Cloud Migration Architect; Cyber Security and remote

Position: Cloud Migration Architect (Cyber Security and remote - 11months+

The Solution Architect (Cyber Security) leads the design of secure, scalable, and compliant technology solutions across applications, data, infrastructure, and cloud platforms. This role translates business requirements and risk posture into pragmatic security architectures and control designs‑aligning to enterprise patterns, Zero Trust principles, and regulatory obligations (eg, GDPR). You will collaborate with product teams, enterprise architects, and security operations to ensure security‑by‑design from inception through delivery.

Architecture

& Design

• Define security architecture for new and existing solutions across cloud (AWS), hybrid, and on‑prem environments covering application, data, network, identity, and endpoint layers.
• Embed Zero Trust principles (verify explicitly, least privilege, assume breach) into solution patterns, reference architectures, and guardrails.
• Develop threat models and control mappings for solutions using MITRE ATT&CK, STRIDE, and risk‑based prioritization.
• Produce high‑quality artifacts: security patterns, HLD/LLD, control designs, data flow diagrams, encryption schemes, key management, and security acceptance criteria.

Integration & Delivery

• Partner with Solution/Enterprise Architects, Engineering, Product & Dev Ops to integrate security controls (IAM, PAM, network segmentation, API security, EDR, DLP, SIEM/SOAR, CSPM/CNAPP) within delivery pipelines.
• Define secure SDLC and Dev Sec Ops  practices: SAST/DAST/IAST, dependency scanning, secrets management, container and IaC security (eg, Terraform, Bicep, Cloud Formation).
• Ensure solutions meet performance, resilience, and cost goals without compromising risk posture.

Governance, Risk & Compliance

• Map solution controls to NIST CSF 2.0, ISO/IEC 27001/2, CIS Controls, PCI DSS, SOC 2, and GDPR/data protection obligations.
• Contribute to security exception processes, risk assessments, and remediation plans; maintain traceability from risks to controls to testing evidence.
• Drive policy‑as‑code and control‑as‑code adoption across cloud landing zones, Kubernetes, and CI/CD.

Assurance & Operations Enablement

• Define validation plans and acceptance criteria; support penetration testing, red team exercises, and secure configuration baselines.
• Ensure logging/telemetry and use cases are onboarded to SIEM/SOAR with detection logic and response playbooks.
• Provide design handover to operations; drive runbooks, control monitoring, and continuous improvement.

Stakeholder Management

• Translate complex security topics into clear business impacts for executives, product owners, and engineering leads.
• Lead design reviews and decision forums; influence delivery teams and third‑party vendors to meet non‑functional security requirements.

Qualifications

• 7‑10+ years across security architecture, solution architecture, or security engineering roles.
• Proven design experience with cloud‑native security (AWS), network security, identity & access (IAM/PAM), data protection & encryption, and application security.
• Hands‑on involvement with Dev Sec Ops , container/Kubernetes security, and infrastructure‑as‑code guardrails.
• Track record delivering security into enterprise‑scale programs (digital platforms, data/AI, core systems, or M&A integrations).

Technical Skills

• Frameworks & Models: NIST CSF, ISO 27001/27002, CIS Benchmarks, MITRE ATT&CK, OWASP ASVS/Top 10, SABSA/TOGAF.
• Cloud & Platform Security:
  Defender, AWS Security Hub/Guard Duty, GCP Security Command Center; CSPM/CNAPP tools.
• Identity & Access:
  Entra , AWS IAM, SSO/OAuth2/OIDC/SAML, PAM, conditional access, MFA, just‑in‑time access.
• Network & Edge:
  Zero Trust network segmentation, micro‑segmentation, WAF, API gateways, reverse proxies, SWG/ZTNA/SASE.
• App & Dev Sec Ops : SAST/DAST/IAST, dependency/SBOM (Cyclone
  
  DX), secrets scanning, container scanning, Kubernetes policies (OPA/Gatekeeper), CI/CD integration.
• Data Security:
  Tokenization, encryption at rest/in transit, HSM/KMS, DLP, data classification, privacy‑enhancing patterns.
• Detection & Response: SIEM (eg, Microsoft Sentinel, Splunk), SOAR, EDR/XDR, log normalization, detection engineering.
• Compliance & Privacy: GDPR, DPIA, records of processing, data retention/sovereignty, audit readiness.

Please send CV for full details and immediate interviews. We are a preferred supplier to the client.

Northampton and remote - £437.5 per day inside IR35 Contract.

#J-18808-Ljbffr