# DDI Architect (DNS / DHCP / IPAM) **Company**: Leidos **Experience**: senior **Job type**: full-time **Salary**: $92,300.00 - $166,850.00 **Category**: Engineering **Industry**: Technology **Apply**: https://leidos.wd5.myworkdayjobs.com/en-US/External/job/Huntsville-AL/DDI-Architect_R-00188435?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply **Canonical**: https://yubhub.co/jobs/job_6e092c99-91a ## Description NASA seeks a seasoned DDI Architect to lead the architecture, design, engineering, and lifecycle management of enterprise-scale DNS, DHCP, and IP Address Management (IPAM) services across Corporate and Mission networks. The role will drive secure, resilient name resolution aligned to federal requirements,including NIST SP 800-53 controls for secure name/address resolution (SC-20, SC-21), NIST SP 800-81r3 DNS security guidance, and CISA encrypted/protective DNS mandates,and support NASA’s mission-critical DNS operations, which include participation as a Root Server Operator (E-root). **Key Responsibilities:** - **Enterprise DDI Architecture & Compliance** - Design and maintain authoritative and recursive DNS architectures that implement NIST SP 800-53 SC-20 (authoritative) and SC-21 (recursive/caching),including DNSSEC signing/validation and chain-of-trust with DS records. - Operationalize NIST SP 800-81r3 guidance for secure DNS deployment (protective DNS, encrypted DNS protocols such as DoT/DoH/DoQ, logging/forensics, QNAME minimization) across enterprise DNS roles (authoritative servers, resolvers, zone administration). - Ensure compliance with CISA’s Encrypted DNS Implementation Guidance and Zero Trust objectives, including routing egress resolution via CISA Protective DNS (PDNS) and blocking unauthorized external resolvers. - Align with CISA Binding Operational Directives (BODs),BOD 18-01 (DMARC/HSTS/STARTTLS), BOD 22-01 (KEV remediation timelines), BOD 23-01 (asset visibility/vulnerability detection), and BOD 23-02 (mitigate internet-exposed management interfaces). - Drive IPv6-first strategy per OMB M-21-07 (native IPv6 for public services, IPv6-only milestones) and maintain dual-stack transition hygiene for DNS, DHCPv6, and IPAM. - **Operations, Risk Reduction & Lifecycle Management** - Serve as technical lead for large-scale DDI environments, overseeing secure configurations, automation, availability, and performance across centers. - Implement protective controls and monitoring to detect, log, and investigate DNS misuse; integrate with SIEM/SOAR for forensics and incident response per 800-81r3. - Maintain continuous vulnerability management aligned to CISA’s KEV catalog and reporting expectations; coordinate remediation timelines and control validation. - Secure networked management interfaces (e.g., DNS appliance UI/API, DHCP consoles, IPAM admin) by removing public exposure or enforcing Zero Trust policy enforcement points in accordance with BOD 23-02. - Govern DNS email-related configurations (SPF/DKIM/DMARC) to meet BOD 18-01 requirements and support NASA Email Architecture. - **Root & .gov Domain Stewardship** - Participate in operations for E.root-servers.org (E-root) as applicable,supporting authoritative root zone service, anycast deployments, and adherence to RSSAC-002 metrics and RSO coordination. - Ensure .gov domain compliance (DNSSEC signing, secure delegation) per federal directives and NIST guidance. - **IP Address Governance** - Administer top-level allocations and growth planning for IPv4/IPv6, consistent with ARIN policies and best practices (aggregation, RPKI, reverse DNS hygiene). - **Automation & Modernization** - Evaluate and integrate DDI platform capabilities (e.g., encrypted DNS with PDNS, DNSSEC automation, DHCPv6 prefix delegation, IPAM APIs), and champion modernization aligned with Zero Trust and federal CDM initiatives. **Minimum Qualifications:** - Bachelor's degree and 10+ years of experience, or an Associate's degree and 15+ years of experience designing and operating enterprise DNS/DHCP/IPAM (DDI) services, with demonstrated authority in secure DNS architectures (DNSSEC, validating resolvers, signed zones, DS management). - Hands-on implementation of NIST SP 800-81r3 practices: protective DNS, encrypted DNS (DoT/DoH/DoQ), secure recursive resolvers, authoritative hardening, and comprehensive DNS logging/forensics. - Practical experience meeting CISA’s Encrypted DNS Guidance and PDNS integration; ability to prevent unauthorized DNS traffic and enforce endpoint, cloud, and SASE/SSE DNS policies. - Proven track record implementing federal BODs (18-01, 22-01, 23-01, 23-02) within large environments, including KEV-driven patch prioritization and Zero Trust controls for management interfaces. - IPv6 expertise: DNS over IPv6, DHCPv6, IPAM for IPv6, and strategic migration compliant with OMB M-21-07 milestones. - Familiarity with .gov DNSSEC requirements and secure delegation processes for federal domains. - Knowledge of ARIN policies (NRPM), address planning/aggregation, and registry hygiene (WHOIS/POC validation, RPKI, reverse DNS). **Preferred Qualifications:** - Experience supporting or coordinating with Root Server Operators; familiarity with E-root anycast operations and RSSAC-002 metrics submissions. - Prior leadership in environments with protective DNS and encrypted DNS end-to-end (endpoint, internal resolvers, egress to PDNS, cloud). - Demonstrated capability to manage DMARC/SPF/DKIM deployments at scale per BOD 18-01 (including HSTS/HTTPS and STARTTLS hardening). - Experience integrating DDI with asset discovery and vulnerability enumeration programs per BOD 23-01; evidence of KEV remediation workflows. - Strong understanding of NIST SP 800-53 Rev.5 broader control families (SC, SI, AU) and mapping to DNS/Network operations. - Background with ARIN IPv6 allocations, ASN operations, and address governance at federal scale. **Clearance requirements:** - U.S. Citizenship is required. - Ability to obtain and maintain a Public Trust. **Pay Range:** $92,300.00 - $166,850.00 ## Skills ### Required - NIST SP 800-53 - NIST SP 800-81r3 - CISA Encrypted DNS Guidance - DNSSEC - DHCPv6 - IPAM - IPv6 - ARIN policies - RPKI - reverse DNS hygiene ### Nice to have - Root Server Operators - E-root anycast operations - RSSAC-002 metrics submissions - DMARC/SPF/DKIM deployments - asset discovery and vulnerability enumeration programs - KEV remediation workflows - NIST SP 800-53 Rev.5 --- Source: [Apply at leidos.wd5.myworkdayjobs.com](https://leidos.wd5.myworkdayjobs.com/en-US/External/job/Huntsville-AL/DDI-Architect_R-00188435?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)