Azure Cloud Platform / Landing Zone Engineer

Northrop Grumman•Rolling Meadows, IL

4d•$111,700 - $193,900•Onsite

About The Position

Northrop Grumman's Corporate Sector's Chief Information & Digital Office (CIDO) is seeking a Sr. Principal Computer Systems Analyst – Cloud Platform / Landing Zone Engineer (Azure) to support its IT Infrastructure & Operations organization's Classified Solutions team. The selected candidate will serve as the leading technical authority for our DoD-approved Azure Isolated Secret Region (AISR) IL 6 multi-account cloud environment. This technical leader applies extensive technical expertise to design, implement, and automate secure, scalable Azure Landing Zones, subscription structures, and virtual enclaves. You will lead the transition from legacy on-premises operational habits to automated, highly resilient, cloud-native architectures. You will ensure that major programs receive high-velocity, modern capabilities without compromising our multi-tenant Authorization to Operate (ATO). Additionally, you will serve as a key technical contact and mentor for junior systems administrators, network engineers, and tier-1 triage teams across the enterprise. The selected candidate will be required to work on-site, full-time at our Redondo Beach, CA, or Rolling Meadows, IL, or Melbourne, FL location.

Requirements

Master's Degree with 6 years of IT experience; OR a Bachelor's Degree with 8 years of IT experience; OR an Associate's Degree with 10 years of IT experience; OR a High School Diploma/GED with 12 years of IT experience is required.
Candidates must have the ability to obtain a U.S. Government Secret level security clearance as a condition of continued employment.
Candidates must meet U.S. Government DoD 8140 (formerly 8570) requirements for an appropriate IAT Level II certification (e.g., CompTIA Security+ CE, CCNA Security, or equivalent) or able to obtain within six months of hire.
Extensive experience with Azure Cloud Administration, Entra ID (Azure AD) directory synchronization, role-based access control (RBAC), and virtual desktop pooling (AVD/VDI) in secure, air-gapped, or regulated environments.
Strong proficiency in Azure-native automation and declarative tools (Bicep, PowerShell, Azure CLI, ARM templates, YAML).
Solid understanding of enterprise networking concepts (subnets, routing, VLANs, BGP) and Azure networking primitives (VNETs, Virtual WAN hubs, ExpressRoute, Azure DNS Private Resolvers, Network Security Groups).

Nice To Haves

A current U.S. Government Secret level security clearance.
Candidates must have the ability to obtain, and maintain, a U.S. Government Top Secret level security clearance as a condition of continued employment.
Candidates must have the ability to obtain, and maintain, SCI level access as a condition of continued employment.
Candidates must have the ability to obtain, and maintain, a Polygraph as a condition of continued employment.
Candidates must have the ability to obtain, and maintain, access to Special Programs as a condition of continued employment.
Microsoft Certified: Azure Solutions Architect Expert, DevOps Engineer Expert, or Azure Security Engineer Associate.
Advanced cybersecurity certifications, such as CASP+ or CISSP (meeting IAM Level III baseline) active at the time of hire.
Experience working directly with Information System Security Managers (ISSMs) and supporting Assessment & Authorization (A&A) activities for cloud-hosted systems under the Risk Management Framework (RMF).
Hands-on experience administering container orchestration platforms (e.g., Azure Kubernetes Service - AKS or OpenShift on Azure) in classified, air-gapped, or regulated environments.
Experience configuring and administering Red Hat Enterprise Linux (RHEL 8/9) servers and Satellite Server repositories in secure environments.
Experience with automated container and code security scanners (e.g., Trivy, Anchore) in offline, air-gapped DevSecOps pipelines.
Familiarity with Cross-Domain Solutions (CDS) and controlled Data Transfer Architectures (DTA) for importing patches and updates into air-gapped Secret networks.
Experience operating under and managing systems within NISPOM Chapter 8, DCID 6/3, ICD-503, JSIG, or JAFAN information system security environments.
Familiarity with logging, audit trails, and observability stacks (such as Prometheus, Grafana, SolarWinds, or Splunk) deployed in air-gapped environments.
Familiarity with Azure's high-side government-only secret regions (Microsoft Isolated Secret Region - MSISR) and their specific architectural constraints (e.g., alias label routing, lack of public internet egress).
Demonstrated technical leadership, including active participation in a technical community of practice, and mentoring junior systems and network administrators.

