DevSecOps Engineer

Our Core Values 

Our core values define who we are as an organization and serve as the foundation of our code of ethics. Arbor Research expects all employees to embody and demonstrate in our day-to-day work.

• Collaborative Spirit: We expect each staff member to learn from and teach one another and ask each to exhibit curiosity and respect for the contributions of others.
• Creativity:We strive to cultivate a challenging, stimulating, and supportive environment where our employees are expected to be inquisitive, take the initiative, and demonstrate ingenuity.
• Credibility:Our employees are smart, thoughtful, and objective in their work. We expect them to be technically solid in their area of expertise and for those researching to demonstrate scientific rigor.
• Dedication:Our team achieves success because of our dedication to carrying out high-quality work and delivering trusted results.

Position Summary

The DevSecOps Engineer designs, builds, secures and operates the cloud infrastructure that hosts federal research data platforms, including public websites, request management applications, searchable data catalogs and data processing pipelines. The role combines cloud and DevOps engineering with information security engineering. It owns the infrastructure, deployment automation, monitoring, backup and disaster recovery for each environment, and it implements and continuously monitors the security controls required by NIH, HHS and federal standards (FISMA, NIST SP 800-53 Moderate, HIPAA and the NIH security standards for controlled-access data repositories).

The ideal candidate combines hands-on Amazon Web Services (AWS) engineering skills (compute, storage, databases, networking, identity and serverless services), infrastructure as code and CI/CD pipeline automation with practical security engineering experience in threat detection, vulnerability management, security documentation and audit readiness. The engineer builds security into every stage of the delivery lifecycle rather than adding it at the end.

Essential Duties and Responsibilities

Cloud infrastructure and operations

• Design, provision and maintain secure, scalable AWS environments that host public websites, web applications, APIs and data platforms, using services such as Amazon EC2 behind Elastic Load Balancing, Amazon S3 (with lifecycle policies to S3 Glacier), Amazon RDS for PostgreSQL, Amazon OpenSearch Service, Amazon API Gateway, AWS Lambda and Amazon CloudFront.
• Maintain separate development, test and production environments with environment-specific configurations that provide accurate connectivity to compute, data and integrated resources.
• Architect for high availability, elastic scaling and performance as data volumes, file sizes and user demand grow, including large digital image collections (e.g., DICOM radiology images and digital pathology slides) and multi-modal omics datasets.
• Build and operate secure data ingestion and distribution services, including secure upload portals, SFTP and AWS Transfer Family endpoints, AWS Lambda validation workflows, and controlled S3 download services for approved investigators.
• Host and support the infrastructure for metadata search and indexing (Amazon OpenSearch Service), secure APIs, and large language model services (e.g., Amazon Bedrock) used for natural-language search.
• Support integration with external NIH platforms and systems (e.g., NHLBI BioData Catalyst, the BSI II Biospecimen Inventory and the NHLBI Data Repository) through secure APIs and automated ETL pipelines, including handoff to secure cloud workspaces for analyze-in-place workflows.
• Monitor system health, capacity, availability and cost with Amazon CloudWatch metrics, logs, dashboards and alerts, and tune resources to meet service levels.
• Manage operating system and software patching (e.g., AWS Systems Manager) and configuration baselines across all servers and services.
• Leverage AI (e.g. Claude Code) as both a tool to aid engineering and a component for solutions, following organizational guidance and controls.

DevOps and CI/CD automation

• Build and maintain continuous integration/continuous delivery (CI/CD) pipelines that automatically build, test, scan and release code to each environment, supporting daily development and test releases and production releases every two weeks under an Agile process.
• Define infrastructure as code (e.g., Terraform or AWS CloudFormation) so that environments are repeatable, version controlled and auditable.
• Manage source code and infrastructure code in private GitHub repositories owned by the client, with branch protection, code review and secrets management.
• Work with developers who use AI-assisted development tools to make sure generated code passes automated testing and security scanning before release.
• Lead the technical side of contract transitions: provision and configure environments, install applications and databases, configure interfaces, integrate external resources, migrate and validate data, execute cutover, and complete production release within compressed timelines (e.g., six weeks).
• Leverage AI (e.g. Claude Code) as both a tool to aid DevOps and a component for CI/CD solutions, following organizational guidance and controls.

