Secure Cloud Architect

Booz Allen Hamilton•Fort Meade, MD

3d•$86,900 - $198,000

About The Position

The Secure Cloud Architect designs and governs end-to-end AWS environments for mission-critical Retrieval Augmented Generation (RAG) and data integration systems. The role defines technical strategy across development, staging, and production environments and ensures architecture meets security, compliance, and operational-readiness standards. The architect shapes VPC and subnet topology, OpenSearch deployment models, Amazon Bedrock integration patterns, and standards for availability, scalability, and cost control. The role owns the security control framework for implementation, including IAM least-privilege boundaries, KMS key policies, secrets lifecycle management, and data access controls for Bedrock, OpenSearch, and application services. The architect produces architecture decision records, resolves cross-team technical tradeoffs, and partners with security, application, data, and reliability engineers to keep systems secure, high-performing, and ready for deployment. The position also involves mentoring cloud security experts and strengthening expertise in AWS architecture, AI/ML infrastructure security, infrastructure automation, and cloud security engineering. Applicants must hold a TS/SCI clearance and a high school diploma or GED. The position’s projected annualized salary range is $86,900 to $198,000. Booz Allen offers health, life, disability, financial, and retirement benefits, paid leave, professional development, tuition assistance, work-life programs, dependent care, and recognition awards. Benefit-program eligibility depends on hours worked; regular employees working at least 20 hours per week are eligible to participate.

Requirements

Experience designing and governing end-to-end AWS architectures, including VPC topology, subnet design, routing, secure connectivity, and multi-environment deployments.
Experience designing identity and access protections, including IAM least-privilege architectures, role segmentation, and policy governance.
Experience designing KMS key strategies, encryption standards, and secrets lifecycle management practices.
Experience assessing security risks in cloud service integrations, including Amazon Bedrock, OpenSearch, Lambda, ECS or EKS, and cloud data storage services.
Experience producing architecture decision records and guiding teams through cloud architecture tradeoff decisions.
Experience interpreting and applying security controls, compliance requirements, and accreditation-aligned architectural patterns.
Experience integrating logging, monitoring, and security event capture into cloud architectures.
Ability to communicate complex architectural decisions and collaborate with application, security, data, and DevOps teams.
TS/SCI clearance is required.
High school diploma or GED.

Nice To Haves

Experience designing or securing OpenSearch clusters, including index lifecycle planning, shard configuration, encryption, and access controls.
Experience implementing Amazon Bedrock model strategies, including secure model invocation, model orchestration, and cross-service IAM permissions.
Experience with hybrid or air-gapped cloud architectures and secure enclave designs.
Experience implementing container security patterns with ECS, EKS, or Kubernetes, including runtime hardening and boundary protections.
Experience performing threat modeling, risk assessments, or cloud-native security reviews.
Experience with Infrastructure-as-Code frameworks such as Terraform, CloudFormation, or AWS CDK, and secure configuration pipelines.
Experience defining security guardrails, baselines, or governance frameworks for cloud adoption.
AWS Solutions Architect Professional, AWS Security Specialty, CISSP, or equivalent cloud security certification.

Responsibilities

Design and govern end-to-end AWS architectures, including VPC and subnet topology, and secure connectivity patterns.
Define cloud strategies for development, staging, and production environments.
Establish standards for availability, scalability, and cost control.
Own the implementation security control framework, including IAM boundaries, KMS key policies, secrets lifecycle management, and data access controls.
Assess and shape secure integration patterns for Amazon Bedrock, OpenSearch, and application services.
Produce architecture decision records and guide teams through cloud architecture tradeoffs.
Apply security controls, compliance requirements, and accreditation-aligned architectural patterns.
Integrate logging, monitoring, and security event capture into cloud architectures.
Collaborate with security, application, data, and DevOps teams to support secure, high-performing deployment across implementation phases.
Mentor cloud security experts.