Senior Cybersecurity Architect (Cloud)

Amentum•Richmond, VA

About The Position

The Senior Cloud Security Architect is a hands-on senior engineering role responsible for designing, building, deploying, and maintaining security controls across commercial and government cloud environments, including Microsoft 365 Commercial and GCC High, Azure, AWS, and hybrid services. The role covers software, platforms, infrastructure, virtual desktops, and approved cloud-based AI services. It leads technical design for complex work while directly contributing to configuration, infrastructure as code, deployment automation, testing, troubleshooting, control validation, and operational support. The position reports to the Senior Cybersecurity Architect & Senior Manager. A central focus is establishing and implementing security patterns that enable safe adoption of generative AI, machine learning, enterprise copilots, and agentic systems across commercial, government, and CUI environments. The architect applies government, defense-industry, privacy, and international security frameworks to practical technical designs, and collaborates with engineering, platform, compliance, and security teams. This is a technical leadership role that includes mentoring and reviewing technical work, but does not assume personnel-management responsibility. The position requires U.S. citizenship and typically eight or more years of relevant experience, including five years in cloud, security, systems, or infrastructure engineering, along with a bachelor's degree in a related field or an equivalent combination of education and experience. The stated compensation range is $150,000–$165,000. The work environment is a typical office setting, with no unusual hazards and occasional lifting up to 50 pounds.

Requirements

U.S. citizenship is required.
Typically eight or more years of relevant experience, including five years in cloud, security, systems, or infrastructure engineering, with hands-on responsibility for design and implementation; a bachelor's degree in cybersecurity, information technology, computer science, engineering, or a related field, or an equivalent combination of education and relevant experience.
Strong hands-on knowledge of Microsoft cloud or AWS security capabilities, demonstrated through practical experience supporting Microsoft 365, Azure, AWS, and hybrid services.
Experience designing, deploying, and troubleshooting controls for cloud identity, network segmentation, data protection, logging, posture management, and workload protection.
Experience applying cloud security principles to AI or machine-learning services, generative AI applications, enterprise copilots, agents, or comparable automated platforms, including threat modeling and control design.
Experience using infrastructure as code, source control, scripting, and deployment automation to implement and maintain cloud controls.
Experience with threat modeling, technical risk assessment, and translating security or regulatory requirements into working technical solutions.
Ability to explain technical decisions, tradeoffs, and risk clearly to engineering teams, leaders, and non-technical stakeholders.

Nice To Haves

Experience with a cloud security posture management, workload protection, or cloud-native application protection platform.
Experience supporting government, defense-industrial-base, CUI, or other regulated cloud environments through assessments, audits, or major control implementations.
Hands-on experience with Microsoft 365 GCC High or a comparable government cloud environment, including regulated-data boundaries, service limitations, and cross-environment design considerations.
Working knowledge of government and defense-industry security requirements, including CMMC and NIST SP 800-171 and NIST SP 800-172 concepts.
Familiarity with DFARS, ITAR, ISO 27001, Australia DISP, UK Cyber Essentials Plus, GDPR, or comparable regulatory and international requirements.
Hands-on experience securing retrieval-augmented generation, agentic workflows, AI connectors and tools, model or data integrations, or AI security monitoring.
A relevant security or cloud architecture certification, such as CISSP, CCSP, an Azure or AWS security or architecture certification, or comparable training.

Responsibilities

Design and implement security controls and reusable patterns across Microsoft 365 Commercial and GCC High, Azure, AWS, and hybrid services, including cloud guardrails, landing zones, workload protections, and virtual desktop environments.
Design and implement security architectures for generative AI, machine learning, enterprise copilots, and agentic systems, including secure access, data protection, identity, logging, content safety, and human-oversight controls.
Evaluate AI services and integrations for prompt injection, data leakage, excessive permissions, insecure model or plugin connections, and unauthorized use of sensitive or CUI data.
Establish reusable governance and technical patterns for secure adoption, monitoring, testing, and lifecycle management of AI capabilities across commercial, government, and hybrid cloud environments.
Configure, test, troubleshoot, and tune complex cloud security implementations and platform integrations.
Build and maintain reusable infrastructure-as-code components and deployment automation for security policies, controls, and platform onboarding.
Lead focused design reviews and threat modeling for new services, major changes, and higher-risk use cases, and help implement approved designs.
Engineer and administer cloud security posture management and workload protection capabilities, including environment onboarding, policy configuration, security recommendations, coverage, alert integrations, and platform health.
Lead complex platform changes and escalations while sharing implementation, tuning, and support work with the Cloud Security Engineer.
Integrate cloud security telemetry with enterprise monitoring and response platforms and support escalated investigations requiring cloud expertise.
Partner with Vulnerability Management to prioritize and track exposure, and work with cloud platform owners on practical remediation approaches.
Design and validate technical controls supporting CMMC and applicable NIST requirements, including NIST SP 800-171 and NIST SP 800-172.
Develop secure patterns for Microsoft 365 GCC High and CUI workloads that account for tenant and security boundaries, government-cloud service limitations, data handling requirements, and controlled connectivity with commercial environments.
Translate requirements from DFARS, ITAR, ISO 27001, Australia DISP, UK Cyber Essentials Plus, GDPR, and other relevant frameworks into implementable technical control objectives in coordination with Risk and Compliance.
Lead technical risk assessments and control testing; document compensating controls and exceptions; and provide implementation evidence and technical support for internal and external assessments.
Define and configure AI and agent security controls, including identity and access, data-source permissions, workload identities, secrets handling, execution boundaries, sandboxing, tool restrictions, human approval, network egress, and audit logging.
Lead threat modeling and hands-on security testing for AI risks including prompt injection, indirect prompt injection, sensitive-data exposure, unsafe tool execution, excessive agency, over-privileged connectors, and manipulation of models or grounding content.
Evaluate AI platforms, models, services, and features for security, privacy, data residency, government-cloud availability, CUI suitability, and integration risk; document required controls and approved conditions of use.
Develop reference implementations, infrastructure-as-code components, deployment automation, and validation methods to apply AI safeguards consistently.
Define AI telemetry and investigation requirements with Security Operations and Detection Engineering, and support escalated investigations, control improvements, and secure recovery when specialized expertise is needed.
Integrate Identity, Network Security, Data Security, Vulnerability Management, and Security Operations requirements into cloud implementations while preserving ownership with the responsible teams.
Provide practical design and engineering guidance to cloud platform owners, application teams, IT, and connected program sites, including options and tradeoffs when requirements compete.
Maintain configuration standards, implementation guides, reusable deployment patterns, diagrams, threat models, operating procedures, and decision records.
Translate security and regulatory requirements into technical control objectives and provide technical evidence or input for assessments and audits when requested.
Mentor engineers, review technical work, and provide hands-on support for complex cloud and AI security issues without assuming personnel-management responsibility.
Perform other duties as assigned.