Description
The Solutions Architect is a Key Personnel role on the FDIC Enterprise DevSecOps program, supporting the client's CIO organization (CIOO). The architect owns the target-state design of the FDIC DevSecOps platform - a hybrid estate spanning Azure/AKS, AWS, mainframe z/OS/Endevor, and enterprise middleware (WebLogic/WebSphere, Oracle, PeopleSoft, SAP, MuleSoft) - translating FDIC Enterprise Architecture directives into repeatable, secure platform blueprints that let delivery teams ship with minimal client intervention. The role demands recent, hands-on design authority over a self-managed (non-SaaS) GitHub Enterprise Server, GitHub Actions, and GitHub Advanced Security toolchain on Azure/AKS, hardened to FISMA-moderate, NIST 800-53/800-207, OMB M-22-09, and CISA Zero Trust Maturity Model 2.0 standards.
PRIMARY RESPONSIBILITIES
Platform Architecture and Target-State Design
Own the DevSecOps platform architecture across the FDIC hybrid estate (Azure primary - AKS, ACR, App Gateway, Key Vault; plus AWS and the mainframe/middleware portfolio), producing and maintaining Architecture Decision Records aligned to FDIC target-state Enterprise Architecture.
Architect and operate a self-managed (non-SaaS) GitHub Enterprise Server, GitHub Actions, and GitHub Advanced Security/CodeQL platform on AKS - high-availability configuration, runner architecture, secure networking, reusable workflow templates, OIDC, and environment protection rules - and define upgrade paths under an n/n-1 version strategy.
Establish immutable-infrastructure and GitOps patterns (Flux, Helm) and author reusable Terraform IaC modules (and Bicep templates) for repeatable, policy-compliant provisioning across Azure and AWS landing zones.
Design pipeline architecture for a large CI/CD estate (GitHub Actions; on-prem, cloud, and hybrid patterns) with blocking security gates on Critical/High findings, and provide design oversight for the integration of the broader FDIC toolchain (JFrog Artifactory/Xray, SonarQube, Subject7) and GitHub Copilot into those pipelines within FDIC compliance constraints.
Security Architecture and Zero Trust
Architect Zero Trust controls aligned to OMB M-22-09 and CISA ZTMM 2.0, mapping identity (Entra/CyberArk), device, network, application, and data pillars to the DevSecOps toolchain.
Design policy-as-code and compliance-as-code enforcement (OPA/Gatekeeper, Azure Policy) for Kubernetes admission control and IaC guardrails, with CyberArk and Azure Key Vault secrets-management patterns meeting FIPS 140-2/3 requirements.
Define continuous-ATO architecture: continuous compliance monitoring, automated evidence collection, and alignment to NIST 800-37/800-53/800-207 control families for a FISMA-moderate boundary, coordinated through CCB, ISSM/ISSO, and OCISO governance bodies.
Hybrid and Mainframe Integration Architecture
Design integration patterns connecting Azure/AKS cloud pipelines to mainframe z/OS/Endevor build and deploy workflows, ensuring CI/CD coverage spans both cloud and mainframe application portfolios - design authority over both sides of the hybrid boundary, not cloud-only coverage.
Produce reference architectures and DevSecOps onboarding playbooks for enterprise middleware and integration workloads (WebLogic/WebSphere, Oracle, PeopleSoft, SAP, MuleSoft), covering build, scan, test, and release stages.
Technical Leadership and Governance
Serve as the technical authority and primary architect point of contact for FDIC, resolving architecture ambiguities autonomously to minimize client intervention, and lead architecture reviews through Enterprise Architecture fitness gates before implementation.
Architect the observability and reliability stack (Splunk, DynaTrace, Azure Monitor) to support availability SLAs and Critical/High remediation timelines, and mentor senior engineers and DevSecOps leads on architecture patterns, IaC standards, and secure-by-default pipeline design.
REQUIRED QUALIFICATIONS
Citizenship / Work Authorization
U.S. Citizen.
Background Investigation / Clearance
Must be able to obtain and maintain a Public Trust determination. As a named Key Person, the candidate may participate in client presentations.
Education
Bachelor's degree in Computer Science, Computer Engineering, Information Systems, Electrical Engineering, or a closely related technical discipline. An additional four (4) years of directly relevant experience may substitute in lieu of degree.
Experience
Minimum 8 years of progressive IT experience with at least 5 years in senior solution/enterprise architecture roles.
Demonstrated hands-on architecture ownership (current experience, typically within the past 1-2 years) of a self-managed (non-SaaS) GitHub Enterprise Server and GitHub Actions environment at enterprise scale (hundreds of repositories and active pipelines), including GitHub Advanced Security/CodeQL, code and secret scanning, and policy-as-code guardrails in a federal enclave or comparable regulated environment.
Proven, recent experience authoring production-grade Terraform IaC modules and Kubernetes/AKS manifests for a regulated federal or financial-sector environment; immutable-infrastructure and policy-as-code patterns required.
Demonstrated Zero Trust architecture experience aligned to OMB M-22-09 and CISA ZTMM in a FISMA-moderate or higher environment, including leading architecture through formal governance bodies (EA fitness-gate boards, CCB, or ATO boards).
Recent architecture experience integrating CI/CD pipelines across a hybrid estate that includes both cloud-native AKS workloads and mainframe or host-based build/deploy environments (z/OS, Endevor, or equivalent), with design oversight of the broader DevSecOps toolchain (artifact management, SAST/quality gates, and test automation) integrated into those pipelines.
