{"id":2280188,"url":"https://alion.io/job/northrop-grumman-aws-cloud-platform-landing-zone-engineer","title":"AWS Cloud Platform / Landing Zone Engineer","company":{"id":12494,"name":"Northrop Grumman","domain":"northropgrumman.com","url":"https://alion.io/company/northropgrumman","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"A","score":88,"open_postings":487,"ghost_share":0.002,"stale_share":0.682,"repost_share":0.018,"time_to_fill_p50_days":13,"computed_at":"2026-10-13T05:45:00Z"}},"role":"DevOps","role_family":"DevOps","seniority":"staff","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Redondo Beach, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":111700,"max":193900,"currency":"USD","period":"year","gross":null,"usd_annual":193900},"salary_estimate":null,"experience_years_min":10,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Active Directory","optional":false},{"name":"Amazon EKS","optional":false},{"name":"Amazon S3","optional":false},{"name":"Ansible","optional":false},{"name":"AWS","optional":false},{"name":"Bash","optional":false},{"name":"CI/CD","optional":false},{"name":"CloudFormation","optional":false},{"name":"Configuration Management","optional":false},{"name":"DNS","optional":false},{"name":"IAM","optional":false},{"name":"Kubernetes","optional":false},{"name":"Linux","optional":false},{"name":"OpenShift","optional":false},{"name":"OpenTofu","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Red Hat","optional":false},{"name":"Splunk","optional":false},{"name":"TCP/IP","optional":false},{"name":"Terraform","optional":false},{"name":"Unix","optional":false},{"name":"Windows","optional":false},{"name":"Zero Trust","optional":false},{"name":"Azure","optional":true},{"name":"Clair","optional":true},{"name":"Docker","optional":true},{"name":"Docker Compose","optional":true},{"name":"Grafana","optional":true},{"name":"HashiCorp Vault","optional":true},{"name":"KVM","optional":true},{"name":"LDAP","optional":true},{"name":"Podman","optional":true},{"name":"Prometheus","optional":true},{"name":"QEMU","optional":true},{"name":"Rancher","optional":true},{"name":"SonarQube","optional":true},{"name":"Trivy","optional":true},{"name":"VMWare","optional":true}],"status":"live","first_seen_at":"2026-10-08T00:00:00Z","employer_posted_date":"2026-10-08","last_verified_at":"2026-10-13T22:58:55Z","board_verified":true,"closed_at":null,"days_open":6,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":6},"description":"RELOCATION ASSISTANCE: No relocation assistance availableCLEARANCE REQUIRED FOR START: NoCLEARANCE TYPE: SecretTRAVEL: Yes, 10% of the TimeDescription\nAt Northrop Grumman, our employees have incredible opportunities to work on revolutionary systems that impact people's lives around the world today, and for generations to come. Our pioneering and inventive spirit has enabled us to be at the forefront of many technological advancements in our nation's history - from the first flight across the Atlantic Ocean, to stealth bombers, to landing on the moon. We look for people who have bold new ideas, courage and a pioneering spirit to join forces to invent the future, and have fun along the way. Our culture thrives on intellectual curiosity, cognitive diversity and bringing your whole self to work - and we have an insatiable drive to do what others think is impossible. Our employees are not only part of history, they're making history.At the heart of Defining Possible is our commitment to missions. In rapidly changing global security environments, Northrop Grumman brings informed insights and secure technological solutions to enable strategic objectives. We’re looking for innovators who can help us keep building on our wide portfolio of secure, affordable, integrated, and multi-domain systems and technologies that fuel those missions. By joining in our shared mission, we will support yours by expanding your personal network and developing skills, whether you are new to the field or an industry thought leader. At Northrop Grumman, you will have the resources, support, and team to do some of the best work of your career.\nNorthrop Grumman’s Corporate Sector's Chief Information & Digital Office (CIDO) is seeking a Sr. Principal Computer Systems Analyst - Cloud Platform / Landing Zone Engineer (AWS) to support its IT Infrastructure & Operations organization's Classified Solutions team. The selected candidate will serve as the leading technical authority for our proprietary, air-gapped AWS Secret Cloud for Industry (ASCI) IL6 multi-account environment. This technical leader will guide the successful design, security standards, and architectural integrity of classified multi-account workloads.\nThis role is responsible for the transition from legacy “on-prem” operational habits to automated, highly resilient cloud-native infrastructures, ensuring that developers receive modern, high velocity capabilities without compromising our Authorization to Operate (ATO). You will apply extensive technical expertise to solve complex, non-recurring deployment challenges and serving as a key mentor for junior platform personnel and tier-1 triage teams.\nThe selected candidate will be required to work on-site, full-time at our Redondo Beach, CA, or Rolling Meadows, IL, or Melbourne, FL location.\nThe responsibilities of this role include, but are not limited to, the following:\nGeneral Responsibilities:\nPerform as a lead Sr. Principal Computer Systems Analyst - Cloud Platform / Landing Zone Engineer (AWS) in support of classified government contracts.