Security Architect

Description

Leidos is seeking a Cloud Security Architect to lead the design and development of secure multi-cloud solutions supporting the U.S. Air Force Cloud One Next (C1N) ACSS contract.

In this role, you will serve as a senior technical architect responsible for designing security capabilities across Amazon Web Services (AWS), Microsoft Azure, Google Cloud Platform (GCP), and Oracle Cloud Infrastructure (OCI). The Cloud Security Architect will translate mission, cybersecurity, and platform requirements into implementable architectures and work directly with engineering teams to turn those architectures into reusable Cloud One capabilities.

This is a solution architecture and engineering-focused role, rather than a security operations or compliance management position. The architect will evaluate technologies, develop reference architectures, prototype solutions, make technical recommendations, define integration patterns, and guide engineering teams through implementation.

The Cloud Security Architect will work across cloud, network, platform, DevSecOps, and cybersecurity teams to determine how security capabilities should be designed and integrated into the Cloud One platform. A primary objective of the role is to abstract CSP-specific security complexity into standardized architectures and reusable capabilities that can be consistently deployed across Cloud One environments.

Key Responsibilities:

• Multi-Cloud Security Architecture: Design security architectures and solutions spanning AWS, Azure, GCP, and OCI, identifying common architectural patterns while accounting for CSP-specific capabilities and limitations.
• Security Solution Development: Translate cybersecurity requirements and identified capability gaps into implementable technical solutions, including architecture, technology selection, integration patterns, and implementation guidance.
• Reference Architecture Development: Create reusable reference architectures, design patterns, technical standards, and architectural guardrails that engineering teams can use to consistently build secure cloud environments.
• Architecture Prototyping: Develop proofs of concept and prototypes to validate new security architectures, technologies, integrations, and design approaches before enterprise implementation.
• Technology Evaluation & Selection: Evaluate cloud-native and third-party security technologies and develop recommendations based on capability, integration complexity, security effectiveness, scalability, cost, and applicability to Cloud One.
• Build vs. Buy Analysis: Assess when Cloud One should leverage CSP-native capabilities, enterprise security platforms, commercial products, or internally developed automation and services.
• Multi-Cloud Capability Abstraction: Design solutions that provide consistent security outcomes across CSPs while minimizing unnecessary CSP-specific implementation differences for Cloud One consumers.
• Security Platform Integration: Architect integrations between CSP-native security services and enterprise security platforms, including identity, network security, CNAPP, vulnerability management, SIEM, security telemetry, secrets management, and related capabilities.
• Identity Architecture: Design multi-cloud identity and access architectures including federation, privileged access, workload identities, service identities, role-based and attribute-based access controls, and machine-to-machine authentication.
• Zero Trust Architecture: Translate DoD Zero Trust requirements into practical cloud architecture patterns and platform capabilities spanning identity, workloads, networks, applications, and data.
• Network Security Architecture: Partner with the Cloud Network Architect to design trust boundaries, segmentation, ingress/egress security, traffic inspection, microsegmentation, private connectivity, and cross-cloud security patterns.
• Workload Security Architecture: Design security patterns for virtual machines, containers, Kubernetes, serverless services, APIs, cloud-native applications, and other workload architectures.
• Data Protection Architecture: Design approaches for encryption, key management, secrets management, certificate management, data access controls, and protection of sensitive information across multiple CSPs.
• DevSecOps Architecture: Define how security capabilities are integrated into Infrastructure as Code and CI/CD workflows, including automated security testing, policy enforcement, artifact security, and software supply chain protections.
• Security as Code: Develop architectural patterns for implementing security through Infrastructure as Code, Policy as Code, and Configuration as Code, enabling security controls to be consistently incorporated into Cloud One engineering workflows.
• Solution Engineering: Work directly with engineering teams during solution development to resolve design challenges, validate implementation approaches, and ensure delivered capabilities align with the intended architecture.
• Architecture Reviews: Review new platform capabilities, cloud services, infrastructure designs, and major technical changes to identify security implications and recommend architectural solutions.
• Technical Roadmap Development: Identify security capability gaps and emerging technology needs and contribute to the Cloud One technical roadmap by defining future security capabilities and modernization initiatives.
• Technical Decision-Making: Develop architecture decision records, technical trade studies, and recommendations that clearly document alternatives, constraints, risks, and rationale for major security architecture decisions.

Required Qualifications:

