Senior Cybersecurity Architect (Cloud)

Purpose and scopeThe Senior Cloud Security Architect is a hands-on senior engineering position that designs builds deploys and maintains security controls across commercial and government cloud environments including Microsoft 365 Commercial and GCC High Azure AWS and hybrid services. Its scope includes software platform infrastructure virtual desktop and approved cloud-based artificial intelligence services. The role leads technical design for complex work while remaining directly involved in configuration infrastructure as code deployment automation testing troubleshooting control validation and operational support. A central responsibility is establishing and implementing the security patterns that allow the organization to adopt generative AI machine learning enterprise copilots and agentic systems safely across commercial government and CUI environments. It applies government defense-industry privacy and international security frameworks to practical technical designs. This role reports to the Senior Cybersecurity Architect & Senior Manager.Essential responsibilitiesCloud security engineering and designDesign and implement security controls and reusable patterns across Microsoft 365 Commercial and GCC High Azure AWS and hybrid services including cloud guardrails landing zones workload protections and virtual desktop environments.Design and implement security architectures for generative AI machine learning enterprise copilot and agentic systems including secure access data protection identity logging content safety and human-oversight controls. Evaluate AI services and integrations for threats such as prompt injection data leakage excessive permissions insecure model or plugin connections and unauthorized use of sensitive or CUI data. Establish reusable governance and technical patterns for the secure adoption monitoring testing and lifecycle management of AI capabilities across commercial government and hybrid cloud environments.Perform hands-on configuration testing troubleshooting and tuning for complex cloud security implementations and platform integrations.Build and maintain reusable infrastructure-as-code components and deployment automation for security policies controls and platform onboarding.Lead focused design reviews and threat modeling for new services major changes and higher-risk use cases then help implement the approved approach.Cloud security platforms and operationsEngineer and administer cloud security posture management and workload protection capabilities including environment onboarding policy configuration security recommendations coverage alert integrations and platform health.Lead complex platform changes and escalations while sharing implementation tuning and support work with the Cloud Security Engineer.Integrate cloud security telemetry with enterprise monitoring and response platforms and support escalated investigations when cloud expertise is needed.Partner with Vulnerability Management on exposure prioritization and tracking and work with cloud platform owners on practical remediation approaches.Government cloud and compliance engineeringDesign and validate technical controls that support CMMC and applicable NIST requirements including NIST SP 800-171 and NIST SP 800-172.Develop secure patterns for Microsoft 365 GCC High and CUI workloads that account for tenant and security boundaries government-cloud service limitations data handling requirements and controlled connectivity with commercial environments.Translate applicable requirements from DFARS ITAR ISO 27001 Australia DISP UK Cyber Essentials Plus GDPR and other relevant frameworks into implementable technical control objectives in coordination with Risk and Compliance.Lead technical risk assessments and control testing document compensating controls and exceptions and provide implementation evidence and technical support for internal and external assessments.Artificial intelligence and agent securityDesign and implement reusable security patterns for AI and machine-learning services enterprise copilots generative AI applications retrieval-augmented generation agents model and data integrations and automated tools.Define and configure identity and access controls data-source permissions agent and workload identities secrets handling execution boundaries sandboxing tool restrictions human approval controls network egress and audit logging.Lead threat modeling and hands-on security testing for risks such as prompt injection indirect prompt injection sensitive-data exposure unsafe tool execution excessive agency over-privileged connectors and manipulation of models or grounding content.Evaluate AI platforms models services and new features for security privacy data residency government-cloud availability CUI suitability and integration risk document required controls and approved conditions of use.Develop reference implementations infrastructure-as-code components deployment automation and validation methods that allow AI safeguards to be applied consistently.Define AI telemetry and investigation requirements with Security Operations and Detection Engineering then support escalated investigations control improvements and secure recovery when specialized cloud or AI expertise is needed.Collaboration and technical leadershipIntegrate Identity Network Security Data Security Vulnerability Management and Security Operations requirements into cloud implementations while keeping ownership with the responsible teams.Provide practical design and engineering guidance to cloud platform owners application teams