DDI Architect: Secure DNS/DHCP/IPAM for Enterprise

Leidos; Houston (TX); On-site; USD 92,000 - 167,000; Full time

Job summary

Leidos seeks a seasoned DDI Architect to lead the design, rollout, and lifecycle management of DNS, DHCP, and IPAM for NASA enterprise networks. You will drive DNSSEC, DoT/DoH/DoQ, and IPv6 strategies while aligning with NIST SP 800-53 controls and federal guidance.

Collaborating with engineering, system administration, and operations, you will ensure secure, compliant, and highly available services, oversee risk reduction, logging, and forensics, and participate in root server operations as

Qualifications

• Bachelor's degree and 10+ years of experience designing and operating enterprise DNS/DHCP/IPAM (DDI) services, with authority in secure DNS architectures (DNSSEC, validating resolvers, signed zones, DS management).
• Hands-on implementation of NIST SP 800-81r3 practices: protective DNS, encrypted DNS (DoT/DoH/DoQ), secure recursive resolvers, authoritative hardening, and comprehensive DNS logging/forensics.
• Practical experience meeting CISA’s Encrypted DNS Guidance and PDNS integration; ability to prevent unauthorized DNS traffic and enforce endpoint, cloud, and SASE/SSE DNS policies.
• Proven track record implementing federal BODs (18‑01, 22‑01, 23‑01, 23‑02) within large environments, including KEV‑driven patch prioritization and Zero Trust controls for management interfaces.
• IPv6 expertise: DNS over IPv6, DHCPv6, IPAM for IPv6, and strategic migration compliant with OMB M‑21‑07 milestones.
• Familiarity with .gov DNSSEC requirements and secure delegation processes for federal domains.
• Knowledge of ARIN policies (NRPM), address planning/aggregation, and registry hygiene (WHOIS/POC validation, RPKI, reverse DNS).

Responsibilities

• Design and maintain authoritative and recursive DNS architectures that implement NIST SP 800‑53 SC‑20 (authoritative) and SC‑21 (recursive/caching)—including DNSSEC signing/validation and chain-of-trust with DS records.
• Operationalize NIST SP 800‑81r3 guidance for secure DNS deployment (protective DNS, encrypted DNS protocols such as DoT/DoH/DoQ, logging/forensics, QNAME minimization) across enterprise DNS roles (authoritative servers, resolvers, zone administration).
• Ensure compliance with CISA’s Encrypted DNS Implementation Guidance and Zero Trust objectives, including routing egress resolution via CISA Protective DNS (PDNS) and blocking unauthorized external resolvers.
• Align with CISA Binding Operational Directives (BODs)—BOD 18‑01 (DMARC/HSTS/STARTTLS), BOD 22‑01 (KEV remediation timelines), BOD 23‑01 (asset visibility/vulnerability detection), and BOD 23‑02 (mitigate internet‑exposed management interfaces).
• Drive IPv6‑first strategy per OMB M‑21‑07 (native IPv6 for public services, IPv6‑only milestones) and maintain dual‑stack transition hygiene for DNS, DHCPv6, and IPAM.

Skills

DNS architectures

DDI (DNS/DHCP/IPAM)

DNS security

DNSSEC

NIST SP 800-53

DoT/DoH/DoQ

IPv6

Zero Trust

Root server operations

Education

Bachelor's degree

Tools

DNSSEC automation

PDNS integration

RPKI

Job description

Leidos seeks a seasoned DDI Architect to lead the design, rollout, and lifecycle management of DNS, DHCP, and IPAM for NASA enterprise networks. You will drive DNSSEC, DoT/DoH/DoQ, and IPv6 strategies while aligning with NIST SP 800-53 controls and federal guidance.

Collaborating with engineering, system administration, and operations, you will ensure secure, compliant, and highly available services, oversee risk reduction, logging, and forensics, and participate in root server operations as