own secure code integration from source through build, test, release, and deployment
• Directly support developers integrating and deploying software onto Government and customer systems
• Build and maintain secure CI/CD pipelines, reusable pipeline templates, and hardened build environments
• Integrate and tune SAST, DAST, SCA, secrets scanning, container scanning, and infrastructure-as-code scanning, and consolidate overlapping tool chains into a single supported stack
• Define and enforce promotion gates: which findings block, which are advisory, and the severity thresholds applied. Where a finding cannot be remediated before release, record the exception with a justification, an accountable owner, and a remediation date
• Serve as the primary technical resource for developers by troubleshooting findings, pairing on remediation, and removing delivery blockers
• Automate system hardening, security validation, and compliance evidence collection using infrastructure-as-code and policy-as-code (OPA/Rego, cfn-guard, Cedar, or equivalent), producing machine-readable evidence that holds up in front of a third-party assessor
• Build preventive and detective controls in AWS Gov Cloud, including Service Control Policies and Resource Control Policies across multi-account Organizations, Config, Security Hub, IAM, KMS, Cloud Trail, and Event Bridge, with automated remediation workflows
• Implement software supply chain protections including SBOM generation, artifact signing, and secure dependency management, and admission control that rejects unsigned or unscanned images at deploy time
• Support software promotion into classified and air-gapped environments, including offline dependencies and controlled transfer workflows, and offline package mirrors for language and native dependency managers
• Lead threat modeling and security design reviews for new services and pipeline changes, and propose compensating controls where direct remediation is not possible
• Partner with the ISSM and Cyber Security Engineer to map technical controls to NIST 800-53, NIST 800-171, DISA STIGs, and CMMC Level 2, and support evidence production during assessments and ATO activity
• Establish secure development guidance, technical documentation, and repeatable engineering patterns for product teams
• Serve as a documented backup on build, artifact, and pipeline systems, and participate in the…