Google Cloud Architect

SAIC•Washington, DC

About The Position

The Senior GCP Architect serves as the principal technical authority and platform strategist across the DOT enterprise cloud ecosystem within OST Shared Services. The role provides technical governance and architectural oversight for independent GCP development teams, reviews and approves architectural changes, enforces zero-trust landing zone patterns, and engineers an enterprise Continuous Authorization to Operate (ATO) framework across Commercial, FedRAMP Moderate, and FedRAMP High Assured Workloads enclaves. The architect designs and governs GCP landing zones and infrastructure-as-code standards; establishes DevSecOps pipelines and continuous compliance practices; and leads integration between user-facing applications and backend GCP API execution platforms for self-service provisioning. The position also defines secure architecture and governance standards for enterprise AI services, models, and data within Assured Workloads enclaves.

Requirements

At least 8 years of progressive experience in cloud engineering, IT infrastructure, and DevSecOps.
At least 4 years acting as a Lead GCP Engineer or Cloud Architect in complex multi-tenant enterprise environments.
Proven experience architecting enterprise GCP environments, including Shared VPC topologies, Interconnect/HA VPN routing, Palo Alto NGFW integration, VPC Service Controls perimeters, and GKE cluster governance.
Practical understanding of FedRAMP Moderate/High compliance frameworks, Assured Workloads boundaries, DoD Iron Bank container assets, and continuous monitoring practices.
Must be a U.S. citizen.
Must possess or be eligible to obtain a Public Trust.

Nice To Haves

Operational architectural understanding of AWS (GovCloud/Commercial) or Microsoft Azure for cross-cloud identity federation and hybrid network connectivity.
Expertise in modular Terraform design, remote state administration, plan/apply automation pipelines, dynamic data parsing, and drift resolution.
Advanced knowledge of GitHub Actions, including runner pool architecture, Jenkins, and Git branching strategies for immutable cloud deployments.
Google Cloud Certified Professional Cloud Architect certification (highly preferred).
Google Cloud Certified Professional Cloud Security Engineer certification.

Responsibilities

Design, maintain, and govern multi-folder GCP landing zones using Assured Workloads for FedRAMP Moderate and FedRAMP High compliance boundaries.
Enforce organizational policies, data residency constraints, and Cloud KMS customer-managed encryption key governance.
Maintain technical boundaries between OST Shared Services management responsibilities and tenant application workloads.
Work with development teams to author and manage modular Terraform code and standardize JSON/YAML parameters for landing-zone vending, subnet allocation, and zero-trust IAM roles.
Implement VPC Service Controls perimeters, Workload Identity Federation, service-account governance, and fine-grained role-based access control across shared and tenant projects.
Architect enterprise CI/CD pipelines using GitHub Actions with self-hosted runners in isolated management VPCs and Jenkins.
Integrate automated SAST, DAST, and dependency scanning into pull-request workflows.
Establish continuous authorization baselines aligned with NIST SP 800-53, FedRAMP High/Moderate, and federal directives; automate compliance validation and drift detection through IaC pipelines.
Design centralized logging and monitoring pipelines, routing security audit and network telemetry through Cloud Logging sinks, Pub/Sub, and Dataflow to downstream storage such as Elastic Cloud and Splunk.
Lead architectural integration between user-facing web applications and backend GCP API execution platforms for self-service infrastructure provisioning.
Define orchestration standards for automated user requests, including project vending, Terraform plan and apply execution, state tracking, and error handling.
Implement cross-boundary authentication protocols mapping user credentials to GCP resources using SAML 2.0, Entra ID, Keycloak, and OIDC federated single sign-on.
Formulate architecture standards for integrating Gemini foundation models, Vertex AI endpoints, and custom generative AI pipelines within Assured Workloads enclaves.
Establish secure private access patterns using Private Service Connect, VPC Service Controls, and customer-managed encryption keys to protect training datasets and model interaction history.
Oversee ethical AI compliance, prompt security boundaries, data leakage prevention, and continuous monitoring of AI payload invocations.