Senior GCP Architect

Job Description

Description

On-site in Washington, DC

Our client seeks a Senior GCP Architect to serve as the principal technical authority for enterprise cloud architecture, DevSecOps, and platform automation across multi-tenant environments. The role provides governance over GCP landing zones, zero-trust patterns, and continuous authorization practices spanning Commercial, FedRAMP Moderate, and FedRAMP High enclaves. The architect will standardize Terraform-based automation, integrate CI/CD and continuous compliance, and lead portal-to-API orchestration for self-service provisioning. The role also defines secure integration patterns for enterprise AI services and enforces ethical AI controls.

Due to federal security clearance requirements, applicant must be a United States Citizen or Permanent Resident with an active Public Trust clearance. This is a contract to hire opportunity. Applicants must be willing and able to work on a w2 basis and convert to FTE following contract duration. For our w2 consultants, we offer a great benefits package that includes Medical, Dental, and Vision benefits, 401k with company matching, and life insurance.

Rate: $90.00 to $100.00/hr. w2

Responsibilities

• Design, maintain, and govern multi-folder GCP landing zones using Assured Workloads for FedRAMP Moderate and High compliance with organizational policy, data residency, and CMEK via Cloud KMS.
• Define and enforce boundaries between shared services management and tenant application workloads, including firewalls, HA VPN, DNS, Infoblox, and connectivity hubs.
• Author and standardize modular Terraform with JSON/YAML parameters for landing zone vending, subnet allocation, and zero-trust IAM roles.
• Implement VPC Service Controls, Workload Identity Federation, service account governance, and fine-grained RBAC.
• Architect CI/CD with GitHub Actions and Jenkins, including SAST, DAST, and dependency scanning in PR workflows.
• Establish continuous authorization baselines aligned to NIST SP 800-53 and FedRAMP with automated compliance validation and drift detection.
• Design centralized logging and monitoring with Cloud Logging sinks, Pub/Sub, Dataflow, and downstream platforms such as Elastic Cloud or Splunk.
• Lead integration between user-facing portals and backend GCP APIs for self-service provisioning with standardized orchestration, state tracking, and error handling.
• Implement cross-boundary authentication using SAML 2.0, Entra ID, Keycloak, and OIDC federation.
• Define enterprise AI architecture standards for Vertex AI and Gemini, including PSC, VPC-SC, and CMEK for secure datasets and interactions.
• Oversee ethical AI controls, DLP, prompt security, and continuous monitoring of AI payloads.

Experience Requirements

• 8+ years in cloud engineering, IT infrastructure, and DevSecOps with 4+ years as Lead GCP Engineer or Cloud Architect in complex multi-tenant environments.
• Proven GCP architecture with Shared VPC, Interconnect or HA VPN, Palo Alto NGFW, VPC-SC perimeters, and GKE governance.
• Practical understanding of FedRAMP Moderate/High, Assured Workloads, DoD Iron Bank, and continuous monitoring practices.
• Preferred multi-cloud awareness across AWS or Azure for identity federation and hybrid networking.
• Preferred Terraform expertise in modular design, remote state, plan/apply automation, dynamic data parsing, and drift resolution.
• Advanced knowledge of GitHub Actions, Jenkins, and branching strategies for immutable deployments.

Education Requirements

• Must possess or be eligible for a Public Trust clearance.
• Preferred certifications: Google Cloud Professional Cloud Architect and Professional Cloud Security Engineer.