Overview
The AWS DevSecOps Engineer builds, secures, and operates the AWS environments and automated delivery pipelines that PhoenixTeam uses for internal and client applications. This is a hands-on production engineering role spanning infrastructure as code, container deployment, CI/CD, security controls integrated into releases, reliability, and incident recovery. The engineer uses shared Platform patterns to make deployment repeatable rather than relying on one-off application setups.
Agentic orchestration is a primary delivery approach: the engineer designs, supervises, and verifies AI-assisted workflows for testing, hardening, containerization, infrastructure provisioning, and deployment. Success depends on independent AWS, DevSecOps, and security judgment-especially when generated scripts or configurations are wrong. The goal is to improve speed and reliability from prototype through production without bypassing security reviews or release controls.
Key Functions
- Build and operate AWS infrastructure using Terraform, AWS CDK, or CloudFormation, including VPC networking, IAM, ECS/Fargate or EKS, RDS, load balancing, KMS, Secrets Manager, S3, and CloudWatch.
- Implement application infrastructure within shared Platform patterns; support multi-account controls using AWS Organizations, Control Tower, service control policies, or comparable guardrails.
- Own build, test, approval, and deployment pipelines as code using GitHub Actions, Forgejo Actions, AWS CodePipeline, or comparable tools; create reusable, documented workflows.
- Embed SAST, DAST, software-composition/dependency, container-image, and infrastructure-as-code scanning in release stages; maintain blocking criteria and escalate risk acceptance and exceptions to authorized decision-makers.
- Apply least-privilege IAM, encryption, secrets handling, network isolation, and controlled production access; constrain what automation and AI agents can access or change.
- Design and verify agent-executable playbooks for hardening, testing, provisioning, and deployment; independently review and test generated code, infrastructure definitions, and security evidence.
- Support blue/green or canary deployment and tested rollback; use lead time, deployment frequency, failure rate, and recovery metrics to improve reliable release delivery.
- Implement logs, metrics, tracing, health checks, alerts, and cost visibility; participate in a rotating on-call schedule, respond to incidents, and contribute to post-incident reviews and runbooks.
- Use AWS security and audit tooling such as Security Hub, GuardDuty, Config, CloudTrail, Inspector, and IAM Access Analyzer as applicable; remediate findings and support relevant evidence needs.
- Work with application engineers, Platform, QA/verification, and client security stakeholders to support secure handoffs and explain deployment decisions, controls, and human verification.
Minimum Qualifications
- 5+ years of hands-on DevOps, DevSecOps, site reliability, or platform engineering experience, including production responsibility, infrastructure automation, and deployment or incident recovery.
- Strong production AWS experience spanning VPC/networking, IAM, ECS or EKS, RDS, KMS, secrets management, CloudWatch, and CloudTrail.
- Experience deploying containerized workloads with Docker and building production infrastructure as code using Terraform, AWS CDK, or CloudFormation.
- Experience owning CI/CD pipelines as code, including automated testing, security gates, release promotion, troubleshooting, and rollback.
- Hands-on experience integrating SAST, DAST, SCA/dependency, container, and infrastructure-as-code security checks into delivery workflows.
- Ability to script automation in Python, Bash, or Go and independently validate generated scripts and infrastructure configurations.
- Practical understanding of least-privilege access, encryption, secure credential handling, and NIST SP 800-53 or a comparable security-control framework.
- Ability to supervise and verify AI-assisted engineering workflows with independent judgment; clear written and verbal communication with technical and non-technical partners.
Preferred Qualifications or Skills
- Experience with LLM-assisted or multi-agent engineering automation, including Amazon Bedrock or comparable orchestration tools.
- AWS multi-account landing-zone expertise; policy-as-code or guardrails using OPA, Checkov, cfn-guard, SCPs, or comparable controls.
- Experience supporting SOC 2 or other applicable commercial security assessments and automated audit evidence.
- Relevant AWS professional, cloud security, or security engineering certification.
- Client-facing delivery in mortgage, financial services, or another regulated industry; experience mentoring engineers in reliable pipeline practices.
Position Details
- Employment type: Full-Time, W2 employee; not a contract or 1099 position.
- Work arrangement: Remote-first, with flexible arrangements and collaboration across engineering and client teams.
- On-call: Participation in a rotating schedule to support production systems and incident response is required; coverage details will be discussed during hiring.
- Travel: Up to 10% may be required based on business or client needs.
