Cloud Specialist

Viasat, Inc.•Carlsbad, CA

About The Position

The Integrated Solutions Business Unit is hiring a TMF Cloud Engineer to operate the cloud infrastructure layer of our Tactical Mission Fabric (TMF) program. TMF is a multi-tenant network-as-a-service platform that delivers secure, globally interconnected managed networking to DoD mission owners. This is a hands-on cloud engineering role, not an architecture-only seat and not a generalist IT role. Working alongside the Lead Systems Engineer, you will build, deploy, and operate the AWS infrastructure that TMF tenants run on: landing zones, networking, identity, security telemetry, and tenant compute, all inside a continuous authorization boundary where every configuration maps to a FedRAMP and NIST control. We're looking for a cloud engineer who has operated production AWS in a regulated environment: someone fluent in Terraform-driven multi-account design who understands that in a FedRAMP boundary, the audit trail is as important as the uptime.

Requirements

Hands-on production AWS experience: VPC, IAM, EC2, S3, CloudTrail, Config, and multi-account structures
Terraform module authoring and GitOps discipline in a production environment
AWS networking: Transit Gateway, Direct Connect, VPC topologies, route tables, security groups, and hybrid connectivity to carrier or MPLS backbones
Experience operating in a regulated or compliance-bound cloud environment (FedRAMP, DoD IL4/IL5, or equivalent), where configurations map to NIST 800-53 / 800-171 controls
Familiarity with cloud security tooling: SIEM integration, vulnerability management, and continuous monitoring
Scripting proficiency (Python, Bash, or similar) for automation beyond Terraform
5+ years in cloud engineering, infrastructure engineering, or DevSecOps roles, with at least 2 years hands-on in AWS
Bachelor's degree in a technical field, or equivalent operational experience
US Citizenship required
Active DoD Secret clearance required
Ability to travel up to 15%

Nice To Haves

AWS GovCloud-specific experience, including partition constraints and IL4/IL5 boundary operations
AWS multi-account governance at scale: Organizations, SCPs, Control Tower or custom landing zone frameworks, account vending automation
Terraform Enterprise or Terraform Cloud workflow experience with policy-as-code gates (Sentinel, OPA, or similar)
GitLab CI/CD pipeline development for infrastructure delivery
Identity stack experience: IAM Identity Center, Active Directory integration, RADIUS/MFA solutions (PrivacyIDEA or equivalent)
OpenSearch/Elasticsearch SIEM administration, plus Security Hub, GuardDuty, and Tenable/Nessus integration
AWS WorkSpaces or VDI deployment in hardened configurations
KMS, AWS Backup, and encryption baseline engineering
AWS Secret Region (IL6) or Top Secret Region experience, or other classified cloud operations
AWS certifications: Solutions Architect Professional, Security Specialty, Advanced Networking Specialty, or SysOps
Experience integrating cloud infrastructure with SD-WAN overlays and NGFW boundary security (FortiGate, Palo Alto)
Cloud broker or multi-cloud service delivery experience
Container and edge compute platforms (EKS, AWS Outposts, or forward compute architectures)
DoD 8140/8570 baseline certification (Security+, CASP+, CISSP, or equivalent)
TS/SCI clearance currently held
Experience supporting FedRAMP or CMMC assessments with technical artifacts

Responsibilities

Build and operate multi-account, multi-partition AWS architectures spanning GovCloud (IL4/IL5), Secret Region (IL6), and commercial partitions, with tenant isolation enforced by architecture, not by policy alone.
Maintain and extend AWS landing zones for tenant and shared-service segmentation, including account vending, guardrails, service control policies, and CloudTrail/Config baselines, under the direction of the Lead Systems Engineer.
Engineer cloud networking: Transit Gateway, Direct Connect Gateway, Global Accelerator, VPC spoke topologies, PrivateLink, and AWS Network Firewall, integrated with the MPLS backbone and SD-WAN overlay at NNI boundary points.
Author and extend Terraform modules for cloud infrastructure. Every change flows through Terraform Enterprise and GitLab CI/CD with policy gates; no direct-to-production applies.
Deploy and operate tenant compute and workspace services, including AWS WorkSpaces VDI in STIG-hardened configurations and tenant account guardrails.
Operate the identity stack: AWS IAM Identity Center, AD Connector, self-managed Active Directory, and PrivacyIDEA RADIUS MFA.
Engineer security telemetry into the centralized OpenSearch SIEM, integrating Security Hub, GuardDuty, and Nessus/Tenable findings to sustain continuous monitoring under the platform's C-ATO posture.
Apply and maintain KMS CMK encryption baselines, AWS Backup vaults, and STIG/CIS hardening across cloud workloads; produce configuration evidence that maps to NIST 800-53 Rev 5 and 800-171 controls.
Support FedRAMP Moderate and CMMC Level 2 assessments with cloud-layer artifacts, POA&M inputs, and continuous monitoring data.
Work alongside the Lead Systems Engineer and network engineering team to keep cloud, network, and security layers integrated at every boundary.
Execute tenant onboarding runbooks for the cloud layer: account provisioning, boundary controls, telemetry enrollment, and operational handoff to GCC/CSOC.
Contribute to the structured runbook catalog for security, platform, and recovery operations, and feed operational lessons back into Terraform modules and landing zone baselines.