Lead Platform Engineer

E&M Technologies, Inc.•Chantilly, VA

3d•$155,000 - $170,000•Onsite

About The Position

E&M Technologies, Inc. is seeking a Lead Platform Engineer to support the National Geospatial-Intelligence Agency in Chantilly, Virginia. The role focuses on engineering and operating secure, highly available Kubernetes platforms in on-premises and air-gapped environments. The engineer will administer Linux systems, build and maintain Kubernetes clusters and distributed storage, implement platform security, and automate infrastructure deployment and lifecycle management. The position is temporary and requires U.S. citizenship and a Top Secret/SCI clearance, with willingness and ability to obtain a polygraph within the customer’s timeline after hire. Travel requirements are up to 10%.

Requirements

Master’s degree in a STEM field and at least 6 years of relevant experience, or a bachelor’s degree and at least 8 years of relevant experience.
At least 2 years of hands-on experience deploying and managing production Kubernetes clusters in on-premises or non-cloud environments.
Demonstrated experience bootstrapping Kubernetes clusters using Kubespray, kubeadm, or similar tools.
Proven experience managing enterprise Linux systems in production environments.
Experience with Ansible automation and playbook development for infrastructure provisioning.
Experience designing and implementing high-availability infrastructure architectures.
Experience with GitOps methodologies and ArgoCD or similar continuous deployment tools.
Experience with air-gapped or offline deployment strategies.
Must be a U.S. citizen.
Must have and be capable of maintaining a U.S. Department of Defense Top Secret/SCI security clearance upon hire, and be willing and able to obtain a polygraph within the customer’s timeline after hire.
Must meet eligibility requirements for access to classified information and be subject to a U.S. Government security investigation.

Nice To Haves

Expertise with identity and authorization standards, including X.509, SAML, OAuth2, OIDC, and LDAP.
Experience architecting ICAM solutions using Oracle or other enterprise-grade identity platforms.
Certified Kubernetes Security Specialist.

Responsibilities

Perform advanced Linux administration, including configuring systemd, kernel tuning parameters, and SSH key architecture.
Install and configure container runtimes such as containerd and CRI-O; manage cgroups v2, namespaces, and OS-level container isolation.
Implement OS-level security hardening using AppArmor, SELinux, and security profiles.
Design software-defined storage solutions that translate physical storage into dynamic persistent volumes, and build resilient distributed storage clusters from local drives.
Implement CSI drivers for dynamic volume provisioning; monitor storage performance, plan capacity, and manage data replication strategies.
Bootstrap production Kubernetes clusters from scratch in on-premises data centers without managed services.
Design high-availability control-plane architectures with multi-master nodes and configure internal load balancers for API server redundancy.
Manage etcd operations, including backups, snapshots, restoration, and defragmentation.
Deploy clusters using kubeadm, Kubespray, or similar tools; perform upgrades, node maintenance, and disaster recovery.
Implement cluster monitoring, logging, and observability solutions.
Apply Kubernetes security best practices, including API server auditing, RBAC, network policies, pod security standards, admission controllers, and runtime security controls.
Manage certificate lifecycles for cluster components and service mesh implementations; conduct security assessments and remediate infrastructure vulnerabilities.
Develop automation scripts and Ansible playbooks, implement GitOps workflows, and maintain infrastructure-as-code repositories for repeatable deployments.
Build CI/CD pipelines for infrastructure testing and validation; manage Kaniko-based container image builds in air-gapped environments.
Configure environment-specific inventories and Helm values across multiple deployment tiers.
Analyze ArgoCD application logs, pod events, and container logs to identify root causes.
Administer clusters and debug pods and containers using k9s, kubectl, and crictl.
Troubleshoot static pods, including etcd, kube-apiserver, kube-controller-manager, and kube-scheduler, on controller nodes.