Senior Cloud Architect, Government Missions
Second Front Systems is looking for an operationally focused, compliance-hardened, multi-cloud Senior Cloud Architect, Government Missions to strengthen our cloud infrastructure and security practice.
Operating at classified and unclassified DoD and IC networks, you will be responsible for architecting and operating secure multi-tenant cloud foundations across AWS, Azure, and GCP; designing government enclave architectures (TSE-SE, LZA, MLZ, Assured Workloads); and leading compliance and Authority to Operate efforts end to end.
You will design and troubleshoot cloud and hybrid networking topologies (Transit Gateway, Virtual WAN, Network Connectivity Center, Direct Connect, ExpressRoute, Cloud Interconnect); architect and operate production Kubernetes platforms (EKS, AKS, GKE, air-gapped distributions) with multi-tenancy and DISA STIG/CIS hardening; establish Infrastructure as Code standards using Terraform, Pulumi, and Crossplane, ensuring that landing zones, network segmentation, centralized logging, and guardrails enforce zero-trust principles aligned to SCCA and CAP requirements, and systems achieve continuous Authority to Operate across NIST SP 800-53 controls.
We need someone capable of designing networks to DISA Secure Cloud Computing Architecture and Cloud Access Point specifications; leading deployments into NIPRNet, SIPRNet, JWICS, and classified fabrics; operating as mission owner in AWS GovCloud, Azure Government, and classified regions; and owning compliance end to end—control inheritance, System Security Plans, POA&Ms, STIG/SCAP scanning, continuous monitoring, and continuous ATO workflows.
As a key partner to customers, program leadership, and authorized assessors, you will establish technical authority and architectural direction across programs, serving as senior technical mentor to engineering teams.
Note: Candidates must reside in one of our approved hiring hubs:
• DC/Maryland/Virginia
• Denver/Colorado Springs, CO
This is a full-time position.
What You'll Do
• Architect and own secure multi-tenant landing zones across AWS, Azure, and GCP with account/subscription/project vending, network segmentation, centralized logging, and policy guardrails.
• Design and deploy government enclave architectures including AWS Trusted Secure Enclaves–Sensitive Edition, Landing Zone Accelerator, Azure Mission Landing Zone, and Google Cloud Assured Workloads foundations.
• Operate as mission owner within AWS GovCloud, Azure Government, and classified regions (Secret/Top Secret) connected to NIPRNet, SIPRNet, JWICS, and classified fabrics.
• Design and troubleshoot hybrid cloud networking end to end: hub-and-spoke and transit topologies, private connectivity (Direct Connect, ExpressRoute, Cloud Interconnect), BGP routing, DNS, private endpoints, load balancing, and firewall/inspection stacks.
• Establish Infrastructure as Code standards using Terraform, Pulumi, and Crossplane with module libraries, state management, and drift detection.
• Architect and operate production Kubernetes platforms (EKS, AKS, GKE, air-gapped distributions) with multi-tenancy, lifecycle management, CNI, network policy, Istio service mesh, secrets management, Helm/Kustomize, Flux/Argo CD, and DISA STIG/CIS hardening.
• Lead Authority to Operate efforts end to end: control inheritance matrices, NIST SP 800-53 implementation, System Security Plans, POA&Ms, STIG/SCAP scanning, continuous monitoring, and continuous ATO.
• Serve as senior technical authority for customers and assessors; mentor engineers and set architectural direction across programs.
What You Bring
• 8-10 years in infrastructure or cloud engineering, with 5+ years in a senior or lead architect role.
• Active TS/SCI clearance and U.S. citizenship.
• Deep, hands-on expertise in at least two of AWS, Azure, and GCP, including their government offerings.
• Extensive experience deploying into classified networks (SIPRNet and/or JWICS), including…