Senior DevSecOps Engineer - AWS

BAE Systems Digital Intelligence is home to 4,500 digital, cyber and intelligence experts. We work collaboratively across 10 countries to collect, connect and understand complex data, so that governments, nation states, armed forces and commercial businesses can unlock digital advantage in the most demanding environments.
 

BAE Systems Digital Intelligence are seeking a dynamic and ambitious Software Engineer to join a high-performing team engaged on a range of large-scale public sector engagements. 

About the role

You will design, build and run the AWS platforms behind mission systems for Australian Government and National Security customers. Everything is delivered as code: CloudFormation templates, CodePipeline delivery and Git-controlled change.

The environments are classified and accredited, so security is designed in from the first template rather than added at the end. You will be the team's go-to engineer for AWS infrastructure, working alongside systems, network and security engineers.

The candidate must hold an active NV1 security clearance and be willing to undergo an upgrade to PV clearance. 

Key responsibilities

• Write, review and maintain best-practice CloudFormation templates from scratch, including nested stacks, StackSets and custom resources
• Build, configure and operate AWS CodePipeline delivery for infrastructure and applications
• Administer Git and CodeCommit: repository structure, branching strategy, access control and code review
• Commission and deploy AWS services as code, including EC2, ECS, EKS, Secrets Manager, Private CA, ElastiCache (Redis), Amazon MQ (RabbitMQ), RDS and OpenSearch
• Build security into every deployment: least-privilege IAM, encryption, network segmentation, logging and policy-as-code checks (for example cfn-lint and cfn-guard)
• Produce design and as-built documentation and evidence that supports system accreditation against the ISM
• Write automation, tooling and application code where the platform needs it
• Troubleshoot and fix platform issues across development, test and production environments
• Mentor engineers in infrastructure-as-code and DevSecOps practice

Essential skills and experience

• Strong infrastructure-as-code delivery on AWS using CloudFormation in production
• Ability to write best-practice CloudFormation templates from scratch, not only adapt existing ones
• Hands-on configuration and operation of AWS CodePipeline (with CodeBuild and CodeDeploy)
• Experienced Git administrator; CodeCommit experience preferred, though strong Git skills on another platform will be considered
• Extensive knowledge of AWS infrastructure services, including Secrets Manager, EC2, ECS, EKS, Private CA, Redis, RabbitMQ, RDS and OpenSearch
• Proven ability to commission and deploy those services entirely through infrastructure as code
• Extensive software development skills in at least one language such as Python, Go, TypeScript or Java
• Experience working in secure environments and delivering solutions that are secure by design
• Candidates whose infrastructure-as-code experience is mainly Terraform or AWS CDK are encouraged to apply, provided they can show CloudFormation depth at interview.

Desirable skills and experience

Experience in any one of them is a strong advantage.

• SIEM administration (for example Splunk, Elastic or Microsoft Sentinel)
• ITSM platform administration (for example ServiceNow or Jira Service Management)
• Threat intelligence platform administration (for example MISP or OpenCTI)
• Wider Linux and Windows system administration
• Experience with ISM, Essential Eight, IRAP assessments or accredited systems
• AWS Certified DevOps Engineer – Professional, or AWS Certified Security – Specialty