What is the Opportunity?The Federal Security Architect owns and develops Aecon's federal security architecture. It produces integrated designs, reference patterns, decisions, technical acceptance criteria, and as-built baselines for federal contracting environments. The role turns applicable requirements into implementable solutions that protect Controlled Unclassified Information (CUI), Federal Contract Information (FCI), and other applicable controlled information while supporting reliable business operations.
Reporting to the Manager, US IT Operations, Federal, the architect partners with the Federal Information Security Lead and guides Systems, Infrastructure and Applications teams and providers. The role provides required documented technical concurrence and bounded hands-on prototyping, troubleshooting, and validation. Platform operation, control ownership, project management, and approval authorities remain with designated owners.
What You'll Do Here: Enclave Architecture & Strategy
- Own the Federal Enclave architecture baseline and roadmap for applicable federal requirements.
- Develop integrated designs across identity, cloud, endpoints, networks, applications, and providers.
- Define boundaries, segmentation, data flows, controlled exchange, and physical-output and printing paths.
- Produce reference patterns, configuration standards, and decision records with trade-offs and limitations.
- Give Federal IT management prioritized design decisions, options, technical risks, and escalations.
CMMC & NIST Compliance Leadership
- Translate applicable contract and control requirements with Compliance and Legal into practical designs.
- Partner with the Federal Information Security Lead on control coverage, inheritance, and exception analysis.
- Develop test criteria and technical evidence requirements using applicable NIST SP 800-171A methods.
- Maintain System Security Plan narratives and technical remediation inputs to Plans of Action and Milestones.
- Assess change impacts; authorized information owners and Legal retain information-applicability and legal decisions.
Security Engineering & Risk Management
- Personally design and validate controls, threat and failure scenarios, and technical remediation options.
- Document gaps; exceptions or proposed compensating controls do not themselves meet mandatory requirements.
- Design privileged access, least privilege, separation of duties, and secure administrative workflows.
- Provide required documented technical concurrence before design or change approval; escalate unresolved objections to authorized system, security, and risk owners for resolution.
- Design logging, monitoring, retention, and response interfaces; operations retain incident command and daily execution.
Microsoft GCC High & Cloud Architecture
- Design Microsoft 365/Azure government-cloud and GCC High solutions within service and enclave boundaries.
- Design secure government-cloud collaboration, identity, endpoint, threat, and information-protection capabilities.
- Design SAML/SCIM, Conditional Access, MFA, privileged access, and Zero Trust identity patterns.
- Design labeling, data-loss prevention, access, placement, and exchange with authorized information owners.
Governance & Documentation
- Maintain architecture baselines, boundary and data-flow diagrams, standards, and implementation records.
- Keep approved designs, as-built configurations, inventories, and technical control narratives current.
- Produce handoffs with validation results, limitations, rollback, support ownership, and technical evidence.
- Preserve accountable approvals: authorized owners retain risk acceptance, exceptions, production authorization, legal/HR decisions, and required SPRS affirmations; independent assessors retain assessment conclusions.
Vendor & Solution Assessments
- Challenge provider capabilities, designs, data handling, and integration assumptions against federal requirements.
- For applicable FedRAMP services, verify the authorized boundary; labels or encryption do not prove compliance.
- Document internal, provider, inherited, and customer-retained build, control, and evidence responsibilities.
- Lead proofs of concept and technical testing; record concurrence, limitations, and unresolved objections.
Cross-Functional Leadership
- Guide technical teams/providers on test environments, configuration, integration, troubleshooting, and validation.
- Own architecture and acceptance criteria; assigned teams retain build, operations, and control-evidence duties.
- The delivery PM owns plans, backlog, schedule, budget, vendor follow-up, test tracking, and handoff coordination.
- Explain designs and evidence at audits; mentor teams without assuming security-lead, risk, or approval authority.
What You Bring to the Team:- Bachelor's degree in Information Technology, Computer Science, Cybersecurity, Engineering, or a related field.
- An equivalent combination of education, certifications, and relevant experience may be considered.
- Eight or more years of relevant IT infrastructure, cybersecurity, cloud engineering, or architecture experience.
- Five or more years designing or delivering security architectures and secure integrations for federal government, defense, or federal-contractor environments.
- Demonstrated NIST SP 800-171 control implementation in operating contractor CUI environments; agency RMF/ATO familiarity alone is insufficient.
- Personal ownership of designs, decisions, acceptance, troubleshooting, and assessment evidence, not policy coordination alone.
- Practical Microsoft 365/Azure government-cloud security-design experience; GCC High preferred, or demonstrably transferable government-cloud architecture experience.
- U.S. Citizenship required due to federal contract obligations.
Required Technical Expertise
- CMMC Level 2, NIST SP 800-171 and 800-171A, and applicable DFARS/SPRS obligations
- Control requirements translated into implementable designs, test criteria, and technical evidence
- Federal enclave boundaries, CUI data flows, and end-to-end secure integration
- Zero Trust architecture, network segmentation, and trust relationships
- Microsoft Entra ID, Conditional Access, MFA, and privileged access
- SAML authentication, SCIM provisioning, and secure application integration
- Audit logging, monitoring, evidence retention, and operational handoff
- Endpoint protection, vulnerability remediation, and control-failure analysis
- Threat modeling, technical risk analysis, and remediation alternatives
- Cloud/SaaS security and shared responsibilities; RMF/FedRAMP literacy complements direct CUI implementation
Preferred Certifications and Training
- Certified CMMC Professional (CCP)
- Information Systems Security Architecture Professional (ISSAP)
- Certified Information Systems Security Professional (CISSP)
- Microsoft Certified: Cybersecurity Architect Expert
- Certified Cloud Security Professional (CCSP)
- Certified Information Security Manager (CISM)
- Relevant Microsoft or CMMC assessment training; this role is not the independent certification assessor
Core Competencies
- Independent federal architectural judgment and ownership of integrated technical solutions.
- Practical control engineering that bridges requirements, implementation, testing, and operations.
- Clear technical writing, diagrams, standards, and decision records.
- Constructive challenge of unsupported claims and sound analysis of trade-offs.
- Evidence-based technical acceptance and transparent escalation of unresolved issues.
- Ability to explain complex security designs to technical, business, and executive audiences.
- Technical leadership, mentoring, and collaboration across delivery and operational teams.
- Pragmatic prioritization without transferring others' control ownership or exceeding delegated authority.