IT and connected program sites including options and tradeoffs when requirements compete.Maintain configuration standards implementation guides reusable deployment patterns diagrams threat models operating procedures and decision records.Translate applicable security and regulatory requirements into technical control objectives and provide technical evidence or input for assessments and audits when requested.Mentor engineers review technical work and provide hands-on support for complex cloud and AI security issues without assuming personnel-management responsibility.Performs other duties as assigned.Knowledge Skills & AbilitiesStrong hands-on knowledge of Microsoft cloud or AWS security capabilities.Ability to explain technical decisions tradeoffs and risk clearly to engineering teams leaders and non-technical stakeholders.Minimum qualificationsU.S. citizenship is required for this position.Typically eight or more years of relevant experience to include five years in cloud security systems or infrastructure engineering including hands-on responsibility for design and implementation with a Bachelors degree in cybersecurity information technology computer science engineering or a related field or an equivalent combination of education and relevant experience.Strong hands-on knowledge of Microsoft cloud or AWS security capabilities demonstrated by practical experience supporting Microsoft 365 Azure AWS and hybrid services.Experience designing deploying and troubleshooting controls for cloud identity network segmentation data protection logging posture management and workload protection.Experience applying cloud security principles to AI or machine-learning services generative AI applications enterprise copilots agents or comparable automated platforms including threat modeling and control design.Experience using infrastructure as code source control scripting and deployment automation to implement and maintain cloud controls.Experience with threat modeling technical risk assessment and translating security or regulatory requirements into working technical solutions.Preferred qualificationsExperience with a cloud security posture management workload protection or cloud-native application protection platform.Experience supporting government defense-industrial-base CUI or other regulated cloud environments through assessments audits or major control implementations.Hands-on experience with Microsoft 365 GCC High or a comparable government cloud environment including regulated-data boundaries service limitations and cross-environment design considerations.Working knowledge of government and defense-industry security requirements including CMMC NIST SP 800-171 and NIST SP 800-172 concepts.Familiarity with DFARS ITAR ISO 27001 Australia DISP UK Cyber Essentials Plus GDPR or comparable regulatory and international requirements.Hands-on experience securing retrieval-augmented generation agentic workflows AI connectors and tools model or data integrations or AI security monitoring.A relevant security or cloud architecture certification such as CISSP CCSP an Azure or AWS security or architecture certification or comparable training.Work environment physical demands and mental demandsTypical office environment with no unusual hazards occasional lifting up to 50 pounds constant sitting while using a computer terminal constant use of sight while reviewing documents constant use of speech and hearing for communication constant mental alertness and the ability to plan and organize work and meet deadlines. Other related cloud security duties may be assigned. Compensation Details150K - 165K The compensation range or hourly rate listed for this position is provided as a good-faith estimate of what the company intends to offer for this role at the time this posting was issued. Actual compensation may vary based on factors such as job responsibilities education experience skills internal equity market data applicable collective bargaining agreements and relevant laws.Benefits OverviewOur health and welfare benefits are designed to support you and your priorities. Offerings includeHealth dental and vision insurancePaid time off and holidaysRetirement benefits including 401k matchingEducational reimbursementParental leaveEmployee stock purchase planTax-saving optionsDisability and life insurancePet insuranceNote Benefits may vary based on employment type location and applicable agreements. Positions governed by a Collective Bargaining Agreement CBA the McNamara-OHara Service Contract Act SCA or other employment contracts may include different provisionsbenefits. Original PostingAmentum anticipates this job requisition will remain open for at least three days with a closing date no earlier than three days after the original posting. This timeline may change based on business needs. Amentum is proud to be an Equal Opportunity Employer. Our hiring practices provide equal opportunity for employment without regard to race sex sexual orientation pregnancy including pregnancy childbirth breastfeeding or medical conditions related to pregnancy childbirth or breastfeeding age ancestry United States military or veteran status color religion creed marital or domestic partner status medical condition genetic information national origin citizenship status low-income status or mental or physical disability so long as the essential functions of the job can be performed with or without reasonable accommodation or any other protected category under federal state or local law. Learn more about your rights under Federal laws and supplemental language atLabor Laws Posters.