Senior Cloud Architect, Government Missions

📋 Job Overview

Second Front Systems is looking for an operationally focused, compliance-hardened, multi-cloud Senior Cloud Architect, Government Missions to strengthen our cloud infrastructure and security practice.

🏢 About [Company]

Second Front Systems is a company focused on cloud infrastructure and security practice, particularly in government missions.

🎯 The Role

Operating at classified and unclassified DoD and IC networks, you will be responsible for architecting and operating secure multi-tenant cloud foundations across AWS, Azure, and GCP; designing government enclave architectures (TSE-SE, LZA, MLZ, Assured Workloads); and leading compliance and Authority to Operate efforts end to end.

✅ Key Responsibilities

• Architect and own secure multi-tenant landing zones across AWS, Azure, and GCP with account/subscription/project vending, network segmentation, centralized logging, and policy guardrails.
• Design and deploy government enclave architectures including AWS Trusted Secure Enclaves–Sensitive Edition, Landing Zone Accelerator, Azure Mission Landing Zone, and Google Cloud Assured Workloads foundations.
• Operate as mission owner within AWS GovCloud, Azure Government, and classified regions (Secret/Top Secret) connected to NIPRNet, SIPRNet, JWICS, and classified fabrics.
• Design and troubleshoot hybrid cloud networking end to end: hub-and-spoke and transit topologies, private connectivity (Direct Connect, ExpressRoute, Cloud Interconnect), BGP routing, DNS, private endpoints, load balancing, and firewall/inspection stacks.
• Establish Infrastructure as Code standards using Terraform, Pulumi, and Crossplane with module libraries, state management, and drift detection.
• Architect and operate production Kubernetes platforms (EKS, AKS, GKE, air-gapped distributions) with multi-tenancy, lifecycle management, CNI, network policy, Istio service mesh, secrets management, Helm/Kustomize, Flux/Argo CD, and DISA STIG/CIS hardening.
• Lead Authority to Operate efforts end to end: control inheritance matrices, NIST SP 800-53 implementation, System Security Plans, POA&Ms, STIG/SCAP scanning, continuous monitoring, and continuous ATO.
• Serve as senior technical authority for customers and assessors; mentor engineers and set architectural direction across programs.

📌 Required Qualifications

• 8-10 years in infrastructure or cloud engineering, with 5+ years in a senior or lead architect role.
• Active TS/SCI clearance and U.S. citizenship.
• Deep, hands-on expertise in at least two of AWS, Azure, and GCP, including their government offerings.
• Extensive experience deploying into classified networks (SIPRNet and/or JWICS), including air-gapped or disconnected environments.
• Production IaC experience with Terraform/OpenTofu and at least one of Pulumi or Crossplane.
• Hands-on compliance experience with FedRAMP High, the DoD Cloud Computing Security Requirements Guide (CC SRG), NIST SP 800-53, DISA STIGs, and the RMF/ATO process, including authoring or owning ATO artifacts (SSPs, POA&Ms, control implementation statements).
• In-depth Kubernetes expertise running production, multi-tenant clusters, including networking, security hardening, upgrades, and troubleshooting; in-depth hands-on experience with Helm (chart authoring and lifecycle), Kustomize (bases and overlays), and GitOps tooling such as Flux and Argo CD, plus CI/CD pipelines.
• Proven experience designing multi-tenant landing zones and operating as a mission owner in government clouds (AWS GovCloud, Azure Government) at DoD Impact Level 4/5 or higher.
• U.S. citizenship is required for this role.

⭐ Desirable Experience

• Experience with cross-domain solutions (CDS) and moving software across classification boundaries.
• Experience with ICAM (CAC/PIV, SAML/OIDC federation).
• Professional certifications such as AWS Certified Solutions Architect – Professional, Microsoft Azure Solutions Architect Expert, Google Professional Cloud Architect, or CKA/CKS.
• DoD 8140 (formerly 8570) compliant certification at time of hire, such as CISSP or CCSP.

🎁 Benefits

Base salary: $200,000 - $215,000. Offers Equity. Offers Bonus.

🛂 Visa & Eligibility

Candidates must reside in one of our approved hiring hubs: DC/Maryland/Virginia or Denver/Colorado Springs, CO. Active TS/SCI clearance and U.S. citizenship are required for this role.