{"id":765223,"url":"https://alion.io/job/lumbra-forward-deployed-infrastructure-engineer-tssci-clearance-required","title":"Forward Deployed Infrastructure Engineer (TS/SCI Clearance Required)","company":{"id":679123,"name":"Lumbra","domain":"lumbra.ai","url":"https://alion.io/company/lumbra","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"B","score":83,"open_postings":9,"ghost_share":0,"stale_share":0.667,"repost_share":0,"time_to_fill_p50_days":null,"computed_at":"2026-10-30T05:48:23Z"}},"role":"Solutions","role_family":"Solutions","seniority":null,"employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Arlington, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":110000,"max_usd":246000,"period":"year","method":"role_country_seniority_unknown","sample_n":4589},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"ArgoCD","optional":false},{"name":"AWS","optional":false},{"name":"buildah","optional":false},{"name":"Docker","optional":false},{"name":"GitOps","optional":false},{"name":"Harbor","optional":false},{"name":"Helm","optional":false},{"name":"Kubernetes","optional":false},{"name":"PKI","optional":false},{"name":"Podman","optional":false},{"name":"Rancher","optional":false},{"name":"Keycloak","optional":true}],"status":"live","first_seen_at":"2026-06-23T09:55:13Z","employer_posted_date":"2026-06-23","last_verified_at":"2026-10-30T20:42:51Z","board_verified":true,"closed_at":null,"days_open":129,"trust":{"level":"stale","repost_count":0,"flags":["stale"],"days_open":127},"description":"About the Role\nLumbra is building Nebula, an agentic harness deployed across commercial cloud, on-prem cloud (AWS GovCloud, C2S, or equivalent), and fully air-gapped classified environments. We're looking for a cleared infrastructure engineer to own the onsite deployment pipeline and ensure the harness runs reliably across this spectrum, from managed Kubernetes with limited connectivity to standalone clusters with no internet access at all.\nThis role requires an active U.S. security clearance (TS/SCI).\nWhat You'll Own\nOwn the air-gapped deployment pipeline end to end: transferring source code, charts, and configuration to disconnected environments, then building and deploying container images onsite. You need deep experience operating where nothing can be pulled from the internet.\n\nAuthor and maintain onsite Helm configurations that adapt to each deployment target, whether that means leveraging managed services in an on-prem cloud or replacing them with Kubernetes-native alternatives on standalone clusters. Strong Helm skills and an understanding of environment-specific translation are essential.\n\nDeploy and operate stateful infrastructure services (databases, caching, workflow orchestration, identity, object storage) on bare Kubernetes without managed cloud backends. Comfort with stateful workloads in constrained environments is a must.\n\nOwn the onsite cluster management and delivery toolchain including Rancher for Kubernetes lifecycle management, ArgoCD for GitOps-based deployments, and Harbor as the container registry. Experience operating these tools in disconnected environments is essential.\n\nManage the secrets lifecycle in classified environments, ensuring all credentials are generated fresh onsite with no secrets transferred on physical media. Rigorous security practices and familiarity with classified handling procedures are required.\n\nOwn PKI and certificate management across onsite deployments: CA hierarchies, certificate issuance and rotation, mTLS between services, and trust chain validation in environments where external certificate authorities are unavailable. A fundamental understanding of public key infrastructure is essential.\n\nBuild and maintain OCI-compliant container build pipelines (Podman, Buildah) for environments where Docker is not available. Experience with rootless, hardened container tooling is needed.\n\nTroubleshoot Kubernetes issues in environments with no external access: crashed pods, failed migrations, certificate errors, storage problems, all without pulling a debug image or searching the internet. Deep Kubernetes internals knowledge and self-sufficiency are essential.\n\nProfile and optimize system performance in constrained environments: resource utilization, pod scheduling, storage I/O, and network throughput on clusters where you can't simply scale up. Every millisecond and megabyte matters when hardware is fixed and access is limited.