DDIL Subject Matter Expert (Infrastructure Engineer/Architect)

Sapient Logic LLC; Charleston (SC); On-site; USD 130,000 - 190,000; Full time

Benefits offered by this job

401(k) matching

Employee assistance program

Flexible spending account

Health insurance

Health savings account

Life insurance

Paid time off

Parental leave

Vision insurance

Job summary

Sapient Logic seeks a DDIL Subject Matter Expert (Infrastructure Engineer/Architect) to guide architecture for secure mission services operating in disconnected environments. The role focuses on local identity and data protection, cache strategies, and resilient synchronization with enterprise services.

The engineer defines operational scenarios, develops implementation roadmaps, and ensures adherence to security controls and performance criteria across edge and on-site deployments in

Qualifications

• Demonstrated expertise designing systems operating with denied or degraded connectivity.
• Experience creating mission/enterprise architectures for disconnected operation and eventual synchronization.
• Translate operational constraints into technical requirements and testable criteria.
• Understand distributed systems concepts: consistency, replication, caching, conflict resolution, failure recovery.
• Address identity, authentication, authorization, or credential dependencies when services are unavailable.
• Security implications of stale attributes, revocation delays, expired credentials, and unavailable policy or key services.
• Assess bandwidth, latency, and network availability impacts on apps and services.
• Develop architecture docs, analyses, and implementation roadmaps.
• Explain tradeoffs and residual risks to decision-makers and engineering teams.
• Experience across mission, cybersecurity, infrastructure, and app development stakeholders.
• Deploy localized PEPs and PDPs on edge compute devices.

Responsibilities

• Develop DDIL strategies and implementation roadmaps for mission apps and security services.
• Collaborate with mission owners to define operational scenarios and constraints.
• Translate scenarios into requirements for autonomy, bandwidth, latency, and recovery.
• Define which capabilities must remain available without enterprise reachback.
• Architect local identity services and caching of security attributes.
• Plan for cached attribute freshness, credential expiry, revocation, and offline policy updates.
• Evaluate access control tradeoffs and offline operation safeguards.
• Design synchronization and reconnection approaches for data consistency on reconnection.
• Define dependencies among apps, identity providers, policy services, and key management.
• Produce architecture diagrams, interface specs, and risk assessments.
• Support governance docs for caching and use of identity attributes.
• Guide prototypes and demonstrations under impaired network conditions.
• Define measurable criteria for continuity and security during outages.

Skills

DDIL expertise

Distributed systems

Identity management

Data protection

Policy enforcement

Edge compute

HWIL testing

Security architecture

Threat modeling

DoD TS/SCI awareness

Education

Bachelor's or Master's degree

Tools

AWS

Kubernetes

OpenShift

Job description

Sapient Logic is seeking a DDIL Subject Matter Expert (Infrastructure Engineer/Architect) to support a Government mission customer in Charleston, SC or Reston, VA. This full-time, on-site role will guide architecture for secure mission services operating under denied, disrupted, intermittent, or limited connectivity. The engineer will design resilient identity, authorization, and data protection capabilities that support disconnected operation and safe reconnection to enterprise services.

Responsibilities:

• Develop DDIL strategies, architectural approaches, and implementation roadmaps for mission applications and supporting security services.
• Work with mission owners to define operational scenarios, connectivity constraints, mission priorities, and acceptable levels of degraded service.
• Translate those scenarios into requirements for local autonomy, bandwidth use, latency, outage duration, synchronization, and recovery.
• Define which identity, authorization, directory, credential, and data protection capabilities must remain available without enterprise reachback.
• Architect local identity and attribute services, including virtual directories and approved caching of security information.
• Establish approaches for cached attribute freshness, credential expiration, revocation awareness, authorization policy updates, and operation when authoritative sources cannot be reached.
• Evaluate access control tradeoffs, including when services should deny access, permit bounded local operation, or require additional safeguards.
• Design synchronization and reconnection approaches that address conflicting updates, stale identity data, audit records, and restoration of enterprise consistency.
• Define dependencies among applications, identity providers, policy services, directories, encryption services, and key management infrastructure.
• Assess data placement, replication, and protection requirements across connected and disconnected environments, including approved cross-domain interfaces.
• Develop architecture diagrams, interface requirements, alternatives analyses, risk assessments, and phased implementation recommendations.
• Support agreements and approval documentation governing the caching and use of identity and security attributes.
• Guide prototypes and demonstrations that validate architectural assumptions under representative network impairments.
• Define measurable acceptance criteria and help teams evaluate mission continuity, security behavior, and recovery during connectivity loss and restoration.
• Coordinate with Government stakeholders, mission partners, security personnel, and engineering teams to resolve architectural gaps and guide implementation.

