Senior Platform Engineer-TS Required

Senior Platform Engineer Building, securing, and scaling virtualization, network, and endpoint infrastructure for a sensitive, high-assurance environment Position Overview Position: Senior Platform Engineer Job Type: Full-time Location: Sterling or Reston, VA (Hybrid)-3 days a week in office/2 days WFH Clearance Requirements: Active TS/SCI required; CI polygraph preferred Experience: 5+ years What You'll Do We are seeking a Senior Platform Engineer to build, secure, administer, and scale the in-house infrastructure that supports a sensitive, high-assurance environment. You will design and operate the virtualization, networking, identity, and monitoring stack our teams depend on — standing infrastructure up from bare metal, automating it end to end, and keeping it secure, reliable, and auditable. The ideal candidate pairs deep hypervisor and Linux systems expertise with strong network and endpoint security, infrastructure-as-code fluency, and the discipline to run a controlled, well-documented environment. You will own the platform end to end — virtualization, segmentation, identity and secrets, software supply chain, and observability — and turn architecture into a resilient, production-ready capability. Key Responsibilities Virtualization & Hypervisor Engineering Design, build, and administer a highly available Type-1 hypervisor cluster as the backbone for internal services and workloads — including shared/software-defined storage, redundant networking, and GPU passthrough for local compute and AI inference. Build hardened, versioned golden images with an automated, scheduled rebuild cadence so workloads always launch from a current, patched baseline. Automate provisioning of isolated workload VMs with controlled, auditable access to shared storage. Tune and troubleshoot the virtualization layer for concurrent workloads and capacity; manage cluster health against a documented sizing model. Network Architecture & Security Architect and enforce a segmented, least-privilege network with layered firewall enforcement (defense in depth) and a default-deny posture. Implement strong isolation between user access, shared services, workloads, and management, so each tier reaches only what it must. Build and operate self-hosted remote access (modern VPN with strong MFA) and internal connectivity, keeping control planes private and not internet-exposed. Own internal DNS, PKI/mTLS, and time synchronization; enforce encrypted, controlled name resolution. Endpoint & System Hardening Build and maintain hardened endpoints and hosts to recognized baselines (CIS Benchmarks / DISA STIG): full-disk encryption, measured boot, host firewalls, and least privilege. Reduce platform attack surface across firmware and OS; disable unnecessary services and management interfaces. Maintain a consistent, reproducible hardened baseline across the fleet, validated before deployment. Author and enforce the hardening standards, runbooks, and image definitions that keep endpoints and hosts clean, patched, and reproducible. Automation, Infrastructure-as-Code & Platform Operations Provision the environment as code (infrastructure-as-code plus configuration management) with encrypted state and runtime secret injection — no secrets at rest in code. Build self-service provisioning that stands up and decommissions workloads cleanly, with each action recorded. Run a controlled software supply chain: internal package and code mirrors so systems build from vetted, internal sources. Maintain a staging path to validate changes before production, plus staged patch management and tested backup/restore. Monitoring, Audit & Assurnace Build the observability stack (metrics, health, alerting), isolated from workloads so it cannot be reached or tampered with from them. Stand up centralized logging and a SIEM with tamper-evident, long-retention audit storage, so every action is attributable and traceable. Deploy network and flow monitoring at key boundaries, with alerting on anoma…