\n\nEnsure deployment parity between cloud and onsite by validating that health checks, resource limits, and service configurations stay aligned across both tracks. Own the onsite monitoring architecture that gives the team high visibility into system health, resource utilization, and service status across environments. You'll work closely with the cloud infrastructure team to prevent drift.\n\nAuthor and maintain database operations tooling (migrations, backup/restore, schema management) that works reliably in disconnected environments using Kubernetes Job templates.\n\nWrite deployment procedures, runbooks, and troubleshooting guides that onsite operators can follow independently. Clear technical writing for classified operational contexts is important.\n\nPreferred Qualifications\nExperience operating Kubernetes across classified environments: on-prem cloud (GovCloud, C2S), standalone clusters, or SCIF environments at IL4/IL5/IL6\n\nExperience with Rancher, ArgoCD, and Harbor in air-gapped or restricted environments\n\nPrior work with Podman and Buildah for rootless container builds in restricted environments\n\nExperience with identity provider deployment (Keycloak or similar) without cloud backends\n\nBackground in workflow orchestration operations (Temporal or similar), especially schema bootstrapping and upgrades without internet access\n\nFamiliarity with DoD-hardened base images, or STIG compliance\n\nExperience authoring STIGs, SSPs, or ATO documentation for classified deployments\n\nPrior work with cross-domain solutions or data transfer procedures between classification levels\n\nWhat We Offer\nHealth, dental, and vision insurance. 99% of your premiums covered, and 100% of your dependents' premiums.\n\nOptional HSA plan. Lower premium, HSA eligible, fully portable, self directed or managed.\n\nHealth Reimbursement Account for qualified healthcare expenses.\n\nLife insurance of $150,000 plus AD&D, 100% company paid.\n\n401(k) with a 100% match on the first 6%, immediately vested. No cliff, no waiting period. Yours from day one.\n\nWellhub Gold. Everything from Gold's Gym to Lifetime, fully covered, plus [solidcore], F45, and hundreds of other studios.\n\nUnlimited PTO. Real time off, not accrual based. Take what you need, no counting required.\n\nEvery federal holiday, plus additional paid days off over the winter break.\n\nSupportive leave of absence program, including time off for military service, medical events, and parental leave.\n\nBreakfast, lunch, and endless snacks every day you are in the office.\n\nPre-tax commuter benefits.\n\nCompany phone plan. A new iPhone, fully company paid.","description_format":"text","description_chars":5524,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":true,"languages":[]},"benefits":["Life insurance","Parental leave","Unlimited PTO","Vision insurance"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["AI Agents","Defense AI"],"lifecycle":[{"event":"open","at":"2026-09-11T19:44:20Z"}],"visa":[],"liveness":{"score":6,"band":"cold","label":"Long shot","p_open":1,"p_active":0.209,"p_room":0.28,"age_days":128,"expected_fill_days":27,"reasons":["conf:2","win:tail","crowd:"],"computed_at":"2026-10-30T05:48:23Z"},"pay":null,"html_url":"https://alion.io/job/lumbra-forward-deployed-infrastructure-engineer-tssci-clearance-required","json_url":"https://alion.io/job/lumbra-forward-deployed-infrastructure-engineer-tssci-clearance-required.json","meta":{"generated_at":"2026-10-30T22:01:41Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":12661,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-31T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":679123},"rest":"https://alion.io/mcp/rest/get_company?id=679123"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Flumbra-forward-deployed-infrastructure-engineer-tssci-clearance-required"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Flumbra-forward-deployed-infrastructure-engineer-tssci-clearance-required"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Flumbra-forward-deployed-infrastructure-engineer-tssci-clearance-required"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/lumbra-forward-deployed-infrastructure-engineer-tssci-clearance-required\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Flumbra-forward-deployed-infrastructure-engineer-tssci-clearance-required"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":765223}},{"tool":"search_jobs","arguments":{"company":"lumbra.ai","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":765223},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}