Google Cloud Architect

SAIC•Washington, DC

14h

About The Position

The Senior GCP Architect serves as the principal technical authority and platform strategist across the DOT enterprise cloud ecosystem within OST Shared Services. The role provides technical governance and architectural oversight for independent GCP development teams, reviews and approves architectural changes, enforces zero-trust landing zone patterns, and engineers an enterprise Continuous Authorization to Operate (ATO) framework across Commercial, FedRAMP Moderate, and FedRAMP High Assured Workloads enclaves. The architect designs and governs multi-folder GCP landing zones, enterprise infrastructure-as-code blueprints, DevSecOps deployment pipelines, continuous compliance capabilities, and integrations for self-service infrastructure provisioning. The role also establishes architecture for enterprise AI services and model governance within Assured Workloads enclaves, with attention to security, privacy, encryption, and compliance.

Requirements

At least 8 years of progressive experience in cloud engineering, IT infrastructure, and DevSecOps.
At least 4 years of experience acting as a Lead GCP Engineer or Cloud Architect in complex multi-tenant enterprise environments.
Proven experience architecting enterprise GCP environments, including Shared VPC topologies, Interconnect/HA VPN routing, Palo Alto NGFW integration, VPC Service Controls perimeters, and GKE cluster governance.
Practical understanding of FedRAMP Moderate/High compliance frameworks, Assured Workloads boundaries, DoD Iron Bank container assets, and continuous monitoring practices.
Must be a U.S. citizen.
Must possess or be eligible to obtain a Public Trust.

Nice To Haves

Operational architectural understanding of AWS GovCloud/Commercial or Microsoft Azure for cross-cloud identity federation and hybrid network connectivity.
Expertise in modular Terraform design, remote state administration, plan/apply automation pipelines, dynamic data parsing, and drift resolution.
Advanced knowledge of GitHub Actions, including runner pool architecture, Jenkins, and Git branching strategies for immutable cloud deployments.
Google Cloud Certified Professional Cloud Architect certification (highly preferred).
Google Cloud Certified Professional Cloud Security Engineer certification.

Responsibilities

Design, maintain, and govern multi-folder GCP landing zones using Assured Workloads for FedRAMP Moderate and FedRAMP High compliance boundaries.
Enforce organizational policies, data-residency constraints, and Cloud KMS customer-managed encryption key (CMEK) governance.
Maintain technical boundaries between OST Shared Services management responsibilities and tenant-mode application workloads.
Work with development teams to author and manage modular, enterprise-grade Terraform code.
Standardize JSON/YAML parameters to automate landing-zone provisioning, subnet allocation, and zero-trust IAM roles.
Implement VPC Service Controls perimeters, Workload Identity Federation, service-account governance, and fine-grained RBAC across shared and tenant projects.
Architect enterprise CI/CD pipelines using GitHub Actions and Jenkins, including self-hosted runners in isolated management VPCs.
Integrate automated SAST, DAST, and dependency scanning into pull-request workflows.
Establish continuous authorization baselines aligned with NIST SP 800-53, FedRAMP High/Moderate, and federal directives.
Automate real-time compliance validation and drift detection through IaC execution pipelines.
Design centralized logging and monitoring pipelines, routing security audit and network telemetry through Cloud Logging sinks, Pub/Sub, and Dataflow to downstream storage such as Elastic Cloud and Splunk.
Lead integration between user-facing web applications and backend GCP API execution platforms for self-service infrastructure provisioning.
Define orchestration standards for automated user requests, including project vending, Terraform plan/apply execution, state tracking, and error handling.
Implement cross-boundary authentication mapping user credentials to GCP resources using SAML 2.0, Entra ID, Keycloak, and OIDC federated single sign-on.
Formulate architecture standards for Gemini foundation models, Vertex AI endpoints, and custom generative AI pipelines within Assured Workloads enclaves.
Establish secure private access patterns using Private Service Connect, VPC Service Controls, and CMEK to protect training datasets and model interaction history.
Oversee ethical AI compliance, prompt security boundaries, data leakage prevention, and continuous monitoring of AI payload invocations.
Review and approve architectural changes and provide technical governance for independent GCP development teams.