Architect, Federal Security

AECON • Charlotte, NC

10d

About The Position

The Federal Security Architect owns and develops Aecon's federal security architecture, producing integrated designs, reference patterns, decisions, technical acceptance criteria, and as-built baselines for federal contracting environments. The role translates applicable requirements into implementable solutions that protect Controlled Unclassified Information (CUI), Federal Contract Information (FCI), and other controlled information while supporting reliable business operations. Reporting to the Manager, US IT Operations, Federal, the architect partners with the Federal Information Security Lead and guides Systems, Infrastructure, and Applications teams and providers. The role provides documented technical concurrence and bounded hands-on prototyping, troubleshooting, and validation. Platform operation, control ownership, project management, and approval authorities remain with designated owners.

The architect owns the federal enclave architecture baseline and roadmap; develops designs across identity, cloud, endpoints, networks, applications, and providers; and defines boundaries, segmentation, data flows, controlled exchange, and physical-output and printing paths. The role translates contract and control requirements into practical designs, partners on control coverage and evidence, develops test criteria, maintains security-plan narratives and remediation inputs, and designs and validates technical controls and mitigations.

The role also designs Microsoft 365 and Azure government-cloud and GCC High solutions, identity and Zero Trust patterns, information-protection capabilities, and secure integrations. It maintains architecture documentation and baselines, assesses providers and solutions against federal requirements, leads proofs of concept and technical testing, and guides technical teams and providers. It explains designs and evidence during audits and mentors teams, while respecting designated owners' authority for risk acceptance, production authorization, legal decisions, control evidence, operations, and independent assessment conclusions.

Requirements

• Bachelor's degree in Information Technology, Computer Science, Cybersecurity, Engineering, or a related field; an equivalent combination of education, certifications, and relevant experience may be considered.
• Eight or more years of relevant IT infrastructure, cybersecurity, cloud engineering, or architecture experience.
• Five or more years designing or delivering security architectures and secure integrations for federal government, defense, or federal-contractor environments.
• Demonstrated implementation of NIST SP 800-171 controls in operating contractor CUI environments; agency RMF/ATO familiarity alone is insufficient.
• Personal ownership of designs, decisions, acceptance, troubleshooting, and assessment evidence, rather than policy coordination alone.
• Practical Microsoft 365/Azure government-cloud security-design experience.
• U.S. citizenship is required due to federal contract obligations.
• Expertise in CMMC Level 2, NIST SP 800-171 and 800-171A, and applicable DFARS/SPRS obligations.
• Ability to translate control requirements into implementable designs, test criteria, and technical evidence.
• Experience with federal enclave boundaries, CUI data flows, and end-to-end secure integration.
• Knowledge of Zero Trust architecture, network segmentation, and trust relationships.
• Knowledge of Microsoft Entra ID, Conditional Access, MFA, and privileged access.
• Knowledge of SAML authentication, SCIM provisioning, and secure application integration.
• Knowledge of audit logging, monitoring, evidence retention, and operational handoff.
• Knowledge of endpoint protection, vulnerability remediation, and control-failure analysis.
• Ability to conduct threat modeling and technical risk analysis and develop remediation alternatives.
• Knowledge of cloud/SaaS security and shared responsibilities; RMF/FedRAMP literacy complements direct CUI implementation.
• Independent federal architectural judgment and ownership of integrated technical solutions.
• Practical control engineering connecting requirements, implementation, testing, and operations.
• Clear technical writing and ability to produce diagrams, standards, and decision records.
• Ability to challenge unsupported claims and analyze trade-offs soundly.
• Evidence-based technical acceptance and transparent escalation of unresolved issues.
• Ability to explain complex security designs to technical, business, and executive audiences.
• Technical leadership, mentoring, and collaboration across delivery and operational teams.
• Pragmatic prioritization without transferring others' control ownership or exceeding delegated authority.

Nice To Haves

• GCC High experience, or demonstrably transferable government-cloud architecture experience.
• Certified CMMC Professional (CCP).
• Information Systems Security Architecture Professional (ISSAP).
• Certified Information Systems Security Professional (CISSP).
• Microsoft Certified: Cybersecurity Architect Expert.
• Certified Cloud Security Professional (CCSP).
• Certified Information Security Manager (CISM).
• Relevant Microsoft or CMMC assessment training.

Responsibilities

• Own the Federal Enclave architecture baseline and roadmap for applicable federal requirements.
• Develop integrated designs across identity, cloud, endpoints, networks, applications, and providers.
• Define enclave boundaries, segmentation, data flows, controlled exchange, and physical-output and printing paths.
• Produce reference patterns, configuration standards, and decision records documenting trade-offs and limitations.
• Provide Federal IT management with prioritized design decisions, options, technical risks, and escalations.
• Translate applicable contract and control requirements with Compliance and Legal into practical designs.
• Partner with the Federal Information Security Lead on control coverage, inheritance, and exception analysis.
• Develop test criteria and technical evidence requirements using applicable NIST SP 800-171A methods.
• Maintain System Security Plan narratives and technical remediation inputs to Plans of Action and Milestones.
• Assess change impacts while respecting authorized information owners' and Legal's decision authority over information applicability and legal matters.
• Design and validate controls, threat and failure scenarios, and technical remediation options; document gaps and analyze proposed alternatives.
• Design privileged access, least privilege, separation of duties, and secure administrative workflows.
• Provide documented technical concurrence before design or change approval, and escalate unresolved objections to authorized owners.
• Design logging, monitoring, retention, and response interfaces while leaving incident command and daily execution to operations.
• Design Microsoft 365/Azure government-cloud and GCC High solutions within service and enclave boundaries.
• Design secure government-cloud collaboration, identity, endpoint, threat, and information-protection capabilities.
• Design SAML/SCIM, Conditional Access, MFA, privileged access, and Zero Trust identity patterns.
• Design labeling, data-loss prevention, access, placement, and exchange with authorized information owners.
• Maintain architecture baselines, boundary and data-flow diagrams, standards, and implementation records.
• Keep approved designs, as-built configurations, inventories, and technical control narratives current.
• Produce handoffs documenting validation results, limitations, rollback, support ownership, and technical evidence.
• Challenge provider capabilities, designs, data handling, and integration assumptions against federal requirements.
• For applicable FedRAMP services, verify the authorized boundary and document internal, provider, inherited, and customer-retained responsibilities.
• Lead proofs of concept and technical testing, recording concurrence, limitations, and unresolved objections.
• Guide technical teams and providers on test environments, configuration, integration, troubleshooting, and validation.
• Explain designs and evidence at audits and mentor teams without assuming security-lead, risk, or approval authority.

Benefits

• Services and benefits intended to support employees' and their families' mental, emotional, and physical well-being.
• Career and skills development through Aecon University.
• Tuition reimbursement.
• Leadership Programs.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior