Infrastructure Engineer

DescriptionLocation: Charleston, SC or Washington, DC metro area. This is a full-time, on-site role at a Government facility.TEKsystems is seeking a Denied, Disrupted, Intermittent, and Limited (DDIL) Subject Matter Expert to guide strategy and architecture for secure mission services operating under constrained connectivity. This role focuses on operating at the intersection of tactical communications, systems engineering, and advanced cybersecurity, this role addresses the unique technical challenges of enforcing Zero Trust principles (continuous verification, least privilege access, explicit risk-based attestation) when continuous reachback to enterprise identity providers, policy engines, and cloud trust brokers is degraded or entirely severed. The engineer will establish resilient Policy Enforcement Points (PEP) and decentralized Policy Decision Points (PDP), architect edge-capable Identity, Credential, and Access Management (ICAM) solutions, and optimize cryptographic overhead across constrained tactical data links.We are looking for someone who has designed, evaluated, or fielded systems for these conditions and understands the tradeoffs involved. The SME will help Government stakeholders and engineering teams determine which capabilities must operate locally, what information can be cached or replicated, how long that information remains trustworthy, and how systems reconnect safely. Success requires sound technical judgment grounded in mission needs and experience beyond traditional enterprise availability planning.What Youll Do Develop DDIL strategies, architectural approaches, and implementation roadmaps for mission applications and supporting security services. Work with mission owners to define operational scenarios, connectivity constraints, mission priorities, and acceptable levels of degraded service. Translate those scenarios into requirements for local autonomy, bandwidth use, latency, outage duration, synchronization, and recovery. Define which identity, authorization, directory, credential, and data protection capabilities must remain available without enterprise reach back. Architect local identity and attribute services, including virtual directories and approved caching of security information. Establish approaches for cached attribute freshness, credential expiration, revocation awareness, authorization policy updates, and operation when authoritative sources cannot be reached. Evaluate access control tradeoffs, including when services should deny access, permit bounded local operation, or require additional safeguards. Design synchronization and reconnection approaches that address conflicting updates, stale identity data, audit records, and restoration of enterprise consistency. Define dependencies among applications, identity providers, policy services, directories, encryption services, and key management infrastructure. Assess data placement, replication, and protection requirements across connected and disconnected environments, including approved cross-domain interfaces. Develop architecture diagrams, interface requirements, alternatives analyses, risk assessments, and phased implementation recommendations. Support agreements and approval documentation governing the caching and use of identity and security attributes. Guide prototypes and demonstrations that validate architectural assumptions under representative network impairments. Define measurable acceptance criteria and help teams evaluate mission continuity, security behavior, and recovery during connectivity loss and restoration. Coordinate with Government stakeholders, mission partners, security personnel, and engineering teams to resolve architectural gaps and guide implementation.Basic Qualifications Active Top Secret/Sensitive Compartmented Information (TS/SCI) clearance with ability to obtain a Counterintelligence (CI) Polygraph. Demonstrated subject matter expertise designing, evaluating, or fielding systems that operate with denied, disrupted, intermittent, or limited connectivity. Experience developing mission or enterprise architectures that support disconnected operation, local processing, and eventual synchronization with authoritative services. Ability to translate operational constraints into technical requirements, architectural decisions, and testable performance criteria Understanding of distributed systems concepts, including consistency, replication, caching, conflict resolution, and failure recovery. Experience addressing identity, authentication, authorization, or credential dependencies when enterprise services are unavailable. Understanding of the security implications of stale attributes, delayed revocation information, expired credentials, and unavailable policy or key services. Experience assessing bandwidth, latency, packet loss, and network availability constraints and their effects on application and service behavior. Experience developing technical strategies, architecture documentation, alternatives analyses, and implementation roadmaps. Ability to explain architectural tradeoffs and residual risks to Government decision-makers and provide actionable guidance to engineering teams. Experience working across mission, cybersecurity, infrastructure, and application development stakeholders. Experience deploying localized Policy Enforcement Points (PEPs) and lightweight Policy Decision Points (PDPs) on edge compute appliances and dismounted kits. Experience conducting modeling, simulation, and hardware-in-the-loop (HWIL) testing to replicate tactical link degradation, electronic warfare (EW) effects, and packet-loss profiles.Desired Qualifications Prior experience supporting the Intelligence Community. Bachelors or Masters degree Operational DDIL experience: Experience supporting deployed, tactical, expeditionary, edge, or other mission environments with constrained reach back. Identity services: Experience with Identity, Credential, and Access Management (ICAM), virtual directories, identity federation, and local identity and attribute caching. Authorization design: Experience with attribute-based access control, local policy enforcement, bounded offline access, and synchronization of authorization policies. Data protection: Familiarity with Trusted Data Format (TDF), data tagging, encryption, and access enforcement when central services are unavailable. Key and certificate services: Experience addressing Public Key Infrastructure (PKI), certificate validation, credential renewal, and key availability in disconnected environments. Distributed applications: Experience with store-and-forward messaging, durable queues, retry behavior, duplicate handling, and reconciliation after reconnection. Cross-domain environments: Experience defining approved identity and data exchanges across security domains and mission partner boundaries. Cloud and edge platforms: Familiarity with Amazon Web Services (AWS), Kubernetes, Red Hat OpenShift, and deployment patterns spanning enterprise and local infrastructure. Validation and experimentation: Experience using network impairment testing, fault injection, or operational demonstrations to assess degraded-mode behavior. Zero Trust: Experience adapting identity, device, application, and data security controls to environments where continuous enterprise connectivity cannot be assumed. Segmentation: Experience implementing software-defined micro segmentation, overlay networks, and dynamic perimeter controls across non-standard transport channels (e.g., HF/VHF/UHF, SATCOM, mesh radios, 5G tactical bubbles).SkillsTop secret clearance, Cyber security, Security, OpenID, Active directory, Identity management, Access management, API, OIDC, Identity access management, LDAP, ICAM, Policy enformenet points, pep, Policy decision points, pdp, Modeling and simulation, Infrastructure, Engineering, Systems engineering, Cybersecurity engineeringTop Skills DetailsTop secret clearance,Cyber security,Security,OpenID,Active directory,Identity management,Access management,API,OIDC,Identity access management,LDAP,ICAM,Policy enformenet points,pep,Policy decision points,pdp,Modeling and simulationAdditional Skills & QualificationsBasic Qualifications Active Top Secret/Sensitive Compartmented Information (TS/SCI) clearance with ability to obtain a Counterintelligence (CI) Polygraph. Demonstrated subject matter expertise designing, evaluating, or fielding systems that operate with denied, disrupted, intermittent, or limited connectivity. Experience developing mission or enterprise architectures that support disconnected operation, local processing, and eventual synchronization with authoritative services. Ability to translate operational constraints into technical requirements, architectural decisions, and testable performance criteria Understanding of distributed systems concepts, including consistency, replication, caching, conflict resolution, and failure recovery. Experience addressing identity, authentication, authorization, or credential dependencies when enterprise services are unavailable. Understanding of the security implications of stale attributes, delayed revocation information, expired credentials, and unavailable policy or key services. Experience assessing bandwidth, latency, packet loss, and network availability constraints and their effects on application and service behavior. Experience developing technical strategies, architecture documentation, alternatives analyses, and implementation roadmaps. Ability to explain architectural tradeoffs and residual risks to Government decision-makers and provide actionable guidance to engineering teams. Experience working across mission, cybersecurity, infrastructure, and application development stakeholders. Experience deploying localized Policy Enforcement Points (PEPs) and lightweight Policy Decision Points (PDPs) on edge compute appliances and dismounted kits. Experience conducting modeling, simulation, and hardware-in-the-loop (HWIL) testing to replicate tactical link degradation, electronic warfare (EW) effects, and packet-loss profiles.Experience LevelExpert Level Job Type & LocationThis is a Contract position based out of Reston, VA. Pay and BenefitsThe pay range for this position is $70.00 - $127.00/hr. Individual compensation offered for this position within this range will depend on many factors, including qualifications, skills, relevant experience, job knowledge, geographic location, internal equity, and other pertinent job-related factors.Eligibility requirements apply to some benefits and may depend on your job classification and length of employment. Benefits are subject to change and may be subject to specific elections, plan, or program terms. If eligible, the benefits

