DDI Architect: Secure DNS/DHCP/IPAM for Enterprise

Leidos Inc; Houston (TX); On-site; USD 92,000 - 167,000; Full time

Job summary

Leidos seeks a seasoned DDI Architect to lead architecture, design, engineering, and lifecycle management of enterprise DNS, DHCP, and IPAM services across NASA networks. You will drive secure, compliant deployments aligned to NIST SP 80053, NIST SP 80081r3, CISA guidance, and DNS operations including Eroot participation.

You will partner with Engineering, System Administration, and Operations teams to deliver scalable DDI, enforce Zero Trust, logging/forensics, and KEV-aligned vulnerability

Qualifications

• Bachelor's degree and 10+ years designing and operating enterprise DNS/DHCP/IPAM (DDI) services with secure DNS architectures (DNSSEC, validating resolvers, signed zones, DS management).
• Hands-on implementation of NIST SP 80081r3 practices: protective DNS, encrypted DNS (DoT/DoH/DoQ), secure recursive resolvers, authoritative hardening, and comprehensive DNS logging/forensics.
• Practical experience meeting CISA's Encrypted DNS Guidance and PDNS integration; ability to prevent unauthorized DNS traffic and enforce DNS policies.
• Proven track record implementing federal BODs (1801, 2201, 2301, 2302) with KEV patching and Zero Trust controls for management interfaces.
• IPv6 expertise: DNS over IPv6, DHCPv6, IPAM for IPv6, and migration per OMB M2107 milestones.
• Familiarity with .gov DNSSEC requirements and secure delegation processes for federal domains.
• Knowledge of ARIN policies (NRPM), address planning/aggregation, and registry hygiene (WHOIS/POC validation, RPKI, reverse DNS).

Responsibilities

• Design and maintain authoritative and recursive DNS architectures with DNSSEC and DS management; ensure chain-of-trust.
• Operationalize NIST SP 80081r3 guidance for secure DNS deployment across enterprise roles.
• Ensure compliance with Encrypted DNS guidance and Zero Trust objectives; route egress resolution to PDNS.
• Align with BODs (1801, 2201, 2301, 2302) for DMARC/HSTS/STARTTLS and KEV remediation timelines.
• Drive IPv6first strategy per OMB M2107; maintain dualstack hygiene for DNS, DHCPv6, IPAM.
• Lead large-scale DDI environments; oversee secure configurations, automation, availability, performance.
• Implement monitoring for DNS misuse; integrate with SIEM/SOAR for forensics per 80081r3.
• Maintain vulnerability management aligned to KEV; coordinate remediation timelines.
• Secure management interfaces; enforce Zero Trust in accordance with BOD 2302.
• Govern DNS email configurations (SPF/DKIM/DMARC) to meet BOD 1801.

Skills

DDI architecture

DNS/DHCP/IPAM

DNSSEC & DNS security

NIST SP 80053 SC20/SC21

Zero Trust / PDNS integration

IPv6/DNS over IPv6

ARIN/IP address governance

Education

Bachelor's degree in a relevant field

Equivalent combination with 15+ years experience

Tools

DNS appliances UI/API

PDNS integration

DNSSEC tooling

Job description

Leidos seeks a seasoned DDI Architect to lead architecture, design, engineering, and lifecycle management of enterprise DNS, DHCP, and IPAM services across NASA networks. You will drive secure, compliant deployments aligned to NIST SP 80053, NIST SP 80081r3, CISA guidance, and DNS operations including Eroot participation.

You will partner with Engineering, System Administration, and Operations teams to deliver scalable DDI, enforce Zero Trust, logging/forensics, and KEV-aligned vulnerability