Senior Cloud Architect, Government Missions

Senior Cloud Architect, Government Missions

Second Front Systems is looking for an operationally focused, compliance-hardened, multi-cloud Senior Cloud Architect, Government Missions to strengthen our cloud infrastructure and security practice.

Operating at classified and unclassified DoD and IC networks, you will be responsible for architecting and operating secure multi-tenant cloud foundations across AWS, Azure, and GCP; designing government enclave architectures (TSE-SE, LZA, MLZ, Assured Workloads); and leading compliance and Authority to Operate efforts end to end.

You will design and troubleshoot cloud and hybrid networking topologies (Transit Gateway, Virtual WAN, Network Connectivity Center, Direct Connect, ExpressRoute, Cloud Interconnect); architect and operate production Kubernetes platforms (EKS, AKS, GKE, air-gapped distributions) with multi-tenancy and DISA STIG/CIS hardening; establish Infrastructure as Code standards using Terraform, Pulumi, and Crossplane, ensuring that landing zones, network segmentation, centralized logging, and guardrails enforce zero-trust principles aligned to SCCA and CAP requirements, and systems achieve continuous Authority to Operate across NIST SP 800-53 controls.

We need someone capable of designing networks to DISA Secure Cloud Computing Architecture and Cloud Access Point specifications; leading deployments into NIPRNet, SIPRNet, JWICS, and classified fabrics; operating as mission owner in AWS GovCloud, Azure Government, and classified regions; and owning compliance end to end-control inheritance, System Security Plans, POA&Ms, STIG/SCAP scanning, continuous monitoring, and continuous ATO workflows.

As a key partner to customers, program leadership, and authorized assessors, you will establish technical authority and architectural direction across programs, serving as senior technical mentor to engineering teams.

Note: Candidates must reside in one of our approved hiring hubs:

• DC/Maryland/Virginia
• Denver/Colorado Springs, CO This is a full-time position.

What You'll Do

• Architect and own secure multi-tenant landing zones across AWS, Azure, and GCP with account/subscription/project vending, network segmentation, centralized logging, and policy guardrails.
• Design and deploy government enclave architectures including AWS Trusted Secure Enclaves-Sensitive Edition, Landing Zone Accelerator, Azure Mission Landing Zone, and Google Cloud Assured Workloads foundations.
• Operate as mission owner within AWS GovCloud, Azure Government, and classified regions (Secret/Top Secret) connected to NIPRNet, SIPRNet, JWICS, and classified fabrics.
• Design and troubleshoot hybrid cloud networking end to end: hub-and-spoke and transit topologies, private connectivity (Direct Connect, ExpressRoute, Cloud Interconnect), BGP routing, DNS, private endpoints, load balancing, and firewall/inspection stacks.
• Establish Infrastructure as Code standards using Terraform, Pulumi, and Crossplane with module libraries, state management, and drift detection.
• Architect and operate production Kubernetes platforms (EKS, AKS, GKE, air-gapped distributions) with multi-tenancy, lifecycle management, CNI, network policy, Istio service mesh, secrets management, Helm/Kustomize, Flux/Argo CD, and DISA STIG/CIS hardening.
• Lead Authority to Operate efforts end to end: control inheritance matrices, NIST SP 800-53 implementation, System Security Plans, POA&Ms, STIG/SCAP scanning, continuous monitoring, and continuous ATO.
• Serve as senior technical authority for customers and assessors; mentor engineers and set architectural direction across programs.

