Lead DevSecOps Engineer and Application Administrator

Work Location: Huntsville, AL

Schedule: Full-time 40 hrs. per week, 8 hours per day (remote work is not authorized).

Relocation: Negotiable

IronMountain Solutions is seeking a highly skilled, mission-focused Lead DevSecOps Engineer & Application Administrator to serve as the primary technical point of contact for CATENA (Critical Asset Tracking & Enterprise Node Analysis), a mission-critical supply chain risk management dashboard.

In this role, you will hold end-to-end technical ownership of the CATENA platform—from implementing new capabilities and maintaining codebase health to coordinating deployment operations within the Artificial Intelligence Integration Center (AI2C) hosting environment. You will champion the application's cybersecurity posture, managing vulnerability remediation, enforcing Army-approved identity/access workflows, orchestrating continuous security scanning, and ensuring rigorous data protection and disaster recovery verification.

• Serve as the principal technical authority and point person for the CATENA dashboard.
• Design, build, and deploy enhancements, integrating new functional modules and refining existing features based on stakeholder feedback.
• Maintain clean, documented, and version-controlled application codebases across all environments using modern CI/CD pipelines.
• Ensure application performance, responsiveness, high availability, and seamless data visualization for supply chain risk intelligence.

• Serve as the primary technical liaison to the Artificial Intelligence Integration Center (AI2C) platform and infrastructure teams.
• Coordinate deployment, scaling, containerization, and configuration of CATENA within the AI2C enterprise hosting infrastructure.
• Align development sprints with AI2C platform maintenance windows, runtime prerequisites, and infrastructure governance policies.

• Conduct continuous static and dynamic security assessments (SAST/DAST/container scanning) across CATENA code and infrastructure.
• Triage, prioritize, and remediate discovered security vulnerabilities; apply all necessary security patches and dependency updates within mandated timeframes.
• Immediately report detected security incidents, anomalous system behavior, or emerging threats to the Information System Security Manager (ISSM) and the AI2C Platform Team.
• Author and maintain formal Plan of Action and Milestones (POA&M) documentation for any findings or vulnerabilities that cannot be resolved within standard remediation windows.
• Support ongoing Risk Management Framework (RMF) and Authority to Operate (ATO) activities for the dashboard.

• Configure all hosted frontend applications and backend components to enforce Army-approved Multi-Factor Authentication (MFA) via Single Sign-On (SSO) for all interactive user and administrative sessions.
• Integrate identity and authentication workflows directly with the platform's centralized Keycloak service or an authorized, platform-approved alternative Identity Provider (IdP).
• Implement granular Role-Based Access Control (RBAC) to ensure strict adherence to the principle of least privilege.

• Architect, implement, and maintain comprehensive backup and restore procedures for all CATENA application data, configurations, and persistent storage.
• Conduct monthly recovery drills and verification tests to validate restore viability, minimizing potential recovery time objectives (RTO) and recovery point objectives (RPO).
• Maintain complete documentation and runbooks for business continuity, disaster recovery, and failover scenarios.

• Education: Bachelor’s degree in Computer Science, Software Engineering, Information Systems, Cybersecurity, or a related technical discipline (or equivalent practical experience).
• Experience: 5+ years of combined experience in software development, application administration, and DevSecOps within enterprise or defense environments.
• Identity & Authentication:
• Hands-on experience integrating applications with Keycloak, OAuth 2.0, OpenID Connect (OIDC), or SAML 2.0.
• Experience implementing DoD/Army-compliant PKI, CAC/PIV-based MFA, and SSO architectures.
• Security & Compliance:
• Demonstrated familiarity with DoD RMF, NIST SP 800-53, DISA STIGs, and vulnerability scanning/management tools (e.g., SonarQube, Fortify, Anchore, Prisma Cloud, or ACAS/Tenable).
• Direct experience authoring and managing Plan of Action and Milestones (POA&M)
• Experience interfacing directly with an ISSM / ISSO.
• DevSecOps & Hosting:
• Proficiency in container technologies (Docker, Podman) and orchestration (Kubernetes, Red Hat OpenShift).
• Working knowledge of modern GitOps, CI/CD pipeline automation (GitLab CI, GitHub Actions, or Jenkins).
• Data Management:
• Experience managing database backends (e.g., PostgreSQL, Elasticsearch, MongoDB) along with automated backup scripts, snapshots, and recovery verification routines.

• Prior experience collaborating with or deploying solutions onto AI2C or Army enterprise cloud environments (e.g., cARMY).
• Active DoD 8570/8140 IAT Level II or III certification (e.g., Security+ CE, CySA+, CASP+, CISSP).
• Familiarity with supply chain risk management (SCRM), bill of materials (SBOM) analysis, or logistics analytics.
• Active Secret or higher security clearance.

• System Availability: Maintenance of high operational uptime within the AI2C runtime environment.
• Patch Timeliness: 100% adherence to established vulnerability mitigation timelines or immediate POA&M submission.
• Audit Readiness: Full traceability and zero unapproved exceptions in Keycloak SSO/MFA configurations and monthly backup verification logs.
• Stakeholder Alignment: High responsiveness and proactive communication with the ISSM, AI2C engineering teams, and executive stakeholders.