Solutions Architect - FDIC Enterprise DevSecOps

Description

The Solutions Architect is a Key Personnel role on the FDIC Enterprise DevSecOps program, supporting the client's CIO organization (CIOO). The architect owns the target-state design of the FDIC DevSecOps platform - a hybrid estate spanning Azure/AKS, AWS, mainframe z/OS/Endevor, and enterprise middleware (WebLogic/WebSphere, Oracle, PeopleSoft, SAP, MuleSoft) - translating FDIC Enterprise Architecture directives into repeatable, secure platform blueprints that let delivery teams ship with minimal client intervention. The role demands recent, hands-on design authority over a self-managed (non-SaaS) GitHub Enterprise Server, GitHub Actions, and GitHub Advanced Security toolchain on Azure/AKS, hardened to FISMA-moderate, NIST 800-53/800-207, OMB M-22-09, and CISA Zero Trust Maturity Model 2.0 standards.

PRIMARY RESPONSIBILITIES

Platform Architecture and Target-State Design

Own the DevSecOps platform architecture across the FDIC hybrid estate (Azure primary - AKS, ACR, App Gateway, Key Vault; plus AWS and the mainframe/middleware portfolio), producing and maintaining Architecture Decision Records aligned to FDIC target-state Enterprise Architecture.

Architect and operate a self-managed (non-SaaS) GitHub Enterprise Server, GitHub Actions, and GitHub Advanced Security/CodeQL platform on AKS - high-availability configuration, runner architecture, secure networking, reusable workflow templates, OIDC, and environment protection rules - and define upgrade paths under an n/n-1 version strategy.

Establish immutable-infrastructure and GitOps patterns (Flux, Helm) and author reusable Terraform IaC modules (and Bicep templates) for repeatable, policy-compliant provisioning across Azure and AWS landing zones.

Design pipeline architecture for a large CI/CD estate (GitHub Actions; on-prem, cloud, and hybrid patterns) with blocking security gates on Critical/High findings, and provide design oversight for the integration of the broader FDIC toolchain (JFrog Artifactory/Xray, SonarQube, Subject7) and GitHub Copilot into those pipelines within FDIC compliance constraints.

Security Architecture and Zero Trust

Architect Zero Trust controls aligned to OMB M-22-09 and CISA ZTMM 2.0, mapping identity (Entra/CyberArk), device, network, application, and data pillars to the DevSecOps toolchain.

Design policy-as-code and compliance-as-code enforcement (OPA/Gatekeeper, Azure Policy) for Kubernetes admission control and IaC guardrails, with CyberArk and Azure Key Vault secrets-management patterns meeting FIPS 140-2/3 requirements.

Define continuous-ATO architecture: continuous compliance monitoring, automated evidence collection, and alignment to NIST 800-37/800-53/800-207 control families for a FISMA-moderate boundary, coordinated through CCB, ISSM/ISSO, and OCISO governance bodies.

Hybrid and Mainframe Integration Architecture

Design integration patterns connecting Azure/AKS cloud pipelines to mainframe z/OS/Endevor build and deploy workflows, ensuring CI/CD coverage spans both cloud and mainframe application portfolios - design authority over both sides of the hybrid boundary, not cloud-only coverage.

Produce reference architectures and DevSecOps onboarding playbooks for enterprise middleware and integration workloads (WebLogic/WebSphere, Oracle, PeopleSoft, SAP, MuleSoft), covering build, scan, test, and release stages.

Technical Leadership and Governance

Serve as the technical authority and primary architect point of contact for FDIC, resolving architecture ambiguities autonomously to minimize client intervention, and lead architecture reviews through Enterprise Architecture fitness gates before implementation.

Architect the observability and reliability stack (Splunk, DynaTrace, Azure Monitor) to support availability SLAs and Critical/High remediation timelines, and mentor senior engineers and DevSecOps leads on architecture patterns, IaC standards, and secure-by-default pipeline design.

REQUIRED QUALIFICATIONS

Citizenship / Work Authorization

U.S. Citizen.

Background Investigation / Clearance

Must be able to obtain and maintain a Public Trust determination. As a named Key Person, the candidate may participate in client presentations.

Education

Bachelor's degree in Computer Science, Computer Engineering, Information Systems, Electrical Engineering, or a closely related technical discipline. An additional four (4) years of directly relevant experience may substitute in lieu of degree.

Experience

Minimum 8 years of progressive IT experience with at least 5 years in senior solution/enterprise architecture roles.

Demonstrated hands-on architecture ownership (current experience, typically within the past 1-2 years) of a self-managed (non-SaaS) GitHub Enterprise Server and GitHub Actions environment at enterprise scale (hundreds of repositories and active pipelines), including GitHub Advanced Security/CodeQL, code and secret scanning, and policy-as-code guardrails in a federal enclave or comparable regulated environment.

Proven, recent experience authoring production-grade Terraform IaC modules and Kubernetes/AKS manifests for a regulated federal or financial-sector environment; immutable-infrastructure and policy-as-code patterns required.

Demonstrated Zero Trust architecture experience aligned to OMB M-22-09 and CISA ZTMM in a FISMA-moderate or higher environment, including leading architecture through formal governance bodies (EA fitness-gate boards, CCB, or ATO boards).

