AWS ProServe Platform Engineer

Major duties and responsibilities

ECMA cARMY onboarding

• Run the ECMA intake end to end:o tenant request package and account vendingo Control Tower / Landing Zone Accelerator guardrails within the ECMA baselineo IAM Identity Center federation to the Army identity providero VPN and boundary connectivity requests• Prepare and track the Government artifacts the program depends on: the Authorizing Official designation memo, the ISSO appointment and the inherited-control matrix.• Use established working relationships with ECMA, the Authorizing Official and SCA-V to keep reviews moving.• Maintain a dependency tracker for every Government-paced item, with owner, submission date and escalation path, reported weekly.• SIPR option: repeat onboarding for IL6, covering the second Authorizing Official chain, SIPR identity binding, the DISA SIPRNet circuit request and classified break-glass access.Landing zone and environments• Deliver reusable, parameterized landing-zone infrastructure code for cARMY: account baseline, service control policies, centralized CloudTrail/Config/log archive, Security Hub, GuardDuty, network baseline with VPC endpoints, and the KMS key hierarchy. NIPR and SIPR must differ only by parameters.• Stand up NIPR development, test and staging by about month 4, and multi-region production by about month 7. Production includes Global Tables and Route 53 failover, with recovery time and recovery point objectives documented and demonstrated.• Integrate with the program's AWS SAM application layer through a defined contract: exported VPC, subnet, endpoint, KMS and logging identifiers. The engagement does not fork or replace the application templates.IL5 boundary, STIG and ATO acceleration• Define the IL5 authorization boundary: boundary and data-flow diagrams, ports, protocols and services, and the split of inherited, shared and system-specific controls with cARMY.• Deliver NIST SP 800-53 Rev. 5 conformance packs and DISA STIG automation for Lambda, API Gateway, DynamoDB and the landing-zone services, with evidence the RMF team can load into eMASS.• Provide System Security Plan templates pre-filled for cARMY-inherited controls, and support the SSP amendment, eMASS submission and SCA-V coordination.• Set up DoD PKI certificate distribution and rotation.Continuous ATO• Provide the continuous-ATO playbook and help stand up the OSCAL/ConMon pipeline: Config and Security Hub feeds, drift detection, the ConMon dashboard and the 30-day evidence period.• Support the Authorizing Official signature campaign toward NIPR continuous ATO at month 12.Migration into cARMY• Plan and execute the move of the demonstrator from the commercial GovCloud account into cARMY: AWS DMS or DynamoDB export and import, cut-over and rollback runbooks, and a full rehearsal. Workloads land in development, test and staging first, then production.Knowledge transfer and exit• Pair with the Lead DevSecOps / SRE throughout. Every artifact is committed to the program repositories, runs through the program pipeline, and is operated at least once by program staff before month 9.• Deliver runbooks and architecture decision records for every landing-zone design decision.

• ECMA cARMY onboarding experience: has taken at least one prior Army tenant through ECMA cARMY onboarding to first authenticated deployment. This is the qualification that defines the role.
• GovCloud landing zones at IL5: Control Tower and/or Landing Zone Accelerator, AWS Organizations and service control policies, IAM Identity Center, centralized logging, Security Hub, GuardDuty, AWS Config conformance packs.
• DoD authorization: DoD Cloud Computing SRG, RMF, NIST SP 800-53 Rev. 5 and eMASS, with direct experience of Authorizing Official and SCA-V review cycles. Prior continuous-ATO or ConMon delivery is strongly preferred.
• Infrastructure as code: production-quality CloudFormation / AWS SAM. CDK (Landing Zone Accelerator) or Terraform is acceptable where the output integrates with the SAM application layer.
• Serverless platform depth: Lambda, API Gateway, DynamoDB (Global Tables, point-in-time recovery, Streams, capacity), EventBridge, SQS, KMS, WAF, VPC endpoints, Route 53 failover.
• Data migration: AWS DMS and DynamoDB export and import.
• Hardening: DISA STIG automation for cloud and serverless resources.
• Experience and education: 10+ years in cloud infrastructure, including 5+ years in AWS GovCloud or DoD environments. Bachelor's in IT, CS or a related field, or equivalent experience.

• AWS Certified SysOps Administrator – Associate or higher is required. This is the labor-category minimum and cannot be waived.
• AWS Certified Solutions Architect – Professional is expected for this engagement.
• AWS Certified Security – Specialty or DevOps Engineer – Professional is preferred.
• The engineer must be DoD 8140 compliant for the IAT/IAM functions performed.

• Prior SIPR/IL6 (AWS Secret Region) enclave build-out and DISA SIPRNet circuit coordination
• Army Cross-Domain Solution (ARCDS) familiarity, if cross-domain capability enters scope
• OSCAL tooling and Security Hub-to-eMASS evidence automation
• GovCloud FinOps, tagging and cost-allocation design
• Comfort working with an AI-augmented team. Generated infrastructure code and STIG scripts are welcome once reviewed to an ATO-defensible standard.

#LI-BQ1

***************** No Agencies Please *****************