This role pays less than
96%
of similar roles. Most pay
$165,437–$238,737
— the shaded band above.
At the midpoint, this role pays about
$130k
versus about
$202k
for comparable roles.
Based on 240 similar postings.
Employer
About Leidos
Leidos is an industry and technology leader serving government and commercial customers with smarter, more efficient digital and mission innovations.
Leidos currently has
264 open roles
on FindRole.
Listed pay typically runs
$92,300–$166,850
across 245 roles with salary data.
DDI Architect serves as a technical lead for the architecture, design, engineering, and lifecycle management of enterprise-scale DNS, DHCP, and IP Address Management services across Corporate and Mission networks. The role involves building secure, resilient name resolution systems that comply with federal requirements including NIST SP 800-53 controls, NIST 800-81r3 guidance, and CISA mandates. Key responsibilities include implementing DNSSEC signing, managing encrypted protocols like DoT, DoH, and DoQ, and overseeing IPv6-first strategies for public services. The position requires expertise in DMARC, HSTS, and STARTTLS configurations while ensuring compliance with various Binding Operational Directives. Technical requirements include proficiency in IPAM APIs, RPKI, and anycast deployments. This role addresses critical infrastructure challenges by securing network management interfaces, managing .gov domain stewardship, and maintaining authoritative root zone services for mission-critical operations.
Design and maintain authoritative and recursive DNS architectures compliant with NIST SP 800-53 and federal security standards.
Implement secure DNS protocols including DNSSEC, DoT, DoH, and DoQ to meet CISA and Zero Trust requirements.
Manage the lifecycle of enterprise-scale DHCP and IPAM services for both IPv4 and IPv6 networks.
Execute .gov domain stewardship including DNSSEC signing, secure delegation, and compliance with federal mandates.
Perform technical leadership for DDI infrastructure, ensuring high availability, performance, and automated configuration management.
Manage IP address governance, including ARIN policy compliance, RPKI, and reverse DNS hygiene.
Support Root Server Operations (E-root) and coordinate with other Root Server Operators on anycast deployments.
Coordinate vulnerability management and remediation for DDI systems in alignment with CISA’s KEV catalog.
What we're looking for
U.S. Citizenship is required.
Ability to obtain and maintain a Public Trust.
Bachelor's degree and 10+ years of experience, or an Associate's degree and 15+ years of experience designing and operating enterprise DNS/DHCP/IPAM services.
Demonstrated authority in secure DNS architectures including DNSSEC signing, validating resolvers, signed zones, and DS management.
Hands-on implementation of NIST SP 800-81r3 practices, including protective DNS, encrypted DNS (DoT/DoH/DoQ), and comprehensive DNS logging/forensics.
Proven track record implementing federal BODs (18-01, 22-01, 23-01, 23-02) and managing IPv6 infrastructure compliant with OMB M-21-07.
Knowledge of ARIN policies, address planning/aggregation, and .gov DNSSEC requirements for federal domains.
Experience supporting Root Server Operators or coordinating with E-root anycast operations (preferred); experience with DMARC/SPF/DKIM at scale (preferred).
Active Directory
Identity Management (IdM)
Multi-Factor Authentication (MFA)
Zero Trust
DNS
DHCP
Group Policy
Windows Server
Attribute-Based Access Control (ABAC)
NIST SP 800-207
RMF
DISA STIGs
Privileged Access Management (PAM)
ITIL
Agile
PMP