Sr. Cloud Engineer

HyerTek; Brookeville (MD); Hybrid; USD 140,000 - 160,000; Full time

Benefits offered by this job

Medical, dental, and vision insurance

401(k) with employer contribution

PTO and company holidays

Flexible work arrangements

Certification support

Employee assistance program

Job summary

HyerTek in the Washington DC metro region is seeking a Sr. Cloud Engineer to design, build, and own the secure cloud foundation for federal solutions in Azure Gov across IL5‑IL7.

You will architect landing zones, harden them to DISA STIG and DoD Cloud SRG, and automate them as code, delivering accredited, performant cloud services for government customers. This is a hands‑on role focused on infrastructure and security: landing‑zone design, network isolation, IAM with Entra ID government, and

Qualifications

• 7+ years hands-on cloud engineering across architecture, security hardening, and automation.
• 5+ years Azure Government delivery, IL4/IL5, DoD SRG controls.
• Infrastructure as Code with Bicep/ARM or Terraform for Azure Gov.
• DISA STIG, NIST SP 800-53, RMF/ATO artifact production.
• Azure networking and identity with Entra ID Government, CAC/PIV.
• Backend language: C#/.NET or Python; zero-trust and data protection experience.

Responsibilities

• Design and own Azure Government landing zones across tiers with secure baselines.
• Re-platform apps into scalable Azure designs with managed databases and private networking.
• Build CI/CD pipelines with embedded security gates and policy-as-code features.
• Implement STIG/CIS baselines and automated evidence for configuration compliance.
• Produce DoD RMF/ATO artifacts and support audit activities.
• Design data protection controls, encryption, and PII masking for sensitive workloads.
• Implement network isolation, CAC/PIV authentication, and Entra ID Government integration.
• Collaborate with developers, architects, and security engineers embedded in delivery teams.

Skills

Azure Government architecture

Security engineering

Infrastructure as Code

RMF/ATO artifact production

CI/CD with security gates

Zero-trust concepts

Tools

Terraform

Bicep/ARM

Terraform for Azure Gov

Azure DevOps

Key Vault

Azure Monitor / Sentinel

Job description

Description

HyerTek is a federal technology consulting firm delivering secure enterprise applications, data analytics, and modernization services to federal government agencies. HyerTek is hiring a Sr. Cloud Engineer to design, build, and own the secure cloud foundation that powers our federal solutions in Azure Government across DoD Impact Levels IL5 through IL7. You will architect landing zones, harden them to DISA STIG and DoD Cloud SRG standards, automate them as code, and operate them under the Risk Management Framework (RMF) — partnering with developers, architects, and security engineers to deliver accredited, performant, well-architected cloud services for government customers.

Description

HyerTek is a federal technology consulting firm delivering secure enterprise applications, data analytics, and modernization services to federal government agencies. HyerTek is hiring a Sr. Cloud Engineer to design, build, and own the secure cloud foundation that powers our federal solutions in Azure Government across DoD Impact Levels IL5 through IL7. You will architect landing zones, harden them to DISA STIG and DoD Cloud SRG standards, automate them as code, and operate them under the Risk Management Framework (RMF) — partnering with developers, architects, and security engineers to deliver accredited, performant, well-architected cloud services for government customers. This is a hands‑on, builder role. On the infrastructure side, you will own landing‑zone design, network isolation, identity, and Infrastructure as Code. On the security side, you will engineer the STIG‑hardened baselines, zero‑trust controls, and audit and encryption guarantees that mission workloads depend on to earn and keep an Authority to Operate. You will work directly with developers, architects, and security engineers, embedded with delivery teams rather than sitting in a separate platform organization. Your work will go to federal customers handling sensitive and classified data, and the correctness and durability of the environments you build will directly shape their trust in HyerTek.

Location

Candidate must be located in the Washington, DC, metro region. This is a hybrid position with a requirement to be on‑site to perform certain tasks in accredited/SCIF facilities.

