CSfC Systems Engineer Subject Matter Expert (SME)

Global Enterprise Services•Fort Belvoir, VA

16h

About The Position

GES is seeking an experienced Systems Engineer Subject Matter Expert (SME) to join its Integrated Information Technology Support Services (I3TS) team and support a digital modernization program for the Defense Threat Reduction Agency (DTRA). The role works closely with Leidos and Government technical leadership to advance innovation, growth, and efficiency across the I3TS portfolio. The SME will architect, deploy, and maintain Commercial Solutions for Classified (CSfC) infrastructure across Black, Gray, and Red networks. The work includes PKI and hardware-backed key protection, virtualized compute and storage, resilient backup and disaster recovery, hardened Windows Server and Red Hat Enterprise Linux platforms, centralized logging, vulnerability remediation, and compliance with DISA Security Technical Implementation Guides (STIGs) and Department of War (DoW) patching requirements. The role supports continuous Authorization to Operate (ATO) and automated gold-image provisioning for CSfC End User Devices.

Requirements

Active TS/SCI clearance at the time of consideration.
Bachelor’s degree or higher in Computer Science, Information Technology, Engineering, Engineering Management, Management Information Systems, or a related STEM program, plus 12–15 years of relevant experience; alternatively, a master’s degree with 10–13 years of relevant experience. A doctorate in a technical domain may be held. Specific experience, education, and training may be considered in lieu of a degree.
At least 12 years of progressive systems engineering experience in DoD/DoW, federal, or defense contractor enterprise environments.
Active DoD 8570.01-M / DoD 8140 IAT Level II or III baseline certification, such as Security+ CE, CySA+, CASP+, or CISSP.
Active computing environment certification in at least one of the following: VMware VCP/VCAP, Nutanix NCP, RHCE, or Microsoft Certified: Windows Server Hybrid Administrator Associate.
Direct experience drafting CSfC Key Management Plans and Continuous Monitoring Plans for NSA CSfC PMO approval.
Proficiency with PowerShell, Bash, and Ansible for automated STIG remediation, configuration drift detection, and certificate deployment.
Advanced configuration experience with Rsyslog or Syslog-ng and forwarding architectures to enterprise SIEM platforms such as Splunk or Elastic.

Nice To Haves

Experience designing, deploying, and maintaining IT infrastructures for DTRA or other DoW organizations.

Responsibilities

Architect, deploy, and maintain CSfC infrastructure operating within Black, Gray, and Red networks.
Design, configure, and maintain multi-layer CSfC architectures aligned with NSA Data-At-Rest and Mobile Access Capability Packages.
Architect, deploy, and maintain Certificate Authority and OCSP responder services, and hardware-backed key protection using HSMs in accordance with CSfC Key Management Requirements.
Build, manage, and optimize virtualized compute and storage fabrics using VMware vSphere/ESXi or Nutanix AHV with vSAN or distributed storage.
Design resilient, air-gapped backup and disaster recovery pipelines.
Deploy, configure, and administer hardened Windows Server systems, including Active Directory, DNS, and Group Policy, and RHEL systems.
Establish centralized, tamper-resistant Syslog and audit logging across network devices, systems, hypervisors, and operating systems to support continuous monitoring and SIEM ingestion.
Understand cross-domain systems and forward log data through them to a centralized SIEM.
Build and maintain automated OS deployment and gold-image pipelines using Microsoft Configuration Manager (MCM/SCCM) for CSfC End User Devices.
Apply and validate patching and STIGs across virtual and physical infrastructure.
Execute vulnerability scans, track IAVMs, and remediate findings to maintain ATO.
Draft CSfC Key Management Plans and Continuous Monitoring Plans for NSA CSfC PMO approval.
Use PowerShell, Bash, and Ansible for automated STIG remediation, configuration drift detection, and certificate deployment.