What You Bring

• 8-10 years in infrastructure or cloud engineering, with 5+ years in a senior or lead architect role.
• Active TS/SCI clearance and U.S. citizenship.
• Deep, hands-on expertise in at least two of AWS, Azure, and GCP, including their government offerings.
• Extensive experience deploying into classified networks (SIPRNet and/or JWICS), including air-gapped or disconnected environments.
• Production IaC experience with Terraform/OpenTofu and at least one of Pulumi or Crossplane.
• Hands-on compliance experience with FedRAMP High, the DoD Cloud Computing Security Requirements Guide (CC SRG), NIST SP 800-53, DISA STIGs, and the RMF/ATO process, including authoring or owning ATO artifacts (SSPs, POA&Ms, control implementation statements).
• In-depth Kubernetes expertise running production, multi-tenant clusters, including networking, security hardening, upgrades, and troubleshooting; in-depth hands-on experience with Helm (chart authoring and lifecycle), Kustomize (bases and overlays), and GitOps tooling such as Flux and Argo CD, plus CI/CD pipelines.
• Proven experience designing multi-tenant landing zones and operating as a mission owner in government clouds (AWS GovCloud, Azure Government) at DoD Impact Level 4/5 or higher.
• U.S. citizenship is required for this role.

Preferred

• Experience with cross-domain solutions (CDS) and moving software across classification boundaries.
• Experience with ICAM (CAC/PIV, SAML/OIDC federation).
• Professional certifications such as AWS Certified Solutions Architect - Professional, Microsoft Azure Solutions Architect Expert, Google Professional Cloud Architect, or CKA/CKS.
• DoD 8140 (formerly 8570) compliant certification at time of hire, such as CISSP or CCSP. The base salary for this position will fall between $200,000 and $215,000. Your ultimate compensation will be determined by professional background, technical proficiency, seniority, and regional cost factors. Furthermore, this opportunity includes potential eligibility for equity awards and discretionary bonuses, rounding out a comprehensive total rewards offering.

Success at 2F Looks Like:

• A proactive and solutions oriented mindset
• Viewing obstacles as opportunities for growth
• Having a bias toward action and tangible, measurable results
• Being team-oriented with a focus on personal responsibility and autonomy

Perks & Benefits:

This role is a full time position. As a public benefit corporation, we’re a team of purpose-driven trailblazers transforming the future of U.S. national security. We hire the best to do their best and, as such, we are committed to providing the perks and benefits you need to be successful-both in- and outside the workplace.

Perks of Joining Our Team:

• Competitive salary
• 100% employer-paid medical, dental, and vision coverage for you and your dependents
• 401(k) with a 3% company contribution
• Comprehensive wellness benefits, including a One Medical membership, mental health resources, family planning support, and more
• Equity incentive plan
• New hire technology and home office stipend
• Annual professional development stipend
• Flexible paid time off, plus all federal holidays
• Generous parental leave
• Flexible remote work opportunities
• Employee referral bonus program Visit our careers page to learn more.

Who We Are:

Second Front Systems (2F) is a public-benefit software company powering software for the free world. We eliminate the friction that slows innovation, enabling faster, more secure development and deployment of software across government and regulated networks. Built by national security veterans and backed by top-tier venture capital, our platform is trusted by the world’s leading organizations to cut deployment timelines from years to weeks. We move fast, solve hard problems, and deliver trusted capabilities where they’re needed most. Our work strengthens global security and gives the United States and its allies a lasting competitive advantage. Learn more at secondfront.com.

Citizenship requirement:

This position requires U.S. citizenship due to the nature of our work supporting U.S. government and defense customers.

One last thing:

We are an equal opportunity employer and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity or expression, pregnancy, age, national origin, disability status, genetic information, protected veteran status, or any other characteristic protected by law.

Are you ready to join our team:

To apply, click the “Apply for This Job” button at the top or bottom of this page and complete the application form. This position will remain open until filled, and applications will be reviewed on a rolling basis.

State notices:

Colorado:

In accordance with Colorado law, applicants may redact their date of birth, dates of attendance, and dates of graduation from any uploaded documents.

Maryland:

Under Maryland law, an employer may not require or demand, as a condition of employment, prospective employment, or continued employment, that an individual submit to or take a polygraph examination or similar test. An employer who violates this law is guilty of a misdemeanor and subject to a fine not exceeding $100.