Position Title:  Architect, Federal Security

Come Build Your Career at Aecon!

Aecon delivers some of the most complex and impactful infrastructure projects — from transformative transportation networks to critical energy, industrial and nuclear programs. The projects we build connect communities and power future generations. With deep roots in North America and a strong footprint internationally, Aecon brings global expertise and proudly serves public and private sector clients through its Construction and Concessions segment.

Safety Always is not only our #1 core value – it is the standard that anchors our culture. We believe the most ambitious projects deserve the most committed people. At Aecon, you won’t just build your career — you’ll help build what matters to enable future generations to thrive.

At Aecon, you can count on:

• Safety Always. Our number one core value. The safety of our people, projects, partners, and stakeholders is our priority focus – today and always.
• Integrity. We lead by example, with humility and courage.
• Accountability. We’re passionate about delivering on our commitments.
• Inclusion. We provide opportunities where people feel valued, supported, and empowered to contribute fully.

We deliver infrastructure with purpose, and our people are at the heart of everything we do. Aecon employees are incredibly proud to build some of the most impactful infrastructure of this generation – we call it Aecon Proud.

At Aecon we:

• Ensure you and your family receive the services and benefits needed to support your mental, emotional, and physical well-being.
• Are intentional when it comes to investing in your development. We help you build your career and advance your skills through our Aecon University, tuition reimbursement, and Leadership Programs.
• Are committed to creating work environments focused on mutual respect, teamwork, collaboration, and new ideas, through meaningful initiatives, training, and partnerships with Veteran groups, to ensure we are building with top talent and harnessing our collective strengths within every aspect of our culture.
• Operate responsibly by managing risk, safety, and environmental considerations across all our projects and surrounding communities.

Our success is built on the passion, expertise, and dedication of our people. Together, we embrace strong execution, innovation, and continuous improvement — values that come to life through the unique talents and collaborative spirit of every team member. If you’re inspired to make a difference through future-building projects, join our best-in-class team.

• Own the Federal Enclave architecture baseline and roadmap for applicable federal requirements.
• Develop integrated designs across identity, cloud, endpoints, networks, applications, and providers.
• Define boundaries, segmentation, data flows, controlled exchange, and physical-output and printing paths.
• Produce reference patterns, configuration standards, and decision records with trade-offs and limitations.
• Give Federal IT management prioritized design decisions, options, technical risks, and escalations.

• Translate applicable contract and control requirements with Compliance and Legal into practical designs.
• Partner with the Federal Information Security Lead on control coverage, inheritance, and exception analysis.
• Develop test criteria and technical evidence requirements using applicable NIST SP 800-171A methods.
• Maintain System Security Plan narratives and technical remediation inputs to Plans of Action and Milestones.
• Assess change impacts; authorized information owners and Legal retain information-applicability and legal decisions.

• Personally design and validate controls, threat and failure scenarios, and technical remediation options.
• Document gaps; exceptions or proposed compensating controls do not themselves meet mandatory requirements.
• Design privileged access, least privilege, separation of duties, and secure administrative workflows.
• Provide required documented technical concurrence before design or change approval; escalate unresolved objections to authorized system, security, and risk owners for resolution.
• Design logging, monitoring, retention, and response interfaces; operations retain incident command and daily execution.

• Design Microsoft 365/Azure government-cloud and GCC High solutions within service and enclave boundaries.
• Design secure government-cloud collaboration, identity, endpoint, threat, and information-protection capabilities.
• Design SAML/SCIM, Conditional Access, MFA, privileged access, and Zero Trust identity patterns.
• Design labeling, data-loss prevention, access, placement, and exchange with authorized information owners.

• Maintain architecture baselines, boundary and data-flow diagrams, standards, and implementation records.
• Keep approved designs, as-built configurations, inventories, and technical control narratives current.
• Produce handoffs with validation results, limitations, rollback, support ownership, and technical evidence.
• Preserve accountable approvals: authorized owners retain risk acceptance, exceptions, production authorization, legal/HR decisions, and required SPRS affirmations; independent assessors retain assessment conclusions.

