OUR CORE VALUES
Our core values define who we are as an organization and serve as the foundation
of our code of ethics. Arbor Research expects all employees to embody and
demonstrate in our day-to-day work.
Collaborative Spirit: We expect each staff member to learn from and teach one
another and ask each to exhibit curiosity and respect for the contributions
of others.
Creativity: We strive to cultivate a challenging, stimulating, and supportive
environment where our employees are expected to be inquisitive, take the
initiative, and demonstrate ingenuity.
Credibility: Our employees are smart, thoughtful, and objective in their
work. We expect them to be technically solid in their area of expertise and
for those researching to demonstrate scientific rigor.
Dedication: Our team achieves success because of our dedication to carrying
out high-quality work and delivering trusted results.
POSITION SUMMARY
The DevSecOps Engineer designs, builds, secures and operates the cloud
infrastructure that hosts federal research data platforms, including public
websites, request management applications, searchable data catalogs and data
processing pipelines. The role combines cloud and DevOps engineering with
information security engineering. It owns the infrastructure, deployment
automation, monitoring, backup and disaster recovery for each environment, and
it implements and continuously monitors the security controls required by NIH,
HHS and federal standards (FISMA, NIST SP 800-53 Moderate, HIPAA and the NIH
security standards for controlled-access data repositories).
The ideal candidate combines hands-on Amazon Web Services (AWS) engineering
skills (compute, storage, databases, networking, identity and serverless
services), infrastructure as code and CI/CD pipeline automation with practical
security engineering experience in threat detection, vulnerability management,
security documentation and audit readiness. The engineer builds security into
every stage of the delivery lifecycle rather than adding it at the end.
ESSENTIAL DUTIES AND RESPONSIBILITIES
Cloud infrastructure and operations
Design, provision and maintain secure, scalable AWS environments that host
public websites, web applications, APIs and data platforms, using services
such as Amazon EC2 behind Elastic Load Balancing, Amazon S3 (with lifecycle
policies to S3 Glacier), Amazon RDS for PostgreSQL, Amazon OpenSearch
Service, Amazon API Gateway, AWS Lambda and Amazon CloudFront.
Maintain separate development, test and production environments with
environment-specific configurations that provide accurate connectivity to
compute, data and integrated resources.
Architect for high availability, elastic scaling and performance as data
volumes, file sizes and user demand grow, including large digital image
collections (e.g., DICOM radiology images and digital pathology slides) and
multi-modal omics datasets.
Build and operate secure data ingestion and distribution services, including
secure upload portals, SFTP and AWS Transfer Family endpoints, AWS Lambda
validation workflows, and controlled S3 download services for approved
investigators.
Host and support the infrastructure for metadata search and indexing (Amazon
OpenSearch Service), secure APIs, and large language model services (e.g.,
Amazon Bedrock) used for natural-language search.
Support integration with external NIH platforms and systems (e.g., NHLBI
BioData Catalyst, the BSI II Biospecimen Inventory and the NHLBI Data
Repository) through secure APIs and automated ETL pipelines, including
handoff to secure cloud workspaces for analyze-in-place workflows.
Monitor system health, capacity, availability and cost with Amazon CloudWatch
metrics, logs, dashboards and alerts, and tune resources to meet service
levels.
Manage operating system and software patching (e.g., AWS Systems Manager) and
configuration baselines across all servers and services.
Leverage AI (e.g. Claude Code) as both a tool to aid engineering and a
component for solutions, following organizational guidance and controls.
DevOps and CI/CD automation
Build and maintain continuous integration/continuous delivery (CI/CD)
pipelines that automatically build, test, scan and release code to each
environment, supporting daily development and test releases and production
releases every two weeks under an Agile process.
Define infrastructure as code (e.g., Terraform or AWS CloudFormation) so that
environments are repeatable, version controlled and auditable.
Manage source code and infrastructure code in private GitHub repositories
owned by the client, with branch protection, code review and secrets
management.
Work with developers who use AI-assisted development tools to make sure
generated code passes automated testing and security scanning before release.
Lead the technical side of contract transitions: provision and configure
environments, install applications and databases, configure interfaces,
integrate external resources, migrate and validate data, execute cutover, and
complete production release within compressed timelines (e.g., six weeks).
Leverage AI (e.g. Claude Code) as both a tool to aid DevOps and a component
for CI/CD solutions, following organizational guidance and controls.
Security engineering and compliance
Implement layered administrative, technical and physical safeguards in a
FedRAMP-aligned cloud environment that meets FISMA, NIST SP 800-53
(Moderate), HIPAA and NIH/NHLBI security requirements.
Design and enforce network security, including virtual private clouds,
subnets, security groups, firewalls, intrusion detection, and a multi-zoned
architecture that isolates management, application and data environments,
with additional project-specific segmentation for sensitive datasets.
Administer identity and access management with AWS IAM and Amazon Cognito,
including role-based access control, least-privilege authorization,
multifactor authentication, federated login (e.g., NIH and institutional
credentials) and secure remote access.
Encrypt data at rest and in transit with AWS Key Management Service (KMS),
and manage keys, secrets and certificates.
Deploy, configure and tune AWS security services, including AWS WAF in front
of web applications and APIs, Amazon GuardDuty for continuous threat
detection, Amazon Macie for discovery and classification of sensitive data in
S3 (supporting validation of de-identification controls), and AWS Security
Hub for centralized security posture, prioritized remediation and audit-ready
reporting.
Configure centralized logging and monitoring with AWS CloudTrail and Amazon
CloudWatch, generate alerts for operational and security events, and
investigate and respond to security incidents.
Perform continuous monitoring, vulnerability scanning, container and
dependency scanning, and static and dynamic application security testing, and
track findings to remediation.
Develop and maintain the Information System Security Plan (ISSP) and related
security documentation (risk assessments, contingency, configuration
management and incident response plans), review and update the ISSP
quarterly, and support security assessment and authorization (ATO) activities
and agency security reviews.
Operate controlled-access data workflows in compliance with the NIH Required
Security and Operational Standards for Controlled-Access Data Repositories
(NOT-OD-25-159), including centralized access logging, periodic access
reviews, support for data access renewals, and investigation of potential
non-compliance.
Maintain a complete, tamper-resistant audit trail of system access, requests,
approvals and data distributions to support program management and federal
data sharing compliance.
Conduct periodic quality assurance audits of security controls, access
permissions and audit logs, and routine checks of encryption status, user
access privileges and backup completion; report security and data integrity
metrics.
Leverage AI (e.g. Claude Code) as both a tool to aid security engineering and
a component for solutions, following organizational guidance and controls.
Backup, disaster recovery and continuity
Implement automated daily backups of all changes to electronic resources and
weekly encrypted cross-region replication to a geographically remote location
using AWS Backup and S3 replication.
Monitor and validate backup jobs for completion and data integrity, and
regularly test restoration and disaster recovery procedures.
Document backup, recovery and business continuity procedures within the ISSP
and related standard operating procedures.
Collaboration and development
Work with software developers, data managers, business analysts and project
managers to translate application and data requirements into secure
infrastructure designs.
Prepare and submit required paperwork for access to government systems (e.g.,
PIV credentials) and comply with associated agency policies.
Provide security guidance, Security Rules of Behavior briefings and
role-based security awareness training (e.g., incident response and
contingency roles) to project staff.
Explain technical and security approaches clearly to technical and
non-technical audiences, including government sponsors and auditors.
Display a professional and exemplary work and research ethic.
Additional duties for those serving in a technical lead capacity
Serve as technical lead for cloud infrastructure and security on one or more
projects.
Set infrastructure, deployment and security standards and review the work of
other engineers and programmers.
Coordinate with members from other teams to ensure project requirements are
met.
Formulate written infrastructure and security plans that tie technical tasks
to project scope.
Tools and technologies
Candidates are expected to be strong in several of these areas, not all of
them.
