Secure CI/CD for Federal Workloads
Built and hardened CI/CD pipelines for multiple federal agencies, from application delivery to a multi-environment Azure data platform, folding code analysis and supply-chain scanning into the path to production, administering the GitHub organization (80+ repositories across ~10 applications), and holding the line on NIST and FedRAMP controls.
- Role
- Cloud Engineer
- Org
- Procentrix
- Period
- 2022–Present
Context
Federal software delivery has to be fast and auditable. Each release needs a defensible trail showing that code was scanned, dependencies were checked, and compliance controls held, without turning the pipeline into a bottleneck that teams route around.
Approach
Pipelines were designed as the enforcement point, following the DoD Enterprise DevSecOps reference patterns and OWASP guidance.
- Static analysis and dependency scanning in-line. SonarQube and GitHub Advanced Security run on every change, so quality and vulnerability gates are part of merging, not a separate audit later.
- Container security across Docker/Kubernetes workloads, with image and configuration checks shifted left into the build.
- Infrastructure as Code (Terraform, ARM, Bicep) plus PowerShell/Bash automation, so environments are reproducible and reviewable rather than hand-built.
- Compliance controls wired in. Microsoft Purview and Microsoft Sentinel configured to align delivery with NIST, FedRAMP, and data-handling requirements (GDPR/HIPAA where applicable).
- Data-platform delivery (ADF & SQL). Beyond application code, automated a multi-environment Azure Data Factory estate (publish-branch ARM promotion across many isolated environments) and tokenless SQL database deployments, with DACPACs published using a short-lived Entra ID token, no SQL logins, and just-in-time firewall control.
- GitHub organization administration. Owned the org’s structure, with teams, roles, and permissions across 80+ repositories spanning ~10 applications, and code, dependency, and secret scanning enabled org-wide so issues surface at the pull request, not after merge.
Outcome
Secure-by-default delivery: every artifact reaching production carried an automated record of the scans and gates it passed, giving agency stakeholders the audit trail they need while keeping engineers shipping.