Description What You'll Get to Do as a Network/Cloud Engineer (DevSecOps/Security): • Evaluate cloud hosting architectures across AWS, Azure, and hybrid environments including compute, storage, networking, and managed services utilization • Assess cloud-native design patterns, serverless adoption, containerization maturity, and platform-as-a-service (PaaS) opportunities • Review multi-region and multi-availability zone strategies for high availability and disaster recovery • Evaluate environment design across development, test, staging, and production including environment parity and configuration drift • Identify cloud cost optimization opportunities including rightsizing, reserved capacity, and architectural efficiency • Assess alignment with FedRAMP requirements, cloud security best practices, and DHS cloud policies CI/CD Pipeline & DevSecOps Maturity Evaluation: • Review Continuous Integration/Continuous Deployment (CI/CD) pipelines including build automation, testing frameworks, and deployment orchestration • Assess artifact management practices, container registries, and software composition analysis • Evaluate deployment strategies including blue-green deployments, canary releases, rolling updates, and rollback procedures • Review test automation coverage including unit testing, integration testing, security testing (SAST/DAST), and performance testing • Assess DevSecOps maturity including security integration within development workflows, shift-left security practices, and automated compliance validation • Identify pipeline bottlenecks, manual handoffs, and opportunities to accelerate delivery velocity while maintaining security and quality Infrastructure-as-Code & Configuration Management: • Evaluate Infrastructure-as-Code (IaC) adoption using tools such as Terraform, CloudFormation, ARM templates, or similar platforms • Assess configuration management practices, version control discipline, and code review processes for infrastructure • Review environment provisioning automation, infrastructure testing, and policy-as-code implementation • Evaluate immutable infrastructure patterns, container orchestration (Kubernetes, ECS, AKS), and declarative configuration approaches • Identify opportunities to reduce configuration drift, improve environment consistency, and enhance infrastructure reliability through automation Cybersecurity Controls & Authorization Posture: • Assess Identity and Access Management (IAM) patterns, role-based access control (RBAC), and least-privilege implementation • Evaluate Multi-Factor Authentication (MFA) enforcement, privileged access management (PAM), and secrets management practices • Review Security Information and Event Management (SIEM) integration, centralized logging coverage, and log retention compliance • Assess alerting mechanisms, threat detection capabilities, and Security Orchestration, Automation and Response (SOAR) maturity • Evaluate incident response preparedness, playbook documentation, and security operations center (SOC) integration • Review vulnerability management practices including scanning frequency, remediation workflows, and patch management automation • Assess compliance with NIST SP 800-53 security controls, Risk Management Framework (RMF) requirements, and continuous monitoring practices Legacy Technology Risk & Remediation Strategy: • Identify risks stemming from unsupported legacy technologies including end-of-life operating systems, bsolete middleware, and deprecated frameworks • Assess compensating controls, vulnerability exposure, and attack surface associated with legacy components • Recommend remediation strategies including containerization, platform upgrades, refactoring, or replacement • Develop migration roadmaps that balance security risk reduction with operational stability and resource constraints • Advise on interim security measures and risk mitigation during transition periods Performance, Scalability & Resilience Engineering: • Assess performance monitoring, observability platforms, and application performance management (APM) implementation • Evaluate auto-scaling configurations, capacity planning practices, and surge handling capabilities • Review continuity strategies including multi-region architectures, failover mechanisms, and disaster recovery automation • Assess backup strategies, recovery testing practices, and Recovery Time Objective (RTO)/Recovery Point Objective (RPO) alignment • Identify performance bottlenecks, scalability constraints, and opportunities for architectural optimization Modern Architecture Enablers & Integration Patterns: • Recommend adoption of API gateways for centralized API management, traffic control, and security policy enforcement • Evaluate service mesh opportunities (Istio, Linkerd, AWS App Mesh) to improve microservices observability, security, and resilience • Assess automation platforms and orchestration tools that can improve operational efficiency and reduce manual toil • Identify opportunities to leverage managed services, serverless computing, and event-driven architectures • Recommend container orchestration, service discovery, and distributed tracing implementations • Advise on interoperability improvements through standardized APIs, event streaming, and asynchronous messaging patterns Zero Trust & Modern Identity Architecture: • Evaluate alignment with zero-trust security principles including continuous verification, least-privilege access, and micro-segmentation • Assess software-defined perimeter implementations, identity-based access controls, and context-aware authentication • Review encryption at rest and in transit, certificate management, and cryptographic key management practices • Recommend modern identity architectures including federated identity, single sign-on (SSO), and attribute-based access control (ABAC) Documentation & Technical Narrative Development: • Support documentation of hosting and technical environment findings with clear, evidence-based analysis • Draft modernization engineering narratives that translate technical assessments into strategic recommendations • Create architecture diagrams, pipeline visualizations, and security control mappings • Contribute to assessment profiles with DevSecOps and cloud maturity inputs • Provide technical recommendations accessible to both engineering teams and executive audiences Requirements • Bachelor's degree and 15+ years of infrastructure, cloud, and security engineering experience across hybrid cloud and on-premises environments • Hands-on experience architecting and implementing solutions on AWS and/or Azure including core services (compute, storage, networking, databases, security) • Demonstrated expertise designing and implementing CI/CD pipelines, DevSecOps workflows, and automated deployment strategies • Proficiency with Infrastructure-as-Code tools (Terraform, CloudFormation, ARM templates, Ansible, or similar) • Deep understanding of security control implementation across cloud and hybrid environments • Experience assessing technical maturity, identifying gaps, and recommending practical modernization strategies • Strong analytical skills with the ability to evaluate complex technical environments and distill findings into actionable recommendations • Ability to obtain DHS Entry on Duty (EOD) clearance Desired Qualifications: • FedRAMP authorization experience including security assessment, continuous monitoring, and compliance documentation • Familiarity with NIST Risk Management Framework (RMF), Authority to Operate (ATO) processes, and federal security control baselines • Knowledge of DHS cloud policies, Trusted Internet Connection (TIC) 3.0 requirements, and DHS Enterprise Architecture standards • Experience implementing zero-trust architecture principles including software-defined perimeter, micro-segmentation, and identity-centric security • Hands-on experience with container orchestration platforms (Kubernetes, Docker, ECS, AKS) • Background with service mesh architectures (Istio, Linkerd, Consul) and API gateway platforms (Kong, Apigee, AWS API Gateway) • Proficiency with observability and monitoring tools (Prometheus, Grafana, Datadog, Splunk, ELK stack) • Experience with security automation tools including SAST/DAST scanners, dependency scanning, and compliance-as-code platforms • Cloud certifications: AWS Solutions Architect, AWS DevOps Engineer, Azure Solutions Architect, Azure DevOps Engineer, or equivalent • Security certifications: CISSP, CCSP, or cloud security specialty certifications • DevOps/DevSecOps certifications or demonstrable expertise • Experience supporting federal IT modernization programs or cloud migration initiatives • Background in Site Reliability Engineering (SRE) practices and chaos engineering principle