Senior Platform Engineer-TS Required

SixGen • Reston, VA

13d • Hybrid

About The Position

We are seeking a Senior Platform Engineer to build, secure, administer, and scale the in-house infrastructure that supports a sensitive, high-assurance environment. You will design and operate the virtualization, networking, identity, and monitoring stack our teams depend on — standing infrastructure up from bare metal, automating it end to end, and keeping it secure, reliable, and auditable. The ideal candidate pairs deep hypervisor and Linux systems expertise with strong network and endpoint security, infrastructure-as-code fluency, and the discipline to run a controlled, well-documented environment. You will own the platform end to end — virtualization, segmentation, identity and secrets, software supply chain, and observability — and turn architecture into a resilient, production-ready capability.

Requirements

• 5+ years in platform, infrastructure, systems, or DevOps engineering — building and administering production virtualization, networking, and Linux environments.
• Active TS/SCI clearance.
• Deep hands-on expertise with a Type-1 hypervisor (Proxmox VE, KVM/QEMU, VMware ESXi, or equivalent), including clustering, shared storage, templating, and GPU passthrough.
• Strong network engineering and security skills: segmentation, stateful firewalls, zero-trust / least-privilege design, VPNs, DNS, PKI/mTLS, and TCP/IP fundamentals.
• Demonstrated endpoint and OS hardening across Linux and Windows to CIS/STIG baselines: full-disk encryption, measured boot, host firewalls, and attack-surface reduction.
• Fluency in infrastructure-as-code and automation (e.g., Terraform, Ansible, Packer) plus Python and Bash, with a track record of shipping and maintaining working tooling and pipelines.
• Working knowledge of secrets management, containerization, Git and CI/CD, and an observability/SIEM stack.
• Proven ability to stand up infrastructure from bare metal to operational, document it in runbooks, and operate it under security- and audit-sensitive conditions.

Nice To Haves

• TS/SCI with CI polygraph; background supporting national security, intelligence community, or federal missions.
• Experience building or operating secure, isolated, or highly segmented infrastructure for sensitive or security-critical environments.
• Multi-cloud experience (AWS, GCP, Azure) with self-hosted networking.
• Experience building SIEM/audit pipelines with tamper-evident logging and detection engineering.
• Relevant certifications (e.g., RHCE, CKA, Security+/CISSP) and familiarity with SOC 2, ISO/IEC 27001, NIST CSF, or NIST SP 800-115.
• Experience standing up a new capability, unit, or program from zero — including standards authorship, staging environments, and identity-lifecycle (onboarding/offboarding) design.

Responsibilities

• Virtualization & Hypervisor Engineering: Design, build, and administer a highly available Type-1 hypervisor cluster as the backbone for internal services and workloads — including shared/software-defined storage, redundant networking, and GPU passthrough for local compute and AI inference.
• Build hardened, versioned golden images with an automated, scheduled rebuild cadence so workloads always launch from a current, patched baseline.
• Automate provisioning of isolated workload VMs with controlled, auditable access to shared storage.
• Tune and troubleshoot the virtualization layer for concurrent workloads and capacity; manage cluster health against a documented sizing model.
• Network Architecture & Security: Architect and enforce a segmented, least-privilege network with layered firewall enforcement (defense in depth) and a default-deny posture.
• Implement strong isolation between user access, shared services, workloads, and management, so each tier reaches only what it must.
• Build and operate self-hosted remote access (modern VPN with strong MFA) and internal connectivity, keeping control planes private and not internet-exposed.
• Own internal DNS, PKI/mTLS, and time synchronization; enforce encrypted, controlled name resolution.
• Endpoint & System Hardening: Build and maintain hardened endpoints and hosts to recognized baselines (CIS Benchmarks / DISA STIG): full-disk encryption, measured boot, host firewalls, and least privilege.
• Reduce platform attack surface across firmware and OS; disable unnecessary services and management interfaces.
• Maintain a consistent, reproducible hardened baseline across the fleet, validated before deployment.
• Author and enforce the hardening standards, runbooks, and image definitions that keep endpoints and hosts clean, patched, and reproducible.
• Automation, Infrastructure-as-Code & Platform Operations: Provision the environment as code (infrastructure-as-code plus configuration management) with encrypted state and runtime secret injection — no secrets at rest in code.
• Build self-service provisioning that stands up and decommissions workloads cleanly, with each action recorded.
• Run a controlled software supply chain: internal package and code mirrors so systems build from vetted, internal sources.
• Maintain a staging path to validate changes before production, plus staged patch management and tested backup/restore.
• Monitoring, Audit & Assurance: Build the observability stack (metrics, health, alerting), isolated from workloads so it cannot be reached or tampered with from them.
• Stand up centralized logging and a SIEM with tamper-evident, long-retention audit storage, so every action is attributable and traceable.
• Deploy network and flow monitoring at key boundaries, with alerting on anomalies and integrity issues.
• Implement isolation and response controls, and generate the audit evidence that supports common security frameworks (SOC 2, ISO 27001, NIST CSF, NIST SP 800-115).

Benefits

• Employer-paid health insurance premiums (medical, dental, vision) for you and your family
• Employer-paid short/long term disability insurance and basic life/AD&D insurance
• 401K with a 4% employer contribution
• Professional development reimbursement options available (training, certification, education, etc)
• Flexible and remote work policies for most positions
• Flexible PTO and holiday schedule

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed