Cloud Architect
hace 2 días
Oxford
Objectives & Outcomes • Define and socialise target state architectures across Azure/AWS/GCP (networking, identity, landing zones, operations)., • Deliver reference architectures and reusable patterns for containerised, serverless, and data workloads., • Establish/extend Cloud Landing Zones (policy, guardrails, RBAC, tagging, network segmentation)., • Lead migration and modernisation (re‑host/re‑platform/re‑factor) for priority applications., • Implement IaC at scale (Terraform preferred; standard modules; pipelines)., • Build observability (logs, metrics, traces, SLOs) and resilience (HA, DR, RTO/RPO)., • Drive FinOps—cost transparency, budgets, showback/chargeback, right‑sizing., • Architecture & Design, • Produce HLDs/LLDs, diagrams, ADRs, non‑functional requirements, and traceability to business goals., • Select and justify cloud services (compute, storage, data, AI/ML, integration)., • Define multi‑cloud connectivity (hub‑and‑spoke, transit gateways, ExpressRoute/Direct Connect/Cloud Interconnect, SD‑WAN)., • Design identity and access (Azure AD/Microsoft Entra, AWS IAM, GCP IAM; SSO; workload identities)., • Platform Engineering, • Standardise Terraform modules; enforce code quality, policy‑as‑code (OPA/Conftest/Azure Policy)., • Build/optimise Kubernetes platforms (AKS/EKS/GKE), service mesh (Istio/Linkerd), ingress, and autoscaling., • Implement CI/CD (GitHub Actions/Azure DevOps/GitLab), environment promotion, secrets management, artifact repos., • Security & Compliance, • Define guardrails (CIS benchmarks), cloud security posture management (Defender for Cloud, AWS Security Hub, GCP SCC)., • Vaulting and KMS (AWS KMS, Azure Key Vault, GCP KMS), key rotation, data classification & encryption., • Threat modelling, zero trust patterns, vulnerability management, incident runbooks., • Data & Integration, • Reference architectures for streaming/batch (Kafka/MSK, Event Hubs, Pub/Sub), data lakes, warehouses (BigQuery, Synapse, Redshift), ETL/ELT., • API strategy (APIM/API Gateway/Apigee), messaging (SQS/SNS/Service Bus/PubSub), event‑driven design., • Operations & Reliability, • Observability stack (CloudWatch/CloudTrail, Azure Monitor/Log Analytics, Cloud Logging/Monitoring; Prometheus/Grafana)., • DR/BCP architectures (cross‑region, multi‑region, backups, runbooks; tested failover)., • Performance testing, capacity planning, SLO/SLIs, error budgets., • Governance & Cost, • Landing zone governance, tagging/labels, budget alerts, reserved/savings plans., • Operating model definition (RACI), platform backlog, roadmap, and risk management., • Stakeholder Management, • Run workshops, architecture reviews, and design clinics., • 8+ years in cloud architecture/engineering; 3+ years multi‑cloud across Azure, AWS, and GCP., • Proven delivery of enterprise landing zones, Kubernetes, IaC at scale, and secure network architectures., • Strong track record in app migration/modernisation and cost optimisation., • Cloud: Azure (Resource Manager, Entra ID, Policy, Monitor), AWS (EC2, VPC, IAM, TGW), GCP (VPC, IAM, Interconnect)., • Networking: DNS, TLS/mTLS, BGP, NAT, WAF, CDN, private endpoints, service endpoints., • Compute/Containers: AKS/EKS/GKE, ECS/Fargate, VMSS/ASG, serverless (Lambda, Azure Functions, Cloud Functions)., • IaC & Pipelines: Terraform (required), Terragrunt (nice), Helm, Kustomize, GitHub Actions, Azure DevOps, GitLab CI., • Security: Defender for Cloud, Sentinel, AWS GuardDuty/Security Hub, GCP SCC, OPA, HashiCorp Vault, KMS., • Data/Integration: Event Hubs/Kafka/PubSub, API Gateway/APIM/Apigee, Data Factory/Glue/Cloud Data Fusion, BigQuery/Synapse/Redshift., • Observability: Prometheus/Grafana, OpenTelemetry, CloudWatch, Azure Monitor, Cloud Monitoring, ELK/Elastic., • Azure: AZ‑305 (Architect), AZ‑400 (DevOps), • AWS: Solutions Architect Professional, DevOps Engineer, • GCP: Professional Cloud Architect, DevOps Engineer, • Security/Architecture: CISSP, CISM, TOGAF, CCSP, • Excellent communicator—able to translate complex architecture into clear, actionable plans., • Pragmatic, delivery‑focused, and comfortable with ambiguity., • Cloud Target Operating Model & reference architectures., • Landing zone designs and implementation (per cloud)., • Network & identity blueprints and runbooks., • IaC repositories (Terraform modules, pipelines) with documentation., • Security patterns (guardrails, policies, encryption standards)., • Observability standards (dashboards, alerts, SLOs)., • Application migration plans (waves, dependency maps) and executed milestones., • % workloads onboarded to landing zones with guardrails enforced., • Mean time to provision environments (baseline vs target)., • % policy compliance (CIS/NIST) and critical vulnerabilities remediated., • Cost savings realised (rightsizing, reservations), forecast accuracy., • DR test pass rate; RTO/RPO compliance., • Hybrid: 2–3 days per week in Oxford; flexibility during key milestones., • Cadence: Weekly architecture forum, sprint rituals with squads, monthly exec updates., • Documentation: Diagrams (Draw.io/Visio), ADRs in Git, Confluence/SharePoint., • Tooling Access: Provided by client (SSO, VPN, repositories).