Cloud Security Architect

Cloud Architect, Expert Oakland, CA

Department Overview Information Technology delivers secure, resilient, and scalable enterprise platforms that support critical business applications, infrastructure services, cloud operations, automation, and emerging technology enablement.

Position Summary

The Expert Cloud Architect spends hands-on time writing Terraform, designing pipeline architectures, building proof-of-concepts, and directly resolving the hardest technical problems the team encounters. They are the person who unblocks the Senior Cloud Architects when those architects are stuck. The role spans AWS, Microsoft Azure, and private cloud platforms (Azure Local), with accountability for platform-wide design consistency, performance, security posture, and operational excellence across the hybrid estate.

Job Responsibilities

• Own and evolve the hybrid cloud platform architecture across AWS, Azure, and Azure Local - ensuring coherence, scalability, and security.
• Define and drive the long-term technical roadmap for the platform team in partnership with the Sr. Cloud Principal Architect.
• Architect enterprise landing zones, subscription/account topology, network segmentation, and identity federation strategies.
• Design complex hybrid networking solutions: vWAN, ExpressRoute, SD-WAN integration, network virtual appliances, cross-cloud connectivity.
• Establish architecture decision records (ADRs), design principles, and non-functional requirement frameworks for the platform.
• Evaluate emerging cloud services, open-source tools, and industry trends - make build/buy/adopt recommendations with clear trade-off analysis.
• Lead architecture reviews for high-impact or high-risk initiatives, providing binding technical guidance.
• Author and maintain enterprise Terraform module libraries - defining patterns, interfaces, security defaults, and versioning strategies.
• Design and implement advanced CI/CD pipeline architectures in Azure DevOps for multi-environment, multi-subscription infrastructure delivery.
• Build complex automation: multi-stage deployments, policy-as-code enforcement, drift detection, self-healing infrastructure patterns.
• Implement and validate security architectures through code - private endpoints, managed identities, CMK encryption, network micro-segmentation.
• Design and deploy Kubernetes platforms (AKS/EKS) with production-grade configurations: RBAC, network policies, ingress, service mesh, GitOps.
• Build proof-of-concepts and reference implementations that teams can adopt and extend.
• Resolve the hardest infrastructure challenges - state migration, provider upgrades, complex module refactoring, cross-account/subscription orchestration.
• Serve as the senior technical escalation point - unblock Senior Cloud Architects and platform engineers on the most complex problems.
• Lead cross-team architecture alignment sessions, ensuring consistent patterns across squads and workstreams.
• Define code review standards, module contribution guidelines, and quality gates for the Terraform module library.
• Mentor Senior Cloud Architects and platform engineers - elevate team capability through pairing, design reviews, and technical coaching.
• Drive engineering culture: infrastructure-as-code discipline, automated testing, documentation-as-code, and continuous improvement.
• Facilitate architecture guilds, communities of practice, and cross-functional technical forums.
• Translate complex technical trade-offs into clear recommendations for leadership and business stakeholders.
• Partner with enterprise architecture, security, networking, and compliance teams to shape platform standards and policies.
• Influence enterprise governance frameworks - Azure Policy, AWS SCPs, tagging standards, cost allocation, and resource lifecycle management.
• Drive platform observability strategy: centralized logging, distributed tracing, alerting frameworks, and AIOps integration.
• Support disaster recovery architecture, ransomware resilience, and business continuity planning for platform services.
• Contribute to vendor relationship management - evaluate cloud provider roadmaps, negotiate architectural patterns, and influence feature requests.
• Represent the platform team in enterprise architecture boards, change advisory processes, and technology governance forums.
• Support AI/ML platform infrastructure - GPU scheduling, model serving, feature stores, and MLOps pipeline architecture.

Qualifications

• Bachelor's degree in Computer Science, a job-related discipline, or equivalent experience.
• 8 years of hands-on experience in cloud infrastructure, systems engineering, or cloud architecture roles.
• 5 years of hands-on experience writing Terraform at scale (enterprise module libraries, multi-environment state management, provider development).
• 4 years of experience designing and implementing CI/CD pipeline architectures (Azure DevOps, GitHub Actions, or equivalent).
• 3 years of experience in a technical leadership or architecture role - guiding teams, setting standards, making binding design decisions.
• Demonstrated experience architecting solutions across both AWS and Azure (multi-cloud, not just single-provider).
• Proven track record of resolving complex cross-domain infrastructure challenges (networking + security + compute + automation).
• Experience working in and leading within Agile/Scrum delivery teams.
• AWS Solutions Architect Professional or Azure Solutions Architect Expert certification.
• HashiCorp Terraform Associate or equivalent IaC certification.
• Kubernetes certification (CKA/CKAD) or equivalent hands-on container platform experience.
• Deep expertise in hybrid networking: ExpressRoute, vWAN, Transit Gateway, Palo Alto NVA, SD-WAN, BGP routing.
• Experience designing and operating enterprise landing zones (Azure CAF, AWS Control Tower, or custom).
• Knowledge of AI/ML infrastructure architecture - GPU compute, distributed training, model serving, MLOps.
• Experience with platform engineering practices: internal developer platforms, self-service infrastructure, golden paths.
• Familiarity with FinOps practices, cloud cost optimization, and resource rightsizing.
• Experience with compliance-as-code: Azure Policy, AWS Config Rules, OPA/Rego, Sentinel.
• Strong background in security architecture: zero-trust, identity federation (SAML/OIDC), private connectivity, secrets management.
• Excellent communication skills - ability to present architecture decisions to executives, write technical RFCs, and mentor effectively.
• Experience influencing technology strategy beyond the immediate team - enterprise architecture boards, COEs, or similar.

For applications and inquiries, contact:View email address on us.fitly.work