Required Qualifications:

• Demonstrated subject matter expertise designing, evaluating, or fielding systems that operate with denied, disrupted, intermittent, or limited connectivity.
• Experience developing mission or enterprise architectures that support disconnected operation, local processing, and eventual synchronization with authoritative services.
• Ability to translate operational constraints into technical requirements, architectural decisions, and testable performance criteria.
• Understanding of distributed systems concepts, including consistency, replication, caching, conflict resolution, and failure recovery.
• Experience addressing identity, authentication, authorization, or credential dependencies when enterprise services are unavailable.
• Understanding of the security implications of stale attributes, delayed revocation information, expired credentials, and unavailable policy or key services.
• Experience assessing bandwidth, latency, packet loss, and network availability constraints and their effects on application and service behavior.
• Experience developing technical strategies, architecture documentation, alternatives analyses, and implementation roadmaps.
• Ability to explain architectural tradeoffs and residual risks to Government decision-makers and provide actionable guidance to engineering teams.
• Experience working across mission, cybersecurity, infrastructure, and application development stakeholders.
• Experience deploying localized Policy Enforcement Points (PEPs) and lightweight Policy Decision Points (PDPs) on edge compute appliances and dismounted kits.
• Experience conducting modeling, simulation, and hardware-in-the-loop (HWIL) testing to replicate tactical link degradation, electronic warfare (EW) effects, and packet-loss profiles.
• Active DoD Top Secret/Sensitive Compartmented Information (TS/SCI) Clearance with the ability to obtain a Counterintelligence (CI) Polygraph is required.
• U.S. Citizenship is required.

Desired Qualifications:

• Prior experience supporting the Intelligence Community.
• Bachelor’s or Master’s degree.
• Operational DDIL experience: Experience supporting deployed, tactical, expeditionary, edge, or other mission environments with constrained reachback.
• Identity services: Experience with Identity, Credential, and Access Management (ICAM), virtual directories, identity federation, and local identity and attribute caching.
• Authorization design: Experience with attribute-based access control, local policy enforcement, bounded offline access, and synchronization of authorization policies.
• Data protection: Familiarity with Trusted Data Format (TDF), data tagging, encryption, and access enforcement when central services are unavailable.
• Key and certificate services: Experience addressing Public Key Infrastructure (PKI), certificate validation, credential renewal, and key availability in disconnected environments.
• Distributed applications: Experience with store-and-forward messaging, durable queues, retry behavior, duplicate handling, and reconciliation after reconnection.
• Cross-domain environments: Experience defining approved identity and data exchanges across security domains and mission partner boundaries.
• Cloud and edge platforms: Familiarity with Amazon Web Services (AWS), Kubernetes, Red Hat OpenShift, and deployment patterns spanning enterprise and local infrastructure.
• Validation and experimentation: Experience using network impairment testing, fault injection, or operational demonstrations to assess degraded-mode behavior.
• Zero Trust: Experience adapting identity, device, application, and data security controls to environments where continuous enterprise connectivity cannot be assumed.
• Segmentation: Experience implementing software-defined micro-segmentation, overlay networks, and dynamic perimeter controls across non-standard transport channels (e.g., HF/VHF/UHF, SATCOM, mesh radios, 5G tactical bubbles).

• Job Type:Full-time
• 401(k) matching
• Employee assistance program
• Flexible spending account
• Health insurance
• Health savings account
• Life insurance
• Paid time off
• Parental leave
• Vision insurance

Schedule:

• 8-hour shift
• Monday to Friday
• Day shift
• Ability to work additional hours as needed to support mission requirements

Work Location: On-site – Charleston, SC or Reston, VA (Washington, DC metro)

Security Clearance: Active TS/SCI clearance required