Security Architect with Security Clearance
Leidos Bedford
R-00194176 Description Leidos is seeking a Cloud Security Architect to lead the design and development of secure multi-cloud solutions supporting the U.S. Air Force Cloud One Next (C1N) ACSS contract. In this role, you will serve as a senior technical architect responsible for designing security capabilities across Amazon Web Services (AWS), Microsoft Azure, Google Cloud Platform (GCP), and Oracle Cloud Infrastructure (OCI).
The Cloud Security Architect will translate mission, cybersecurity, and platform requirements into implementable architectures and work directly with engineering teams to turn those architectures into reusable Cloud One capabilities. This is a solution architecture and engineering-focused role, rather than a security operations or compliance management position.
The architect will evaluate technologies, develop reference architectures, prototype solutions, make technical recommendations, define integration patterns, and guide engineering teams through implementation. The Cloud Security Architect will work across cloud, network, platform, DevSecOps, and cybersecurity teams to determine how security capabilities should be designed and integrated into the Cloud One platform.
A primary objective of the role is to abstract CSP-specific security complexity into standardized architectures and reusable capabilities that can be consistently deployed across Cloud One environments. Key Responsibilities: * Multi-Cloud Security Architecture: Design security architectures and solutions spanning AWS, Azure, GCP, and OCI, identifying common architectural patterns while accounting for CSP-specific capabilities and limitations.
The Cloud Security Architect will translate mission, cybersecurity, and platform requirements into implementable architectures and work directly with engineering teams to turn those architectures into reusable Cloud One capabilities. This is a solution architecture and engineering-focused role, rather than a security operations or compliance management position.
The architect will evaluate technologies, develop reference architectures, prototype solutions, make technical recommendations, define integration patterns, and guide engineering teams through implementation. The Cloud Security Architect will work across cloud, network, platform, DevSecOps, and cybersecurity teams to determine how security capabilities should be designed and integrated into the Cloud One platform.
A primary objective of the role is to abstract CSP-specific security complexity into standardized architectures and reusable capabilities that can be consistently deployed across Cloud One environments. Key Responsibilities: * Multi-Cloud Security Architecture: Design security architectures and solutions spanning AWS, Azure, GCP, and OCI, identifying common architectural patterns while accounting for CSP-specific capabilities and limitations.
- Security Solution Development: Translate cybersecurity requirements and identified capability gaps into implementable technical solutions, including architecture, technology selection, integration patterns, and implementation guidance.
- Reference Architecture Development: Create reusable reference architectures, design patterns, technical standards, and architectural guardrails that engineering teams can use to consistently build secure cloud environments.
- Architecture Prototyping: Develop proofs of concept and prototypes to validate new security architectures, technologies, integrations, and design approaches before enterprise implementation.
- Technology Evaluation & Selection: Evaluate cloud-native and third-party security technologies and develop recommendations based on capability, integration complexity, security effectiveness, scalability, cost, and applicability to Cloud One.
- Build vs. Buy Analysis: Assess when Cloud One should leverage CSP-native capabilities, enterprise security platforms, commercial products, or internally developed automation and services.
- Multi-Cloud Capability Abstraction: Design solutions that provide consistent security outcomes across CSPs while minimizing unnecessary CSP-specific implementation differences for Cloud One consumers.
- Security Platform Integration: Architect integrations between CSP-native security services and enterprise security platforms, including identity, network security, CNAPP, vulnerability management, SIEM, security telemetry, secrets management, and related capabilities.
- Identity Architecture: Design multi-cloud identity and access architectures including federation, privileged access, workload identities, service identities, role-based and attribute-based access controls, and machine-to-machine authentication.
- Zero Trust Architecture: Translate DoD Zero Trust requirements into practical cloud architecture patterns and platform capabilities spanning identity, workloads, networks, applications, and data.
- Network Security Architecture: Partner with the Cloud Network Architect to design trust boundaries, segmentation, ingress/egress security, traffic inspection, microsegmentation, private connectivity, and cross-cloud security patterns.
- Workload Security Architecture: Design security patterns for virtual machines, containers, Kubernetes, serverless services, APIs, cloud-native applications, and other workload architectures.
- Data Protection Architecture: Design approaches for encryption, key management, secrets management, certificate management, data access controls, and protection of sensitive information across multiple CSPs.
- DevSecOps Architecture: Define how security capabilities are integrated into Infrastructure as Code and CI/CD workflows, including automated security testing, policy enforcement, artifact security, and software supply chain protections.
- Security as Code: Develop architectural patterns for implementing security through Infrastructure as Code, Policy as Code, and Configuration as Code, enabling security controls to be consistently incorporated into Cloud One engineering workflows.
- Solution Engineering: Work directly with engineering teams during solution development to resolve design challenges, validate implementation approaches, and ensure delivered capabilities align with the intended architecture.
- Architecture Reviews: Review new platform capabilities, cloud services, infrastructure designs, and major technical changes to identify security implications and recommend architectural solutions.
