Google Cloud Architect

Position Overview

The Senior GCP Architect serves as the principal technical authority and platform strategist across the DOT enterprise cloud ecosystem. Operating within OST Shared Services, this role provides technical governance and architectural oversight for independent GCP development teams.  The candidate is responsible for reviewing and approving architectural changes, enforcing zero-trust landing zone patterns, and engineering an enterprise Continuous Authorization to Operate (ATO) framework across Commercial, FedRAMP Moderate, and FedRAMP High Assured Workloads enclaves. 

Key Responsibilities

GCP Enterprise Architecture & IaC Blueprinting

• Design, maintain, and govern multi-folder GCP landing zones using Assured Workloads for FedRAMP Moderate and FedRAMP High compliance boundaries. Enforce organizational policies, data residency constraints, and CMEK governance via Cloud KMS.
• Maintain clear technical boundaries separating OST Shared Services management responsibilities (Palo Alto MIG firewalls, HA VPN tunnels, central Cloud DNS, Infoblox, Network Connectivity Center hubs) from tenant Mode application workloads.
• Work with development teams to author and manage enterprise-grade, modular Terraform code. Standardize JSON/YAML parameter structures to automate landing zone vending, subnet allocation, and zero-trust IAM roles.
• Implement VPC Service Controls perimeters, Workload Identity Federation, Service Account governance, and fine-grained Role-Based Access Control (RBAC) across shared and tenant projects.

DevSecOps Architecture, CI/CD, & Continuous Compliance

• Architect enterprise CI/CD deployment pipelines using GitHub Actions (utilizing self-hosted runners in isolated management VPCs) and Jenkins. Integrate automated SAST, DAST, and dependency scanning into pull request workflows.
• Establish continuous authorization baselines aligning with NIST SP 800-53, FedRAMP High/Moderate, and federal directives. Automate real-time compliance validation and drift detection via IaC execution pipelines.
• Design centralized logging and monitoring pipelines, configuring Cloud Logging sinks to route security audit and network telemetry to Pub/Sub, Dataflow, and downstream log storage (Elastic Cloud, Splunk).

Unified Cloud Portal Integration & API Orchestration

• Lead the architectural integration between user-facing web applications and backend GCP API execution platforms for self-service infrastructure provisioning.
• Define end-to-end orchestration standards for automated user requests, including project vending, dynamic terraform plan and terraform apply executions, state tracking, and error handling.
• Implement cross-boundary authentication protocols mapping user credentials to GCP resources using SAML 2.0, Entra ID, Keycloak, and OIDC federated single sign-on.

4. Enterprise AI Ecosystem & Model Governance

• Formulate architectural standards for integrating enterprise AI services, including Gemini foundation models, Vertex AI endpoints, and custom generative AI pipelines within Assured Workloads enclaves.
• Establish secure private access patterns using Private Service Connect (PSC), VPC Service Controls, and Customer-Managed Encryption Keys (CMEK) to protect training datasets and model interaction history.
• Oversee ethical AI compliance, prompt security boundaries, data leakage prevention (DLP), and continuous monitoring of AI payload invocations.

Required Qualifications & Experience

• Experience Level: 8+ years of progressive experience in cloud engineering, IT infrastructure, and DevSecOps, including 4+ years acting as a Lead GCP Engineer or Cloud Architect within complex multi-tenant enterprise environments.
• GCP Architecture Proficiency: Proven track record of architecting enterprise GCP environments, including Shared VPC topologies, Interconnect/HA VPN routing, Palo Alto NGFW integration, VPC-SC perimeters, and GKE cluster governance.
• Compliance & Security Controls: Practical understanding of FedRAMP Moderate/High compliance frameworks, Assured Workloads boundaries, DoD Iron Bank container assets, and continuous monitoring practices.

Preferred Qualifications & Clearances

• Multi-Cloud Awareness: Operational architectural understanding of AWS (GovCloud/Commercial) or Microsoft Azure to manage cross-cloud identity federation and hybrid network connectivity.
• Terraform Engineering: Expertise in modular Terraform design, remote state administration, plan/apply automation pipelines, dynamic data parsing, and drift resolution is desirable but not required. 
• DevSecOps & Pipeline Automation: Advanced knowledge of GitHub Actions (including runner pool architecture), Jenkins, and Git branching strategies for immutable cloud deployments.
• Security Clearance: Must possess or be eligible to obtain a Public Trust

Preferred Certifications

• Google Cloud Certified Professional Cloud Architect (Highly Preferred)
• Google Cloud Certified Professional Cloud Security Engineer

Note: Candidate must be a U.S. citizen and the ability to obtain a public trust