Google Cloud Architect
About The Position
The Senior GCP Architect serves as the principal technical authority and platform strategist across the DOT enterprise cloud ecosystem within OST Shared Services. The role provides technical governance and architectural oversight for independent GCP development teams. It is responsible for reviewing and approving architectural changes, enforcing zero-trust landing zone patterns, and engineering an enterprise Continuous Authorization to Operate (ATO) framework across Commercial, FedRAMP Moderate, and FedRAMP High Assured Workloads enclaves. The architect designs, maintains, and governs GCP landing zones and infrastructure-as-code blueprints; defines DevSecOps pipelines and continuous compliance practices; leads integration between self-service web applications and GCP API execution platforms; and establishes architecture and governance for enterprise AI services within Assured Workloads enclaves.
Requirements
- At least 8 years of progressive experience in cloud engineering, IT infrastructure, and DevSecOps.
- At least 4 years acting as a Lead GCP Engineer or Cloud Architect in complex multi-tenant enterprise environments.
- Proven experience architecting enterprise GCP environments, including Shared VPC topologies, Interconnect/HA VPN routing, Palo Alto NGFW integration, VPC-SC perimeters, and GKE cluster governance.
- Practical understanding of FedRAMP Moderate/High compliance frameworks, Assured Workloads boundaries, DoD Iron Bank container assets, and continuous monitoring practices.
- Must be a U.S. citizen.
- Must possess or be eligible to obtain a Public Trust.
Nice To Haves
- Operational architectural understanding of AWS (GovCloud/Commercial) or Microsoft Azure for cross-cloud identity federation and hybrid network connectivity.
- Expertise in modular Terraform design, remote state administration, plan/apply automation pipelines, dynamic data parsing, and drift resolution; desirable but not required.
- Advanced knowledge of GitHub Actions, including runner pool architecture, Jenkins, and Git branching strategies for immutable cloud deployments.
- Google Cloud Certified Professional Cloud Architect certification (highly preferred).
- Google Cloud Certified Professional Cloud Security Engineer certification.
Responsibilities
- Design, maintain, and govern multi-folder GCP landing zones using Assured Workloads for FedRAMP Moderate and FedRAMP High compliance boundaries.
- Enforce organizational policies, data residency constraints, and CMEK governance through Cloud KMS.
- Maintain technical boundaries between OST Shared Services management responsibilities and tenant-mode application workloads.
- Work with development teams to author and manage modular, enterprise-grade Terraform code.
- Standardize JSON/YAML parameter structures to automate landing zone vending, subnet allocation, and zero-trust IAM roles.
- Implement VPC Service Controls perimeters, Workload Identity Federation, service account governance, and fine-grained RBAC across shared and tenant projects.
- Architect enterprise CI/CD deployment pipelines using GitHub Actions and Jenkins.
- Integrate automated SAST, DAST, and dependency scanning into pull request workflows.
- Establish continuous authorization baselines aligned with NIST SP 800-53, FedRAMP High/Moderate, and federal directives.
- Automate real-time compliance validation and drift detection through IaC execution pipelines.
- Design centralized logging and monitoring pipelines, routing security audit and network telemetry through Cloud Logging sinks, Pub/Sub, and Dataflow to downstream storage.
- Lead integration between user-facing web applications and backend GCP API execution platforms for self-service infrastructure provisioning.
- Define orchestration standards for automated user requests, including project vending, Terraform plan/apply executions, state tracking, and error handling.
- Implement cross-boundary authentication protocols connecting user credentials to GCP resources using SAML 2.0, Entra ID, Keycloak, and OIDC federated single sign-on.
- Formulate architecture standards for Gemini foundation models, Vertex AI endpoints, and custom generative AI pipelines within Assured Workloads enclaves.
- Establish secure private access patterns using Private Service Connect, VPC Service Controls, and CMEK to protect training datasets and model interaction history.
- Oversee ethical AI compliance, prompt security boundaries, data leakage prevention, and continuous monitoring of AI payload invocations.
- Review and approve architectural changes and provide technical governance for GCP development teams.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
Education Level
No Education Listed