Technical Skills
GitHub Enterprise Server (self-managed), GitHub Actions, GitHub Advanced Security (GHAS), CodeQL, GitHub Copilot
Azure: AKS, ACR, App Gateway, Key Vault, Azure Policy, Azure Monitor, Arc; AWS integration and landing-zone patterns; multi-cloud architecture
Terraform IaC, Bicep; Helm, Flux (GitOps); Docker; Kubernetes (AKS); policy-as-code (OPA/Gatekeeper, Azure Policy)
Zero Trust and compliance: NIST 800-53/800-207, OMB M-22-09, CISA ZTMM 2.0, FISMA/RMF/FedRAMP, FIPS 140-2/3; CyberArk and Azure Key Vault secrets management
Design oversight and integration of the broader FDIC toolchain: JFrog Artifactory/Xray, SonarQube, container scanning (Aqua, Trivy), and Subject7 test automation
Splunk, DynaTrace, Azure Monitor for observability and continuous-compliance evidence collection
PREFERRED QUALIFICATIONS
Certifications (strongly preferred)
Microsoft Certified: Azure Solutions Architect Expert (AZ-305)
AWS Certified Solutions Architect (Professional or Associate)
CISSP (Certified Information Systems Security Professional) or CCSP (Certified Cloud Security Professional)
HashiCorp Terraform Associate, or Certified Kubernetes Administrator (CKA/CKAD)
Experience Differentiators
Architecture at enterprise scale across hybrid on-prem and multi-cloud (AWS/Azure/GCP) environments, including mainframe (z/OS, Endevor) alongside cloud-native AKS workloads in the same DevSecOps platform.
Architecture ownership for enterprise middleware and legacy-modernization programs in a DevSecOps context (MuleSoft, WebLogic/WebSphere, Oracle, PeopleSoft, SAP).
Continuous-ATO and continuous-compliance automation in a FISMA-moderate boundary, producing evidence packages accepted by an ISSM/ISSO without rework.
Financial-regulator or comparable federal contractor compliance experience (for example 12 CFR 366), and Section 508 architecture patterns for enterprise web and portal applications.
WORK ENVIRONMENT / OTHER
Operational Support
May require participation in on-call or surge support activities for critical incidents, major releases, or FDIC-directed operational events, consistent with contract SLAs.
Location
DC Metro Area. Must reside within commuting distance of FDIC headquarters (Arlington, VA) to support on-site presence on short notice; primarily remote/telework otherwise.
Travel
Up to 30% on-site travel/presence at FDIC Arlington VA consistent with contract requirements. Domestic travel only.
Tools and Collaboration
Microsoft Teams (used for client meetings and ongoing collaboration).
If you're looking for comfort, keep scrolling. At Leidos, we outthink, outbuild, and outpace the status quo — because the mission demands it. We're not hiring followers. We're recruiting the ones who disrupt, provoke, and refuse to fail. Step 10 is ancient history. We're already at step 30 — and moving faster than anyone else dares.
July 2, 2026
For U.S. Positions: While subject to change based on business needs, Leidos reasonably anticipates that this job requisition will remain open for at least 3 days with an anticipated close date of no earlier than 3 days after the original posting date as listed above.
Pay Range $107,900.00 - $195,050.00
The Leidos pay range for this job level is a general guideline only and not a guarantee of compensation or salary. Additional factors considered in extending an offer include (but are not limited to) responsibilities of the job, education, experience, knowledge, skills, and abilities, as well as internal equity, alignment with market data, applicable bargaining agreement (if any), or other law.
About Leidos
Leidos is an industry and technology leader serving government and commercial customers with smarter, more efficient digital and mission innovations. Headquartered in Reston, Virginia, with 47,000 global employees, Leidos reported annual revenues of approximately $16.7 billion for the fiscal year ended January 3, 2025. For more information, visit www.Leidos.com.
Pay and Benefits
Pay and benefits are fundamental to any career decision. That's why we craft compensation packages that reflect the importance of the work we do for our customers. Employment benefits include competitive compensation, Health and Wellness programs, Income Protection, Paid Leave and Retirement. More details are available at www.leidos.com/careers/pay-benefits.
Securing Your Data
Beware of fake employment opportunities using Leidos’ name. Leidos will never ask you to provide payment-related information during any part of the employment application process (i.e., ask you for money), nor will Leidos ever advance money as part of the hiring process (i.e., send you a check or money order before doing any work). Further, Leidos will only communicate with you through emails that are generated by the Leidos.com automated system – never from free commercial services (e.g., Gmail, Yahoo, Hotmail) or via WhatsApp, Telegram, etc. If you received an email purporting to be from Leidos that asks for payment-related information or any other personal information (e.g., about you or your previous employer), and you are concerned about its legitimacy, please make us aware immediately by emailing us at [email protected].
If you believe you are the victim of a scam, contact your local law enforcement and report the incident to the U.S. Federal Trade Commission.
Commitment to Non-Discrimination
All qualified applicants will receive consideration for employment without regard to sex, race, ethnicity, age, national origin, citizenship, religion, physical or mental disability, medical condition, genetic information, pregnancy, family structure, marital status, ancestry, domestic partner status, sexual orientation, gender identity or expression, veteran or military status, or any other basis prohibited by law. Leidos will also consider for employment qualified applicants with criminal histories consistent with relevant laws.
#Remote
