AWS Cloud Security Architect

The AWS Cloud Security Architect will work as part of an agile development team to build and support the modernization of enterprise-class software applications.

The successful candidate shall be capable of providing technical cloud security subject matter expertise to meet current and future security design and architecture requirements for IaaS, PaaS, and SaaS implementations. The candidate shall have experience with designing and implementing security measure to protect data as it moves from on-premises data center servers to cloud storage systems.  The candidate shall have experience with network security and security compliance.

This role provides expert advisory services to ensure secure design and deployment of cloud-based systems, incorporating secure-by-design principles such as access control, encryption, and identity management. The Architect conducts thorough threat and vulnerability assessments, monitors risks, and ensures compliance with federal cybersecurity standards and Judiciary frameworks.

KEY RESPONSIBILITIES

• Designing secure cloud architectures

• Performing risk assessments using enterprise tools

• Coordinating with ITSO and CISA to validate system security through independent evaluations.

• Creates essential security documentation, including System Security Plans, Business Continuity Analyses, and Disaster Recovery Plans

• Delivers a quarterly Cloud Security Roadmap

• Provides operational support to cover cloud firewalls, ACLs, SSL, API endpoints, authentication procedures, private image management, and secure network segmentation.

• Supports incident response planning

• Supports automation for legacy systems

• Ensures proper documentation of cybersecurity control artifacts

• Ensures continuous monitoring and secure data handling

• Engages in proactive risk mitigation

• Strengthens the security posture across production and non-production cloud environments within the CMSO ecosystem.

REQUIREMENTS

Required Education & Experience: Technical Training, Certification(s) or Degree and 10+ years of general experience in information systems required

Preferred Education & Experience: Additional education and/or experience are strongly preferred in the following combinations:

• HS Diploma & 18+ Years Experience

• AA/AS & 16+ Years Experience

• BA/BS & 14+ years Experience

• MA/MS & 12+ Years Experience

• Doctorate Degree/Ph.D. & 11+ Years Experience

Container Security — Expert Level:

• Deep expertise in Amazon EKS security architecture: pod identity, multi-tier namespace isolation, and node group separation across security classification tiers

• Expert Kubernetes RBAC design and auditing: least-privilege ClusterRoles, service account hardening

• Strong expertise in Kubernetes NetworkPolicy 

• Expert Pod Security Admission controls: restricted/baseline profile enforcement, Gatekeeper policy-as-code

• Full lifecycle container image security: ECR private registry, image tag immutability, Inspector Enhanced Scanning, cosign image signing, SBOM generation

• Expert GitLab CI/CD pipeline security: OIDC-based AWS authentication, build node egress restriction, pipeline-integrated scanning (Wiz, Trivy, Checkov, TestifySec), and immutable artifact promotion

• Experience implementing container performance monitoring using New Relic or equivalent (Prometheus, OpenTelemetry, Fluent Bit)

• Demonstrated experience designing FedRAMP High multi-tier web applications on EKS with tiered security classification boundaries

Network Security - Expert Level:

• Expert AWS VPC architecture: multi-tier subnet design, Tr