available for this temporary role may include the following:

Medical, dental & vision Critical Illness, Accident, and Hospital 401(k) Retirement Plan Pre-tax and Roth post-tax contributions available Life Insurance (Voluntary Life & AD&D for the employee and dependents) Short and long-term disability Health Spending Account (HSA) Transportation benefits Employee Assistance Program Time Off/Leave (PTO, Vacation or Sick Leave) Job Type & LocationThis is a Contract position based out of Reston, VA. Application DeadlineThis position is anticipated to close on Nov 18, 2026. Workplace TypeThis is a fully onsite position in Reston,VA.

About TEKsystems

We're partners in transformation. We help clients activate ideas and solutions to take advantage of a new world of opportunity. We are a team of 80,000 strong, working with over 6,000 clients, including 80% of the Fortune 500, across North America, Europe and Asia. As an industry leader in Full-Stack Technology Services, Talent Services, and real-world application, we work with progressive leaders to drive change. That's the power of true partnership. TEKsystems is an Allegis Group company.

The company is an equal opportunity employer and will consider all applications without regards to race, sex, age, color, religion, national origin, veteran status, disability, sexual orientation, gender identity, genetic information or any characteristic protected by law.

About TEKsystems and TEKsystems Global Services

Were a leading provider of business and technology services. We accelerate business transformation for our customers. Our expertise in strategy, design, execution and operations unlocks business value through a range of solutions. Were a team of 80,000 strong, working with over 6,000 customers, including 80% of the Fortune 500 across North America, Europe and Asia, who partner with us for our scale, full-stack capabilities and speed. Were strategic thinkers, hands-on collaborators, helping customers capitalize on change and master the momentum of technology. Were building tomorrow by delivering business outcomes and making positive impacts in our global communities. TEKsystems and TEKsystems Global Services are Allegis Group companies. Learn more at TEKsystems.com.

The company is an equal opportunity employer and will consider all applications without regard to race, sex, age, color, religion, national origin, veteran status, disability, sexual orientation, gender identity, genetic information or any characteristic protected by law.

San Francisco Fair Chance Ordinance: Pursuant to the San Francisco Fair Chance Ordinance, for all positions located in the city and county of San Francisco, we will consider for employment qualified applicants with arrest and conviction records.

Massachusetts Lie Detector: It is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment. An employer who violates this law shall be subject to criminal penalties and civil liability.

Use of Artificial Intelligence (AI): We may use Artificial Intelligence (AI) to support parts of our hiring process, including sourcing, screening, and evaluating candidates. AI helps assess applications and qualifications, but final decisions are made by our hiring team. By applying, you acknowledge and agree that your application may be reviewed using AI tools.