Data Engineer, AWS Glue and Data Lake (GovCloud)

United States Digital Space LLC; United States; Remote; USD 96,000 - 138,000; Full time

Job summary

United States Digital Space LLC seeks a Data Engineer to design and operate a multi-account data lake inside AWS GovCloud (US) at Impact Level 5. You will land raw data, shape it for engineers and analysts, and keep pipelines running securely within a controlled unclassified boundary.

Ingestion is only half the job; the other half is making the environment repeatable, so infrastructure ships as code, baselines are hardened by pipelines, and compliance evidence is produced by delivery.

Qualifications

• Active Secret clearance and CAC eligibility.
• U.S. citizenship required.
• Experience in AWS GovCloud (US) at IL5.
• ETL and data lake design on AWS including S3 storage, partitioning, and cataloging.
• Infrastructure as code with Terraform.

Responsibilities

• Architect multi-account AWS data lake in GovCloud (US) IL5.
• Configure access controls by classification and encrypt at rest.
• Develop and tune AWS Glue ETL jobs and crawlers end-to-end.
• Configure data pipelines for FEMAP/Simcenter Nastran datasets.
• Ship infrastructure as code with Terraform modules.

Skills

Python or PySpark

AWS GovCloud (US) IL5

Multi-account AWS architectures

ETL with AWS Glue

Terraform IaC

Tools

AWS Glue

Terraform

S3

Job description

Data Engineer, AWS Data Lake (GovCloud, IL5)

DATA \& ANALYTICS | ACTIVE SECRET CLEARANCE REQUIRED | ACTIVE CAC REQUIRED | U.S. CITIZENSHIP REQUIRED | FULLY REMOTE (CONUS)

ABOUT THE ROLE

the company is sourcing a cleared Data Engineer to design and operate a multi-account data lake inside AWS GovCloud (US), at Impact Level 5. The work sits where storage, movement, and governance meet. You will land raw data, shape it into something engineers and analysts can actually query, and keep the pipelines that do it running clean under a controlled unclassified boundary.

Ingestion is only half the job. The other half is making the environment repeatable, so that infrastructure ships as code, account baselines are hardened by pipeline rather than by hand, and compliance evidence is produced as a byproduct of delivery instead of reconstructed after the fact.

This seat carries an engineering simulation workload, which changes the shape of the pipeline. Finite element analysis datasets arrive large, arrive often, and punish a lake that was tuned for tidy tabular records. If you are comfortable in a Terraform module, comfortable debugging a Glue job that died at three in the morning, and equally comfortable explaining a partitioning decision to a data consumer who does not care how it was built, this posting was written for you.

WHAT YOU WILL DO

Architect the lake. Design and implement multi-account AWS data lake architectures within GovCloud (US), including S3 storage layers, partitioning strategy, and catalog structure that hold query cost and query time steady as volume grows.

Control access by classification. Configure data access controls that enforce classification level and need to know, and apply data classification tagging and encryption at rest to IL5 requirements.

Own the ETL. Develop, schedule, and tune AWS Glue jobs and crawlers for both structured and unstructured ingestion, then carry the surrounding workflow end to end, from source through curated output.

Feed the simulation workload. Configure data asset pipelines supporting finite element analysis inputs and outputs, and optimize high-throughput processing for large simulation file I/O such as FEMAP and Simcenter Nastran datasets.

Ship infrastructure as code. Author and maintain Terraform modules for baseline account infrastructure and networking, and configure account baseline hardening to IL5 security requirements through code rather than console.

Automate the deployment path. Build deployment pipelines for infrastructure and application code, including Terraform state management in restricted or air-gapped environments where the usual backend patterns do not apply.

Guard data quality. Implement data quality monitoring against operational standards, build validation and alerting into the pipelines, then act on what they surface.

Document what you build. Maintain data flow diagrams, runbooks, and schema documentation that survive your absence.

Partner across the mission. Work with engineering, analytic, and security stakeholders to translate data requirements into working pipelines, and coordinate directly with government technical stakeholders.

REQUIRED QUALIFICATIONS

Active Secret clearance, and personnel eligibility appropriate to IL5 Controlled Unclassified Information work.

Active Common Access Card, required for environment access and for coordination with government stakeholders. Candidates without a current CAC should expect the sponsorship timeline to be the critical path on this task.

U.S. citizenship.

Demonstrated experience operating within AWS GovCloud (US) at Impact Level 5.

Hands-on experience designing, building, or operating a data lake in AWS, including S3 storage design, partitioning, and cataloging.

Proficiency with multi-account AWS architecture patterns and baseline security controls.

Demonstrated ETL and data processing depth with AWS Glue, including job development, crawlers, and the AWS Glue Data Catalog.

Infrastructure as code experience, with Terraform strongly preferred, covering module authorship, provisioning, and state management.

Python or PySpark for data transformation work.

Comfort operating independently in a fully remote, distributed team.

PREFERRED QUALIFICATIONS

Prior work on a DoD data platform of comparable scope and classification.

High performance compute environment configuration supporting finite element analysis or other simulation workloads.

CI/CD pipeline integration for Terraform state management in air-gapped or otherwise restricted environments.

Secure remote access configuration in restricted environments.

Compliance as code experience: policy, control, and configuration enforcement expressed and validated through automation.

Additional AWS analytics services such as Athena, Lake Formation, Redshift, EMR, Step Functions, Kinesis, or Lambda.

AWS certification such as Data Engineer Associate, Solutions Architect Associate, or Data Analytics Specialty.

CompTIA Security+ (Sec+ CE) or an equivalent DoD 8140 baseline certification.

COMPLIANCE AND REGULATORY KNOWLEDGE

This engagement sits inside an existing IL5 authorization boundary, so the selected engineer needs working command of the accreditation environment, not just the technology stack.

Risk Management Framework and the Authority to Operate process.

NIST SP 800-171 controls, and FIPS 140-2 validated cryptographic module requirements.

NISPOM (32 CFR Part 117), FAR Part 4.4, and DFARS 204.4.

DD Form 254 security classification requirements.

Zone B documentation supporting incremental authorization within an existing IL5 boundary.

WORKING ENVIRONMENT AND SCHEDULE

The role is fully remote within the continental United States. The initial task is scoped at approximately 200 labor hours, with follow-on award anticipated and a likely extension into a subsequent year. Because the work supports a cleared program, the selected engineer must hold and maintain an active Secret clearance and an active CAC for the duration of the assignment. Clearance eligibility and CAC status are verified before any offer is extended.

Pay: $70.00 - $100.00 per hour

Application Question(s):

• Do you currently hold a Common Access Card (CAC)?
• Have you worked hands-on in AWS GovCloud (US) at Impact Level 5?
• Have you personally developed and maintained AWS Glue ETL jobs or crawlers?
• How many years of hands-on experience do you have building or operating a data lake on AWS?
• Have you configured Terraform state management or CI/CD pipelines in an air-gapped or restricted environment?
• Which AWS analytics services have you used in production?

Security clearance:

• Secret (Preferred)

Work Location: Remote