• Education: Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Systems Engineering, or a related technical discipline and 12+ years of prior relevant experience, or equivalent additional experience in lieu of degree.
• Security Architecture: Extensive experience designing enterprise security solutions and translating security requirements into implementable technical architectures.
• Solution Architecture: Demonstrated experience taking complex technical problems from requirements and conceptual design through architecture, prototyping, engineering, and implementation.
• Multi-Cloud Architecture: Strong experience with multiple CSPs, with deep technical knowledge of at least two of the following: AWS, Azure, GCP, or OCI, and the ability to develop architectures that span heterogeneous cloud environments.
• Cloud-Native Security: Advanced knowledge of CSP-native security architectures and services covering identity, networking, encryption, key management, secrets, workloads, logging, policy, and data protection.
• Security Technology Integration: Experience architecting integrations between cloud-native capabilities and enterprise security technologies.
• Identity Architecture: Strong understanding of IAM, federation, SSO, MFA, RBAC, ABAC, privileged access, workload identity, service identity, and least-privilege architectures.
• Network Security Architecture: Strong understanding of segmentation, trust boundaries, firewalls, private connectivity, traffic inspection, microsegmentation, ingress/egress controls, and Zero Trust network architecture.
• Infrastructure & Security as Code: Experience designing security capabilities implemented through Terraform, Ansible, Policy as Code, Configuration as Code, APIs, and CI/CD automation.
• Containers & Kubernetes: Knowledge of Kubernetes and container security architectures, including image security, admission controls, secrets, identity, network policies, software supply chain security, and runtime protection.
• DevSecOps: Strong understanding of how security capabilities are integrated throughout software and infrastructure delivery pipelines rather than implemented as downstream compliance activities.
• ·DoD Architecture: Experience designing solutions within DoD, federal, or similarly regulated environments and an understanding of RMF, NIST SP 800-53, DISA STIGs, DoD CC SRG, and DoD Zero Trust requirements.
• Technical Leadership: Demonstrated ability to lead technical design efforts, facilitate architecture discussions, evaluate competing technologies, and provide technical direction to engineering teams.
• Technical Communication: Ability to communicate complex architectures and technical tradeoffs through diagrams, technical documentation, trade studies, presentations, and direct engagement with engineering and Government stakeholders.
• Security Clearance: Ability to obtain and maintain a DoD Secret security clearance.

Preferred Qualifications:

• Active DoD Secret or Top Secret clearance.
• Advanced security architecture certifications such as CISSP, CCSP, CISSP-ISSAP, or equivalent.
• Advanced cloud security certifications such as AWS Certified Security – Specialty, Microsoft Certified: Azure Security Engineer Associate, Google Professional Cloud Security Engineer, or equivalent OCI certification.
• Demonstrated experience developing multi-cloud reference architectures and enterprise security platforms.
• Experience designing security capabilities supporting DoD Impact Levels (IL) 2, 4, 5, and 6.
• Experience architecting and integrating Cloud-Native Application Protection Platforms (CNAPP), including CSPM, CWPP, CIEM, attack-path analysis, and cloud detection capabilities.
• Experience designing solutions involving SIEM, SOAR, vulnerability management, identity security, microsegmentation, network security, secrets management, and data protection technologies.
• Experience designing and implementing DoD Zero Trust Architecture capabilities.
• Experience developing proofs of concept, technical prototypes, trade studies, and technology evaluations for enterprise security capabilities.
• Experience building reusable Terraform modules, Policy as Code frameworks, security APIs, or other automation that translates architecture into deployable platform capabilities.
• Experience with software supply chain security, SBOMs, artifact integrity, container security, and automated security testing.
• Familiarity with MITRE ATT&CK, threat modeling, attack-path analysis, and threat-informed architecture.
• Experience establishing technical roadmaps and identifying new platforms, products, or capabilities needed to address fundamental security architecture gaps.
• Experience supporting large-scale cloud modernization, platform engineering, or enterprise cloud programs within the Department of Defense.

If you're looking for comfort, keep scrolling. At Leidos, we outthink, outbuild, and outpace the status quo — because the mission demands it. We're not hiring followers. We're recruiting the ones who disrupt, provoke, and refuse to fail. Step 10 is ancient history. We're already at step 30 — and moving faster than anyone else dares.

Original Posting:

October 9, 2026

Pay Range:

Pay Range $131,300.00 - $237,350.00

The Leidos pay range for this job level is a general guideline only and not a guarantee of compensation or salary. Additional factors considered in extending an offer include (but are not limited to) responsibilities of the job, education, experience, knowledge, skills, and abilities, as well as internal equity, alignment with market data, applicable bargaining agreement (if any), or other law.

About Leidos

Leidos is an industry and technology leader serving government and commercial customers with smarter, more efficient digital and mission innovations. Headquartered in Reston, Virginia, with 47,000 global employees, Leidos reported annual revenues of approximately $16.7 billion for the fiscal year ended January 3, 2025. For more information, visit www.Leidos.com.

Pay and Benefits

Pay and benefits are fundamental to any career decision. That's why we craft compensation packages that reflect the importance of the work we do for our customers. Employment benefits include competitive compensation, Health and Wellness programs, Income Protection, Paid Leave and Retirement. More details are available at www.leidos.com/careers/pay-benefits.

Securing Your Data

Beware of fake employment opportunities using Leidos’ name. Leidos will never ask you to provide payment-related information during any part of the employment application process (i.e., ask you for money), nor will Leidos ever advance money as part of the hiring process (i.e., send you a check or money order before doing any work). Further, Leidos will only communicate with you through emails that are generated by the Leidos.com automated system – never from free commercial services (e.g., Gmail, Yahoo, Hotmail) or via WhatsApp, Telegram, etc. If you received an email purporting to be from Leidos that asks for payment-related information or any other personal information (e.g., about you or your previous employer), and you are concerned about its legitimacy, please make us aware immediately by emailing us at LeidosCareersFraud@leidos.com.

If you believe you are the victim of a scam, contact your local law enforcement and report the incident to the U.S. Federal Trade Commission.

Commitment to Non-Discrimination

All qualified applicants will receive consideration for employment without regard to sex, race, ethnicity, age, national origin, citizenship, religion, physical or mental disability, medical condition, genetic information, pregnancy, family structure, marital status, ancestry, domestic partner status, sexual orientation, gender identity or expression, veteran or military status, or any other basis prohibited by law. Leidos will also consider for employment qualified applicants with criminal histories consistent with relevant laws.

#Remote