Senior Platform Engineer
Building, securing, and scaling virtualization, network, and endpoint infrastructure for a sensitive, high-assurance environment
Position Overview
Position: Senior Platform Engineer
Job Type: Full-time
Location: Sterling or Reston, VA (Hybrid)-3 days a week in office/2 days WFH
Clearance Requirements: Active TS/SCI required; CI polygraph preferred
Experience: 5+ years
What You'll Do
We are seeking a Senior Platform Engineer to build, secure, administer, and scale the in-house infrastructure that supports a sensitive, high-assurance environment. You will design and operate the virtualization, networking, identity, and monitoring stack our teams depend on — standing infrastructure up from bare metal, automating it end to end, and keeping it secure, reliable, and auditable.
The ideal candidate pairs deep hypervisor and Linux systems expertise with strong network and endpoint security, infrastructure-as-code fluency, and the discipline to run a controlled, well-documented environment. You will own the platform end to end — virtualization, segmentation, identity and secrets, software supply chain, and observability — and turn architecture into a resilient, production-ready capability.
Key Responsibilities
Virtualization & Hypervisor Engineering
- Design, build, and administer a highly available Type-1 hypervisor cluster as the backbone for internal services and workloads — including shared/software-defined storage, redundant networking, and GPU passthrough for local compute and AI inference.
- Build hardened, versioned golden images with an automated, scheduled rebuild cadence so workloads always launch from a current, patched baseline.
- Automate provisioning of isolated workload VMs with controlled, auditable access to shared storage.
- Tune and troubleshoot the virtualization layer for concurrent workloads and capacity; manage cluster health against a documented sizing model.
Network Architecture & Security
- Architect and enforce a segmented, least-privilege network with layered firewall enforcement (defense in depth) and a default-deny posture.
- Implement strong isolation between user access, shared services, workloads, and management, so each tier reaches only what it must.
- Build and operate self-hosted remote access (modern VPN with strong MFA) and internal connectivity, keeping control planes private and not internet-exposed.
- Own internal DNS, PKI/mTLS, and time synchronization; enforce encrypted, controlled name resolution.
Endpoint & System Hardening
- Build and maintain hardened endpoints and hosts to recognized baselines (CIS Benchmarks / DISA STIG): full-disk encryption, measured boot, host firewalls, and least privilege.
- Reduce platform attack surface across firmware and OS; disable unnecessary services and management interfaces.
- Maintain a consistent, reproducible hardened baseline across the fleet, validated before deployment.
- Author and enforce the hardening standards, runbooks, and image definitions that keep endpoints and hosts clean, patched, and reproducible.
Automation, Infrastructure-as-Code & Platform Operations
- Provision the environment as code (infrastructure-as-code plus configuration management) with encrypted state and runtime secret injection — no secrets at rest in code.
- Build self-service provisioning that stands up and decommissions workloads cleanly, with each action recorded.
- Run a controlled software supply chain: internal package and code mirrors so systems build from vetted, internal sources.
- Maintain a staging path to validate changes before production, plus staged patch management and tested backup/restore.
Monitoring, Audit & Assurnace
- Build the observability stack (metrics, health, alerting), isolated from workloads so it cannot be reached or tampered with from them.
- Stand up centralized logging and a SIEM with tamper-evident, long-retention audit storage, so every action is attributable and traceable.
- Deploy network and flow monitoring at key boundaries, with alerting on anomalies and integrity issues.
- Implement isolation and response controls, and generate the audit evidence that supports common security frameworks (SOC 2, ISO 27001, NIST CSF, NIST SP 800-115).
Qualifications
- 5+ years in platform, infrastructure, systems, or DevOps engineering — building and administering production virtualization, networking, and Linux environments.
- Active TS/SCI clearance.
- Deep hands-on expertise with a Type-1 hypervisor (Proxmox VE, KVM/QEMU, VMware ESXi, or equivalent), including clustering, shared storage, templating, and GPU passthrough.
- Strong network engineering and security skills: segmentation, stateful firewalls, zero-trust / least-privilege design, VPNs, DNS, PKI/mTLS, and TCP/IP fundamentals.
- Demonstrated endpoint and OS hardening across Linux and Windows to CIS/STIG baselines: full-disk encryption, measured boot, host firewalls, and attack-surface reduction.
- Fluency in infrastructure-as-code and automation (e.g., Terraform, Ansible, Packer) plus Python and Bash, with a track record of shipping and maintaining working tooling and pipelines.
- Working knowledge of secrets management, containerization, Git and CI/CD, and an observability/SIEM stack.
- Proven ability to stand up infrastructure from bare metal to operational, document it in runbooks, and operate it under security- and audit-sensitive conditions.
Preferred Qualifications
- TS/SCI with CI polygraph; background supporting national security, intelligence community, or federal missions.
- Experience building or operating secure, isolated, or highly segmented infrastructure for sensitive or security-critical environments.
- Multi-cloud experience (AWS, GCP, Azure) with self-hosted networking.
- Experience building SIEM/audit pipelines with tamper-evident logging and detection engineering.
- Relevant certifications (e.g., RHCE, CKA, Security+/CISSP) and familiarity with SOC 2, ISO/IEC 27001, NIST CSF, or NIST SP 800-115.
- Experience standing up a new capability, unit, or program from zero — including standards authorship, staging environments, and identity-lifecycle (onboarding/offboarding) design.
Desired Traits
- A builder's instinct that sees a manual process and immediately asks how to provision, automate, and reproduce it as code.
- Disciplined security mindset with unwavering attention to isolation, least privilege, and operational detail.
- Self-directed, high-ownership, and composed while owning critical infrastructure in fast-paced, high-consequence environments.
- Motivated to build, scale, administer, and audit — and to close the gap between design and a live, resilient capability.
Example Technologies & Environments
- Virtualization & Compute — Enterprise Type-1 hypervisors, software-defined/shared storage, GPU passthrough
- Networking & Security — Software-defined networking, segmentation, stateful firewalls, self-hosted VPN with MFA, internal DNS and PKI
- Endpoint & Hardening — Hardened Linux/Windows images, full-disk encryption, measured boot, CIS/STIG baselines, MFA
- IaC & Automation — Infrastructure-as-code, configuration management, CI/CD, containerization, Python and Bash
- Identity & Secrets — SSO/OIDC, RBAC, centralized secrets management, hardware-backed MFA
- Monitoring & Audit — Metrics and alerting, centralized logging and SIEM, tamper-evident audit storage, network flow monitoring
Compensation & Benefits
The salary range for this role is an estimate based on a wide range of compensation factors, inclusive of base salary only. Actual salary offer may vary based on (but not limited to) work experience, education and/or training, critical skills, and/or business considerations. The final salary offer will be determined after a thorough review of the candidate's background and alignment with the role.
Additionally, SIXGEN offers top-tier benefits for full-time employees, including:
- Employer-paid health insurance premiums (medical, dental, vision) for you and your family
- Employer-paid short/long term disability insurance and basic life/AD&D insurance
- 401K with a 4% employer contribution
- Professional development reimbursement options available (training, certification, education, etc)
- Flexible and remote work policies for most positions
- Flexible PTO and holiday schedule
Our Committment
SIXGEN is an Equal Opportunity Employer. We ensure that all applicants are considered for employment without regard to race, color, religion, sexual orientation, gender identity, national origin, disability, age, marital status, ancestry, projected veteran status, or any other protected group or class.
We are committed to fostering an inclusive culture that values diversity in our people, reflecting the communities we serve and our customer base. We strive to attract and retain a diverse talent pool and create an environment where everyone is empowered to be their authentic selves at work.
