Cloud Security Architect

What you’ll do

• Define the enterprise cloud security architecture and target state across AWS, Azure, GCP, and hybrid environments
• Design secure landing zones, multi-account and multi-subscription structures, network segmentation, and guardrails (SCPs, Azure Policy, org policies)
• Architect identity and access: workload identity, federation, least privilege, privileged access, and zero-trust patterns
• Set data protection standards: encryption, key management (KMS, HSM), secrets management, tokenization, and data classification
• Lead security design reviews and threat modeling for new platforms, applications, and major changes, and document decisions in clear, usable form
• Embed security in delivery: policy-as-code, IaC scanning, secure CI/CD, container and Kubernetes security, and software supply chain controls
• Design cloud detection and response: logging, telemetry, CSPM/CNAPP, and SIEM integration, in partnership with the SOC and detection engineers
• Evaluate and select security tooling (Wiz, Prisma Cloud, Defender for Cloud, GuardDuty, CrowdStrike, and others), build the business case, and guide rollout
• Map architecture to compliance frameworks (SOC 2, ISO 27001, NIST 800-53, HIPAA, PCI-DSS, FedRAMP) and automate evidence where possible
• Define security patterns for AI and ML workloads, including data exposure, model access, and LLM application risks
• Guide cloud migrations and modernization programs so security is designed in, not bolted on
• Create reference architectures, blueprints, and reusable modules teams can adopt without a ticket
• Translate risk into business terms for executives, and into concrete requirements for engineers
• Mentor security engineers and build the cloud security community of practice

Find your level

• Level Typical experience What you’ll own
• Cloud Security Architect II - 7-10 years : Security architecture for a major platform or cloud environment, leading design reviews, guiding engineering teams, mentoring engineers
• Senior Cloud Security Architect - 10-13 years : Architecture across multiple clouds and business units, setting standards and reference patterns, advising leadership, leading major programs
• Principal Cloud Security Architect - 13+ years : Defining long-term cloud security strategy, shaping vendor and investment direction, influencing company-wide architecture and risk posture

Promotion criteria are written down at every level. Architect roles generally start at a mid-senior level. If you’re a strong senior cloud security engineer ready to step up, we want to talk to you, and we have a clear path from engineer to architect.

What you bring

Must have

• Deep, hands-on experience securing at least one major cloud platform (AWS, Azure, or GCP), with working knowledge of a second

• Strong command of cloud IAM, networking, encryption, logging, and the shared responsibility model

• Experience designing security architecture for complex, multi-team environments, not just configuring tools

• Working knowledge of IaC (Terraform, CloudFormation, Bicep), containers, and Kubernetes security

• Fluency in security frameworks and threat models (MITRE ATT&CK, NIST CSF, CIS Benchmarks, STRIDE)

• Ability to defend a design to skeptical engineers and explain tradeoffs to executives

• Leadership through influence: you bring people along without needing authority

• Bachelor’s degree in Computer Science, Cybersecurity, Engineering, or a related field, or equivalent experience. We care about what you’ve designed and delivered.

• Authorization to work in the US

• Nice to have (not required)

• Certifications: CCSP, CISSP, AWS Security Specialty, AWS Solutions Architect Professional, AZ-500, SC-100, GCP Professional Cloud Security Engineer, SABSA, or TOGAF

• Experience with CNAPP/CSPM platforms, policy-as-code (OPA, Sentinel, Checkov), and DevSecOps pipelines

• Familiarity with zero-trust, SASE, and identity-centric security models

• Experience with regulated environments (FedRAMP, HIPAA, PCI-DSS, financial services)

• Background in cloud migrations, M&A integrations, or large-scale modernization

• Exposure to securing AI/ML platforms and LLM-based applications

• Hands-on engineering history: you can still read Terraform and write a detection query

• Conference talks, published research, or open-source contributions

• Industry background in [financial services, healthcare, SaaS, public sector, retail, etc.]