\nCommunicate effectively with all organizational levels, internal/external customers, vendors, and senior leadership, both verbally and in writing.\nOversee operations and administration of multi-user computer systems and multiple networks, coordinating with IT teams, project managers, and end users.\nAnalyze requirements, recommend, and implement hardware/software solutions; interact with vendors to evaluate and troubleshoot products and services.\nDefine, implement, and maintain enterprise-wide system enhancements, including installation, upgrades/patches, monitoring, configuration management, and problem resolution.\nLead testing, validation, and change management for major product releases across platforms.\nDevelop, publish, and continuously improve technical standards and SOPs.\nEnsure compliance with Information Systems security guidelines; prepare and maintain security documentation, audit logs, and Assessment & Authorization (A&A) submissions; serve as senior liaison to the ISSM.\nReport on strategic initiatives and project status to executive stakeholders; act as a key technical advisor impacting enterprise-wide, mission-critical systems.\nActs as a key technical advisor to senior leadership; impacts multiple programs and mission-critical systems across the enterprise.\nProvide senior-level technical expertise by mentoring junior and experienced team members, fostering their professional growth and enhancing team capabilities.\nLifts and moves equipment up to 50 pounds. \nWork after hours, and weekends, as needed.\nEnvironment Automation & IaC:\nDeclarative Infrastructure: Develop and maintain declarative Infrastructure as Code (IaC) templates using declarative tools such as AWS CloudFormation, AWS SAM, Terraform, OpenTofu to standardize and automate Secret-level cloud environments.\nAccount Provisioning: Design and manage automated Account Vending Machines (AVMs) and account factories to rapidly provision standardized, compliant VPCs and AWS accounts for mission application teams, preventing multi-tenant data comingling.\nOffline Pipeline Architecture: Build and maintain offline, air-gapped CI/CD pipelines tailored to execute in code-isolated environments without public internet connectivity or external SaaS dependencies.\nGovernance, Security, & Guardrails:\nAccess Control Enforcement: Author and enforce strict Service Control Policies (SCPs) and IAM permission boundaries to prevent unauthorized lateral movement between multi-tenant program partitions.\nCentralized Security Logging: Configure centralized audit logging by routing AWS CloudTrail events directly to a secure, immutable, centralized S3 logging bucket for seamless ingestion into our on-premises Splunk environment, including designing compliant alternatives when native services (e.g., GuardDuty or SQS-based pipelines) are unavailable or not accredited in the air-gapped region.\nManual AMI Hardening: Lead the manual STIG hardening and security configuration of Red Hat Enterprise Linux (RHEL) and Windows Amazon Machine Images (AMIs) using localized Ansible and PowerShell scripts, managing the interim pipeline while AWS Image Builder remains unapproved on the high side.\nATO Compliance Mapping: Map all cloud infrastructure configurations directly to DISA STIGs and NIST SP 800-53 controls to achieve first time pass rates during DCSA continuous monitoring audits. \nNetwork & Hybrid Data Flow:\nSecure Hybrid Connectivity & Patch Ingestion: Design and maintain zero-trust network connectivity between Secret-level AWS environments and Secret-level on-prem systems using AWS Transit Gateway, Direct Connect, and software-defined firewalls. Work with security and cross-domain solution teams to define compliant, controlled processes for importing patches and updates from lower-classification environments into the air-gapped Secret environment.\nOn-Premise DNS Reach Back: Design and manage conditional DNS forwarding architectures using Route 53 Resolver Endpoints pointing directly back to our on-premises Active Directory and DNS servers, explicitly avoiding the deployment of active domain controllers inside the cloud boundary.\nNote: Due to the classified nature of the work being performed, this position does not offer any virtual or telecommute working options. Applicants are encouraged to apply, only if they are willing to work on-site.\nBasic Qualifications:\nMaster's Degree with 6 years of IT experience; OR a Bachelor's Degree with 8 years of IT experience; OR an Associate's Degree with 10 years of IT experience; OR a High School Diploma/GED with 12 years of IT experience is required.\n Candidates must have the ability to obtain a U.S. Government Secret level security clearance as a condition of continued employment.\nLinux operating system workstation and server administration/support experience in DoD/IC classified and/or air-gapped environments.\nOperating system cross-platform awareness (e.g., Windows, Linux, UNIX variants), including interoperability considerations in mixed on-prem and cloud environments\nExperience administering container orchestration platforms (e.g., Kubernetes-based environments such as Amazon EKS or OpenShift) in classified or regulated environments.\nProficiency with automation and configuration management tools (e.g., Ansible, Bash/Python scripting) in Linux and cloud environments.