Cloud/DevOps Exploitation Specialist

This position is listed on behalf of a partner company, which manages all applications and next steps. Our partner is looking for a Cloud/DevOps Exploitation Specialist based in the United States.

Join a mission-driven cybersecurity team dedicated to strengthening the security and resilience of federal IT infrastructure. In this hands-on role, you will build, secure, and assess AWS environments that support continuous attack-surface testing and proactive vulnerability discovery. You will leverage advanced Terraform and Ansible automation to create repeatable, scalable, and auditable assessment infrastructure. Working across cloud platforms, CI/CD pipelines, containers, and Kubernetes, you will identify and safely validate security weaknesses within authorized testing environments. Your expertise will help uncover exploitable attack paths, strengthen defenses, and deliver actionable remediation guidance to federal agencies. This fully remote opportunity combines cloud engineering, DevSecOps, and offensive security practices in support of critical national cybersecurity missions.

• Cloud Infrastructure Engineering: Design, implement, and maintain secure AWS infrastructure, including networking, IAM, compute, storage, data services, logging, and security controls, using reusable Terraform modules and Ansible automation.
• Infrastructure as Code (IaC): Establish and maintain secure, version-controlled infrastructure workflows covering code reviews, testing, remote state management, secrets management, approvals, deployment, rollback, and change auditing.
• CI/CD Pipeline Development: Build and maintain automated pipelines that deploy assessment infrastructure and integrate infrastructure-as-code validation, dependency analysis, secrets detection, container and registry scanning, static and dynamic application security testing, and vulnerability scanning.
• Cloud Security Assessment: Evaluate AWS environments, CI/CD workflows, container images, registries, Kubernetes configurations, and infrastructure-as-code templates to identify and validate exploitable security weaknesses within approved scopes.
• Attack Path Validation: Safely assess IAM privilege escalation, lateral movement, software supply-chain vulnerabilities, data exposure, serverless security weaknesses, and other cloud attack paths in accordance with established rules of engagement.
• Kubernetes and Container Security: Test Kubernetes and Amazon EKS governance controls, service-account privileges, container configurations, and potential container breakout vectors.
• IaC Vulnerability Investigation: Analyze and validate infrastructure misconfigurations identified by tools such as Checkov and tfsec, demonstrating realistic exploitation scenarios and their potential impact.
• Infrastructure Hardening and Monitoring: Secure and monitor assessment environments while maintaining the flexibility required for reconnaissance, scanning, controlled exploitation, and rapid incident response.
• Automation and Technical Documentation: Develop Python, Bash, and PowerShell scripts, APIs, and operational tools. Maintain architecture diagrams, runbooks, module documentation, recovery procedures, and other technical records.
• Cross-Functional Collaboration: Work closely with attack-surface testing engineers and customer platform owners to troubleshoot technical issues, optimize performance and costs, and deliver reliable, secure, and repeatable assessment capabilities.
• Compliance and Operational Governance: Follow customer-approved tools, data-handling policies, evidence-management controls, deconfliction procedures, and stop-work requirements throughout all assessment activities.

Requirements:

• Professional Experience: At least 5 years of experience in cloud engineering, DevOps, DevSecOps, platform engineering, or cloud security, including a minimum of 3 years of hands-on AWS and infrastructure-as-code experience.
• Citizenship and Clearance: U.S. citizenship is required. Candidates must be eligible to access sensitive information and able to obtain a Public Trust fitness determination at the High Risk level.
• Terraform and Ansible: Advanced practical experience using Terraform and Ansible in production environments, including reusable modules, remote state, secrets management, testing, approval workflows, and repeatable deployments.
• AWS Architecture and Security: Strong knowledge of AWS IAM, VPC and networking, EC2, S3, KMS, CloudTrail, serverless technologies, containers, and data-service security.
• CI/CD and Container Ecosystems: Hands-on experience with tools such as GitLab CI, GitHub Actions, Jenkins, Docker, Kubernetes/EKS, and Amazon ECR or comparable platforms.
• Security Testing Tools: Experience with security assessment and vulnerability detection tools such as Checkov, tfsec, Trivy, Grype, Prowler, ScoutSuite, Semgrep, SAST/DAST solutions, secrets scanners, and cloud-native security services.
• Scripting and Systems Knowledge: Strong Linux, networking, and Git skills, along with practical scripting experience in Python, Bash, or PowerShell.
• Secure Assessment Practices: Ability to operate within customer-provided remote environments, use approved tools, follow rules of engagement, protect sensitive data, maintain assessment evidence, coordinate testing activities, and comply with stop-work criteria.
• Preferred Certifications: AWS Certified Security – Specialty, AWS Solutions Architect or DevOps Engineer Professional, HashiCorp Terraform Associate, Certified Kubernetes Security Specialist (CKS), Certified Kubernetes Administrator (CKA), GIAC Cloud Security Automation (GCSA), or equivalent credentials.
• Offensive Security Infrastructure: Experience building short-lived, segmented security assessment environments with robust auditing, controlled access, and reliable teardown procedures.
• Cloud Exploitation Experience: Familiarity with authorized testing of IAM, CI/CD, containers, registries, Kubernetes, serverless services, metadata services, and infrastructure-as-code weaknesses.
• Advanced Security Practices: Knowledge of policy as code, Open Policy Agent (OPA), Conftest, software bills of materials (SBOMs), software supply-chain security, observability, and cloud cost and performance optimization.
• Federal and Regulated Environments: Experience with federal cloud platforms, FedRAMP, AWS GovCloud, DHS/CISA programs, or other high-assurance environments is highly desirable.
• Communication and Collaboration: Strong analytical thinking, technical documentation, problem-solving, and teamwork skills, with the ability to communicate findings clearly and collaborate effectively with engineers and customer stakeholders.

Benefits:

• Competitive Salary: Annual salary range of $90,300–$189,600, depending on experience, qualifications, location, certifications, and contract-related factors.
• Fully Remote Work: Work remotely from any U.S. state, with occasional travel of up to 10% within the continental United States.
• Flexible Time Off: Access to a flexible time-off benefit designed to support work-life balance.
• Comprehensive Healthcare: Healthcare coverage and benefits designed to support employees and their families.
• Wellness Programs: Access to wellness resources and benefits that promote employee well-being.
• Retirement and Financial Benefits: Financial planning and retirement benefits to support long-term financial security.
• Family Support: Benefits and resources designed to support employees and their families.
• Professional Development: Access to learning resources, continuing education, and development opportunities to strengthen technical expertise and advance career goals.
• Mission-Driven Work: The opportunity to contribute to federal cybersecurity initiatives that protect government networks and strengthen national cyber resilience.
• Collaborative Environment: Work alongside skilled cybersecurity and cloud engineering professionals in a culture emphasizing integrity, innovation, accountability, and continuous improvement.
• Career Growth: Opportunities to develop advanced expertise in cloud security, infrastructure automation, DevSecOps, and authorized offensive security assessments.