Secure Cloud Architect

Booz Allen Hamilton•Annapolis Junction, MD

About The Position

The Secure Cloud Architect designs and governs end-to-end AWS environments for mission-critical Retrieval Augmented Generation (RAG) and data integration systems. The role defines technical strategy across development, staging, and production while ensuring architectural decisions meet security, compliance, and operational-readiness standards. This includes designing VPC and subnet topology, selecting OpenSearch deployment models, shaping Amazon Bedrock integration patterns, and setting standards for availability, scalability, and cost control. The architect owns the security control framework for implementation, including IAM least-privilege boundaries, KMS key policies, secrets lifecycle management, and data access controls for Bedrock, OpenSearch, and application services. The role drives architecture decision records, resolves cross-team technical tradeoffs, and aligns cloud and security patterns with mission outcomes. It works closely with security, application, data, and reliability engineers to keep the system secure, high-performing, and ready for deployment across implementation phases. The position also offers opportunities to strengthen AWS cloud architecture, AI/ML infrastructure security, Amazon Bedrock, OpenSearch, infrastructure automation, and cloud security engineering skills, and to mentor cloud security experts.

Requirements

Experience designing and governing end-to-end AWS architectures, including VPC topology, subnet design, routing, secure connectivity patterns, and multi-environment deployment strategies.
Experience designing identity and access protections, including IAM least-privilege architectures, role segmentation, and policy governance.
Experience designing KMS key strategies, encryption standards, and secrets lifecycle management practices.
Experience assessing security risks in cloud service integrations, including Amazon Bedrock, OpenSearch, Lambda, ECS or EKS, and cloud data storage services.
Experience producing architecture decision records and guiding teams through cloud architecture tradeoff decisions.
Experience interpreting and applying security controls, compliance requirements, and accreditation-aligned architectural patterns.
Experience integrating logging, monitoring, and security event capture into cloud architectures.
Ability to communicate complex architectural decisions and collaborate with application, security, data, and DevOps teams.
TS/SCI clearance.
High school diploma or GED.

Nice To Haves

Experience designing or securing OpenSearch clusters, including index lifecycle planning, shard configuration, encryption, and access controls.
Experience implementing Amazon Bedrock model strategies, including secure model invocation, model orchestration, and cross-service IAM permissions.
Experience with hybrid or air-gapped cloud architectures and secure enclave designs.
Experience implementing container security patterns with ECS, EKS, or Kubernetes, including runtime hardening and boundary protections.
Experience performing threat modeling, risk assessments, or cloud-native security reviews.
Experience with Infrastructure-as-Code frameworks, including Terraform, CloudFormation, or AWS CDK, and secure configuration pipelines.
Experience defining security guardrails, baselines, or governance frameworks for cloud adoption.
AWS Solutions Architect Professional, AWS Security Specialty, CISSP, or equivalent cloud security certification.

Responsibilities

Design and govern end-to-end AWS architectures, including VPC and subnet topology, OpenSearch deployment models, and Amazon Bedrock integration patterns.
Define cloud strategies for development, staging, and production environments.
Establish architectural standards for availability, scalability, and cost control.
Own the implementation security control framework, including IAM least-privilege boundaries, KMS key policies, secrets lifecycle management, and data access controls.
Produce architecture decision records and guide teams through cloud architecture tradeoffs.
Ensure cloud and security patterns align with mission outcomes, security and compliance needs, and operational-readiness standards.
Partner with security engineers, application engineers, data teams, and reliability engineers to prepare systems for deployment across implementation phases.
Mentor cloud security experts.