Lead Platform Engineer

E&M Technologies•Chantilly, VA

6h•Onsite

About The Position

E&M Technologies, Inc. is seeking a Lead Platform Engineer to work in Chantilly, Virginia, supporting the National Geospatial-Intelligence Agency. The role focuses on building, securing, operating, and troubleshooting production Kubernetes platforms in on-premises and air-gapped environments. The engineer will manage Linux systems, container runtimes, software-defined storage, high-availability clusters, security controls, automation, GitOps workflows, and infrastructure delivery pipelines. Candidates must be U.S. citizens and hold and maintain a DoD Top Secret/SCI clearance upon hire, with willingness and ability to obtain a polygraph within the customer’s timeline after hire. Travel requirements are up to 10%.

Requirements

Master’s degree in a STEM field and at least 6 years of relevant experience, or a bachelor’s degree and at least 8 years of experience.
At least 2 years of hands-on experience deploying and managing production Kubernetes clusters in on-premises or non-cloud environments.
Demonstrated experience bootstrapping Kubernetes clusters with Kubespray, kubeadm, or similar tools.
Proven experience managing enterprise Linux systems in production environments.
Experience with Ansible automation and playbook development for infrastructure provisioning.
Experience designing and implementing high-availability infrastructure architectures.
Experience with GitOps methodologies and ArgoCD or similar continuous deployment tools.
Experience with air-gapped or offline deployment strategies.
U.S. citizenship.
Must hold and be capable of maintaining a U.S. Department of Defense Top Secret/SCI security clearance upon hire.
Must be willing and able to obtain a polygraph within the customer’s timeline after hire.
Must meet U.S. Government eligibility requirements for access to classified information.

Nice To Haves

Expertise with identity and authorization standards, including X.509, SAML, OAuth2, OIDC, and LDAP.
Experience architecting ICAM solutions using Oracle or other enterprise-grade identity platforms.
Certified Kubernetes Security Specialist.

Responsibilities

Perform advanced Linux administration, including configuring systemd, kernel tuning parameters, and SSH key architecture.
Install and configure container runtimes such as containerd and CRI-O; manage cgroups v2, namespaces, and container isolation.
Implement operating-system security hardening using AppArmor, SELinux, and security profiles.
Design software-defined storage solutions and resilient distributed storage clusters using local drives.
Implement CSI drivers for dynamic volume provisioning and monitor storage performance, capacity, and data replication.
Bootstrap production Kubernetes clusters from scratch in on-premises data centers without managed services.
Design highly available, multi-master control planes and configure internal load balancers for Kubernetes API server redundancy.
Manage etcd operations, including backups, snapshots, restoration, and defragmentation.
Deploy clusters using kubeadm, Kubespray, or similar tools; perform upgrades, node maintenance, and disaster recovery.
Implement cluster monitoring, logging, and observability solutions.
Apply Kubernetes security best practices, including API server auditing, RBAC, network policies, pod security standards, admission controllers, and runtime controls.
Manage certificates for cluster components and service mesh implementations.
Conduct security assessments and remediate cluster infrastructure vulnerabilities.
Develop Ansible, Bash, or Python automation for cluster provisioning and maintain infrastructure-as-code repositories.
Implement GitOps workflows and build CI/CD pipelines for infrastructure testing and validation.
Manage Kaniko-based container image builds in air-gapped environments and configure environment-specific inventories and Helm values.
Analyze ArgoCD application logs, pod events, and container logs for root cause analysis.
Administer clusters and debug pods and containers using k9s, kubectl, and crictl.
Troubleshoot static pods, including etcd, kube-apiserver, kube-controller-manager, and kube-scheduler, on controller nodes.