Senior Cloud Architect, Government Missions

Second Front; Washington (District of Columbia); Hybrid; USD 200,000 - 215,000; Full time

Benefits offered by this job

Competitive salary

100% employer-paid medical, dental, &视

401(k) with a 3% company contribution

Wellness benefits, One Medical, etc.

Equity incentive plan

New hire technology & home office stip

Annual professional development stip

Flexible PTO and federal holidays

Parental leave

Flexible remote work opportunities

Employee referral bonus program

Job summary

Second Front Systems is seeking an operationally focused Senior Cloud Architect for Government Missions to strengthen our multi-cloud infrastructure and security practice. Your expertise will span AWS, Azure, GCP, and government enclaves with strict compliance and ATO ownership.

You will lead secure landing zones, DISA/STIG hardening, and end-to-end governance across DoD networks, guiding architects and engineers in a mission-driven environment that values security, reliability, and timely

Qualifications

• 8‑10 years in infrastructure or cloud engineering, with 5+ years in a senior or lead architect role.
• Active TS/SCI clearance and U.S. citizenship.
• Hands‑on expertise in at least two of AWS, Azure, and GCP, including their government offerings.
• Extensive experience deploying into classified networks (SIPRNet and/or JWICS).
• Production IaC experience with Terraform/OpenTofu and at least one of Pulumi or Crossplane.
• Hands‑on compliance experience with FedRAMP High, DoD SRG, NIST SP 800‑53, DISA STIGs, RMF/ATO.
• In‑depth Kubernetes expertise in production multi‑tenant clusters with security hardening and GitOps tooling.
• Proven experience designing multi‑tenant landing zones and operating as a mission owner in government clouds.

Responsibilities

• Architect and own secure multi-tenant landing zones across AWS, Azure, and GCP with account/subscription/project vending and policy guardrails.
• Design and deploy government enclave architectures and landing zone accelerators.
• Operate as mission owner within GovCloud regions connected to DoD networks.
• Design and troubleshoot hybrid cloud networking including Direct Connect, ExpressRoute, and Cloud Interconnect.
• Establish IaC standards with Terraform, Pulumi, Crossplane, and drift detection.
• Architect and operate production Kubernetes platforms with multi-tenancy and DISA/STIG hardening.
• Lead Authority to Operate efforts end to end including NIST SP 800-53 and continuous ATO.
• Mentor engineers and set architectural direction across programs.

Skills

Cloud architecture

Security/compliance

Kubernetes

Infrastructure as Code

Government cloud

Network design

Tools

Terraform

Pulumi

Crossplane

EKS

AKS

GKE

Job description

Second Front Systems is looking for an operationally focused, compliance-hardened, multi-cloud Senior Cloud Architect, Government Missions to strengthen our cloud infrastructure and security practice.

Operating at classified and unclassified DoD and IC networks, you will be responsible for architecting and operating secure multi-tenant cloud foundations across AWS, Azure, and GCP; designing government enclave architectures (TSE-SE, LZA, MLZ, Assured Workloads); and leading compliance and Authority to Operate efforts end to end.

You will design and troubleshoot cloud and hybrid networking topologies (Transit Gateway, Virtual WAN, Network Connectivity Center, Direct Connect, ExpressRoute, Cloud Interconnect); architect and operate production Kubernetes platforms (EKS, AKS, GKE, air-gapped distributions) with multi-tenancy and DISA STIG/CIS hardening; establish Infrastructure as Code standards using Terraform, Pulumi, and Crossplane, ensuring that landing zones, network segmentation, centralized logging, and guardrails enforce zero-trust principles aligned to SCCA and CAP requirements, and systems achieve continuous Authority to Operate across NIST SP 800-53 controls.

We need someone capable of designing networks to DISA Secure Cloud Computing Architecture and Cloud Access Point specifications; leading deployments into NIPRNet, SIPRNet, JWICS, and classified fabrics; operating as mission owner in AWS GovCloud, Azure Government, and classified regions; and owning compliance end to end—control inheritance, System Security Plans, POA&Ms, STIG/SCAP scanning, continuous monitoring, and continuous ATO workflows.

As a key partner to customers, program leadership, and authorized assessors, you will establish technical authority and architectural direction across programs, serving as senior technical mentor to engineering teams.

Note:

• DC/Maryland/Virginia
• Denver/Colorado Springs, CO

This is a full-time position.

