Senior Infrastructure Automation Engineer

Overview

• On-Premises Automation Center of Excellence (CoE)
• TISTA | Department of Veterans Affairs | Infrastructure Engineering & Operations (IE&O)
• Employment: Full-time | Hiring scope: Multiple engineering positions
• Proposed reporting: Designated Automation CoE Lead; technical alignment with EAS

Location / work arrangement: To be confirmed; customer and site engagement as required.

TISTA is seeking hands-on Infrastructure Automation Engineers to build, operate, and continuously improve the IE&O Automation Center of Excellence. The team will engineer reusable automation for on-premises infrastructure using Ansible, OpenTofu (Tofu), Terraform, Red Hat OpenShift, and VMware technologies.

Engineers will automate the provisioning and lifecycle management of virtual machines, storage, databases, and supporting services. They will turn approved designs into tested, version-controlled Golden Paths that Application Hosting and Application Services teams can adopt, operate, and extend. Each capability must provide traceable execution evidence, supportable services, and measurable reduction of technical debt and manual effort.

This is a builder role: write and troubleshoot automation, prove it works, enable other teams to use it, and maintain it after release. It is not limited to running existing jobs or administering a tool.

At TISTA, you’ll do meaningful, mission‑driven work that improves lives alongside teammates you trust and leaders who are transparent and supportive. We invest in your learning and internal mobility so you can build a career that keeps advancing. We’re proud to serve and hire Veterans, and we put people first in everything we do.

TISTA associates enjoy above Industry Healthcare Benefits, Remote Working Options, Paid Time Off, Training/Certification opportunities, Healthcare Savings Account & Flexible Savings Account, Paid Life Insurance, Short-term & Long-term Disability, 401K Match, Tuition Reimbursement, Employee Assistance Program, Paid Holidays, Military Leave, and much more!

Responsibilities

Roles and Responsibilities:

End-to-end on-premises provisioning:

Develop integrated workflows for approved VM creation, operating-system configuration, storage allocation, database provisioning, and supporting network, identity, backup, and monitoring tasks. Implement input validation, dependency checks, resource tagging, service-instance linkage, configuration-record updates, and post-provisioning verification. Work through accountable domain teams and approved interfaces.

Ansible automation engineering:

Author and maintain playbooks, roles, collections, inventories, and reusable workflow templates. Build repeatable behavior, controlled credentials, error handling, bounded retries, and useful execution logs. Configure approved automation-controller capabilities, execution environments, access controls, and schedules as assigned; do not rely on manual console actions for the claimed automated path.

Infrastructure as code:

Develop reusable Terraform and/or OpenTofu modules, parameters, outputs, provider integrations, and plan/review/apply pipelines. Protect remote state and sensitive plan data; implement supported locking, drift assessment, version pinning, and controlled import of existing resources. Validate engine/provider compatibility and assign one clear state/control owner per managed resource.

VMware and OpenShift integration:

Automate VMware vSphere/vCenter templates, VM lifecycle, guest configuration, network/storage attachments, and inventory reconciliation. For assigned OpenShift work, automate projects/namespaces, access, quotas, application configuration, and persistent storage using approved APIs, Operators, and GitOps patterns. Validate platform prerequisites, permissions, capacity, and supported dependencies. Specialty depth may differ across engineers.

Storage and database lifecycle automation:

Create reusable workflows for storage provisioning, attachment, expansion, permissions, and safe retirement. Partner with storage and database specialists on database installation/configuration, connectivity, access, backup onboarding, recovery tests, and approved maintenance. Protect persistent data; distinguish a disk or VM snapshot from an application-consistent recovery procedure.

Test, release, and recovery engineering:

Implement code review, automated validation, nonproduction testing, policy checks, and controlled promotion. Test reruns, partial failures, permissions, connectivity, drift, and restore/recovery paths. Define rollback or compensating actions appropriate to the resource; a code revert must not be treated as proof that a database or persistent volume has been restored. Retain failed-run evidence and reconcile any resources left behind.

CoE platform and content sustainment:

Maintain the assigned execution infrastructure, runners, repositories, approved artifact mirrors, collections/providers, state services, and test environments. Address vulnerabilities, upgrades, compatibility, capacity, and backup/recovery. Assign owners to automation assets and manage release notes, supported versions, deprecation, incidents, and recurring defects.

