Senior Virtualization Engineer, VMware Cloud Foundation (VCF 9.1)

Location: Fort Gordon, GA (onsite)
Clearance: Active TS/SCI

145-170K

The job

Customer is moving its vSphere 8 estate to VMware Cloud Foundation 9.1. We need a mid-level engineer to help design the target environment, build it in a lab, and run the upgrade across classified enclaves.

You'll report to a lead architect and own specific design artifacts and deployment workstreams. A lot of the job is spent with the network, storage, and cybersecurity teams, and in front of government stakeholders explaining your choices. The environment is RMF-accredited, so design decisions turn into control statements someone has to defend.

Scope

Current state is vCenter, ESXi, vSAN, NSX, and Aria-era tooling on vSphere 8.x.

VCF 9.x can import existing vCenter instances at 8.0 Update 3 or later as workload domains. That makes in-place conversion the preferred path over a greenfield build with workload migration. It only works for clusters already at U3, though. Determining how much of the estate sits below that line is early work and it drives the schedule.

From there the work covers:

• Assessing conversion eligibility: build levels, hardware compatibility, vSAN OSA versus ESA, NSX version alignment, certificate and identity dependencies
• Producing the target-state design: management domain, VCF Management Services runtime, workload domain topology, network and storage, lifecycle and patching model
• Standing up VCF 9.1 in a lab enclave and proving both the runbook and the rollback
• Executing production upgrades in maintenance windows against an approved change plan
• Moving off Aria-era tooling onto VCF Operations and VCF Automation, including log management, which now lives inside VCF Operations
• STIG compliance and the authorization package updates that a major version change forces open

Responsibilities:

Design

• Architecture artifacts: logical and physical designs, bill of materials, sizing and capacity models, a design decision register with justification and risk, traceability to stated requirements
• Management and VI workload domain layout, availability zones, and cluster topology against mission availability requirements
• vSAN ESA storage policies, fault domains, capacity strategy, and an assessment of whether NVMe memory tiering earns its place on the hardware in hand
• NSX transport zones, edge clusters, T0/T1 routing, and segmentation policy matched to enclave boundaries
• Identity and PKI: Active Directory over LDAPS, CAC authentication, VMCA versus enterprise CA, least-privilege roles
• Lifecycle approach using vLCM image-based clusters, vSphere Configuration Profiles for desired-state enforcement, and the VCF depot model for offline patching

Deploy and upgrade

• Deploy VCF 9.1 with VCF Installer, both greenfield and conversion of existing vSphere 8.0 U3+ vCenter instances
• Build and maintain the lab. Every production change gets rehearsed there first
• Write step-level runbooks: prerequisites, validation gates, decision points, rollback criteria, rollback procedure
• Upgrade vCenter, ESX hosts, vSAN, and NSX in sequence, and manage VM hardware and Tools remediation. Note that VM hardware versions advance automatically during reduced-downtime upgrades
• Pre- and post-upgrade validation: health checks, HCL and firmware verification, backup verification, performance baselines, functional testing of mission workloads
• Workload migration and outage window coordination with application owners
• Troubleshooting upgrade failures and performance regressions, including Broadcom case management and log bundle collection

Security and compliance

• Apply and validate DISA STIGs for ESX, vCenter, NSX, and guest operating systems. Document deviations and write the justifications the government reviews
• Remediate ACAS and Nessus findings, respond to IAVA notices inside program timelines
• Write technical content for security control implementation statements and eMASS artifacts
• Implement encryption, secure boot, and TPM attestation where hardware supports it

Documentation and handoff

• As-built documentation, diagrams, and SOPs, plus knowledge transfer to the government operators who run this long-term
• Automation with PowerCLI and the VCF and vSphere REST APIs. Ansible or Terraform where it fits
• Backup and disaster recovery design and testing for the virtualization layer
• CCB and technical exchange meeting participation, RFI responses

Requirements

Active, in-scope TS/SCI at time of hire. U.S. citizenship. Able to work on-site in a SCIF.

Current Security+ CE, meeting the DoD 8140 IAT Level II baseline, maintained throughout employment. Current VCP. We're looking for VCP-VCF Administrator or Architect. A current legacy-track VCP such as VCP-DCV works at hire if you'll sit the VCF-track exam within six months.

Bachelor's degree in computer science, information systems, or engineering plus 4 to 7 years in enterprise virtualization. Four additional years of relevant experience substitutes for the degree.

You should be able to walk us through VCF instances you designed and built yourself, and what you'd do differently now. Administration experience alone won't cover this role.

Also:

• VCF 9.x experience, or VCF 5.x plus real currency on the 9.x architecture: VCF Installer, VCF Operations, VCF Automation, and how SDDC Manager and Aria functions were absorbed
• At least one multi-cluster vSphere major-version upgrade executed in change-controlled production
• Working depth across ESX, vCenter, vSAN, NSX, vLCM, HA, DRS, vMotion
• Time in an RMF-accredited DoD or IC environment applying STIGs and closing vulnerabilities
• PowerCLI
• Enough server hardware, SAN, and data center networking knowledge to troubleshoot past your own layer
• Technical writing. This role produces documents the government has to approve

Benefits

Our comprehensive benefits package for full-time salaried employees is effective immediately upon the start date. Benefits include comprehensive PPO medical coverage with access to a Health Savings Account (HSA) option, a vision plan, and dental insurance with the base dental plan option paid for by PGTEK. Life Insurance, Short and Long-Term disability, and Critical Illness insurance have premiums covered. Additionally, PGTEK offers a matching 401(k) plan and a discount on pet insurance through ASPCA Pet Insurance. An Employee Assistance Program is available at no cost to all employees. PGTEK offers a generous amount of PTO and Holidays, and an Education Assistance Program is available after 12 months of employment.