What You'll Do

• Architect and own secure multi-tenant landing zones across AWS, Azure, and GCP with account/subscription/project vending, network segmentation, centralized logging, and policy guardrails.
• Design and deploy government enclave architectures including AWS Trusted Secure Enclaves–Sensitive Edition, Landing Zone Accelerator, Azure Mission Landing Zone, and Google Cloud Assured Workloads foundations.
• Operate as mission owner within AWS GovCloud, Azure Government, and classified regions (Secret/Top Secret) connected to NIPRNet, SIPRNet, JWICS, and classified fabrics.
• Design and troubleshoot hybrid cloud networking end to end: hub-and-spoke and transit topologies, private connectivity (Direct Connect, ExpressRoute, Cloud Interconnect), BGP routing, DNS, private endpoints, load balancing, and firewall/inspection stacks.
• Establish Infrastructure as Code standards using Terraform, Pulumi, and Crossplane with module libraries, state management, and drift detection.
• Architect and operate production Kubernetes platforms (EKS, AKS, GKE, air-gapped distributions) with multi-tenancy, lifecycle management, CNI, network policy, Istio service mesh, secrets management, Helm/Kustomize, Flux/Argo CD, and DISA STIG/CIS hardening.
• Lead Authority to Operate efforts end to end: control inheritance matrices, NIST SP 800-53 implementation, System Security Plans, POA&Ms, STIG/SCAP scanning, continuous monitoring, and continuous ATO.
• Serve as senior technical authority for customers and assessors; mentor engineers and set architectural direction across programs.

What You Bring

• 8-10 years in infrastructure or cloud engineering, with 5+ years in a senior or lead architect role.
• Active TS/SCI clearance and U.S. citizenship.
• Deep, hands‑on expertise in at least two of AWS, Azure, and GCP, including their government offerings.
• Extensive experience deploying into classified networks (SIPRNet and/or JWICS), including air‑gapped or disconnected environments.
• Production IaC experience with Terraform/OpenTofu and at least one of Pulumi or Crossplane.
• Hands‑on compliance experience with FedRAMP High, the DoD Cloud Computing Security Requirements Guide (CC SRG), NIST SP 800-53, DISA STIGs, and the RMF/ATO process, including authoring or owning ATO artifacts (SSPs, POA&Ms, control implementation statements).
• In‑depth Kubernetes expertise running production, multi‑tenant clusters, including networking, security hardening, upgrades, and troubleshooting; in‑depth hands‑on experience with Helm (chart authoring and lifecycle), Kustomize (bases and overlays), and GitOps tooling such as Flux and Argo CD, plus CI/CD pipelines.
• Proven experience designing multi‑tenant landing zones and operating as a mission owner in government clouds (AWS GovCloud, Azure Government) at DoD Impact Level 4/5 or higher.
• U.S. citizenship is required for this role.

Preferred

• Experience with cross‑domain solutions (CDS) and moving software across classification boundaries.
• Experience with ICAM (CAC/PIV, SAML/OIDC federation).
• Professional certifications such as AWS Certified Solutions Architect – Professional, Microsoft Azure Solutions Architect Expert, Google Professional Cloud Architect, or CKA/CKS.
• DoD 8140 (formerly 8570) compliant certification at time of hire, such as CISSP or CCSP.

Success at 2F Looks Like

• A proactive and solutions oriented mindset
• Viewing obstacles as opportunities for growth
• Having a bias toward action and tangible, measurable results
• Being team‑oriented with a focus on personal responsibility and autonomy

Perks & Benefits

This role is a full time position. As a public benefit corporation, we’re a team of purpose‑driven trailblazers transforming the future of U.S. national security. We hire the best to do their best and, as such, we are committed to providing the perks and benefits you need to be successful—both in‑and outside the workplace.

Perks of Joining Our Team

• Competitive salary
• 100% employer‑paid medical, dental, and vision coverage for you and your dependents
• 401(k) with a 3% company contribution
• Comprehensive wellness benefits, including a One Medical membership, mental health resources, family planning support, and more
• Equity incentive plan
• New hire technology and home office stipend
• Annual professional development stipend
• Flexible paid time off, plus all federal holidays
• Generous parental leave
• Flexible remote work opportunities
• Employee referral bonus program

Visit our careers page to learn more.

Who We Are

Second Front Systems (2F) is a public‑benefit software company powering software for the free world. We eliminate the friction that slows innovation, enabling faster, more secure development and deployment of software across government and regulated networks. Built by national security veterans and backed by top‑tier venture capital, our platform is trusted by the world’s leading organizations to cut deployment timelines from years to weeks. We move fast, solve hard problems, and deliver trusted capabilities where they’re needed most. Our work strengthens global security and gives the United States and its allies a lasting competitive advantage. Learn more at secondfront.com.

Citizenship requirement

This position requires U.S. citizenship due to the nature of our work supporting U.S. government and defense customers.

One last thing

We are an equal opportunity employer and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity or expression, pregnancy, age, national origin, disability status, genetic information, protected veteran status, or any other characteristic protected by law.

State notices:

Colorado:

In accordance with Colorado law, applicants may redact their date of birth, dates of attendance, and dates of graduation from any uploaded documents.

Maryland:

Under Maryland law, an employer may not require or demand, as a condition of employment, prospective employment, or continued employment, that an individual submit to or take a polygraph examination or similar test. An employer who violates this law is guilty of a misdemeanor and subject to a fine not exceeding $100.

Compensation Range: $200K - $215K