Forward Deployed Infrastructure Engineer (TS/SCI Clearance Required)

Lumbra Inc.; Arlington (VA); On-site; USD 200,000 - 300,000; Full time

Benefits offered by this job

Health insurance

HSA plan

Life insurance

401(k) match

Wellhub Gold

Unlimited PTO

Paid holidays

Leave of absence

Office meals

Company phone

Job summary

Lumbra Incorporated is seeking a Forward Deployed Infrastructure Engineer to own air-gapped deployment pipelines and onsite Kubernetes operations in Arlington, VA. A active TS/SCI clearance is required to manage offline environments and restricted clusters.

You will configure Helm for on-prem targets, manage Rancher/ArgoCD/Harbor, and ensure secure PKI, secret handling, and OCI build pipelines using Podman/Buildah. The role emphasizes reliance on self-contained tooling with no internet access.

Qualifications

• Active TS/SCI clearance required.
• Experience with air-gapped deployments in on-prem/offline environments.
• Deep Kubernetes experience in restricted environments (no internet).
• Kubernetes-native tooling and GitOps workflows (ArgoCD).
• Hands-on with Helm in complex deployments and env translations.
• PKI and certificate management in classified environments.
• Rootless container tooling (Podman/Buildah).
• Experience with DoD STIG or equivalent security standards.

Responsibilities

• Own the air-gapped deployment pipeline end-to-end across disconnected environments.
• Author and maintain onsite Helm configurations for each deployment target.
• Deploy and operate stateful infrastructure services on bare Kubernetes without managed cloud backends.
• Manage cluster and delivery toolchain: Rancher, ArgoCD, and Harbor in air-gapped environments.
• Oversee secrets lifecycle, ensuring credentials are generated onsite with no media transfer.
• Handle PKI across onsite deployments and maintain trust chains without external CAs.
• Build OCI-compliant container build pipelines (Podman/Buildah) for restricted environments.
• Troubleshoot Kubernetes issues in environments with no external access.

Skills

Kubernetes

Helm

Rancher

ArgoCD

Harbor

Podman

Buildah

Keycloak

Temporal

STIG

AT0/ATO documentation

Cross-domain solutions

PKI

Tools

Rancher

ArgoCD

Harbor

Job description

Forward Deployed Infrastructure Engineer (TS/SCI Clearance Required)

Software Engineer / Arlington / On Site / Full Time

About the Role

Lumbra is building Nebula, an agentic harness deployed across commercial cloud, on-prem cloud (AWS GovCloud, C2S, or equivalent), and fully air-gapped classified environments. We're looking for a cleared infrastructure engineer to own the onsite deployment pipeline and ensure the harness runs reliably across this spectrum, from managed Kubernetes with limited connectivity to standalone clusters with no internet access at all.

This role requires an active U.S. security clearance (TS/SCI).

What You’ll Own

Own the air-gapped deployment pipeline end to end: transferring source code, charts, and configuration to disconnected environments, then building and deploying container images onsite. You need deep experience operating where nothing can be pulled from the internet.

Author and maintain onsite Helm configurations that adapt to each deployment target, whether that means leveraging managed services in an on-prem cloud or replacing them with Kubernetes-native alternatives on standalone clusters. Strong Helm skills and an understanding of environment-specific translation are essential.

Deploy and operate stateful infrastructure services (databases, caching, workflow orchestration, identity, object storage) on bare Kubernetes without managed cloud backends. Comfort with stateful workloads in constrained environments is a must.

Own the onsite cluster management and delivery toolchain including Rancher for Kubernetes lifecycle management, ArgoCD for GitOps-based deployments, and Harbor as the container registry. Experience operating these tools in disconnected environments is essential.

Manage the secrets lifecycle in classified environments, ensuring all credentials are generated fresh onsite with no secrets transferred on physical media. Rigorous security practices and familiarity with classified handling procedures are required.

Own PKI and certificate management across onsite deployments: CA hierarchies, certificate issuance and rotation, mTLS between services, and trust chain validation in environments where external certificate authorities are unavailable. A fundamental understanding of public key infrastructure is essential.

Build and maintain OCI-compliant container build pipelines (Podman, Buildah) for environments where Docker is not available. Experience with rootless, hardened container tooling is needed.

Troubleshoot Kubernetes issues in environments with no external access: crashed pods, failed migrations, certificate errors, storage problems, all without pulling a debug image or searching the internet. Deep Kubernetes internals knowledge and self-sufficiency are essential.

Profile and optimize system performance in constrained environments: resource utilization, pod scheduling, storage I/O, and network throughput on clusters where you can't simply scale up. Every millisecond and megabyte matters when hardware is fixed and access is limited.

Ensure deployment parity between cloud and onsite by validating that health checks, resource limits, and service configurations stay aligned across both tracks. Own the onsite monitoring architecture that gives the team high visibility into system health, resource utilization, and service status across environments. You'll work closely with the cloud infrastructure team to prevent drift.

Author and maintain database operations tooling (migrations, backup/restore, schema management) that works reliably in disconnected environments using Kubernetes Job templates.

Write deployment procedures, runbooks, and troubleshooting guides that onsite operators can follow independently. Clear technical writing for classified operational contexts is important.

Preferred Qualifications

Experience operating Kubernetes across classified environments: on-prem cloud (GovCloud, C2S), standalone clusters, or SCIF environments at IL4/IL5/IL6

Experience with Rancher, ArgoCD, and Harbor in air-gapped or restricted environments

Prior work with Podman and Buildah for rootless container builds in restricted environments

Experience with identity provider deployment (Keycloak or similar) without cloud backends

Background in workflow orchestration operations (Temporal or similar), especially schema bootstrapping and upgrades without internet access

Familiarity with DoD-hardened base images, or STIG compliance

Experience authoring STIGs, SSPs, or ATO documentation for classified deployments

Prior work with cross-domain solutions or data transfer procedures between classification levels

Compensation

The base salary range for this role is $200,000 to $300,000, plus equity and benefits. Where an offer lands depends on scope, autonomy, and technical capability, which we assess through the interview process rather than by years or title. Our ranges are a real guide, and we are flexible for the right person: if your experience clearly exceeds this role's scope, we will consider you at a higher level, with that level's range. Base salary is one part of total compensation, alongside equity and the benefits below.What We Offer

What We Offer

Health, dental, and vision insurance. 99% of your premiums covered, and 100% of your dependents' premiums.

Optional HSA plan. Lower premium, HSA eligible, fully portable, self directed or managed.

Life insurance of $150,000 plus AD&D, 100% company paid.

401(k) with a 100% match on the first 6%, immediately vested. No cliff, no waiting period. Yours from day one.

Wellhub Gold. Everything from Gold's Gym to Lifetime, fully covered, plus [solidcore], F45, and hundreds of other studios.

Unlimited PTO. Real time off, not accrual based. Take what you need, no counting required.

Every federal holiday, plus additional paid days off over the winter break.

Supportive leave of absence program, including time off for military service, medical events, and parental leave.

Breakfast, lunch, and endless snacks every day you are in the office.

Company phone plan. A new iPhone, fully company paid.