DDI Architect

Description NEEDED: DDI Architect (DNS / DHCP / IPAM) - NASA About the Role

NASA seeks a seasoned DDI Architect to lead the architecture, design, engineering, and lifecycle management of enterprise-scale DNS, DHCP, and IP Address Management (IPAM) services across Corporate and Mission networks. The role will drive secure, resilient name resolution aligned to federal requirements-including NIST SP 80053 controls for secure name/address resolution (SC20, SC21),
NIST SP 80081r3 DNS security guidance
, and CISA encrypted/protective DNS mandates
-and support NASA's mission-critical DNS operations, which include participation as a Root Server Operator (Eroot).

You will partner closely with Engineering, System Administration, and Operations teams.

• Design and maintain authoritative and recursive DNS architectures that implement NIST SP 80053 SC20 (authoritative) and SC21 (recursive/caching)-including DNSSEC signing/validation and chain-of-trust with DS records.
• Operationalize NIST SP 80081r3 guidance for secure DNS deployment (protective DNS, encrypted DNS protocols such as DoT/DoH/DoQ, logging/forensics, QNAME minimization) across enterprise DNS roles (authoritative servers, resolvers, zone administration).
• Ensure compliance with CISA's Encrypted DNS Implementation Guidance and Zero Trust objectives, including routing egress resolution via CISA Protective DNS (PDNS) and blocking unauthorized external resolvers.
• Align with CISA Binding Operational Directives (BODs)
  - BOD 1801 (DMARC/HSTS/STARTTLS),
  BOD 2201 (KEV remediation timelines),
  BOD 2301 (asset visibility/vulnerability detection), and BOD 2302 (mitigate internet exposed management interfaces).
• Drive IPv6first strategy per OMB M2107 (native IPv6 for public services, IPv6only milestones) and maintain dualstack transition hygiene for DNS, DHCPv6, and IPAM.

• Serve as technical lead for large scale DDI environments, overseeing secure configurations, automation, availability, and performance across centers. (Role scope mirrors enterprise class environments consistent with NASA's operational scale.)
• Implement protective controls and monitoring to detect, log, and investigate DNS misuse; integrate with SIEM/SOAR for forensics and incident response per 80081r3.
• Maintain continuous vulnerability management aligned to CISA's KEV catalog and reporting expectations; coordinate remediation timelines and control validation.
• Secure networked management interfaces (e.g., DNS appliance UI/API, DHCP consoles, IPAM admin) by removing public exposure or enforcing Zero Trust policy enforcement points in accordance with BOD 2302
  .
• Govern DNS email related configurations (SPF/DKIM/DMARC) to meet BOD 1801 requirements and support NASA Email Architecture.

• Participate in operations for E.root servers.org (Eroot) as applicable-supporting authoritative root zone service, anycast deployments, and adherence to RSSAC
  002 metrics and RSO coordination.
• Ensure .gov domain compliance (DNSSEC signing, secure delegation) per federal directives and NIST guidance.

• Administer toplevel allocations and growth planning for IPv4/IPv6
  , consistent with ARIN policies and best practices (aggregation, RPKI, reverse DNS hygiene).

• Evaluate and integrate DDI platform capabilities (e.g., encrypted DNS with PDNS, DNSSEC automation, DHCPv6 prefix delegation, IPAM APIs), and champion modernization aligned with Zero Trust and federal CDM initiatives.

• Bachelor's degree and 10+ years of experience, or an Associate's degree and 15+ years of experience designing and operating enterprise DNS/DHCP/IPAM (DDI) services, with demonstrated authority in secure DNS architectures (DNSSEC, validating resolvers, signed zones, DS management). (Aligned to NIST SP 80053 SC20/SC21.)
• Hands-on implementation of NIST SP 80081r3 practices: protective DNS, encrypted DNS (DoT/DoH/DoQ), secure recursive resolvers, authoritative hardening, and comprehensive DNS logging/forensics.
• Practical experience meeting CISA's Encrypted DNS Guidance and PDNS integration; ability to prevent unauthorized DNS traffic and enforce endpoint, cloud, and SASE/SSE DNS policies.
• Proven track record implementing federal BODs (1801, 2201, 2301, 2302) within large environments, including KEV-driven patch prioritization and Zero Trust controls for management interfaces.
• IPv6 expertise: DNS over IPv6, DHCPv6, IPAM for IPv6, and strategic migration compliant with OMB M2107 milestones.
• Familiarity with .gov DNSSEC requirements and secure delegation processes for federal domains.
• Knowledge of ARIN policies (NRPM), address planning/aggregation, and registry hygiene (WHOIS/POC validation, RPKI, reverse DNS).

• Experience supporting or coordinating with Root Server Operators
  ; familiarity with Eroot anycast operations and RSSAC
  002 metrics submissions.
• Prior leadership in…