Google Cloud Architect

SAIC; Washington (District of Columbia); On-site; USD 180,000 - 260,000; Full time

Job summary

SAIC is seeking a Senior GCP Architect to serve as the principal technical authority for the DOT enterprise cloud ecosystem, providing governance and architectural oversight for independent GCP teams within OST Shared Services.

The role focuses on zero-trust landing zones, enterprise ATO framework, and compliance across FedRAMP Moderate/High Assured Workloads enclaves, with emphasis on Terraform-based IaC and secure, scalable cloud patterns.

Qualifications

• 8+ years of progressive cloud engineering, IT infrastructure, and DevSecOps experience with at least 4+ years as Lead GCP Engineer or Cloud Architect in complex multi-tenant environments.
• Proven track record architecting enterprise GCP environments including Shared VPCs, Interconnect/HA VPN routing, and GKE governance.
• Practical understanding of FedRAMP Moderate/High, Assured Workloads, and continuous monitoring practices.

Responsibilities

• Govern enterprise GCP landing zones, enforce zero-trust patterns, and guide ATO framework across workloads.
• Architect and implement CI/CD pipelines using GitHub Actions and Jenkins with automated security checks.
• Lead API orchestration between user-facing apps and backend GCP platforms for self-service provisioning.
• Oversee AI ecosystem integration, model governance, and data security within Assured Workloads enclaves.

Skills

GCP Architecture

Lead Cloud Architect

DevSecOps

Security Compliance

Education

Bachelor's degree in CS

Tools

Terraform

Jenkins

GitHub Actions

VPC-SC

Job description

Position Overview

The Senior GCP Architect serves as the principal technical authority and platform strategist across the DOT enterprise cloud ecosystem. Operating within OST Shared Services, this role provides technical governance and architectural oversight for independent GCP development teams. The candidate is responsible for reviewing and approving architectural changes, enforcing zero-trust landing zone patterns, and engineering an enterprise Continuous Authorization to Operate (ATO) framework across Commercial, FedRAMP Moderate, and FedRAMP High Assured Workloads enclaves.

Key Responsibilities

GCP Enterprise Architecture & IaC Blueprinting

Design, maintain, and govern multi-folder GCP landing zones using Assured Workloads for FedRAMP Moderate and FedRAMP High compliance boundaries. Enforce organizational policies, data residency constraints, and CMEK governance via Cloud KMS.

Maintain clear technical boundaries separating OST Shared Services management responsibilities (Palo Alto MIG firewalls, HA VPN tunnels, central Cloud DNS, Infoblox, Network Connectivity Center hubs) from tenant Mode application workloads.

Work with development teams to author and manage enterprise-grade, modular Terraform code. Standardize JSON/YAML parameter structures to automate landing zone vending, subnet allocation, and zero-trust IAM roles.

Implement VPC Service Controls perimeters, Workload Identity Federation, Service Account governance, and fine-grained Role-Based Access Control (RBAC) across shared and tenant projects.

DevSecOps Architecture, CI/CD, & Continuous Compliance

Architect enterprise CI/CD deployment pipelines using GitHub Actions (utilizing self-hosted runners in isolated management VPCs) and Jenkins. Integrate automated SAST, DAST, and dependency scanning into pull request workflows.

Establish continuous authorization baselines aligning with NIST SP 800-53, FedRAMP High/Moderate, and federal directives. Automate real-time compliance validation and drift detection via IaC execution pipelines.

Design centralized logging and monitoring pipelines, configuring Cloud Logging sinks to route security audit and network telemetry to Pub/Sub, Dataflow, and downstream log storage (Elastic Cloud, Splunk).

Unified Cloud Portal Integration & API Orchestration

Lead the architectural integration between user-facing web applications and backend GCP API execution platforms for self-service infrastructure provisioning.

Define end-to-end orchestration standards for automated user requests, including project vending, dynamic terraform plan and terraform apply executions, state tracking, and error handling.

Implement cross-boundary authentication protocols mapping user credentials to GCP resources using SAML 2.0, Entra ID, Keycloak, and OIDC federated single sign-on.

4. Enterprise AI Ecosystem & Model Governance

Formulate architectural standards for integrating enterprise AI services, including Gemini foundation models, Vertex AI endpoints, and custom generative AI pipelines within Assured Workloads enclaves.

Establish secure private access patterns using Private Service Connect (PSC), VPC Service Controls, and Customer-Managed Encryption Keys (CMEK) to protect training datasets and model interaction history.

Oversee ethical AI compliance, prompt security boundaries, data leakage prevention (DLP), and continuous monitoring of AI payload invocations.

Required Qualifications & Experience

Experience Level: 8+ years of progressive experience in cloud engineering, IT infrastructure, and DevSecOps, including 4+ years acting as a Lead GCP Engineer or Cloud Architect within complex multi-tenant enterprise environments.

GCP Architecture Proficiency: Proven track record of architecting enterprise GCP environments, including Shared VPC topologies, Interconnect/HA VPN routing, Palo Alto NGFW integration, VPC-SC perimeters, and GKE cluster governance.

Compliance & Security Controls: Practical understanding of FedRAMP Moderate/High compliance frameworks, Assured Workloads boundaries, DoD Iron Bank container assets, and continuous monitoring practices.

Preferred Qualifications & Clearances

Multi-Cloud Awareness: Operational architectural understanding of AWS (GovCloud/Commercial) or Microsoft Azure to manage cross-cloud identity federation and hybrid network connectivity.

Terraform Engineering: Expertise in modular Terraform design, remote state administration, plan/apply automation pipelines, dynamic data parsing, and drift resolution is desirable but not required.

DevSecOps & Pipeline Automation: Advanced knowledge of GitHub Actions (including runner pool architecture), Jenkins, and Git branching strategies for immutable cloud deployments.

Security Clearance: Must possess or be eligible to obtain a Public Trust.

Preferred Certifications

Google Cloud Certified Professional Cloud Architect (Highly Preferred)

Google Cloud Certified Professional Cloud Security Engineer

Note: Candidate must be a U.S. citizen and the ability t