Cloud Security Architect & Infra Lead - Hands-On

Job Purpose This hands‑on Manager role works as a Cloud Security Architect and defines and leads the organisation's infrastructure environment, along with any analysis of on-premise infrastructure vs well-governed cloud services, (such as Microsoft Azure and AWS). The postholder will set the future-state cloud security architecture and migration roadmap, with particular focus on identity, privileged access, Zero Trust and security controls, guiding the organisation towards a secure, cloud-first operating model. This is a hands‑on role: the postholder builds and proves the patterns they design and embeds DevSecOps practices so that security is built into delivery rather than added afterwards. Sitting within Integrated Solutions and Architecture as a key execution arm of the Head of Architecture secure, automated Azure (and AWS) foundations built on Zero Trust principles; modernised identity and privileged access with reduced reliance on legacy on‑premise controls; security embedded into delivery through DevSecOps and threat modelling; resilient services with tested disaster recovery; and growing capability within the team. Example measures include: delivery of the assessment, architecture and roadmap to agreed timescales; workloads migrated against the roadmap; percentage of infrastructure deployed through Infrastructure as Code; improvement in Microsoft Secure Score, Defender for Cloud Secure Score and AWS Security Hub findings; reduction in standing privileged access; GPOs retired or migrated to cloud‑native policy; percentage of new designs with a completed threat model; time to remediate penetration test findings; percentage of critical services with tested disaster recovery meeting RTO/RPO; and designs passing design authority and security gates first time. Other Job information Work Conditions and Environment Location Caerphilly, with regular on‑site attendance for workshops, architecture reviews and team leadership, and occasional travel to other sites. This is not a remote‑first role. Working pattern Full‑time, with occasional work outside core hours for migration cutovers, major incidents and change activity. Working principles Operate within a regulated and audited environment, adhering to change management, security and documentation standards and maintaining auditable records of designs, security decisions and risk acceptances. Demonstrate sound security judgement, embedding security pragmatically to enable delivery rather than block it, with a preference for automation and repeatable patterns over manual effort. Culture and personal fit The organisation values pace, outcomes and pragmatic decision‑making. The successful candidate will be collaborative and sociable while maintaining high standards, and able to lead conversations with the business at the right level. Technical environment context The organisation operates a 100% VDI, hybrid environment with an on‑premise data centre, Active Directory and Group Policy, a small Azure footprint, Microsoft 365 and AWS. Essential Experience and Capabilities Substantial, current hands‑on experience in cloud architecture, cloud engineering or cloud security roles, rather than purely advisory or historic exposure. Proven experience of planning and delivering on‑premise to cloud migrations, from current‑state assessment through target architecture to cutover. Deep, current expertise in Microsoft Azure security (landing zones, networking, Azure Policy, RBAC, Key Vault, Defender for Cloud and Sentinel), with strong working knowledge of AWS. Strong knowledge of Microsoft Entra ID and hybrid identity (Entra Connect / Cloud Sync, Conditional Access, SAML/OIDC federation, B2B and cross‑tenant access), and of Active Directory and Group Policy, including migrating policy to Intune and cloud‑native management. Practical experience designing and implementing privileged access controls, including Entra PIM, PAM tooling, tiered administration and just‑time access. Strong understanding of Zero Trust architecture and cloud network security, including hybrid connectivity, segmentation, firewalls and private networking. Hands‑on DevSecOps experience, including Infrastructure as Code (Terraform, Bicep, CloudFormation), scripting (PowerShell, Python), pipelines (Azure DevOps, GitHub Actions), container platforms (Kubernetes/AKS), security scanning and policy‑as‑code. Experience designing resilient, supportable cloud services (monitoring, logging, backup, disaster recovery and incident response) and producing high‑and low‑level designs for handover to operational teams. Working knowledge of security frameworks and regulatory requirements relevant to a regulated UK environment (for example NCSC Cloud Security Principles, CIS Benchmarks, Microsoft Cloud Security Benchmark, ISO 27001 and UK GDPR). Excellent communication skills, able to explain architecture, risk and trade‑offs to senior, technical and non‑technical stakeholders and to present costed options and business cases for approval. Experience leading small technical teams and mentoring graduates or junior engineers. Commercially aware, making full use of existing products and licensing and recommending new technology only where it adds clear value. Desirable Experience and Qualifications Current security and cloud certifications, for example Microsoft Certified: Cybersecurity Architect Expert (SC-100), Azure Solutions Architect Expert or Azure Security Engineer Associate (AZ-500); AWS Certified Solutions Architect or AWS Certified Security – Specialty; CISSP or CCSP. Experience with Azure Virtual Desktop or Windows 365, and with migrating Microsoft 365 workloads such as Exchange and SharePoint. Experience securing PaaS, data and AI platforms (for example Power Platform, Dynamics 365 and Azure AI Foundry). FinOps or cloud cost governance experience, with a track record of delivering measurable savings. Experience supporting internal and external audit of cloud and identity controls in a regulated environment.