Responsibilities

• Design and own Azure Government landing zones across development, test, and production tiers, treating the environment.
• Re‑platform existing applications into scalable, resilient Azure designs — managed database, secrets in Key Vault, private networking — without loss of role‑scoped behavior or audit fidelity.
• Build and maintain CI/CD pipelines with embedded security gates (SAST/DAST, dependency and container scanning, policy‑as‑code via Azure Policy) that operate in both connected and disconnected modes.
• Implement DISA STIG and CIS‑hardened baselines, with automated application, drift detection, and continuous configuration‑compliance evidence rather than point‑in‑time scans.
• Engineer controls to satisfy the DoD Cloud SRG (IL5/IL6), NIST SP 800-53 control families, and the RMF lifecycle; produce artifacts supporting ATO/cATO packages (SSP inputs, control implementation statements, POA&Ms).
• Implement data‑protection controls for sensitive workloads — FIPS‑validated encryption at rest and in transit, PII masking with logged least‑privilege reveal, and enclave‑appropriate data boundaries by CUI/classification marking.
• Design network isolation (VNets, private endpoints, NSGs, Azure Firewall) appropriate to each Impact Level, including disconnected/air‑gapped topologies.
• Integrate CAC/PIV smartcard authentication and Entra ID (Government) with conditional access and PIM; map application roles to least‑privilege RBAC and zero‑trust segmentation.
• Partner with security engineers to apply hardening, de‑identification, and governed‑release controls; remediate findings and support audit and assessment activities.
• Design the reusable IaC baseline so environments promote cleanly.
• Instrument centralized logging and monitoring (Azure Monitor, Log Analytics, Microsoft Sentinel for Gov) with audit‑log retention meeting DoD requirements.
• Document architectures, control implementations, and as‑built records suitable for customer handoff.
• Support operational monitoring, incident root‑cause analysis, backup/DR, and continuous improvement across managed environments.
• Stay current on the Azure Government ecosystem and bring relevant capabilities into delivery patterns.

Requirements

• 7+ years of hands‑on cloud engineering experience across architecture, security hardening, and infrastructure automation.
• 5+ years hands‑on Azure Government (or demonstrable IL4/IL5 delivery), including workloads meeting DoD Cloud SRG IL5 controls.
• Expert in Infrastructure as Code (Bicep/ARM or Terraform for Azure Gov) and CI/CD with embedded security scanning.
• Demonstrated DISA STIG hardening, NIST SP 800-53, and RMF/ATO artifact production — not just deploying resources, but making them accreditable.
• Strong Azure networking: VNets, private endpoints, firewalls, and disconnected/air‑gapped deployment concepts.
• Identity engineering with Entra ID (Government) and CAC/PIV authentication.
• Production experience with managed data services (Azure SQL / relational databases, Key Vault, secure storage), including migrating relational workloads to managed Azure data tiers.
• Proficiency in a backend language for the service and automation layer — C# / .NET or strong Python; comfort re‑platforming existing applications without regressing security invariants (PII masking, audit logging, role scoping).
• Working knowledge of zero‑trust design, data‑access/security controls (row‑level and role‑based), and encryption/key management.
• DoD 8570/8140 IAT Level II baseline — Security+ CE minimum (CISSP or CASP+ preferred for IL6/IL7).
• Excellent troubleshooting, documentation, and stakeholder communication skills.
• Comfort working independently across multiple concurrent engagements.
• Candidates must have and maintain an active TS/SCI clearance with the Department of Defense.

HyerTek Offers a Comprehensive Benefits Package, Including

• Medical, dental, and vision insurance
• 401(k) with employer contribution
• Paid time off (PTO) and company holidays
• Flexible work arrangements
• Professional development and certification support
• Employee assistance program (EAP)
• Life and disability insurance

Clearance & Work Authorization

This position requires U.S. citizenship and an active TS/SCI clearance with the Department of Defense. Candidates must be authorized to work in the United States without the need for employment‑based visa sponsorship now or in the future. HyerTek will not sponsor applicants for a U.S. work visa status for this opportunity.

Salary Range

$140,000 – $160,000 annually, depending on experience and clearance status.

Equal Employment Opportunity (EEO)

HyerTek is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, veteran status, age, or any other protected status.