Reusable Golden Paths and domain adoption:

Package automation with clear inputs/outputs, versioned dependencies, tests, access prerequisites, runbooks, and support responsibilities. Co-design with Application Hosting and Application Services, demonstrate functionality, conduct pairing and training, onboard consuming teams, and incorporate feedback. Prefer configurable shared modules over unmanaged copies and one-off scripts.

Government visibility and technical-debt reduction:

Publish role-appropriate views of the backlog, ownership, milestones, blockers, approved releases, execution results, adoption, and service outcomes through approved reporting/SDI interfaces. Link a request or debt item to its code version, run, resources, tests, and acceptance. Automate remediation of legacy builds, configuration drift, inconsistent templates, unsupported components, orphaned resources, and repeat incidents; validate closure against the agreed baseline.

Representative Outputs:

Reusable Ansible content and IaC modules; integrated VM/storage/database workflows; OpenShift patterns; tests and recovery evidence; catalog integration; operational runbooks; adoption guides; versioned releases; leadership dashboards; and verified technical-debt closure records.

Role Boundaries:

The CoE engineers reusable capabilities and supports agreed execution. VA retains applicable decisions and acceptance authority; App Hosting, App Services, and other providers retain their assigned operational responsibilities. Coordinate privileges and changes with resource owners. Use only authorized tools, interfaces, data access, and environments; no provider approval or security authorization is implied by this posting.

Qualifications

Required Qualifications:

Experience:

Proposed senior-level benchmark: 7+ years in systems, platform, or infrastructure engineering, including 3+ years developing and supporting production infrastructure automation. These periods overlap. Evidence of personally authored code and implemented workflows is required; years of tool administration alone are insufficient.

Ansible and infrastructure-as-code depth:

Recent hands-on Ansible development and practical Terraform or OpenTofu experience. Ability to explain and troubleshoot playbooks, roles, modules, inventory, variable handling, APIs, plans, state, dependencies, and failures. Strong experience in one IaC engine is acceptable; demonstrated learning and compatibility-validation skills are expected for the other.

On-premises platform capability:

Production automation experience in at least one of VMware vSphere/vCenter or Red Hat OpenShift, with the ability to integrate with adjacent infrastructure domains. The team must collectively cover both platforms. Cloud-only automation without credible on-premises implementation evidence does not satisfy this role.

Infrastructure and data-service fundamentals:

Working knowledge of Linux and/or Windows administration, network/DNS/connectivity dependencies, storage, identity/permissions, databases, backup, and recovery. Direct automation depth in at least one of storage or database lifecycle integration; deeper expertise in both is valued. Work with specialists where necessary rather than claim universal expertise.

Software engineering and safe operations:

Git-based collaboration, code review, reusable components, automated testing, release promotion, and scripting with Python, PowerShell, Bash, or comparable languages. Ability to secure credentials and state, limit change impact, handle repeat execution and partial failures, protect data, and support automation after release.

Adoption, visibility, and communication:

Ability to gather requirements from hosting/application teams, demonstrate working automation, document interfaces and support procedures, and train consumers. Can explain progress, failures, risks, and measured outcomes in plain language and supply auditable evidence to Government leaders. Prior C-level/SES advisory employment is not required.

Preferred Qualifications:

• Experience with Ansible Automation Platform controller administration and execution environments; OpenShift GitOps, Operators, or virtualization; API-based storage/database provisioning; restricted or disconnected environments; ITSM/CMDB and service-catalog integration; infrastructure compliance automation; observability; and a supported internal automation-product library.
• Experience in VA, federal, or regulated environments; development of reusable patterns adopted by other teams; measurable technical-debt remediation; and relevant Red Hat, VMware, infrastructure-as-code, or automation credentials. Certifications supplement demonstrated delivery; they do not replace it.
• Hiring approach: require a common automation foundation, then assemble complementary VMware, OpenShift, storage/database, and automation-platform strengths across the team.
• Internal Hiring Configuration | CoE Team
• This page supports recruiting and team assembly. It is not an additional position-count commitment or a requirement that every engineer be an expert in every platform.
• Coverage emphasis
• Demonstrable specialty
• VMware / compute automation
• VM templates and lifecycle, guest configuration, host/cluster capacity, storage/network dependencies, and inventory reconciliation.
• OpenShift / platform automation
• Projects, access, quotas, GitOps/configuration, Operators, persistent storage, and supported platform integration.
• Storage / database automation
• Data-service provisioning and maintenance with protection, access, backup, recovery, retention, and safe retirement controls.
• Automation platform / quality
• Controller/runners, execution environments, shared libraries, pipeline tests, state protection, secrets, observability, and content lifecycle.
• All hires: personally build Ansible content and Terraform/OpenTofu automation, work in Git, test changes, troubleshoot failures, document interfaces, and support adoption. Specialists can cover more than one emphasis. Size the team to validated demand, concurrent work, support coverage, and the authorized labor mix—not an arbitrary number of tools.
• Education and Government access: Bachelor's degree in computer science, engineering, information technology, information systems, or a related field, or an allowable equivalent combination of education and experience. Ability to meet applicable Government suitability, training, site-access, and system-access requirements.
• Clearance: Must be able to obtain and maintain the personnel suitability, credentials, system access, and training required per a Tier 4 / High Risk clearance.
• Work Location: To be confirmed; customer and site engagement as required.

