Lead AWS Platform Architect

Select Source Solutions•Greenbelt, MD

20h•Remote

About The Position

The Lead AWS Platform Architect provides senior technical leadership for a mission-critical cloud platform in a remote work environment. This hands-on architecture and platform-engineering role focuses on AWS, Amazon EKS, Terraform, GitOps, CI/CD, security, and federal cloud compliance. Infrastructure and application changes are managed through code, peer review, and deployment pipelines rather than manual console configuration. The role owns platform architecture and implementation across multiple AWS environments and helps guide the evolution toward a secure, multi-account federal cloud architecture. The architect designs and implements cloud architecture, reusable Terraform modules, EKS operations, GitOps workflows, CI/CD security controls, and production troubleshooting. The role also supports compliance controls and evidence for security assessments and Authority to Operate activities, while mentoring engineers and raising standards for security, automation, change control, and operations.

Requirements

At least 7 years of professional experience in cloud infrastructure, platform engineering, DevOps, systems engineering, or a related discipline, including senior ownership of production environments.
At least 5 years of hands-on experience engineering and supporting AWS cloud environments.
Deep hands-on Terraform expertise, including reusable modules, remote state, dependency management, and infrastructure drift remediation.
Significant experience operating Amazon EKS or Kubernetes at production scale.
Experience with Kubernetes networking, workload identity, Helm, autoscaling, ingress, load balancing, and cluster lifecycle management.
Strong hands-on experience with AWS services including VPC, IAM, EKS, RDS/Aurora, S3, CloudFront, Secrets Manager, and related technologies.
Experience designing or supporting multi-environment and multi-account AWS architectures.
Hands-on experience implementing GitOps using Argo CD, Flux, or comparable technologies.
Experience designing and maintaining CI/CD pipelines; GitLab CI/CD is strongly preferred.
Hands-on DevSecOps experience implementing automated security scanning, secrets detection, Infrastructure as Code scanning, container scanning, policy-as-code, or pipeline security gates.
Experience with Docker and secure containerized application environments.
Experience supporting cloud-native, microservices, or serverless architectures.
Working knowledge of federal cybersecurity frameworks such as FISMA, NIST SP 800-53, and RMF.
Familiarity with technical evidence and controls required to support an Authority to Operate.
Strong troubleshooting, architecture, documentation, and communication skills.
Demonstrated ability to mentor engineers and provide technical leadership.
Ability to obtain and maintain a U.S. Government security clearance.

Nice To Haves

Experience designing or operating AWS Organizations, Control Tower, federal landing zones, or comparable multi-account architectures.
Experience with AWS GovCloud or FedRAMP-authorized cloud environments.
Experience with container supply-chain security, SBOMs, image signing, admission control, or AWS Signer.
Experience with CloudWatch, Grafana, Prometheus, or comparable observability platforms.
Experience supporting FISMA Moderate or other regulated production environments.
Experience with high-availability, mission-critical cloud systems.
Familiarity with scientific, environmental, weather, geospatial, or other data-intensive systems.
Familiarity with scientific data formats such as GRIB or NetCDF.
Relevant AWS, Kubernetes, Terraform, or DevOps certifications.

Responsibilities

Serve as a senior technical lead for AWS platform architecture, engineering, security, and automation.
Own and evolve Terraform across multi-environment and multi-account AWS infrastructure; develop reusable modules and manage remote state, dependencies, lifecycle, and infrastructure drift.
Safely reconcile existing AWS resources with Infrastructure as Code.
Design, operate, and improve production Amazon EKS environments, including networking, autoscaling, add-ons, workload identity, Helm, ingress, load balancing, upgrades, and cluster lifecycle.
Design and maintain secure AWS networking and identity patterns, including IAM, workload identity, network isolation, secrets management, and least-privilege access.
Develop and extend GitOps deployment models using Argo CD, Flux, or comparable technologies.
Design and maintain GitLab CI/CD pipelines for infrastructure and application delivery.
Implement automated security controls, including SAST, Infrastructure as Code scanning, container scanning, secrets detection, policy-as-code, and deployment gates.
Support secure container supply-chain practices, including image validation, signing, and deployment controls.
Help design and implement a federal multi-account AWS landing-zone architecture, including cross-account identity, networking, environment isolation, and controlled promotion between environments.
Work with AWS services including VPC, IAM, EKS, RDS/Aurora, S3, CloudFront, Secrets Manager, and Lambda, and support cloud-native, containerized, microservices, and serverless architectures.
Implement monitoring, logging, alerting, and continuous security visibility across the platform.
Support technical implementation of controls aligned with NIST SP 800-53, FISMA, RMF, and Authority to Operate requirements; produce and maintain technical evidence for assessments, compliance reviews, and ATO activities.
Troubleshoot complex AWS, Kubernetes, Terraform, networking, GitOps, CI/CD, and security issues.
Mentor engineers and provide technical direction on cloud architecture, automation, Kubernetes, Infrastructure as Code, and DevSecOps practices.
Improve engineering standards for peer review, change management, deployment validation, documentation, and evidence-based operations.
Collaborate with developers, security teams, architects, program stakeholders, and other technical personnel.
Perform other related technical responsibilities as assigned.