Senior AWS Cloud Engineer, Landing Zone Accelerator

The Landing Zone Accelerator is not a service you configure. It is a CDK application that deploys an entire governed AWS organization, driven by a handful of YAML files, and it touches more than thirty services in a single pipeline run. Somebody has to own that pipeline: author the configuration, extend the CDK where the defaults do not fit, push the change through CodePipeline, and read the CloudFormation events when stage nine fails at two in the afternoon. That is this seat. It is also an architecture seat. The environment is multi-account and heavily regulated, spanning GovCloud and other restricted partitions under NIST 800-53, FedRAMP, and DoD Impact Level requirements. You will make and defend design decisions about OU structure, account vending, network topology, and operating model, then live with them. The team is small, so the person who writes the config is the same person who explains the architecture to stakeholders and sets the standard everyone else follows., * Own the LZA configuration and codebase. Author and maintain the YAML configuration files that drive deployment, and extend the CDK application in TypeScript or Python where customization is required.

• Run and troubleshoot the pipeline. Operate CodePipeline and CodeBuild, manage release cadence, and diagnose the hard failures: CDK bootstrap problems, permission boundary conflicts with automation roles, stack drift, and rollback scenarios.
• Design the account foundation. Shape the AWS Organizations structure and OU hierarchy, support Control Tower Account Factory and LZA account vending, and apply baselines consistently to new accounts.
• Build the network layer. Design multi-account VPC topology and CIDR strategy, Transit Gateway routing, the inspection VPC with AWS Network Firewall, and centralized egress and ingress control.
• Make the architecture calls. Own design decisions and trade-off analysis, align to the AWS Security Reference Architecture and Well-Architected principles, and serve as the escalation point for complex multi-account issues.
• Design the operating model. Define how the landing zone is sustained after deployment: change cadence, drift management, onboarding of new workload accounts, and the runbooks that make it repeatable.
• Keep change management disciplined. Maintain Git-based workflows, peer review, and automated validation, because a bad commit here does not break one application, it breaks governance for every account beneath it.
• Communicate the environment. Maintain architecture decision records, diagrams, and deployment procedures, and brief stakeholders in language they can act on., The role is fully remote within the continental United States, with quarterly travel to Charleston, South Carolina for program increment planning sessions. Expect roughly one trip per quarter, planned well in advance.

The initial engagement runs approximately 30 days to close out an existing period of performance. A follow-on award is anticipated to extend the work approximately twelve months, subject to execution of that award.

An active Secret clearance is required at start. Interim clearances will not be accepted for this engagement, and clearance status is verified before any offer is extended. This is a small team supporting a large solution, so the person in this seat carries more breadth than a comparable role at a larger shop would. Depth in the core area is expected; working competence across the adjacent areas is what makes the seat viable.

• Active Secret clearance. Interim clearances are not accepted for this engagement.
• U.S. citizenship.
• Senior hands-on AWS engineering experience in a multi-account environment, including AWS Organizations, OU design, and cross-account access patterns.
• Infrastructure as code depth in production, with AWS CDK, CloudFormation, or Terraform.
• Working proficiency in TypeScript or Python, sufficient to read, extend, and debug a CDK codebase.
• CI/CD pipeline ownership using AWS CodePipeline and CodeBuild or a directly comparable toolchain.
• AWS networking competence: VPC design, CIDR planning, Transit Gateway, and centralized traffic inspection.
• Git-based change management, peer review, and version control discipline.
• Ability to make and defend architecture decisions with technical and non-technical stakeholders.
• Willingness to travel to Charleston, South Carolina approximately quarterly., * Direct hands-on experience deploying, customizing, or operating the AWS Landing Zone Accelerator.
• AWS Control Tower deployment or Account Factory experience.
• AWS GovCloud, Secret, or Top Secret partition experience, including awareness of service availability, endpoint, and ARN format differences across partitions.
• AWS Network Firewall rule group development and inspection VPC design.
• AWS certification such as Solutions Architect Professional or DevOps Engineer Professional.
• CompTIA Security+ (Sec+ CE) or an equivalent DoD 8140 baseline certification.
• Familiarity with NIST SP 800-53, FedRAMP, CMMC, or DoD Impact Level 4 through 6 requirements.
• Experience with SAFe or program increment planning in an agile delivery environment.