Responsibilities

Roles and Responsibilities:

End-to-end on-premises provisioning:

Develop integrated workflows for approved VM creation, operating-system configuration, storage allocation, database provisioning, and supporting network, identity, backup, and monitoring tasks. Implement input validation, dependency checks, resource tagging, service-instance linkage, configuration-record updates, and post-provisioning verification. Work through accountable domain teams and approved interfaces.

Ansible automation engineering:

Author and maintain playbooks, roles, collections, inventories, and reusable workflow templates. Build repeatable behavior, controlled credentials, error handling, bounded retries, and useful execution logs. Configure approved automation-controller capabilities, execution environments, access controls, and schedules as assigned; do not rely on manual console actions for the claimed automated path.

Infrastructure as code:

Develop reusable Terraform and/or OpenTofu modules, parameters, outputs, provider integrations, and plan/review/apply pipelines. Protect remote state and sensitive plan data; implement supported locking, drift assessment, version pinning, and controlled import of existing resources. Validate engine/provider compatibility and assign one clear state/control owner per managed resource.

VMware and OpenShift integration:

Automate VMware vSphere/vCenter templates, VM lifecycle, guest configuration, network/storage attachments, and inventory reconciliation. For assigned OpenShift work, automate projects/namespaces, access, quotas, application configuration, and persistent storage using approved APIs, Operators, and GitOps patterns. Validate platform prerequisites, permissions, capacity, and supported dependencies. Specialty depth may differ across engineers.

Storage and database lifecycle automation:

Create reusable workflows for storage provisioning, attachment, expansion, permissions, and safe retirement. Partner with storage and database specialists on database installation/configuration, connectivity, access, backup onboarding, recovery tests, and approved maintenance. Protect persistent data; distinguish a disk or VM snapshot from an application-consistent recovery procedure.

Test, release, and recovery engineering:

Implement code review, automated validation, nonproduction testing, policy checks, and controlled promotion. Test reruns, partial failures, permissions, connectivity, drift, and restore/recovery paths. Define rollback or compensating actions appropriate to the resource; a code revert must not be treated as proof that a database or persistent volume has been restored. Retain failed-run evidence and reconcile any resources left behind.

CoE platform and content sustainment:

Maintain the assigned execution infrastructure, runners, repositories, approved artifact mirrors, collections/providers, state services, and test environments. Address vulnerabilities, upgrades, compatibility, capacity, and backup/recovery. Assign owners to automation assets and manage release notes, supported versions, deprecation, incidents, and recurring defects.

Reusable Golden Paths and domain adoption:

Package automation with clear inputs/outputs, versioned dependencies, tests, access prerequisites, runbooks, and support responsibilities. Co-design with Application Hosting and Application Services, demonstrate functionality, conduct pairing and training, onboard consuming teams, and incorporate feedback. Prefer configurable shared modules over unmanaged copies and one-off scripts.

Government visibility and technical-debt reduction:

Publish role-appropriate views of the backlog, ownership, milestones, blockers, approved releases, execution results, adoption, and service outcomes through approved reporting/SDI interfaces. Link a request or debt item to its code version, run, resources, tests, and acceptance. Automate remediation of legacy builds, configuration drift, inconsistent templates, unsupported components, orphaned resources, and repeat incidents; validate closure against the agreed baseline.

Representative Outputs:

Reusable Ansible content and IaC modules; integrated VM/storage/database workflows; OpenShift patterns; tests and recovery evidence; catalog integration; operational runbooks; adoption guides; versioned releases; leadership dashboards; and verified technical-debt closure records.

