> Markdown version of [/jobs/ext/3734162-cloud-specialist](https://www.wearedevelopers.com/jobs/ext/3734162-cloud-specialist). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Cloud Specialist - **Company:** Viasat, Inc. - **Location:** San Jose, CA, United States - **Experience:** Experienced - **Salary:** $120,500.0 - $190,000.0 - **Contract:** Permanent contract - **Skills:** Microsoft Access, Active Directory, Amazon Web Services, Amazon Elastic Compute Cloud, Amazon S3, Systems Engineering, Audit Trail, Bash Shell, Cloud Computing, Cloud Computing Security, Cloud Engineering, Elasticsearch, Identity and Access Management, IP Routing, Multi-protocol Systems, Python (Programming Language), Cloud Services, Runbook, Security Information and Event Management, Software Vulnerability Management, Wide Area Networks, Scripting, Multi-Cloud, Firewalls (Computer Science), Amazon Virtual Private Cloud (VPC), Gitlab-ci, Nessus, Fortinet, Terraform, Data Pipelines, Devsecops, OpenSearch, User Administration, Plan of Action and Milestones - **Published:** October 14, 2026 - **Apply:** https://www.clearancejobs.com/jobs/9238548/cloud-specialist ## About the Role * Hands-on production AWS experience: VPC, IAM, EC2, S3, CloudTrail, Config, and multi-account structures * Terraform module authoring and GitOps discipline in a production environment * AWS networking: Transit Gateway, Direct Connect, VPC topologies, route tables, security groups, and hybrid connectivity to carrier or MPLS backbones * Experience operating in a regulated or compliance-bound cloud environment (FedRAMP, DoD IL4/IL5, or equivalent), where configurations map to NIST 800-53 / 800-171 controls * Familiarity with cloud security tooling: SIEM integration, vulnerability management, and continuous monitoring * Scripting proficiency (Python, Bash, or similar) for automation beyond Terraform * 5+ years in cloud engineering, infrastructure engineering, or DevSecOps roles, with at least 2 years hands-on in AWS * Bachelor's degree in a technical field, or equivalent operational experience * US Citizenship required * Active DoD Secret clearance required * Ability to travel up to 15% Strongly Preferred (90-Day Ramp) * AWS GovCloud-specific experience, including partition constraints and IL4/IL5 boundary operations * AWS multi-account governance at scale: Organizations, SCPs, Control Tower or custom landing zone frameworks, account vending automation * Terraform Enterprise or Terraform Cloud workflow experience with policy-as-code gates (Sentinel, OPA, or similar) * GitLab CI/CD pipeline development for infrastructure delivery * Identity stack experience: IAM Identity Center, Active Directory integration, RADIUS/MFA solutions (PrivacyIDEA or equivalent) * OpenSearch/Elasticsearch SIEM administration, plus Security Hub, GuardDuty, and Tenable/Nessus integration * AWS WorkSpaces or VDI deployment in hardened configurations * KMS, AWS Backup, and encryption baseline engineering What will help you on the job * AWS Secret Region (IL6) or Top Secret Region experience, or other classified cloud operations * AWS certifications: Solutions Architect Professional, Security Specialty, Advanced Networking Specialty, or SysOps * Experience integrating cloud infrastructure with SD-WAN overlays and NGFW boundary security (FortiGate, Palo Alto) * Cloud broker or multi-cloud service delivery experience * Container and edge compute platforms (EKS, AWS Outposts, or forward compute architectures) * DoD 8140/8570 baseline certification (Security+, CASP+, CISSP, or equivalent) * TS/SCI clearance currently held * Experience supporting FedRAMP or CMMC assessments with technical artifacts ## Description * Landing Zones: Maintain and extend AWS landing zones for tenant and shared-service segmentation, including account vending, guardrails, service control policies, and CloudTrail/Config baselines, under the direction of the Lead Systems Engineer. * Cloud Networking: Engineer cloud networking: Transit Gateway, Direct Connect Gateway, Global Accelerator, VPC spoke topologies, PrivateLink, and AWS Network Firewall, integrated with the MPLS backbone and SD-WAN overlay at NNI boundary points. * IaC-First Delivery: Author and extend Terraform modules for cloud infrastructure. Every change flows through Terraform Enterprise and GitLab CI/CD with policy gates; no direct-to-production applies. * Tenant Compute: Deploy and operate tenant compute and workspace services, including AWS WorkSpaces VDI in STIG-hardened configurations and tenant account guardrails. Security, Identity, and Compliance in the Cloud * Identity and Access: Operate the identity stack: AWS IAM Identity Center, AD Connector, self-managed Active Directory, and PrivacyIDEA RADIUS MFA. * Security Telemetry and SIEM: Engineer security telemetry into the centralized OpenSearch SIEM, integrating Security Hub, GuardDuty, and Nessus/Tenable findings to sustain continuous monitoring under the platform's C-ATO posture. * Hardening and Evidence: Apply and maintain KMS CMK encryption baselines, AWS Backup vaults, and STIG/CIS hardening across cloud workloads; produce configuration evidence that maps to NIST 800-53 Rev 5 and 800-171 controls. * Accreditation Support: Support FedRAMP Moderate and CMMC Level 2 assessments with cloud-layer artifacts, POA&M inputs, and continuous monitoring data. Team and Platform Contribution * Integration Partnership: Work alongside the Lead Systems Engineer and network engineering team to keep cloud, network, and security layers integrated at every boundary. * Tenant Onboarding: Execute tenant onboarding runbooks for the cloud layer: account provisioning, boundary controls, telemetry enrollment, and operational handoff to GCC/CSOC. * Runbooks and Improvement: Contribute to the structured runbook catalog for security, platform, and recovery operations, and feed operational lessons back into Terraform modules and landing zone baselines.