Area
Tools
Cloud compute, storage and data
AWS EC2, Elastic Load Balancing, S3 and S3 Glacier, RDS (PostgreSQL), OpenSearch
Service, CloudFront, Transfer Family/SFTP
Serverless, APIs and AI services
AWS Lambda, Amazon API Gateway, Amazon Bedrock
Identity and access
AWS IAM, Amazon Cognito, federated identity (SAML/OIDC), multifactor
authentication
Security services
AWS WAF, Amazon GuardDuty, Amazon Macie, AWS Security Hub, AWS KMS, AWS Secrets
Manager, Amazon Inspector
Logging and monitoring
AWS CloudTrail, Amazon CloudWatch, centralized log management or SIEM tools
Backup and recovery
AWS Backup, cross-region replication, snapshot and restore testing
Infrastructure as code and configuration
Terraform, AWS CloudFormation, AWS Systems Manager
CI/CD and source control
Git and GitHub, GitHub Actions or AWS CodePipeline, Agile ticketing (e.g., Jira)
Containers
Docker, Amazon ECS or EKS, AWS Fargate
Security testing
Vulnerability scanning (e.g., Tenable/Nessus, Amazon Inspector), SAST/DAST
(e.g., SonarQube, OWASP ZAP), dependency and container scanning
Scripting
Python, Bash, PowerShell
Frameworks and standards
FISMA, NIST SP 800-53, NIST Risk Management Framework, FedRAMP, HIPAA Security
Rule, NIH NOT-OD-25-159
QUALIFICATIONS
REQUIRED
Bachelor's degree in computer science, computer engineering, information
security or a related field, with at least eight (8) years of progressively
more responsible experience in systems engineering, cloud infrastructure,
DevOps or security engineering.
At least three (3) years of hands-on experience designing and operating
production workloads on AWS (e.g., EC2, S3, RDS, IAM, VPC networking, Lambda,
CloudWatch).
Experience building and maintaining CI/CD pipelines and infrastructure as
code (e.g., Terraform or CloudFormation).
Demonstrated experience implementing security controls for cloud-hosted
applications and data, including identity and access management, multifactor
authentication, encryption and key management, network segmentation, and
logging and monitoring.
Working knowledge of federal security frameworks, including FISMA, NIST SP
800-53, the NIST Risk Management Framework and the HIPAA Security Rule.
Experience with vulnerability management, patching and incident response.
Experience implementing and testing backup and disaster recovery procedures.
Proficiency in at least one scripting language (e.g., Python, Bash or
PowerShell).
Experience with version control (Git) in a collaborative, Agile workflow.
Strong written documentation skills, including security plans and standard
operating procedures.
Excellent organizational, analytical and communication skills; ability to
work as part of a team.
PREFERRED QUALIFICATIONS:
AWS certification (e.g., AWS Certified Security - Specialty, AWS Certified
Solutions Architect or AWS Certified DevOps Engineer) or security
certification (e.g., CompTIA Security+, CISSP or CCSP).
Experience supporting system security authorization (ATO), FedRAMP-aligned
environments or NIST SP 800-53 Moderate system security plans.
Experience operating NIH controlled-access data repositories or other systems
handling sensitive health research data, and familiarity with NOT-OD-25-159.
Experience configuring AWS WAF, GuardDuty, Macie and Security Hub.
Experience with Amazon Cognito and federated authentication (e.g., NIH login
or institutional credentials).
Experience with Amazon OpenSearch Service and Amazon Bedrock or other large
language model services.
Experience managing large imaging data (e.g., DICOM or digital pathology) and
secure file transfer services.
Experience with containers and container security (e.g., Docker, ECS, EKS,
Fargate).
Experience with Section 508 and WCAG requirements for federal websites.
Experience supporting federal contracts and contract transitions; health
research background.
Non-profit experience.
ENTITY:
Arbor Research LLC.
WORK ARRANGEMENT:
Remote
LOCATION:
Must be physically located in one of the following states:
Colorado, Washington D.C., Georgia, Maryland, Michigan, Minnesota, North
Carolina, or Virginia
FAIR LABOR STANDARDS ACT STATUS:
Exempt
REPORTS TO:
Program Director
HOURS PER WEEK:
40
SUPERVISES OTHERS:
No
OVERNIGHT TRAVEL:
Minimal, no more than 5%
SALARY RANGE:
$92,000 to $149,500
Base Compensation is determined by market range and geographic location pay
zones. Base Compensation also includes various individual factors unique to each
candidate such as job level, prior experience, skill set, certifications, and
education, which may impact the compensation structure.