DDI Architect: Secure DNS/DHCP/IPAM for Enterprise

Leidos Inc; Orlando (FL); On-site; USD 92,000 - 167,000; Full time

Job summary

Leidos is seeking a DDI Architect to lead the design, deployment, and lifecycle management of DNS/DHCP/IPAM services for NASA networks. You will drive secure, scalable architecture aligned to federal guidance and collaborate with engineering, system administration, and operations teams.

The role emphasizes DNSSEC, encrypted DNS (DoT/DoH/DoQ), and Zero Trust controls, including root/server operations and government domain stewardship.

Qualifications

• Bachelor's degree and 10+ years designing and operating enterprise DNS/DHCP/IPAM (DDI) services, with authority in secure DNS architectures (DNSSEC, validating resolvers, signed zones, DS management). (Aligned to NIST SP 80053 SC20/SC21.)
• Hands-on implementation of NIST SP 80081r3 practices: protective DNS, encrypted DNS (DoT/DoH/DoQ), secure recursive resolvers, authoritative hardening, and DNS logging/forensics.
• Practical experience meeting CISA's Encrypted DNS Guidance and PDNS integration; ability to prevent unauthorized DNS traffic and enforce DNS policies.
• Proven track record implementing federal BODs (1801, 2201, 2301, 2302) with KEV-driven patching and Zero Trust controls for management interfaces.
• IPv6 expertise: DNS over IPv6, DHCPv6, IPAM for IPv6, and migration per OMB M2107 milestones.

Responsibilities

• Design and maintain authoritative and recursive DNS architectures with DNSSEC signing/validation and DS management.
• Operationalize NIST SP 80081r3 guidance for protective DNS and encrypted protocols (DoT/DoH/DoQ), logging/forensics across authoritative servers, resolvers, and zone administration.
• Ensure compliance with CISA Encrypted DNS Guidance and Zero Trust objectives for egress resolution via PDNS and blocking unauthorized resolvers.
• Align with BODs (1801, 2201, 2301, 2302) including KEV remediation timelines and secure management interfaces.
• Govern DNS email configurations (SPF/DKIM/DMARC) to meet BOD 1801 requirements and support NASA Email Architecture.
• Participate in Root Server operations and .gov domain stewardship as applicable, including adherence to RSSAC002 metrics.
• Administer IPv4/IPv6 allocations per ARIN policies and ensure registry hygiene and RPKI deployment.
• Evaluate and integrate DDI platform capabilities (encrypted DNS with PDNS, DNSSEC automation, DHCPv6 prefix delegation, IPAM APIs) for Zero Trust alignment.

Skills

DDI Architecture

DNS

DHCP

IPAM

DNSSEC

NIST SP 80053

NIST SP 80081r3

Zero Trust

IPv6

Root Server Operations

Education

Bachelor's degree

Job description

Leidos is seeking a DDI Architect to lead the design, deployment, and lifecycle management of DNS/DHCP/IPAM services for NASA networks. You will drive secure, scalable architecture aligned to federal guidance and collaborate with engineering, system administration, and operations teams.

The role emphasizes DNSSEC, encrypted DNS (DoT/DoH/DoQ), and Zero Trust controls, including root/server operations and government domain stewardship.