Security engineering and compliance

• Implement layered administrative, technical and physical safeguards in a FedRAMP-aligned cloud environment that meets FISMA, NIST SP 800-53 (Moderate), HIPAA and NIH/NHLBI security requirements.
• Design and enforce network security, including virtual private clouds, subnets, security groups, firewalls, intrusion detection, and a multi-zoned architecture that isolates management, application and data environments, with additional project-specific segmentation for sensitive datasets.
• Administer identity and access management with AWS IAM and Amazon Cognito, including role-based access control, least-privilege authorization, multifactor authentication, federated login (e.g., NIH and institutional credentials) and secure remote access.
• Encrypt data at rest and in transit with AWS Key Management Service (KMS), and manage keys, secrets and certificates.
• Deploy, configure and tune AWS security services, including AWS WAF in front of web applications and APIs, Amazon GuardDuty for continuous threat detection, Amazon Macie for discovery and classification of sensitive data in S3 (supporting validation of de-identification controls), and AWS Security Hub for centralized security posture, prioritized remediation and audit-ready reporting.
• Configure centralized logging and monitoring with AWS CloudTrail and Amazon CloudWatch, generate alerts for operational and security events, and investigate and respond to security incidents.
• Perform continuous monitoring, vulnerability scanning, container and dependency scanning, and static and dynamic application security testing, and track findings to remediation.
• Develop and maintain the Information System Security Plan (ISSP) and related security documentation (risk assessments, contingency, configuration management and incident response plans), review and update the ISSP quarterly, and support security assessment and authorization (ATO) activities and agency security reviews.
• Operate controlled-access data workflows in compliance with the NIH Required Security and Operational Standards for Controlled-Access Data Repositories (NOT-OD-25-159), including centralized access logging, periodic access reviews, support for data access renewals, and investigation of potential non-compliance.
• Maintain a complete, tamper-resistant audit trail of system access, requests, approvals and data distributions to support program management and federal data sharing compliance.
• Conduct periodic quality assurance audits of security controls, access permissions and audit logs, and routine checks of encryption status, user access privileges and backup completion; report security and data integrity metrics.
• Leverage AI (e.g. Claude Code) as both a tool to aid security engineering and a component for solutions, following organizational guidance and controls.

Backup, disaster recovery and continuity

• Implement automated daily backups of all changes to electronic resources and weekly encrypted cross-region replication to a geographically remote location using AWS Backup and S3 replication.
• Monitor and validate backup jobs for completion and data integrity, and regularly test restoration and disaster recovery procedures.
• Document backup, recovery and business continuity procedures within the ISSP and related standard operating procedures.

Collaboration and development

• Work with software developers, data managers, business analysts and project managers to translate application and data requirements into secure infrastructure designs.
• Prepare and submit required paperwork for access to government systems (e.g., PIV credentials) and comply with associated agency policies.
• Provide security guidance, Security Rules of Behavior briefings and role-based security awareness training (e.g., incident response and contingency roles) to project staff.
• Explain technical and security approaches clearly to technical and non-technical audiences, including government sponsors and auditors.
• Display a professional and exemplary work and research ethic.

Additional duties for those serving in a technical lead capacity

• Serve as technical lead for cloud infrastructure and security on one or more projects.
• Set infrastructure, deployment and security standards and review the work of other engineers and programmers.
• Coordinate with members from other teams to ensure project requirements are met.
• Formulate written infrastructure and security plans that tie technical tasks to project scope.

Tools and technologies

Candidates are expected to be strong in several of these areas, not all of them.

Qualifications

Required

• Bachelor's degree in computer science, computer engineering, information security or a related field, with at least eight (8) years of progressively more responsible experience in systems engineering, cloud infrastructure, DevOps or security engineering.
• At least three (3) years of hands-on experience designing and operating production workloads on AWS (e.g., EC2, S3, RDS, IAM, VPC networking, Lambda, CloudWatch).
• Experience building and maintaining CI/CD pipelines and infrastructure as code (e.g., Terraform or CloudFormation).
• Demonstrated experience implementing security controls for cloud-hosted applications and data, including identity and access management, multifactor authentication, encryption and key management, network segmentation, and logging and monitoring.
• Working knowledge of federal security frameworks, including FISMA, NIST SP 800-53, the NIST Risk Management Framework and the HIPAA Security Rule.
• Experience with vulnerability management, patching and incident response.
• Experience implementing and testing backup and disaster recovery procedures.
• Proficiency in at least one scripting language (e.g., Python, Bash or PowerShell).
• Experience with version control (Git) in a collaborative, Agile workflow.
• Strong written documentation skills, including security plans and standard operating procedures.
• Excellent organizational, analytical and communication skills; ability to work as part of a team.

Preferred Qualifications:

• AWS certification (e.g., AWS Certified Security - Specialty, AWS Certified Solutions Architect or AWS Certified DevOps Engineer) or security certification (e.g., CompTIA Security+, CISSP or CCSP).
• Experience supporting system security authorization (ATO), FedRAMP-aligned environments or NIST SP 800-53 Moderate system security plans.
• Experience operating NIH controlled-access data repositories or other systems handling sensitive health research data, and familiarity with NOT-OD-25-159.
• Experience configuring AWS WAF, GuardDuty, Macie and Security Hub.
• Experience with Amazon Cognito and federated authentication (e.g., NIH login or institutional credentials).
• Experience with Amazon OpenSearch Service and Amazon Bedrock or other large language model services.
• Experience managing large imaging data (e.g., DICOM or digital pathology) and secure file transfer services.
• Experience with containers and container security (e.g., Docker, ECS, EKS, Fargate).
• Experience with Section 508 and WCAG requirements for federal websites.
• Experience supporting federal contracts and contract transitions; health research background.
• Non-profit experience.