• Challenge provider capabilities, designs, data handling, and integration assumptions against federal requirements.
• For applicable FedRAMP services, verify the authorized boundary; labels or encryption do not prove compliance.
• Document internal, provider, inherited, and customer-retained build, control, and evidence responsibilities.
• Lead proofs of concept and technical testing; record concurrence, limitations, and unresolved objections.

• Guide technical teams/providers on test environments, configuration, integration, troubleshooting, and validation.
• Own architecture and acceptance criteria; assigned teams retain build, operations, and control-evidence duties.
• The delivery PM owns plans, backlog, schedule, budget, vendor follow-up, test tracking, and handoff coordination.
• Explain designs and evidence at audits; mentor teams without assuming security-lead, risk, or approval authority.

• Bachelor's degree in Information Technology, Computer Science, Cybersecurity, Engineering, or a related field.
• An equivalent combination of education, certifications, and relevant experience may be considered.
• Eight or more years of relevant IT infrastructure, cybersecurity, cloud engineering, or architecture experience.
• Five or more years designing or delivering security architectures and secure integrations for federal government, defense, or federal-contractor environments.
• Demonstrated NIST SP 800-171 control implementation in operating contractor CUI environments; agency RMF/ATO familiarity alone is insufficient.
• Personal ownership of designs, decisions, acceptance, troubleshooting, and assessment evidence, not policy coordination alone.
• Practical Microsoft 365/Azure government-cloud security-design experience; GCC High preferred, or demonstrably transferable government-cloud architecture experience.
• U.S. Citizenship required due to federal contract obligations.

• CMMC Level 2, NIST SP 800-171 and 800-171A, and applicable DFARS/SPRS obligations
• Control requirements translated into implementable designs, test criteria, and technical evidence
• Federal enclave boundaries, CUI data flows, and end-to-end secure integration
• Zero Trust architecture, network segmentation, and trust relationships
• Microsoft Entra ID, Conditional Access, MFA, and privileged access
• SAML authentication, SCIM provisioning, and secure application integration
• Audit logging, monitoring, evidence retention, and operational handoff
• Endpoint protection, vulnerability remediation, and control-failure analysis
• Threat modeling, technical risk analysis, and remediation alternatives
• Cloud/SaaS security and shared responsibilities; RMF/FedRAMP literacy complements direct CUI implementation

• Certified CMMC Professional (CCP)
• Information Systems Security Architecture Professional (ISSAP)
• Certified Information Systems Security Professional (CISSP)
• Microsoft Certified: Cybersecurity Architect Expert
• Certified Cloud Security Professional (CCSP)
• Certified Information Security Manager (CISM)
• Relevant Microsoft or CMMC assessment training; this role is not the independent certification assessor

Core Competencies

• Independent federal architectural judgment and ownership of integrated technical solutions.
• Practical control engineering that bridges requirements, implementation, testing, and operations.
• Clear technical writing, diagrams, standards, and decision records.
• Constructive challenge of unsupported claims and sound analysis of trade-offs.
• Evidence-based technical acceptance and transparent escalation of unresolved issues.
• Ability to explain complex security designs to technical, business, and executive audiences.
• Technical leadership, mentoring, and collaboration across delivery and operational teams.
• Pragmatic prioritization without transferring others' control ownership or exceeding delegated authority.

Aecon fosters belonging within and across our organization. We consider all applicants for positions without regard to race, color, religion, sex, national origin, age, mental or physical disabilities, veteran status, and all other characteristics protected by law.

We are committed to adhering to the objectives and requirements outlined in the Equal Employment Opportunity Commission (EEOC), and to meeting the accessibility needs of persons with disabilities in a timely manner, through the implementation of the requirements of the EEOC and its applicable regulations. Appropriate accommodation under the EEOC will be provided upon request throughout the interview and hiring process.

Aecon is committed to ensuring all job postings are compliant with all applicable laws. Any candidate who has a concern regarding the contents of this or any other job posting can email aecon@aecon.com.