Senior Infrastructure Engineer

📋 Job Overview

Spear AI is hiring a Senior Infrastructure Engineer to own deployment and authorization on our developer cloud for the undersea enterprise. It's an accredited platform for building, deploying, and operating mission software across unclassified and classified environments. You'll take commercial and partner software from first onboarding through hardened deployment and Authority to Operate, working directly with government security staff to compress timelines without cutting corners. Authorization speed is what we're measured on. This is a builder's role. You decide when to build, when to reuse, and when a problem doesn't need solving, and you leave behind tooling that makes the next deployment faster than the last. The result is real capability in mission users' hands in months, not years.

🏢 About Spear AI

Spear AI is a growing defense contracting company dedicated to delivering cutting-edge solutions that support our nation’s security. As we expand, we’re building a culture where innovation meets mission-critical work. We operate with a flat organizational structure that empowers every team member to make an impact, collaborate directly with leadership, and contribute to projects that matter. Whether you’re joining our Hardware, Software, or Services division, you’ll work alongside talented professionals who are committed to excellence and advancing the capabilities that keep our nation safe and secure. Spear AI builds sonobuoy sensors that are deployed into the water and collect edge data. You’ll have an opportunity to work on real-world projects that directly impact warfighter capabilities and mission success.

🎯 The Role

You'll sit with Spear AI's infrastructure engineers inside Services, our applied engineering and technical advisory arm. We embed with government customers to design, build, and operate platforms, pipelines, and software that take emerging capability from concept to fielded mission impact.

✅ Key Responsibilities

• Design, build, and operate platform and tenant infrastructure across AWS GovCloud and classified cloud environments, defined entirely as code and treated as software: versioned, reviewed, and tested.
• Onboard commercial and third-party software: containerize or package it, integrate it with platform identity (CAC/PIV, OIDC, SAML), logging, vulnerability scanning, and artifact services, and get it production-ready.
• Drive each capability through the Risk Management Framework to ATO: define the authorization boundary, map inherited and system-specific controls, own the SSP and supporting artifacts, remediate findings, and manage POA&Ms.
• Make and defend build, reuse, or buy decisions, with a bias toward the simplest thing that meets the security requirement.
• Harden systems to DISA STIGs and DoD/IC baselines and run and respond to vulnerability scans and continuous monitoring.
• Build CI/CD and DevSecOps pipelines that work inside air-gapped and restricted networks, including internal registries, mirrored package repositories, and controlled egress.
• Serve as the technical point of contact for government ISSMs, ISSOs, assessors, and Authorizing Official staff.
• Build the templates, tooling, and golden paths that make every new capability deploy and authorize faster than the last, and mentor less experienced engineers on secure deployment.

📌 Required Qualifications

• Active TS/SCI required, with the ability to obtain a CI Polygraph. Active IC CI Poly is a plus.
• DoD 8140 baseline certification (Security+ or higher) is required for privileged access; if you don't have it yet, you'll need to earn it shortly after starting.
• 5+ years of hands-on platform, DevOps, or infrastructure engineering on production systems
• Real code in Python, Go, or TypeScript, with version control and tests
• Infrastructure as Code with the same discipline (Terraform, Pulumi, or similar)
• CI/CD pipeline design
• Deep working knowledge of containers and Kubernetes, including running them securely in restricted environments
• Designing and operating AWS infrastructure: networking, IAM, and encryption boundaries (GovCloud is a plus)
• Linux and networking fundamentals (DNS, TLS/PKI, load balancing, routing) and the ability to debug across all of them
• Working knowledge of RMF, NIST SP 800-53, DISA STIGs, and vulnerability management
• Translating security requirements into technical implementation and explaining it clearly to government security staff
• Picking up new AI platforms and integrations quickly, including agentic AI tooling

⭐ Desirable Experience

• Taking a system through RMF to ATO, IATT, or IATC in a DoD or IC environment, including eMASS or Xacta
• Deploying commercial software into government-controlled cloud accounts (BYOC, multi-tenant, SCCA-compliant or broker-provisioned structures)
• Air-gapped or cross-domain environments: mirrored repositories, controlled egress, cross domain solution integrations
• Identity federation (Keycloak, Authentik, or similar) with CAC/PIV, OIDC, and SAML
• DevSecOps tooling: SAST/DAST, container image scanning, SBOM generation, policy-as-code
• Supporting AI/LLM workloads in government cloud, such as model serving

🛂 Visa & Eligibility

Active TS/SCI required, with the ability to obtain a CI Polygraph. Active IC CI Poly is a plus.