• Designing, deploying, and sustaining RHEL 8/9/10 environments and RKE2 Kubernetes clusters across multiple AWS accounts and VPCs
• Operating the cluster control plane and per-environment agent pools (dev/test/staging/prod) with node labeling, taints, and workload isolation
• Performing hardening, patching, and performance tuning in a disconnected environment using bundled RPM delivery (no upstream repos), SELinux, and host firewalls
• Administering platform-native core services CoreDNS, AWS Route 53, ingress/load balancing, and certificate lifecycle (cert-manager / TLS secrets)
• Designing HA/DR and resilience multi-node control planes, automated backup/restore of stateful workloads (PVCs, GitLab, databases), and failover across availability zones

• Architecting and managing AWS GovCloud environments (EC2, S3, EBS, VPC, IAM, Route 53) across multiple accounts with cross-account roles, key pairs, and AMI strategy
• Designing secure, scalable multi-VPC network architectures Transit Gateway meshes, subnets, routing, and CIDR-based security-group rules (cross-VPC SG references are not available in GovCloud)
• Implementing all infrastructure as code with Terraform (reusable per-VPC modules, cross-account providers, programmatically rendered variables)
• Standing up and operating an in-environment OCI/container registry and bootstrap services for offline image distribution
• Optimizing cloud cost, performance, and availability through right-sizing, repeatable destroy/redeploy, and monitoring

• Building and sustaining CI/CD pipelines on self-managed GitLab EE, including version-ladder upgrades, the container registry, and auto-registered Kubernetes runners
• Integrating DevSecOps container/image CVE scanning (e.g., Trivy, Grype, Clair), secrets management, and policy/gating in pipelines
• Operating container build and delivery tooling (Docker/podman, kaniko, Helm) with helm-template-derived, air-gap-reproducible image bundles
• Implementing GitOps delivery with ArgoCD (pull-based, per-app Applications, environment promotion and prod gating)

• Developing automation that eliminates manual intervention single-command, phase-driven deployments validated end-to-end before delivery
• Engineering self-contained, offline deployment bundles (RPMs, OCI images, Helm charts, binaries) for reproducible installs in disconnected networks
• Writing and maintaining automation in Ansible, Python, and Bash; automating provisioning, configuration management, and patching
• Maintaining idempotent, resumable deploy/upgrade/teardown workflows

• Implementing zero-trust identity and SSO with Keycloak (OIDC/SAML), federating platform services (GitLab, ArgoCD, monitoring, admin UIs) and supporting CAC/PIV X.509 smart-card authentication
• Implementing system hardening in accordance with DISA STIGs and NIST baselines as automated, repeatable controls
• Supporting RMF/ATO processes authoring control evidence, security documentation, POA&M items, and continuous-monitoring inputs
• Implementing centralized logging, monitoring, and alerting (Elastic/SIEM, host/audit telemetry, and AWS-native sources where applicable)
• Ensuring IL5/IL6/TS-SCI compliance through enforced security controls, secrets-at-rest protection, and system hardening

• Standing up and operating monitoring/observability (Prometheus, Grafana, node/cluster metrics) and vulnerability scanning (ACAS Tenable.sc/Nessus)
• Monitoring system performance, availability, and capacity to ensure reliability and scalability
• Troubleshooting complex, cross-component issues across the platform (networking, DNS, container runtime, registry, identity) to restore operations
• Providing Tier III support and leading root-cause analysis to resolve issues and prevent recurrence
• Maintaining architecture documentation, deployment guides, and standard operating procedures/runbooks

#LI-LH1

FILLING THIS POSITION IS CONTINGENT UPON FUNDING

• Five plus years of experience in systems/infrastructure engineering with strong Linux (RHEL 8/9/10) depth
• Five plus years of experience in DevSecOps, automation, and AWS cloud environments
• Strong hands-on experience with AWS core services and multi-account/VPC networking
• Production experience operating Kubernetes (RKE2 preferred) RBAC, ingress, Helm, troubleshooting
• Experience with scripting/automation in Ansible, Python, and Bash
• Hands-on experience with infrastructure as code (Terraform)
• Experience building and sustaining CI/CD pipelines (GitLab)
• Working knowledge of networking fundamentals (routing, host firewalls, load balancers, DNS)
• Experience applying DISA STIG / NIST hardening and supporting RMF/ATO in DoD or regulated environments

• Experience with Kubernetes (RKE2, EKS, OpenShift, NKP, Rancher Federal, or similar)
• Knowledge of zero-trust architecture and modern identity solutions
• Experience with HashiCorp Vault, ArgoCD, or GitOps workflows, and service mesh technologies
• Familiarity with monitoring tools (Prometheus, Grafana)
• Experience in DoD or regulated environments (RMF, IL5/IL6/TS-SCI)

SRC IS A CONTRACTOR FOR THE U.S. GOVERNMENT, THIS POSITION WILL REQUIRE U.S. CITIZENSHIP AS WELL AS, A U.S. GOVERNMENT SECURITY CLEARANCE AT THE SECRET LEVEL WITH TOP SECRET / SCI ELIGIBILITY

• Locally within US Space Command's Colorado Springs AOR. Peterson SFB, Schriever SFB and other locations in Colorado Springs (CO)
• Up to two weeks per month to US Space Command facilities at Redstone Arsenal, Huntsville (AL)