- Technical Roadmap Development: Identify security capability gaps and emerging technology needs and contribute to the Cloud One technical roadmap by defining future security capabilities and modernization initiatives.
- Technical Decision-Making: Develop architecture decision records, technical trade studies, and recommendations that clearly document alternatives, constraints, risks, and rationale for major security architecture decisions. Required Qualifications: * Education: Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Systems Engineering, or a related technical discipline and 12+ years of prior relevant experience, or equivalent additional experience in lieu of degree.
- Security Architecture: Extensive experience designing enterprise security solutions and translating security requirements into implementable technical architectures.
- Solution Architecture: Demonstrated experience taking complex technical problems from requirements and conceptual design through architecture, prototyping, engineering, and implementation.
- Multi-Cloud Architecture: Strong experience with multiple CSPs, with deep technical knowledge of at least two of the following: AWS, Azure, GCP, or OCI, and the ability to develop architectures that span heterogeneous cloud environments.
- Cloud-Native Security: Advanced knowledge of CSP-native security architectures and services covering identity, networking, encryption, key management, secrets, workloads, logging, policy, and data protection.
- Security Technology Integration: Experience architecting integrations between cloud-native capabilities and enterprise security technologies.
- Identity Architecture: Strong understanding of IAM, federation, SSO, MFA, RBAC, ABAC, privileged access, workload identity, service identity, and least-privilege architectures.
- Network Security Architecture: Strong understanding of segmentation, trust boundaries, firewalls, private connectivity, traffic inspection, microsegmentation, ingress/egress controls, and Zero Trust network architecture.
- Infrastructure & Security as Code: Experience designing security capabilities implemented through Terraform, Ansible, Policy as Code, Configuration as Code, APIs, and CI/CD automation.
- Containers & Kubernetes: Knowledge of Kubernetes and container security architectures, including image security, admission controls, secrets, identity, network policies, software supply chain security, and runtime protection.
- DevSecOps: Strong understanding of how security capabilities are integrated throughout software and infrastructure delivery pipelines rather than implemented as downstream compliance activities.
- ·DoD Architecture: Experience designing solutions within DoD, federal, or similarly regulated environments and an understanding of RMF, NIST SP 800-53, DISA STIGs, DoD CC SRG, and DoD Zero Trust requirements.
- Technical Leadership: Demonstrated ability to lead technical design efforts, facilitate architecture discussions, evaluate competing technologies, and provide technical direction to engineering teams.
- Technical Communication: Ability to communicate complex architectures and technical tradeoffs through diagrams, technical documentation, trade studies, presentations, and direct engagement with engineering and Government stakeholders.
- Security Clearance: Ability to obtain and maintain a DoD Secret security clearance. Preferred Qualifications: * Active DoD Secret or Top Secret clearance.
- Advanced security architecture certifications such as CISSP, CCSP, CISSP-ISSAP, or equivalent.
- Advanced cloud security certifications such as AWS Certified Security – Specialty, Microsoft Certified: Azure Security Engineer Associate, Google Professional Cloud Security Engineer, or equivalent OCI certification.
- Demonstrated experience developing multi-cloud reference architectures and enterprise security platforms.
- Experience designing security capabilities supporting DoD Impact Levels (IL) 2, 4, 5, and 6.
- Experience architecting and integrating Cloud-Native Application Protection Platforms (CNAPP), including CSPM, CWPP, CIEM, attack-path analysis, and cloud detection capabilities.
- Experience designing solutions involving SIEM, SOAR, vulnerability management, identity security, microsegmentation, network security, secrets management, and data protection technologies.
- Experience designing and implementing DoD Zero Trust Architecture capabilities.
- Experience developing proofs of concept, technical prototypes, trade studies, and technology evaluations for enterprise security capabilities.
- Experience building reusable Terraform modules, Policy as Code frameworks, security APIs, or other automation that translates architecture into deployable platform
Computer Merchant, Ltd., TheWaltham (MA), 6 mi from Bedford (MA)
JOB TITLE: Principal Azure Cloud Security Architect
JOB LOCATION: REMOTE (1 Day Onsite per Quarter in either Brooklyn, NY, Hicksville, NY, or Waltham, MA)
SALARY RANGE*: 190k-210k plus benefits, pto, etc.. (Bonus Structure: 15% target - can go up...
Motion Recruitment Partners, LLCBoston, 14 mi from Bedford (MA)
We are looking for a Security Architect / Risk & Compliance Lead to support a large-scale enterprise HR and Payroll transformation program in Boston, MA. This is a full-time contract opportunity working across cloud security, application security...
Systems Engineering Solutions CorporationHanscom Air Force Base, 2 mi from Bedford (MA)
This role supports the U.S. Air Force Cloud One Architecture and Common Shared Services contract and currently has an opening for a Cloud Security Architect. This position will coordinate across multiple areas as the program supports AWS, Azure...