> Markdown version of [/jobs/ext/4658038-cloud-architect-government-missions](https://www.wearedevelopers.com/jobs/ext/4658038-cloud-architect-government-missions). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Cloud Architect, Government Missions - **Company:** Second Front Systems, Inc. - **Location:** Denver, CO, United States (Remote available) - **Experience:** Expert - **Salary:** $200,000 - **Contract:** Permanent contract - **Skills:** OpenTofu, Amazon Web Services, Microsoft Azure, Border Gateway Protocol, Cloud Computing, Cloud Computing Security, Cloud Engineering, Computer Networks, Domain Name System (DNS), Key Management, Network Connections, Network Segmentation, NIPRNet, Octopus Deploy, OpenID, Security Assertion Markup Language (SAML), Security Content Automation Protocol, Wireless Access Point, Data Logging, Network Switches, Pulumi, Google Cloud, Load Balancing, Istio, HybridCloud, Kubernetes, Terraform - **Published:** November 10, 2026 - **Apply:** https://startup.jobs/senior-cloud-architect-government-missions-secondfront-com-10723851 ## About the Role * 8-10 years in infrastructure or cloud engineering, with 5+ years in a senior or lead architect role. * Active TS/SCI clearance and U.S. citizenship. * Deep, hands-on expertise in at least two of AWS, Azure, and GCP, including their government offerings. * Extensive experience deploying into classified networks (SIPRNet and/or JWICS), including air-gapped or disconnected environments. * Production IaC experience with Terraform/OpenTofu and at least one of Pulumi or Crossplane. * Hands-on compliance experience with FedRAMP High, the DoD Cloud Computing Security Requirements Guide (CC SRG), NIST SP 800-53, DISA STIGs, and the RMF/ATO process, including authoring or owning ATO artifacts (SSPs, POA&Ms, control implementation statements). * In-depth Kubernetes expertise running production, multi-tenant clusters, including networking, security hardening, upgrades, and troubleshooting; in-depth hands-on experience with Helm (chart authoring and lifecycle), Kustomize (bases and overlays), and GitOps tooling such as Flux and Argo CD, plus CI/CD pipelines. * Proven experience designing multi-tenant landing zones and operating as a mission owner in government clouds (AWS GovCloud, Azure Government) at DoD Impact Level 4/5 or higher. * U.S. citizenship is required for this role. Preferred * Experience with cross-domain solutions (CDS) and moving software across classification boundaries. * Experience with ICAM (CAC/PIV, SAML/OIDC federation). * Professional certifications such as AWS Certified Solutions Architect - Professional, Microsoft Azure Solutions Architect Expert, Google Professional Cloud Architect, or CKA/CKS. * DoD 8140 (formerly 8570) compliant certification at time of hire, such as CISSP or CCSP. ## Description Second Front Systems is looking for an operationally focused, compliance-hardened, multi-cloud Senior Cloud Architect, Government Missions to strengthen our cloud infrastructure and security practice. Operating at classified and unclassified DoD and IC networks, you will be responsible for architecting and operating secure multi-tenant cloud foundations across AWS, Azure, and GCP; designing government enclave architectures (TSE-SE, LZA, MLZ, Assured Workloads); and leading compliance and Authority to Operate efforts end to end. You will design and troubleshoot cloud and hybrid networking topologies (Transit Gateway, Virtual WAN, Network Connectivity Center, Direct Connect, ExpressRoute, Cloud Interconnect); architect and operate production Kubernetes platforms (EKS, AKS, GKE, air-gapped distributions) with multi-tenancy and DISA STIG/CIS hardening; establish Infrastructure as Code standards using Terraform, Pulumi, and Crossplane, ensuring that landing zones, network segmentation, centralized logging, and guardrails enforce zero-trust principles aligned to SCCA and CAP requirements, and systems achieve continuous Authority to Operate across NIST SP 800-53 controls. We need someone capable of designing networks to DISA Secure Cloud Computing Architecture and Cloud Access Point specifications; leading deployments into NIPRNet, SIPRNet, JWICS, and classified fabrics; operating as mission owner in AWS GovCloud, Azure Government, and classified regions; and owning compliance end to end-control inheritance, System Security Plans, POA&Ms, STIG/SCAP scanning, continuous monitoring, and continuous ATO workflows. As a key partner to customers, program leadership, and authorized assessors, you will establish technical authority and architectural direction across programs, serving as senior technical mentor to engineering teams. Note: Candidates must reside in one of our approved hiring hubs: * DC/Maryland/Virginia * Denver/Colorado Springs, CO This is a full-time position. What You'll Do * Architect and own secure multi-tenant landing zones across AWS, Azure, and GCP with account/subscription/project vending, network segmentation, centralized logging, and policy guardrails. * Design and deploy government enclave architectures including AWS Trusted Secure Enclaves-Sensitive Edition, Landing Zone Accelerator, Azure Mission Landing Zone, and Google Cloud Assured Workloads foundations. * Operate as mission owner within AWS GovCloud, Azure Government, and classified regions (Secret/Top Secret) connected to NIPRNet, SIPRNet, JWICS, and classified fabrics. * Design and troubleshoot hybrid cloud networking end to end: hub-and-spoke and transit topologies, private connectivity (Direct Connect, ExpressRoute, Cloud Interconnect), BGP routing, DNS, private endpoints, load balancing, and firewall/inspection stacks. * Establish Infrastructure as Code standards using Terraform, Pulumi, and Crossplane with module libraries, state management, and drift detection. * Architect and operate production Kubernetes platforms (EKS, AKS, GKE, air-gapped distributions) with multi-tenancy, lifecycle management, CNI, network policy, Istio service mesh, secrets management, Helm/Kustomize, Flux/Argo CD, and DISA STIG/CIS hardening. * Lead Authority to Operate efforts end to end: control inheritance matrices, NIST SP 800-53 implementation, System Security Plans, POA&Ms, STIG/SCAP scanning, continuous monitoring, and continuous ATO. * Serve as senior technical authority for customers and assessors; mentor engineers and set architectural direction across programs.