Senior DevOps

About the role

You will lead our US federal infrastructure. The GovCloud account is empty today — you are building it from scratch. The mandate is to stand up a compliant AWS GovCloud enclave that is logically and operationally separated from our commercial platform, migrate our federal workloads into it, take it through FedRAMP authorization and CMMC Level 2 assessment, and then audit that environment against the controls you implemented. This is a greenfield build, not a maintenance role: you make the foundational architecture decisions, you own the environment end to end in production — availability, security posture, cost and compliance — and you hire and lead the small team that runs it with you.

Agentic AI is in the product, not just the pitch: we automate screening and investigation workflows, and customers extend them with their own templates and data sources. We build the same way — agentic development is how our engineering and security teams work day to day, and we expect the same from you on infrastructure and compliance work.

What you'll do

- Build the entire GovCloud environment from scratch — greenfield, no existing footprint to inherit: account and Organizations structure, networking, identity, encryption, logging, boundary protection, and every supporting service.

- Own that environment permanently once it exists: you are the accountable engineer for its availability, security posture, patch state, cost and audit readiness.

- Lead the end-to-end migration of our federal workloads into it: plan, sequence, cutover and validate, with clear rollback criteria at every stage.

- Conduct full internal audits of the environment you built — control-by-control assessment, gap analysis, findings and remediation plans — and stand behind that assessment in front of external assessors.

- Define and defend the FedRAMP authorization boundary — data flow diagrams, inventory, and the technical evidence behind each control.

- Own infrastructure as code across the federal environment (Terraform), including drift detection, policy-as-code guardrails, and reproducible environment builds.

- Build and operate Kubernetes (EKS) workloads in GovCloud: hardened cluster configuration, workload identity, admission control, patching and upgrade cadence.

- Build FedRAMP-compliant CI/CD: separated pipelines, signed artifacts, SBOM generation, provenance, and controlled promotion paths between commercial and federal environments.

- Implement continuous monitoring and the monthly ConMon reporting cycle: vulnerability scanning, POA&M management, deviation requests, and significant change requests.

- Stand up centralized logging, audit trail integrity and alerting to federal retention requirements; integrate incident response and on-call for the federal environment.

- Work directly with the CISO, our 3PAO and prime contractors on assessment readiness, evidence collection, SSP maintenance and SPRS scoring.

- Establish the operational runbooks, DR/BCP procedures and RPO/RTO validation for federal workloads.