Principal DevSecOps Engineer

This position requires an active TS/SCI clearance with a current Full Scope Polygraph at the time of application. Due to the nature of the work and U.S. Government contractual requirements, applicants must be U.S. citizens and must be able to maintain the required clearance for the duration of employment. Candidates without an active in-scope clearance and polygraph cannot be considered, and we are unable to sponsor clearances for this role.

Agentic Defense Solutions, Inc. is seeking a Principal Dev Sec Ops  Engineer to lead the team that builds, secures, and operates the delivery pipeline and cloud infrastructure behind large-scale data ingest and analytics platforms in accredited environments.

This is a dual-track role. Roughly [60]% of your time is hands‑on engineering: you will design the pipelines, write the automation, and own the architecture. The remaining [40]% is leadership: you will manage a team of engineers, own their growth and performance, plan staffing against contract scope, and serve as a senior technical voice with the government customer.

The distinguishing requirement is that security is your job, not the job of a team you hand off to. We are looking for someone who builds pipelines where hardening, scanning, and control evidence are automated products of the build itself — and who can then sit across from an Authorizing Official and defend how it works.

• Own the architecture of the CI/CD pipeline supporting multiple microservice development teams — build, artifact management, automated test and security gating, and promotion through environments to production.
• Own infrastructure-as-code and configuration management; environment builds are reproducible, version-controlled artifacts, never hand‑tuned systems.
• Design and operate automated deployments of large‑scale distributed data and AI infrastructure including capacity planning, scaling policy, and upgrade strategy.
• Implement low‑and zero‑downtime deployment strategies with automated rollback driven by health and performance signals.
• Build self‑healing automation: instrument the platform for known instability patterns and implement corrective actions that fire automatically instead of paging a human.
• Engineer and tune cloud infrastructure (compute, object storage, load balancing, autoscaling, monitoring, notification) for throughput, resilience, and cost.
• Build and maintain observability — metrics, logging, distributed tracing, alerting — and drive down mean time to detection and recovery.

• Embed security throughout the pipeline: SAST, DAST, software composition analysis, secrets scanning, IaC scanning, and container image scanning, with risk‑based gating and a defensible exception process.
• Automate system hardening — STIG and benchmark application, drift detection, and remediation as code rather than as a checklist.
• Own supply‑chain integrity: SBOM generation, dependency provenance, artifact signing, and trusted base image management.
• Design and operate secrets and key management (vaulting, rotation, brokered credentials); eliminate static credentials from the pipeline.
• Implement container and orchestration security — image hardening, admission control, network policy, runtime detection.
• Drive vulnerability management end to end: discovery, triage, patch automation, and closure tracking against POA&M commitments.
• Implement NIST SP 800‑53 controls as automated, continuously evidenced capabilities; generate accreditation artifacts from pipeline telemetry rather than assembling them by hand.
• Partner with ISSM/ISSO staff and interface directly with the SCA and Authorizing Official on control implementation, risk positions, and the path toward continuous ATO.
• Le…