Role Boundaries:

The CoE engineers reusable capabilities and supports agreed execution. VA retains applicable decisions and acceptance authority; App Hosting, App Services, and other providers retain their assigned operational responsibilities. Coordinate privileges and changes with resource owners. Use only authorized tools, interfaces, data access, and environments; no provider approval or security authorization is implied by this posting.

Qualifications

Required Qualifications:

Experience:

Proposed senior-level benchmark: 7+ years in systems, platform, or infrastructure engineering, including 3+ years developing and supporting production infrastructure automation. These periods overlap. Evidence of personally authored code and implemented workflows is required; years of tool administration alone are insufficient.

Ansible and infrastructure-as-code depth:

Recent hands-on Ansible development and practical Terraform or OpenTofu experience. Ability to explain and troubleshoot playbooks, roles, modules, inventory, variable handling, APIs, plans, state, dependencies, and failures. Strong experience in one IaC engine is acceptable; demonstrated learning and compatibility-validation skills are expected for the other.

On-premises platform capability:

Production automation experience in at least one of VMware vSphere/vCenter or Red Hat OpenShift, with the ability to integrate with adjacent infrastructure domains. The team must collectively cover both platforms. Cloud-only automation without credible on-premises implementation evidence does not satisfy this role.

Infrastructure and data-service fundamentals:

Working knowledge of Linux and/or Windows administration, network/DNS/connectivity dependencies, storage, identity/permissions, databases, backup, and recovery. Direct automation depth in at least one of storage or database lifecycle integration; deeper expertise in both is valued. Work with specialists where necessary rather than claim universal expertise.

Software engineering and safe operations:

Git-based collaboration, code review, reusable components, automated testing, release promotion, and scripting with Python, PowerShell, Bash, or comparable languages. Ability to secure credentials and state, limit change impact, handle repeat execution and partial failures, protect data, and support automation after release.

Adoption, visibility, and communication:

Ability to gather requirements from hosting/application teams, demonstrate working automation, document interfaces and support procedures, and train consumers. Can explain progress, failures, risks, and measured outcomes in plain language and supply auditable evidence to Government leaders. Prior C-level/SES advisory employment is not required.

Preferred Qualifications:

• Experience with Ansible Automation Platform controller administration and execution environments; OpenShift GitOps, Operators, or virtualization; API-based storage/database provisioning; restricted or disconnected environments; ITSM/CMDB and service-catalog integration; infrastructure compliance automation; observability; and a supported internal automation-product library.
• Experience in VA, federal, or regulated environments; development of reusable patterns adopted by other teams; measurable technical-debt remediation; and relevant Red Hat, VMware, infrastructure-as-code, or automation credentials. Certifications supplement demonstrated delivery; they do not replace it.
• Hiring approach: require a common automation foundation, then assemble complementary VMware, OpenShift, storage/database, and automation-platform strengths across the team.
• Internal Hiring Configuration | CoE Team
• This page supports recruiting and team assembly. It is not an additional position-count commitment or a requirement that every engineer be an expert in every platform.
• Coverage emphasis
• Demonstrable specialty
• VMware / compute automation
• VM templates and lifecycle, guest configuration, host/cluster capacity, storage/network dependencies, and inventory reconciliation.
• OpenShift / platform automation
• Projects, access, quotas, GitOps/configuration, Operators, persistent storage, and supported platform integration.
• Storage / database automation
• Data-service provisioning and maintenance with protection, access, backup, recovery, retention, and safe retirement controls.
• Automation platform / quality
• Controller/runners, execution environments, shared libraries, pipeline tests, state protection, secrets, observability, and content lifecycle.
• All hires: personally build Ansible content and Terraform/OpenTofu automation, work in Git, test changes, troubleshoot failures, document interfaces, and support adoption. Specialists can cover more than one emphasis. Size the team to validated demand, concurrent work, support coverage, and the authorized labor mix—not an arbitrary number of tools.
• Education and Government access: Bachelor's degree in computer science, engineering, information technology, information systems, or a related field, or an allowable equivalent combination of education and experience. Ability to meet applicable Government suitability, training, site-access, and system-access requirements.
• Clearance: Must be able to obtain and maintain the personnel suitability, credentials, system access, and training required per a Tier 4 / High Risk clearance.
• Work Location: To be confirmed; customer and site engagement as required.