Cloud Architect

Cloud Architect

Key Responsibilities

• Define and socialise target state architectures across Azure/AWS/GCP (networking, identity, landing zones, operations).
• Deliver reference architectures and reusable patterns for containerised, serverless, and data workloads.
• Lead migration and modernisation (re‑host/re‑platform/re‑factor) for priority applications.
• Implement IaC at scale (Terraform preferred; standard modules; pipelines).
• Build observability (logs, metrics, traces, SLOs) and resilience (HA, DR, RTO/RPO).
• Produce HLDs/LLDs, diagrams, ADRs, non‑functional requirements, and traceability to business goals.
• Select and justify cloud services (compute, storage, data, AI/ML, integration).
• Design identity and access (Azure AD/Microsoft Entra, AWS IAM, GCP IAM; SSO; workload identities).
• Build/optimise Kubernetes platforms (AKS/EKS/GKE), service mesh (Istio/Linkerd), ingress, and autoscaling.
• Implement CI/CD (Git Hub Actions/Azure Dev Ops/Git Lab), environment promotion, secrets management, artifact repos.
• Security & Compliance
• Define guardrails (CIS benchmarks), cloud security posture management (Defender for Cloud, AWS Security Hub, GCP SCC).
• Vaulting and KMS (AWS KMS, Azure Key Vault, GCP KMS), key rotation, data classification & encryption.
• Threat modelling, zero trust patterns, vulnerability management, incident runbooks.
• Data & Integration
• Reference architectures for streaming/batch (Kafka/MSK, Event Hubs, Pub/Sub), data lakes, warehouses (Big Query, Synapse, Redshift), ETL/ELT.
• Operations & Reliability
• Performance testing, capacity planning, SLO/SLIs, error budgets.
• Governance & Cost
• Landing zone governance, tagging/labels, budget alerts, reserved/savings plans.
• Operating model definition (RACI), platform backlog, roadmap, and risk management.
• Stakeholder Management
• Run workshops, architecture reviews, and design clinics.
• Collaborate with Info Sec, Network, Data, and App teams; mentor engineers.

• 8+ years in cloud architecture/engineering; 3+ years multi‑cloud across Azure, AWS, and GCP
  .
• Proven delivery of enterprise landing zones
  , Kubernetes
  , IaC at scale, and secure network architectures
  .
• Strong track record in app migration/modernisation and cost optimisation
  .
• Comfortable in highly regulated environments (finance, healthcare, public sector) is a plus.

• Networking: DNS, TLS/mTLS, BGP, NAT, WAF, CDN, private endpoints, service endpoints.
• Compute/Containers: AKS/EKS/GKE, ECS/Fargate, VMSS/ASG, serverless (Lambda, Azure Functions, Cloud Functions).
• Security: Defender for Cloud, Sentinel, AWS Guard Duty/Security Hub, GCP SCC, OPA, Hashi Corp Vault, KMS.
• Scripting: Python/Bash/Power Shell; strong Git and code review practices.

• AWS: Solutions Architect Professional, Dev Ops Engineer
• GCP: Professional Cloud Architect, Dev Ops Engineer

• Excellent communicator—able to translate complex architecture into clear, actionable plans.
• Pragmatic, delivery‑focused, and comfortable with ambiguity.
• Strong stakeholder management and mentoring capabilities.
• Cloud Target Operating Model & reference architectures.
• Landing zone designs and implementation (per cloud).
• Network & identity blueprints and runbooks.
• IaC repositories (Terraform modules, pipelines) with documentation.
• Security patterns (guardrails, policies, encryption standards).
• Observability standards (dashboards, alerts, SLOs).
• Application migration plans (waves, dependency maps) and executed milestones.
• Fin Ops reports and cost optimisation recommendations.

• % workloads onboarded to landing zones with guardrails enforced.
• Mean time to provision environments (baseline vs target).
• % policy compliance (CIS/NIST) and critical vulnerabilities remediated.
• Cost savings realised (rightsizing, reservations), forecast accuracy.
• Uptime/SLO adherence and incident reduction.

• Hybrid: 2–3 days per week in Oxford; flexibility during key milestones.
• Cadence: Weekly architecture forum, sprint rituals with squads, monthly exec updates.
• Documentation: Diagrams (Draw.io/Visio), ADRs in Git, Confluence/SharePoint.
• Tooling Access: Provided by client (SSO, VPN, repositories).

Mid-Senior level

Contract

Other

Construction