Cloud & Infrastructure Security Architect

About the Role

We are looking for a Cloud & Infrastructure Security Architect to serve as the security authority across our multi-cloud environment. You will define the security architecture standards our infrastructure must meet, govern continuous audit and assurance to ensure zero gaps, and drive measurable improvement in cloud security posture across AWS, Azure, and GCP. This is a hands-on architecture role with real ownership.

Responsibilities

Cloud Security Architecture & Standards

• Define and own the cloud security architecture across AWS, Azure, and GCP.
• Drive secure landing zone architecture, including account structure, network segmentation, logging pipelines, and security control inheritance.
• Lead security architecture reviews and sign-offs for new cloud infrastructure designs and migrations.
• Define multi-cloud IAM architecture, including least privilege design, role federation, and privileged access management.
• Architect secrets management standards across AWS Secrets Manager, Azure Key Vault, and GCP Secret Manager.
• Publish reusable, secure reference architectures and approved cloud service patterns.

Continuous Audit, Assurance & Posture Management

• Own the continuous cloud security audit program against defined standards.
• Govern Cloud Security Posture Management (CSPM), triaging findings and enforcing remediation SLAs.
• Conduct deep-dive security audits covering IAM, network exposure, encryption, logging, and workload configuration.
• Define and enforce cloud security benchmarks aligned to CIS, NIST SP 800-144, and CSA CCM.
• Maintain the cloud security risk register and report to the CISO on a defined cadence.
• Conduct adversarial validation using cloud attack simulation tools.

Kubernetes & Container Security

• Own end-to-end Kubernetes security architecture at CKS depth.
• Define and enforce Kubernetes security standards, including Pod Security Admission, RBAC, admission controllers, and network policies.
• Conduct regular Kubernetes security audits, including CIS Kubernetes Benchmark assessments.
• Define container image security standards, including vulnerability scanning and image signing.
• Own runtime security architecture and container escape and anomaly detection validation.
• Drive Kubernetes CVE triage and response to closure.

IaC Security & Policy-as-Code

• Review and approve Infrastructure-as-Code templates for misconfigurations and over-permissive IAM.
• Define IaC security standards and reusable secure modules.
• Define IaC scanning standards and security gate requirements for CI/CD pipelines.
• Own the policy-as-code framework and continuously audit compliance.

Zero Trust & Network Security

• Define and drive Zero Trust Architecture across cloud environments.
• Design cloud network security standards, including VPC/VNet architecture and egress controls.
• Define service mesh security requirements, including mTLS enforcement.
• Conduct network security audits to identify deviations from approved architecture.

Serverless & Cloud-Native Security

• Define security architecture standards for serverless workloads across AWS Lambda, Azure Functions, and GCP Cloud Functions.
• Audit serverless and cloud-native deployments for SSRF, over-permissive roles, and insecure triggers.
• Define security standards for managed services with encryption, access control, and audit logging.

Threat Detection & Cloud Incident Response

• Design the cloud threat detection architecture and alert pipeline into SIEM and SOC workflows.
• Audit detection coverage and drive tuning to close gaps.
• Define cloud incident response playbooks for key scenarios.
• Design SIEM integration architecture and detection use case requirements.
• Conduct cloud attack simulations to validate detection and response readiness.

Required Skills & Experience

• 8-10+ years of progressive experience in cloud security, infrastructure security, or platform security architecture.
• Expert-level multi-cloud security knowledge across AWS, Azure, and GCP.
• Kubernetes security expertise at CKS depth.
• Strong CSPM governance experience.
• Hands-on IaC security review experience with Terraform, CDK, Bicep, or Helm.
• Cloud threat detection architecture experience with GuardDuty, Defender for Cloud, or GCP SCC.
• Cloud attack simulation experience.
• Zero Trust Architecture design experience.
• Serverless security experience across AWS, Azure, and GCP.
• Strong scripting capability in Python and/or Bash.
• Excellent communication skills for technical and executive audiences.

Nice to Have

• Experience with SOC workflows and SIEM platforms.
• Familiarity with cloud security maturity frameworks.
• Exposure to AI/ML workload security in cloud environments.
• Experience supporting enterprise customer security reviews or third-party security assessments.
• Background in regulated environments with exposure to SOC 2, ISO 27001, or NIST.

Certifications

Preferred: CKS, AWS Certified Security Specialty, AZ-500. Advantageous: CKA, CCSP, GCP Professional Cloud Security Engineer, GCIA/GCIH, OSCP/PNPT.

Education Qualification

Graduate in Engineering or Masters in Computer Applications.