Cloud Specialist

Security clearance: Dept of Homeland Security

About us

One team. Global challenges. Infinite opportunities. At Viasat, we're on a mission to deliver connections with the capacity to change the world. For more than 35 years, Viasat has helped shape how consumers, businesses, governments and militaries around the globe communicate. We're looking for people who think big, act fearlessly, and create an inclusive environment that drives positive impact to join our team.

What you'll do

The Integrated Solutions Business Unit is hiring a TMF Cloud Engineer to operate the cloud infrastructure layer of our Tactical Mission Fabric (TMF) program.

TMF is a multi-tenant network-as-a-service platform that delivers secure, globally interconnected managed networking to DoD mission owners. This is a hands-on cloud engineering role, not an architecture-only seat and not a generalist IT role. Working alongside the Lead Systems Engineer, you will build, deploy, and operate the AWS infrastructure that TMF tenants run on: landing zones, networking, identity, security telemetry, and tenant compute, all inside a continuous authorization boundary where every configuration maps to a FedRAMP and NIST control. We're looking for a cloud engineer who has operated production AWS in a regulated environment: someone fluent in Terraform-driven multi-account design who understands that in a FedRAMP boundary, the audit trail is as important as the uptime.

The day-to-day

Cloud Infrastructure Engineering (Hands-On)

• Multi-Account AWS Operations: Build and operate multi-account, multi-partition AWS architectures spanning GovCloud (IL4/IL5), Secret Region (IL6), and commercial partitions, with tenant isolation enforced by architecture, not by policy alone.
• Landing Zones: Maintain and extend AWS landing zones for tenant and shared-service segmentation, including account vending, guardrails, service control policies, and CloudTrail/Config baselines, under the direction of the Lead Systems Engineer.
• Cloud Networking: Engineer cloud networking: Transit Gateway, Direct Connect Gateway, Global Accelerator, VPC spoke topologies, PrivateLink, and AWS Network Firewall, integrated with the MPLS backbone and SD-WAN overlay at NNI boundary points.
• IaC-First Delivery: Author and extend Terraform modules for cloud infrastructure. Every change flows through Terraform Enterprise and GitLab CI/CD with policy gates; no direct-to-production applies.
• Tenant Compute: Deploy and operate tenant compute and workspace services, including AWS WorkSpaces VDI in STIG-hardened configurations and tenant account guardrails.

Security, Identity, and Compliance in the Cloud

• Identity and Access: Operate the identity stack: AWS IAM Identity Center, AD Connector, self-managed Active Directory, and PrivacyIDEA RADIUS MFA.
• Security Telemetry and SIEM: Engineer security telemetry into the centralized OpenSearch SIEM, integrating Security Hub, GuardDuty, and Nessus/Tenable findings to sustain continuous monitoring under the platform's C-ATO posture.
• Hardening and Evidence: Apply and maintain KMS CMK encryption baselines, AWS Backup vaults, and STIG/CIS hardening across cloud workloads; produce configuration evidence that maps to NIST 800-53 Rev 5 and 800-171 controls.
• Accreditation Support: Support FedRAMP Moderate and CMMC Level 2 assessments with cloud-layer artifacts, POA&M inputs, and continuous monitoring data.

Team and Platform Contribution

• Integration Partnership: Work alongside the Lead Systems Engineer and network engineering team to keep cloud, network, and security layers integrated at every boundary.
• Tenant Onboarding: Execute tenant onboarding runbooks for the cloud layer: account provisioning, boundary controls, telemetry enrollment, and operational handoff to GCC/CSOC.
• Runbooks and Improvement: Contribute to the structured runbook catalog for security, platform, and recovery operations, and feed operational lessons back into Terraform modules and landing zone baselines.

What you'll need

Required (Day-One Critical)

• Hands-on production AWS experience: VPC, IAM, EC2, S3, CloudTrail, Config, and multi-account structures
• Terraform module authoring and GitOps discipline in a production environment
• AWS networking: Transit Gateway, Direct Connect, VPC topologies, route tables, security groups, and hybrid connectivity to carrier or MPLS backbones
• Experience operating in a regulated or compliance-bound cloud environment (FedRAMP, DoD IL4/IL5, or equivalent), where configurations map to NIST 800-53 / 800-171 controls
• Familiarity with cloud security tooling: SIEM integration, vulnerability management, and continuous monitoring
• Scripting proficiency (Python, Bash, or similar) for automation beyond Terraform
• 5+ years in cloud engineering, infrastructure engineering, or DevSecOps roles, with at least 2 years hands-on in AWS
• Bachelor's degree in a technical field, or equivalent operational experience
• US Citizenship required
• Active DoD Secret clearance required
• Ability to travel up to 15%

Strongly Preferred (90-Day Ramp)

• AWS GovCloud-specific experience, including partition constraints and IL4/IL5 boundary operations
• AWS multi-account governance at scale: Organizations, SCPs, Control Tower or custom landing zone frameworks, account vending automation
• Terraform Enterprise or Terraform Cloud workflow experience with policy-as-code gates (Sentinel, OPA, or similar)
• GitLab CI/CD pipeline development for infrastructure delivery
• Identity stack experience: IAM Identity Center, Active Directory integration, RADIUS/MFA solutions (PrivacyIDEA or equivalent)
• OpenSearch/Elasticsearch SIEM administration, plus Security Hub, GuardDuty, and Tenable/Nessus integration
• AWS WorkSpaces or VDI deployment in hardened configurations
• KMS, AWS Backup, and encryption baseline engineering

What will help you on the job

• AWS Secret Region (IL6) or Top Secret Region experience, or other classified cloud operations
• AWS certifications: Solutions Architect Professional, Security Specialty, Advanced Networking Specialty, or SysOps
• Experience integrating cloud infrastructure with SD-WAN overlays and NGFW boundary security (FortiGate, Palo Alto)
• Cloud broker or multi-cloud service delivery experience
• Container and edge compute platforms (EKS, AWS Outposts, or forward compute architectures)
• DoD 8140/8570 baseline certification (Security+, CASP+, CISSP, or equivalent)
• TS/SCI clearance currently held
• Experience supporting FedRAMP or CMMC assessments with technical artifacts

Salary range

$120,500.00 - $190,000.00 / annually.For specific work locations within San Jose, the San Francisco Bay area and New York City metropolitan area, the base pay range for this role is $149,500.00- $224,500.00/ annually

At Viasat, we consider many factors when it comes to compensation, including the scope of the position as well as your background and experience. Base pay may vary depending on job-related knowledge, skills, and experience. Additional cash or stock incentives may be provided as part of the compensation package, in addition to a range of medical, financial, and/or other benefits, dependent on the position offered. Learn more about Viasat's comprehensive benefit offerings that are focused on your holistic health and wellness at https://careers.viasat.com/benefits.
EEO Statement

Viasat is proud to be an equal opportunity employer, seeking to create a welcoming and diverse environment. All qualified applicants will receive consideration for employment without regard to race, color, religion, gender, gender identity or expression, sexual orientation, national origin, ancestry, physical or mental disability, medical condition, marital status, genetics, age, or veteran status or any other applicable legally protected status or characteristic. If you would like to request an accommodation on the basis of disability for completing this on-line application, please click here.