Architect, Federal Security

Aecon • Charlotte, NC

11d

About The Position

The Federal Security Architect owns and develops Aecon's federal security architecture. The role produces integrated designs, reference patterns, decisions, technical acceptance criteria, and as-built baselines for federal contracting environments. It translates applicable requirements into implementable solutions that protect Controlled Unclassified Information (CUI), Federal Contract Information (FCI), and other controlled information while supporting reliable business operations.

Reporting to the Manager, US IT Operations, Federal, the architect partners with the Federal Information Security Lead and guides Systems, Infrastructure, and Applications teams and providers. The role provides documented technical concurrence and bounded hands-on prototyping, troubleshooting, and validation. Platform operation, control ownership, project management, and approval authorities remain with designated owners.

Requirements

• Bachelor's degree in Information Technology, Computer Science, Cybersecurity, Engineering, or a related field; an equivalent combination of education, certifications, and relevant experience may be considered.
• Eight or more years of relevant IT infrastructure, cybersecurity, cloud engineering, or architecture experience.
• Five or more years designing or delivering security architectures and secure integrations for federal government, defense, or federal-contractor environments.
• Demonstrated NIST SP 800-171 control implementation in operating contractor CUI environments; agency RMF/ATO familiarity alone is insufficient.
• Personal ownership of designs, decisions, acceptance, troubleshooting, and assessment evidence, rather than policy coordination alone.
• Practical Microsoft 365/Azure government-cloud security-design experience; GCC High experience or demonstrably transferable government-cloud architecture experience.
• U.S. Citizenship is required due to federal contract obligations.
• Expertise in CMMC Level 2, NIST SP 800-171 and 800-171A, and applicable DFARS/SPRS obligations.
• Ability to translate control requirements into implementable designs, test criteria, and technical evidence.
• Expertise in federal enclave boundaries, CUI data flows, and end-to-end secure integration.
• Expertise in Zero Trust architecture, network segmentation, and trust relationships.
• Expertise in Microsoft Entra ID, Conditional Access, MFA, and privileged access.
• Expertise in SAML authentication, SCIM provisioning, and secure application integration.
• Expertise in audit logging, monitoring, evidence retention, and operational handoff.
• Expertise in endpoint protection, vulnerability remediation, and control-failure analysis.
• Expertise in threat modeling, technical risk analysis, and remediation alternatives.
• Knowledge of cloud/SaaS security and shared responsibilities; RMF/FedRAMP literacy complements direct CUI implementation.
• Independent federal architectural judgment and ownership of integrated technical solutions.
• Practical control engineering that bridges requirements, implementation, testing, and operations.
• Clear technical writing, diagrams, standards, and decision records.
• Ability to constructively challenge unsupported claims and analyze trade-offs.
• Evidence-based technical acceptance and transparent escalation of unresolved issues.
• Ability to explain complex security designs to technical, business, and executive audiences.
• Technical leadership, mentoring, and collaboration across delivery and operational teams.
• Pragmatic prioritization without transferring others' control ownership or exceeding delegated authority.

Nice To Haves

• Certified CMMC Professional (CCP).
• Information Systems Security Architecture Professional (ISSAP).
• Certified Information Systems Security Professional (CISSP).
• Microsoft Certified: Cybersecurity Architect Expert.
• Certified Cloud Security Professional (CCSP).
• Certified Information Security Manager (CISM).
• Relevant Microsoft or CMMC assessment training.
• GCC High experience is preferred, or demonstrably transferable government-cloud architecture experience.

Responsibilities

• Own the Federal Enclave architecture baseline and roadmap for applicable federal requirements.
• Develop integrated designs across identity, cloud, endpoints, networks, applications, and providers.
• Define boundaries, segmentation, data flows, controlled exchange, and physical-output and printing paths.
• Produce reference patterns, configuration standards, and decision records, including trade-offs and limitations.
• Provide Federal IT management with prioritized design decisions, options, technical risks, and escalations.
• Translate applicable contract and control requirements with Compliance and Legal into practical designs.
• Partner with the Federal Information Security Lead on control coverage, inheritance, and exception analysis.
• Develop test criteria and technical evidence requirements using applicable NIST SP 800-171A methods.
• Maintain System Security Plan narratives and technical remediation inputs to Plans of Action and Milestones.
• Assess change impacts while leaving information-applicability and legal decisions to authorized information owners and Legal.
• Design and validate controls, threat and failure scenarios, and technical remediation options; document gaps and clarify that exceptions or proposed compensating controls do not themselves satisfy mandatory requirements.
• Design privileged access, least privilege, separation of duties, and secure administrative workflows.
• Provide required documented technical concurrence before design or change approval and escalate unresolved objections to authorized system, security, and risk owners.
• Design logging, monitoring, retention, and response interfaces while leaving incident command and daily execution to operations.
• Design Microsoft 365/Azure government-cloud and GCC High solutions within service and enclave boundaries.
• Design secure government-cloud collaboration, identity, endpoint, threat, and information-protection capabilities.
• Design SAML/SCIM, Conditional Access, MFA, privileged access, and Zero Trust identity patterns.
• Design labeling, data-loss prevention, access, placement, and exchange in collaboration with authorized information owners.
• Maintain architecture baselines, boundary and data-flow diagrams, standards, and implementation records.
• Keep approved designs, as-built configurations, inventories, and technical control narratives current.
• Produce handoffs documenting validation results, limitations, rollback, support ownership, and technical evidence.
• Preserve accountable approvals, leaving risk acceptance, exceptions, production authorization, legal/HR decisions, required SPRS affirmations, and independent assessment conclusions to their designated owners.
• Challenge provider capabilities, designs, data handling, and integration assumptions against federal requirements.
• For applicable FedRAMP services, verify the authorized boundary; labels or encryption alone do not establish compliance.
• Document internal, provider, inherited, and customer-retained build, control, and evidence responsibilities.
• Lead proofs of concept and technical testing, recording concurrence, limitations, and unresolved objections.
• Guide technical teams and providers on test environments, configuration, integration, troubleshooting, and validation.
• Own architecture and acceptance criteria while assigned teams retain build, operations, and control-evidence duties.
• Explain designs and evidence at audits and mentor teams without assuming security-lead, risk, or approval authority.

Benefits

• Services and benefits to support employees' and families' mental, emotional, and physical well-being.
• Career development and skills advancement through Aecon University.
• Tuition reimbursement.
• Leadership Programs.
• Meaningful initiatives, training, and partnerships with Veteran groups to support respectful, collaborative, and inclusive work environments.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior