Senior Azure Data Architect

Description

A federal agency already runs a production AI Assistant on Azure Government. You will be the technical authority who extends it to the case files, case records and legal documents of three more of its offices, so that an attorney or investigator gets a cited answer in seconds and never sees a page their role is not cleared to see. Full time, W-2, starting 19 October 2026.

Why this job exists

Our customer is a federal agency that enforces federal law. Its attorneys and investigators decide real cases from thousands of pages of case files, exhibits and correspondence. The agency has built the platform to search that record with AI. What it needs now is one senior person who can bring new offices onto it without weakening the access model that protects the people named in those files.

This is a named Key Personnel position. You are the architect the agency's data and CIO staff will work with directly on design, and your resume is presented to the Contracting Officer for approval before you start. It is a builder's seat on a team of three: you, a Senior BI and Analytics Engineer, and a Program Manager who handles the customer, the schedule and the security writing so that your hours go to engineering.

The environment you will work in

You inherit a working stack and you build inside it. The agency operates the platform; you own what SPN builds on it.

• Azure Government, with separate dev and test subscriptions and production behind an agency go decision
• A governed PostgreSQL read replica fed by change data capture from the agency's case system
• A dbt semantic layer and a data catalog
• Approved Azure OpenAI services, a platform vector store, OCR and embedding services
• Apache Superset for dashboards and AI-assisted views
• A production AI Assistant with retrieval guardrails already in place
• The agency's Git repositories and CI/CD runners, where all code lives from the first commit
• Python: pandas, SQLAlchemy, psycopg, the Azure OpenAI SDK and test frameworks

What you will do

• Own the technical design of every product and record each design decision in the agency repository
• Register each office's case tables and document sets as sources, with a freshness expectation for each
• Check every document for a native text layer and send only image pages to OCR
• Hold pages below the agreed OCR confidence in a review queue instead of indexing them
• Split text on headings, numbered paragraphs, exhibits and pages, and tag every chunk with its document, page, case, owning office and role scope
• Keep the index current from the change stream, removing deleted, withdrawn and redacted material explicitly
• Configure hybrid lexical and vector retrieval with rank fusion, suppress any sentence without a supporting source, and refuse when the evidence is weak
• Compile each user's identity claims into a mandatory filter on every vector query, and write PostgreSQL row-level security and field masking by role
• Write an audit record for every retrieval and export
• Measure retrieval recall, citation precision, groundedness, refusal correctness and access correctness against the agency's test set at every acceptance test
• Build the CI/CD path that promotes dbt, Python and Superset assets from dev to test to production, with a probe that checks upstream schema and credentials before every scheduled run
• Supply the configuration evidence and test results behind the NIST SP 800-53 control statements, and fix penetration-test findings on what we build

Your first 90 days

• Days 1 to 30: suitability forms filed on day one; source inventory and design for the first office; access-control design reviewed with the agency
• Days 31 to 60: the first office's content extracted, chunked and embedded in dev, returning cited answers; the paired-role access test written
• Days 61 to 90: AI features running inside the first product in dev; first measurement run against the agency's test set; the product ready for user acceptance testing in month 4

How your work is judged

• Zero unauthorized-access defects, proven by running the same query under paired roles before every promotion
• AI quality measures at or above the thresholds agreed with the agency, for every office
• No upstream change breaks a scheduled refresh without your probe raising it first
• Every security control statement backed by evidence you produced

What you need

• United States citizenship, and the ability to obtain a Public Trust Tier 2 determination (the agency sponsors it)
• A bachelor's degree in computer science, information technology or a related field
• 12 or more years in technology, 8 or more of them in cloud and data architecture
• Azure architecture at the level of AZ-305, by certification or by equivalent hands-on work
• At least one document question-answering application with citations that you put into production, on Azure OpenAI or an equivalent
• PostgreSQL or SQL Server at the level of writing row-level security policies
• Python
• CI/CD in GitHub Actions or Azure DevOps

What sets a candidate apart

• An active Public Trust, Tier 4 or Secret, which can shorten the start to one to three weeks through reciprocity
• CISSP or an equivalent senior security certification, or 5 or more years of security architecture
• Production OCR or Azure Document Intelligence pipelines
• Azure Government, pgvector or Azure AI Search
• Apache Superset or another open-source BI platform, and dbt
• Written NIST SP 800-53 control evidence for a Federal system

Benefits

Pay is discussed with you directly when we speak. These are the benefits every full-time SPN employee receives.

• Medical and prescription coverage, dental and vision
• Short-term disability
• Life and accidental death insurance
• Competitive 401(k)
• 11 paid federal holidays
• Paid vacation
• Paid sick leave
• Parental leave
• Tuition and professional development assistance

Terms, and how to apply

• Full time, W-2, salaried (exempt), employed by SPN Solutions
• Target start: 19 October 2026
• Hybrid, based in Fairfax, Virginia, with some days in Washington, DC when needed
• All customer work is done on a government-furnished laptop with a PIV credential
• SPN pays the exam fee for the Azure certifications tied to this role if you do not hold them

Apply through the link with your resume. A recruiter reads every application and answers within two business days. If you have built a cited question-answering system, tell us in two or three lines what it searched, who used it and how you kept people from seeing what they should not.

SPN Solutions is an Equal Opportunity Employer. All qualified applicants are considered without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or protected veteran status.