Recent architecture experience integrating CI/CD pipelines across a hybrid estate that includes both cloud-native AKS workloads and mainframe or host-based build/deploy environments (z/OS, Endevor, or equivalent), with design oversight of the broader DevSecOps toolchain (artifact management, SAST/quality gates, and test automation) integrated into those pipelines.

Technical Skills

GitHub Enterprise Server (self-managed), GitHub Actions, GitHub Advanced Security (GHAS), CodeQL, GitHub Copilot

Azure: AKS, ACR, App Gateway, Key Vault, Azure Policy, Azure Monitor, Arc; AWS integration and landing-zone patterns; multi-cloud architecture

Terraform IaC, Bicep; Helm, Flux (GitOps); Docker; Kubernetes (AKS); policy-as-code (OPA/Gatekeeper, Azure Policy)

Zero Trust and compliance: NIST 800-53/800-207, OMB M-22-09, CISA ZTMM 2.0, FISMA/RMF/FedRAMP, FIPS 140-2/3; CyberArk and Azure Key Vault secrets management

Design oversight and integration of the broader FDIC toolchain: JFrog Artifactory/Xray, SonarQube, container scanning (Aqua, Trivy), and Subject7 test automation

Splunk, DynaTrace, Azure Monitor for observability and continuous-compliance evidence collection

PREFERRED QUALIFICATIONS

Certifications (strongly preferred)

Microsoft Certified: Azure Solutions Architect Expert (AZ-305)

AWS Certified Solutions Architect (Professional or Associate)

CISSP (Certified Information Systems Security Professional) or CCSP (Certified Cloud Security Professional)

HashiCorp Terraform Associate, or Certified Kubernetes Administrator (CKA/CKAD)

Experience Differentiators

Architecture at enterprise scale across hybrid on-prem and multi-cloud (AWS/Azure/GCP) environments, including mainframe (z/OS, Endevor) alongside cloud-native AKS workloads in the same DevSecOps platform.

Architecture ownership for enterprise middleware and legacy-modernization programs in a DevSecOps context (MuleSoft, WebLogic/WebSphere, Oracle, PeopleSoft, SAP).

Continuous-ATO and continuous-compliance automation in a FISMA-moderate boundary, producing evidence packages accepted by an ISSM/ISSO without rework.

Financial-regulator or comparable federal contractor compliance experience (for example 12 CFR 366), and Section 508 architecture patterns for enterprise web and portal applications.

WORK ENVIRONMENT / OTHER

Operational Support

May require participation in on-call or surge support activities for critical incidents, major releases, or FDIC-directed operational events, consistent with contract SLAs.

Location

DC Metro Area. Must reside within commuting distance of FDIC headquarters (Arlington, VA) to support on-site presence on short notice; primarily remote/telework otherwise.

Travel

Up to 30% on-site travel/presence at FDIC Arlington VA consistent with contract requirements. Domestic travel only.

Tools and Collaboration

Microsoft Teams (used for client meetings and ongoing collaboration).

If you're looking for comfort, keep scrolling. At Leidos, we outthink, outbuild, and outpace the status quo — because the mission demands it. We're not hiring followers. We're recruiting the ones who disrupt, provoke, and refuse to fail. Step 10 is ancient history. We're already at step 30 — and moving faster than anyone else dares.

Original Posting:

July 2, 2026

Pay Range:

Pay Range $107,900.00 - $195,050.00

The Leidos pay range for this job level is a general guideline only and not a guarantee of compensation or salary. Additional factors considered in extending an offer include (but are not limited to) responsibilities of the job, education, experience, knowledge, skills, and abilities, as well as internal equity, alignment with market data, applicable bargaining agreement (if any), or other law.

About Leidos

Leidos is an industry and technology leader serving government and commercial customers with smarter, more efficient digital and mission innovations. Headquartered in Reston, Virginia, with 47,000 global employees, Leidos reported annual revenues of approximately $16.7 billion for the fiscal year ended January 3, 2025. For more information, visit www.Leidos.com.

Pay and Benefits

Pay and benefits are fundamental to any career decision. That's why we craft compensation packages that reflect the importance of the work we do for our customers. Employment benefits include competitive compensation, Health and Wellness programs, Income Protection, Paid Leave and Retirement. More details are available at www.leidos.com/careers/pay-benefits.

Securing Your Data

Beware of fake employment opportunities using Leidos’ name. Leidos will never ask you to provide payment-related information during any part of the employment application process (i.e., ask you for money), nor will Leidos ever advance money as part of the hiring process (i.e., send you a check or money order before doing any work). Further, Leidos will only communicate with you through emails that are generated by the Leidos.com automated system – never from free commercial services (e.g., Gmail, Yahoo, Hotmail) or via WhatsApp, Telegram, etc. If you received an email purporting to be from Leidos that asks for payment-related information or any other personal information (e.g., about you or your previous employer), and you are concerned about its legitimacy, please make us aware immediately by emailing us at [email protected].

If you believe you are the victim of a scam, contact your local law enforcement and report the incident to the U.S. Federal Trade Commission.

Commitment to Non-Discrimination

All qualified applicants will receive consideration for employment without regard to sex, race, ethnicity, age, national origin, citizenship, religion, physical or mental disability, medical condition, genetic information, pregnancy, family structure, marital status, ancestry, domestic partner status, sexual orientation, gender identity or expression, veteran or military status, or any other basis prohibited by law. Leidos will also consider for employment qualified applicants with criminal histories consistent with relevant laws.

#Remote