\nSolid understanding of networking concepts (TCP/IP, DNS, load balancing, firewalls) and AWS networking primitives (VPCs, subnets, security groups, network ACLs, Transit Gateway, Direct Connect, Route 53 Resolver) in classified cloud contexts.\nDemonstrated experience with system and platform security hardening and patch management using DISA STIGs and other DoD security baselines.\nHands-on experience architecting and operating AWS multi-account landing zones in regulated or classified environments (e.g., AWS Organizations, SCPs, IAM guardrails, centralized logging).\nExperience designing and maintaining CI/CD pipelines and mirrored repositories for patch and artifact distribution into Secret-level environments.\nCandidates must meet U.S. Government DoD 8140 (formerly 8570) requirements for the appropriate IAT/IAM level (typically a CompTIA Security+ or equivalent) for a Sr. Principal Computer Systems Analyst working Linux and cloud systems in a classified environment or able to obtain within six months of hire\nActive DoD Secret clearance or ability to obtain and maintain a DoD Secret clearance.\nPreferred Qualifications:\nBachelor’s degree in Information Technology or related field, and 10+ years of Linux server administration experience in DoD/IC classified and/or air-gapped environments.\nA current U.S. Government Secret level security clearance.\nCandidates must have the ability to obtain, and maintain, a U.S. Government Top Secret level security clearance as a condition of continued employment.\nCandidates must have the ability to obtain, and maintain, SCI level access as a condition of continued employment. \nCandidates must have the ability to obtain, and maintain, a Polygraph as a condition of continued employment.\nCandidates must have the ability to obtain, and maintain, access to Special Programs as a condition of continued employment.\nAdvanced cybersecurity certifications such as CASP+, CISSP, or cloud security certifications (e.g., AWS Certified Security - Specialty) in addition to meeting DoD 8140 baseline (e.g., Security+ CE).\nOperating system cross-platform operations (e.g., Windows, Linux, UNIX variants), including integration between on-premises and AWS workloads in classified environments.\nExperience working directly with Information System Security Managers (ISSMs) and supporting Assessment & Authorization (A&A) activities for cloud hosted systems.\nExperience administering modern Linux distributions (RHEL 8/9, Rocky Linux, etc.), including STIG-hardened images in classified environments.\nExperience operating under and managing systems within NISPOM Chapter 8, DCID 6/3-ICD 503, RMF, STIG, JAFAN, or JSIG information system environments.\nExperience with AWS Secret and Top Secret regions (e.g., SC2S, C2S) or other government-only cloud offerings, including operating within air-gapped or restricted-connectivity constraints.\nPractical experience designing AWS landing zones using AWS Organizations, Control Tower/Account Factory, or homegrown Account Vending Machines in classified environments.\nKubernetes orchestration (CNCF Kubernetes, Rancher, Kubernetes Dashboard, etc.), including experience with Amazon EKS or OpenShift on AWS in secure or classified deployments.\nAdvanced containerization skills (Podman, Podman Compose, Docker, Docker Compose, etc.) and container security tools, with experience securing containers in air-gapped or disconnected environments.\nHands-on experience with DevSecOps tooling in classified or regulated environments, including:\nContainer and code security scanners (e.g., Trivy, Anchore, Clair,...","description_format":"text","description_chars":16449,"description_truncated":true,"requirements":{"experience_years_min":10,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"high_school","optional":false},"security_clearance":true,"languages":[]},"benefits":["401k plan","Annual bonuses","Flexible schedule","Health insurance","Insurance coverage","Relocation assistance"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":true,"industries":["Government"],"lifecycle":[{"event":"open","at":"2026-10-11T11:22:30Z"}],"visa":[],"liveness":{"score":50,"band":"ok","label":"Likely open","p_open":1,"p_active":0.551,"p_room":0.9,"age_days":5,"expected_fill_days":13,"reasons":["conf:1","stale_co","win:mid","comp:brand"],"computed_at":"2026-10-13T05:45:00Z"},"pay":{"stated_usd_annual":193900,"is_top_pay":false},"html_url":"https://alion.io/job/northrop-grumman-aws-cloud-platform-landing-zone-engineer","json_url":"https://alion.io/job/northrop-grumman-aws-cloud-platform-landing-zone-engineer.json","meta":{"generated_at":"2026-10-14T00:54:38Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":1344,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-15T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":12494},"rest":"https://alion.io/mcp/rest/get_company?id=12494"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fnorthrop-grumman-aws-cloud-platform-landing-zone-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fnorthrop-grumman-aws-cloud-platform-landing-zone-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fnorthrop-grumman-aws-cloud-platform-landing-zone-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/northrop-grumman-aws-cloud-platform-landing-zone-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fnorthrop-grumman-aws-cloud-platform-landing-zone-engineer"}]}