Responsibilities

Perform as a lead Sr. Principal Computer Systems Analyst – Cloud Platform / Landing Zone Engineer (Azure) in support of classified government contracts.
Communicate effectively with all organizational levels, internal/external customers, vendors, and senior leadership, both verbally and in writing.
Oversee operations and administration of multi-user computer systems and multiple networks, coordinating with IT teams, project managers, and end users.
Analyze requirements, recommend, and implement hardware/software solutions; interact with vendors to evaluate and troubleshoot products and services.
Define, implement, and maintain enterprise-wide system enhancements, including installation, upgrades/patches, monitoring, configuration management, and problem resolution.
Lead testing, validation, and change management for major product releases across platforms.
Develop, publish, and continuously improve technical standards and SOPs.
Ensure compliance with Information Systems security guidelines; prepare and maintain security documentation, audit logs, and Assessment & Authorization (A&A) submissions; serve as senior liaison to the ISSM.
Report on strategic initiatives and project status to executive stakeholders; act as a key technical advisor impacting enterprise-wide, mission-critical systems.
Acts as a key technical advisor to senior leadership; impacts multiple programs and mission‑critical systems across the enterprise.
Provide senior-level technical expertise by mentoring junior and experienced team members, fostering their professional growth and enhancing team capabilities.
Lifts and moves equipment up to 50 pounds.
Work after hours, and weekends, as needed.
Automate the Azure Landing Zone (ALZ): Develop declarative Infrastructure as Code (IaC) using Microsoft Bicep, ARM templates, and Terraform/OpenTofu to programmatically deploy and maintain the ALZ conceptual architecture, management groups, and resource configurations.
Engineer Subscription Vending Patterns: Design and orchestrate automated subscription vending machines and blueprint templates to rapidly and uniformly provision pre-configured virtual enclaves for mission application teams.
Build Air-Gapped CI/CD Pipelines: Build and maintain localized, offline CI/CD pipelines (utilizing Azure DevOps Server or GitLab CI) engineered to execute compilation, validation, and deployment in code-isolated environments lacking internet dependency.
Maintain Custom Image Pipelines: Build and run automated pipelines via localized Ansible and PowerShell scripts to populate a private Azure Compute Gallery. This ensures manual STIG hardening and SCAP compliance validation for Windows Server, Windows 11, and Red Hat Enterprise Linux (RHEL 8/9) images, mitigating the lack of "stock" cloud images in the isolated region.
Orchestrate Resource Optimization: Design and implement automated, event-driven resource optimization scripts (such as VM and Azure Virtual Desktop "server parking" schedules) and consumption-monitoring dashboards to manage billing and reduce sector overhead costs.
Author Enterprise Guardrails: Author, test, and enforce strict Azure Policies and policy initiatives at the management group level to prevent unauthorized resource deployment, block non-compliant configurations, and protect multi-tenant boundaries.
Classified Identity & Access Management (IdAM): Configure and maintain Active Directory Federation Services (ADFS) and Entra ID (Azure AD) directory synchronization across on-premises and cloud boundaries to enforce zero-trust, passwordless Single Sign-On (SSO) and Role-Based Access Control (RBAC) tied to synced classified domain security groups.
Centralize Security Auditing: Configure continuous monitoring (ConMon) and automated diagnostic log forwarding across all subscriptions to secure, immutable Log Analytics Workspaces and on-premises Splunk environments.
Automate Drift Remediation: Implement automated remediation workflows using Azure Logic Apps and Event Grid to instantly flag, isolate, or tear down non-compliant infrastructure and configuration drift.
Support Assessment & Authorization (A&A): Map cloud infrastructure configurations directly to NIST SP 800-53 and DISA STIG controls in EMASS/Archer. Extract automated technical evidence via Azure Resource Graph to guide the successful completion of DCSA annual audits and continuous ATO renewal cycles.
Architect Secure Hub-and-Spoke Networks: Implement, configure, and maintain secure hybrid network paths utilizing Azure Virtual WAN hubs or Azure Route Server to handle secure, encrypted communication boundaries across classified networks.
Enforce Zero-Trust Network Boundaries: Establish zero-trust network boundaries within the landing zone using Azure Private Links, Private Endpoints, and central inspection architectures featuring Azure Firewall Premium.
Resolve Routing Issues: Mitigate complex BGP route propagation errors, manual routing table conflicts, and asynchronous routing issues, enforcing strict tenant domain separation over virtualized transport paths (Transport Layer Backbone - TLB) using Cisco VRF technology.
Configure Isolated Name Resolution: Architect and configure highly restricted DNS architectures using Azure Private DNS Zones and Azure DNS Private Resolver endpoints to ensure reliable name resolution across disconnected network fabrics.
Azure Virtual Desktop (AVD) Scaling: Architect, configure, and scale secure AVD host pools, managing session load balancing, user profiles (using FSLogix disk attachments), and user connection settings. Resolve critical 3D globe browser rendering and OpenGL/OpenCL nested RDP pass-through challenges on high-performance RTX-class GPU virtual machine instances.
Manage Secure Container Registries: Deploy and configure secure containerized services, including Azure Kubernetes Service (AKS) and private Azure Container Registries (ACR) on the high side. Maintain these localized registries to ensure secure, scanned container ingestion.
Air-Gapped Workload Ingestion: Manage the validation of software dependencies, base images, containerized workloads, and Helm charts, ensuring they are cryptographically verified and scanned before ingestion into IL6 networks.
Provide Tier-3 Engineering Support: Onboard mission application teams into the landing zone framework. Resolve complex Azure RBAC permissions, policy denials, or cross-subscription routing blocks that disrupt application delivery.
Technical Leadership & Mentoring: Represent the organization as the prime technical contact on contracts and projects. Interact with senior external personnel (such as Microsoft Customer Support Advocates/CSAs and DCSA auditors) and actively mentor junior/experienced team members by leading upskilling efforts within the Classified Admins Community of Practice.