AWS ProServe Platform Engineer

DMI • Tysons, VA

1d • $121,600 - $152,000

About The Position

DMI is hiring an AWS ProServe Platform Engineer to support the cARMY program. The role focuses on ECMA cARMY onboarding, AWS GovCloud landing zones and environments, IL5 authorization and security controls, continuous ATO, migration of a demonstrator into cARMY, and knowledge transfer to program staff.

The engineer will deliver reusable, parameterized landing-zone infrastructure code for NIPR and SIPR environments, with NIPR development, test, and staging targeted by approximately month 4 and multi-region production by approximately month 7. Production includes Global Tables and Route 53 failover, with documented and demonstrated recovery objectives. The infrastructure will integrate with the existing AWS SAM application layer through defined exported identifiers; the engagement will not replace or fork application templates.

The position also defines the IL5 authorization boundary, automates security and STIG controls, supports the RMF and eMASS process, and helps establish an OSCAL/ConMon pipeline and NIPR continuous ATO. The engineer will plan and execute migration from a commercial GovCloud account into cARMY, and work alongside the Lead DevSecOps / SRE to ensure program staff operate the delivered artifacts before month 9. Artifacts, runbooks, and architecture decision records are to be maintained in program repositories and pipelines.

Requirements

• Has taken at least one prior Army tenant through ECMA cARMY onboarding to first authenticated deployment; this qualification defines the role.
• Experience with GovCloud landing zones at IL5, including Control Tower and/or Landing Zone Accelerator, AWS Organizations and service control policies, IAM Identity Center, centralized logging, Security Hub, GuardDuty, and AWS Config conformance packs.
• Experience with DoD Cloud Computing SRG, RMF, NIST SP 800-53 Rev. 5, and eMASS, including direct experience with Authorizing Official and SCA-V review cycles.
• Production-quality CloudFormation / AWS SAM experience; CDK (Landing Zone Accelerator) or Terraform is acceptable when the output integrates with the SAM application layer.
• Serverless platform experience with Lambda, API Gateway, DynamoDB (including Global Tables, point-in-time recovery, Streams, and capacity), EventBridge, SQS, KMS, WAF, VPC endpoints, and Route 53 failover.
• Experience with AWS DMS and DynamoDB export and import for data migration.
• Experience automating DISA STIGs for cloud and serverless resources.
• 10+ years of experience in cloud infrastructure, including 5+ years in AWS GovCloud or DoD environments.
• Bachelor's degree in IT, computer science, or a related field, or equivalent experience.
• AWS Certified SysOps Administrator – Associate or higher; this labor-category minimum cannot be waived.
• Must be DoD 8140 compliant for the IAT/IAM functions performed.

Nice To Haves

• Prior continuous-ATO or ConMon delivery is strongly preferred.
• AWS Certified Solutions Architect – Professional is expected for the engagement.
• AWS Certified Security – Specialty or DevOps Engineer – Professional is preferred.
• Prior SIPR/IL6 (AWS Secret Region) enclave build-out and DISA SIPRNet circuit coordination.
• Army Cross-Domain Solution (ARCDS) familiarity, if cross-domain capability enters scope.
• OSCAL tooling and Security Hub-to-eMASS evidence automation.
• GovCloud FinOps, tagging, and cost-allocation design.
• Comfort working with an AI-augmented team; generated infrastructure code and STIG scripts are welcome once reviewed to an ATO-defensible standard.

Responsibilities

• Run ECMA cARMY onboarding end to end, including tenant request packages, account vending, Control Tower / Landing Zone Accelerator guardrails, IAM Identity Center federation, and VPN and boundary connectivity requests.
• Prepare and track Government artifacts, including the Authorizing Official designation memo, ISSO appointment, and inherited-control matrix.
• Coordinate with ECMA, the Authorizing Official, and SCA-V to keep reviews moving; maintain and report a weekly dependency tracker for Government-paced items.
• If the SIPR option is in scope, repeat onboarding for IL6, including the second Authorizing Official chain, SIPR identity binding, DISA SIPRNet circuit request, and classified break-glass access.
• Deliver reusable, parameterized cARMY landing-zone infrastructure code covering account baseline, service control policies, centralized logging, security services, network baseline, and KMS key hierarchy; make NIPR and SIPR differ only by parameters.
• Stand up NIPR development, test, and staging by about month 4, and multi-region production by about month 7, including Global Tables, Route 53 failover, and documented and demonstrated recovery objectives.
• Integrate the landing zone with the program's AWS SAM application layer through exported VPC, subnet, endpoint, KMS, and logging identifiers without replacing or forking application templates.
• Define the IL5 authorization boundary, including boundary and data-flow diagrams, ports, protocols and services, and inherited, shared, and system-specific control allocations.
• Deliver NIST SP 800-53 Rev. 5 conformance packs and DISA STIG automation for Lambda, API Gateway, DynamoDB, and landing-zone services, with evidence usable by the RMF team in eMASS.
• Provide System Security Plan templates pre-filled for cARMY-inherited controls and support SSP amendment, eMASS submission, and SCA-V coordination.
• Set up DoD PKI certificate distribution and rotation.
• Provide a continuous-ATO playbook and help establish the OSCAL/ConMon pipeline, including Config and Security Hub feeds, drift detection, a ConMon dashboard, and the 30-day evidence period.
• Support the Authorizing Official signature campaign toward NIPR continuous ATO at month 12.
• Plan and execute migration of the demonstrator from a commercial GovCloud account into cARMY using AWS DMS or DynamoDB export and import; prepare cut-over and rollback runbooks and conduct a full rehearsal.
• Move workloads through development, test, and staging before production.
• Pair with the Lead DevSecOps / SRE throughout the engagement; commit artifacts to program repositories, run them through the program pipeline, and ensure program staff operate them at least once before month 9.
• Deliver runbooks and architecture decision records for each landing-zone design decision.

Benefits

• Virtual health visits, commuter perks, pet insurance, and entertainment discounts.
• Annual performance reviews, tuition assistance, and internal career growth opportunities.
• 401(k) matches, life and disability insurance, and financial wellness tools.
• Annual awards, service anniversaries, referral bonuses, and peer-to-peer recognition.
• Healthcare coverage, wellness programs, flu shots, and biometric screenings.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior