Cloud Security Architect / Engineer

9th Way Insignia•Columbia, WA

About The Position

9th Way Insignia is seeking a Cloud Security Architect / Engineer to support federal customers by strengthening enterprise security architecture, systems engineering, and the secure implementation of technologies. This role involves applying cybersecurity standards, guidelines, and frameworks to translate requirements into secure, scalable technical solutions. Team members will contribute to security architecture and engineering, implementation guidance, technical analysis, and the development of repeatable approaches for secure technology deployment. Systems security engineering is a key component, focusing on integrating security throughout the system development life cycle. The ultimate goal is to enhance the cybersecurity posture, reduce organizational risk, and protect critical systems and information from evolving cyber threats.

Requirements

Minimum of 10 years of Information Security Experience of which at least 5 years are of Cybersecurity and Cloud Security experience at a large Government agency similar in size/scope to GSA, IRS, DoD or VA.
Expertise in cybersecurity architecture and engineering requirements and authorizations (FedRAMP/RMF) into systems and applications.
Expertise in IT and Cloud security architecture design, security engineering, development, systems engineering, and implementation efforts.
Expertise in Cloud solutions in federal and/or commercial industry.
Expertise with Federal A&A and ATO activities.
Expertise with security compliance requirements and regulatory standards (e.g., NIST, FISMA, FedRAMP, CIS Controls, HIPAA).

Nice To Haves

Bachelor’s degree in Business Administration, Business Management, Cybersecurity, Computer Science, Information Systems, Information Assurance, Information Security, Information Resource Management, or related fields.
CASP+ (SecurityX), CCISO, CISA, CISM, CISSP, CISSP-ISSAP, CISSP-ISSEP, GCED, GCIH, GSLC, CCNP Security

Responsibilities

Design, develop, assess, and implement secure cloud architectures and engineering solutions supporting VA enterprise systems, applications, platforms, and modernization initiatives.
Translate cybersecurity, business, technical, and regulatory requirements into practical cloud security architectures, controls, engineering requirements, and implementation approaches.
Integrate applicable FedRAMP and Risk Management Framework (RMF) requirements into cloud systems, applications, platforms, and technical solutions.
Support Federal Assessment and Authorization (A&A) and Authority to Operate (ATO) activities for cloud-based systems and services.
Develop cloud security solutions that align with applicable VA security policies, Federal cybersecurity frameworks, and regulatory requirements.
Apply Zero Trust, defense-in-depth, least privilege, and secure-by-design principles to cloud architecture and engineering decisions.
Conduct security architecture reviews of new, existing, and modernized cloud systems to determine whether proposed designs adequately address threats, vulnerabilities, and applicable security requirements.
Perform cloud architecture risk and gap analyses to evaluate compliance with VA and Federal policies, standards, security frameworks, and approved architectural requirements.
Identify architectural weaknesses, security-control gaps, configuration risks, and compliance deficiencies within cloud environments and recommend technically sound mitigation strategies.
Conduct or support cloud threat modeling to identify attack vectors, threat actors, misuse cases, attack paths, control gaps, residual risks, and appropriate mitigations.
Review cloud solution designs, applications, platforms, networks, identity services, and data architectures for security risks prior to implementation.
Evaluate technical design artifacts to confirm applicable security requirements have been incorporated into proposed cloud solutions.
Develop Security Reference Architectures, Solution Architectures, Security Patterns, and other reusable cloud security design guidance.
Document logical, physical, conceptual, and data-flow architectures for cloud solutions and supporting enterprise integrations.
Develop reusable security patterns addressing recurring cloud security design challenges within the VA environment.
Provide cloud-security subject matter expertise during technical design reviews, architecture reviews, pilots, use-case development, modernization initiatives, and enterprise transformation efforts.
Support secure cloud modernization by evaluating existing environments and recommending migration, re-architecture, modernization, or security-hardening approaches.
Develop and maintain cloud security configuration baselines aligned with Federal standards, VA requirements, and industry best practices.
Assess cloud-native platforms against approved security baselines and identify configuration deviations, compliance gaps, and required remediation actions.
Develop recommendations for maintaining a consistent, secure, and compliant configuration posture across cloud environments.
Support lifecycle governance and traceability from security controls and architectural requirements through system implementation and final ATO.
Establish security requirements and engineering considerations for cloud systems and document those requirements for implementation teams.
Support development of Security Requirements Needs Documents, Security Engineering Consideration Plans, configuration reports, and security assessment reports for cloud technologies.
Conduct specialized cloud security posture reviews and document associated risks, findings, and recommendations.
Identify, evaluate, monitor, and communicate cloud cybersecurity risks using established Federal and VA risk-management processes.
Evaluate cloud services and architectures for compliance with applicable NIST, FISMA, FedRAMP, CIS Controls, HIPAA, VA security, and privacy requirements.
Support implementation of security and privacy requirements applicable to cloud environments under VA Risk Management Framework for Cloud Computing Services.
Support cloud system authorization by gathering, validating, and maintaining evidence demonstrating implementation of required security controls.
Assist system owners and technical teams in identifying and resolving ATO, accreditation, security-control, or compliance issues associated with cloud services.
Recommend compensating measures and mitigation strategies when design or implementation constraints create security-control gaps.
Support secure identity and access-management architecture for cloud environments in alignment with VA and Federal identity, credential, and access-management requirements.
Evaluate cloud environments for appropriate implementation of least privilege, identity controls, access restrictions, and enterprise authentication requirements.
Support secure cloud networking, data protection, application security, infrastructure hardening, integration, lifecycle management, and security-tool implementation.
Collaborate with DevSecOps engineers, cybersecurity architects, security engineers, developers, system owners, risk and compliance analysts, program managers, and Government stakeholders throughout the cloud solution lifecycle.
Provide technical input into VA security policies, standards, guidelines, technical positions, white papers, and risk-mitigation recommendations involving cloud technologies.
Develop technical briefings and presentations explaining cloud architecture, risk posture, security findings, compliance status, and recommended courses of action to both technical and executive stakeholders.
Participate in VA governance boards, technical-review committees, architecture forums, and engineering working groups involving cloud security or modernization.
Support continuous improvement of cloud security by monitoring emerging threats, technology changes, compliance requirements, and evolving Federal cloud-security standards.
Ensure cloud architectures remain aligned with enterprise security architecture, modernization initiatives, technology roadmaps, and Government strategic objectives throughout their lifecycle.