Cloud Security Architect - IL4 / Workday

TOMORROW HIRE•Washington, DC

17d•$150,000 - $200,000•Hybrid

About The Position

The Cloud Security Architect will design, secure, and support the cloud architecture for U.S. Space Force human capital management modernization, a system managing personnel, promotion, and assignment information for USSF Guardians. The role initially supports a Workday-based Small Business Innovation Research (SBIR) Phase II effort and is expected to help transition the effort toward a production program of record, subject to program award and customer requirements. The position reports to the Program Manager and collaborates with teams across cloud engineering, cybersecurity, identity management, enterprise integration, and Risk Management Framework (RMF) to deliver a secure, scalable architecture meeting Department of War Impact Level 4 (IL4) requirements and authorization needs. The position is full-time and hybrid, with occasional onsite work at a government or MPX site potentially required. The primary site is the Washington, DC metropolitan area, with candidates also potentially based near Buckley, Los Angeles, Patrick, Peterson, Schriever, or Vandenberg Space Force Base. The current SBIR Phase II period of performance runs through contract award. U.S. citizenship, an active Top Secret clearance, and eligibility for SCI access are required in accordance with contract and customer requirements.

Requirements

At least 7 years of cloud architecture, cybersecurity architecture, or secure enterprise systems engineering experience.
Direct experience designing or securing Department of War IL4/IL5 or FedRAMP High environments.
Hands-on experience with RMF and Authority to Operate (ATO) processes, including control implementation, eMASS documentation, and assessor support.
Hands-on experience with identity federation, including CAC/PKI or PIV-based authentication, zero trust architecture, encryption, network security, and SaaS integrations.
Experience designing secure APIs, enterprise integrations, and data exchange architectures.
Ability to document technical decisions, communicate architecture risks, and collaborate across engineering and security teams.
U.S. citizenship.
Active Top Secret clearance and eligibility for SCI access in accordance with applicable contract and customer requirements.

Nice To Haves

Experience integrating Workday or another enterprise human capital management platform.
Experience supporting U.S. Space Force or Department of the Air Force modernization programs.
Familiarity with the DoW Cloud Computing Security Requirements Guide (CC SRG), NIST SP 800-53, and applicable DISA STIGs and SRGs.
Cloud architecture or security certifications, such as AWS or Azure architect or security credentials, or equivalent demonstrated expertise.
Experience transitioning SBIR, prototype, or pilot capabilities into production government environments.
Experience with AWS GovCloud or Azure Government, Cloud Access Point (CAP) connectivity, and CSSP onboarding.
DoD 8140 qualification at the required level, such as CISSP or CCSP, or ability to obtain it within 6 months of hire.

Responsibilities

Design and document secure IL4 cloud architectures in AWS GovCloud, including identity and access management, encryption, network security, boundary protection, and monitoring.
Develop secure Workday and third-party SaaS integration patterns, including identity federation with CAC/PKI and DoD ICAM, APIs, data exchange, and zero trust controls.
Design IL4 network connectivity through the required Cloud Access Point (CAP) and align monitoring and incident response with the program's Cybersecurity Service Provider (CSSP).
Partner with the RMF lead to implement and document NIST SP 800-53 controls in eMASS, apply applicable STIGs and SRGs, prepare authorization evidence, support assessors, and remediate technical findings.
Evaluate the SBIR architecture against production requirements and develop scalable, supportable designs for the anticipated HCM program of record.
Collaborate with architects, platform engineers, cybersecurity specialists, subcontractors, and government technical authorities.
Apply approved AI and automation tools to improve architecture analysis, configuration validation, security documentation, and engineering efficiency while keeping CUI and other sensitive data within approved boundaries and validating all technical outputs.