> Markdown version of [/jobs/ext/4222575-aws-gov-cloud-engineer](https://www.wearedevelopers.com/jobs/ext/4222575-aws-gov-cloud-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# AWS GOV Cloud Engineer

- **Company:** Iquasar, LLC.
- **Location:** Fort Belvoir, VA, United States (Remote available)
- **Experience:** Expert
- **Contract:** Permanent contract
- **Skills:** Amazon Web Services, Cloud Computing, Cloud Computing Security, Cloud Engineering, Cyber Security, Information Systems, Data Centers, DevOps, Identity and Access Management, Intrusion Detection and Prevention, Intrusion Detection Systems, Network Security, Role-Based Access Control, Security Assertion Markup Language (SAML), Data Logging, Software Repository, Infrastructure as Code (IaC), Cloudformation, SC Clearance, Information Technology, Fortinet, Terraform, Vulnerability Analysis
- **Published:** October 8, 2026
- **Apply:** https://www.clearancejobs.com/jobs/9227572/aws-gov-cloud-engineer

## About the Role

* Active U.S. Government Secret clearance (Top Secret/SCI preferred) due to handling DoD IL4/IL5 systems and data.
 * Bachelor's degree in computer science, Cybersecurity, Information Systems, or equivalent experience, combined with 5+ years of dedicated AWS engineering and security experience.
 * Direct, demonstrable experience implementing the DISA Cloud Computing Security Requirements Guide (CC SRG) and building SCCA compliant networks (VDSS/VDMS/CAP).
 * Strong background deploying workloads exclusively within the AWS GovCloud (US-East/US-West) regions.
 * Extensive experience designing, troubleshooting, and managing nested SCPs in complex organizational environments.
 * Must possess a baseline certification meeting IAT Level III or IAM Level III (e.g., CISSP, CASP+, CISM, or Security+ CE with relevant AWS specialty certifications).
 * Advanced proficiency in writing and maintaining Terraform or CloudFormation templates in highly regulated environments.

Preferred Skills:

 * AWS Certified Security - Specialty, AWS Certified Solutions Architect - Professional, or AWS Certified DevOps Engineer - Professional.
 * Experience configuring SAML 2.0 federation with DoD identity providers (IdAPs) for Common Access Card (CAC) / PIV authentication.
 * Experience working alongside a Cyber Security Service Provider (CSSP) for authorization and ATO processes.

## Description

The ideal candidate will have extensive hands-on experience deploying the Virtual Data Center Security Stack (VDSS) and Virtual Data Center Managed Services (VDMS). You will possess advanced expertise in multi-account governance, including the authoring, testing, and continuous enforcement of restrictive Service Control Policies (SCPs). This position is crucial to enabling our mission partners to deploy critical DoD Impact Level 4 (IL4) and Impact Level 5 (IL5) workloads safely into the cloud., * VDSS Implementation: Design, deploy, and maintain the Virtual Data Center Security Stack (VDSS) to protect mission applications. Implement secure network boundary controls, application-aware firewalls, intrusion detection/prevention systems (IDS/IPS), and perimeter defenses.

 * VDMS Management: Standardize and manage host security and shared management services under the Virtual Data Center Managed Services (VDMS) framework, including directory services, vulnerability scanning, host-based security, patching, and configuration governance.
 * Landing Zone Automation: Utilize the AWS Landing Zone Accelerator (LZA) or custom Control Tower implementations to automate the deployment of multi-account SCCA architectures.
 * TCCM Enforcement: Operate as or support the Trusted Cloud Credential Manager (TCCM) role, implementing strict Role-Based Access Control (RBAC) and ensuring least-privileged IAM policies.
 * Service Control Policies (SCPs): Architect, write, and manage highly restrictive Service Control Policies (SCPs) at the AWS Organization and Organizational Unit (OU) level. Prevent unauthorized service usage, enforce geographical region locks (restricting actions to AWS GovCloud), and deny modification of critical security and logging resources.
 * Compliance & Drift Guarding: Establish continuous automated monitoring to detect and remediate drift from SCCA compliance baselines using native AWS governance capabilities.
 * Draft all cloud infrastructure using secure, modular Infrastructure as Code (IaC) (primarily Terraform or AWS CloudFormation).
 * Maintain Infrastructure as Code in secure Git repositories and integrate automated security scanning (e.g., tfsec, Checkov) into CI/CD pipelines.
 * Integrate third-party security appliances (e.g., Palo Alto, Fortinet) within VDSS transit environments where appropriate.
 * Configure and integrate native DoD security tooling, including Host Based Security System (HBSS), Assured Compliance Assessment Solution (ACAS), and CSSP security operations.