Cloud Platform Architect

Giesecke+Devrient; el Prat de Llobregat; Hybrid; EUR 90,000 - 150,000; Full time

Benefits offered by this job

International Collaboration

Meaningful Projects

Career Development

Flexible Working (hybrid) Time

Job summary

Giesecke+Devrient is seeking an experienced Cloud Platform Architect to lead the design and evolution of a global Azure platform within the Business Cloud Services team. You will translate business needs into secure, scalable cloud solutions and drive architectural patterns, governance, and blueprints across Cloud DevOps and Engineering.

The role focuses on Landing Zones, security, high availability, and cost optimization, with a strong emphasis on PaaS and Zero Trust.

Qualifications

• 10+ years of experience across infrastructure engineering, cloud, platform engineering, SRE, or architecture with 5+ years hands‑on designing enterprise Azure architectures.
• Proven experience translating complex requirements into end-to-end cloud architectures and documentation.
• Strong knowledge of enterprise Azure networking (Hub‑and‑Spoke, Firewall, UDRs, ExpressRoute/VPN, WAF, Private Endpoints).
• Extensive knowledge of Azure Landing Zones, CAF, Management Groups, Azure Policy, RBAC, and subscription provisioning models.
• Experience with PaaS‑first secure cloud solutions and Zero Trust principles.
• Solid security architecture understanding: IAM, encryption, compliance, high availability, DR, resilience.
• Autonomous, proactive decision maker who challenges assumptions and owns outcomes.
• Excellent written and spoken English; able to collaborate with distributed teams.

Responsibilities

• Design end‑to‑end Azure architectures for enterprise workloads with clear diagrams and implementation guidelines.
• Define Azure Landing Zones and governance models aligned to CAF and enterprise requirements.
• Develop secure network architectures (Hub‑and‑Spoke, ExpressRoute, Private Endpoints) across regions and environments.
• Promote PaaS‑first, cloud‑native patterns and secure, resilient solutions using Azure services.
• Embed Zero Trust, identity controls, encryption, and compliance into platform designs.
• Create reusable ADRs, blueprints, and technical standards for the enterprise platform.
• Provide technical leadership to Cloud DevOps and Engineering teams and review complex designs.
• Identify risks and drive improvements for resilience, cost efficiency, and reliability.

Skills

Azure architecture

Technical design

Cloud governance

PaaS‑first

Zero Trust

Security architecture

Autonomy

Communication

Education

Bachelor's degree in CS/Eng

Tools

Azure Active Directory

ExpressRoute

Azure Firewall

Azure Policy

RBAC

App Services

Databricks

Job description

About the Role

As a Cloud Platform Architect within the Business Cloud Services (BCS) team, you will design and evolve our enterprise-grade global cloud platform on Microsoft Azure. You will take ownership of architectural design, translating business and technical requirements into secure, scalable, resilient, and well-governed cloud solutions.

Working closely with Cloud DevOps Engineers, Security, and Engineering teams, you will define architectural patterns, create technical designs and architecture diagrams, and establish implementation guidelines that enable engineering teams to build and operate cloud infrastructure consistently.

You will contribute to a major cloud transformation initiative, supporting the consolidation of the company's cloud environments into a centralized platform and the migration of existing applications. This role is ideal for a highly experienced Azure specialist who combines deep technical expertise with architectural vision, sound decision-making, and a proactive approach to solving complex challenges.

Key Responsibilities

• Cloud Architecture & Technical Design: Design end-to-end Azure architectures for enterprise workloads, translating business and technical requirements into clear architecture diagrams, technical designs, and implementation guidelines for Cloud DevOps and Engineering teams.
• Azure Landing Zones & Governance: Design and evolve enterprise-scale Azure Landing Zones in line with the Microsoft Cloud Adoption Framework (CAF). Define governance models using Management Groups, Azure Policy, RBAC, and subscription provisioning standards.
• Enterprise Networking & Connectivity: Define secure, scalable network architectures covering Hub-and-Spoke topologies, Azure Firewall, User-Defined Routes (UDRs), ExpressRoute/VPN, Application Gateway WAF, and Private Endpoints. Design connectivity patterns across Azure regions, on-premises environments, and external cloud platforms where required.
• PaaS-First & Cloud-Native Architecture: Establish architectural patterns that prioritize PaaS and SaaS services over traditional IaaS where appropriate. Design secure, resilient solutions using Azure services such as App Services, Databricks, Event Hubs, and Azure Virtual Desktop.
• Security, Identity & Compliance: Embed Zero Trust principles, identity and access governance, encryption, vulnerability management, and security controls into platform architecture. Work with Security teams to address architectural risks and support compliance requirements.
• Architecture Standards & Reusable Blueprints: Define reusable architectural patterns, landing zone blueprints, technical standards, and Architecture Decision Records (ADRs). Ensure architectural decisions are documented, consistent, and aligned with enterprise requirements.
• Technical Leadership & Collaboration: Guide Cloud DevOps Engineers through architectural decisions and implementation requirements, review proposed technical solutions, and provide direction on complex design challenges. Collaborate with Engineering, Security, and Operations teams to ensure solutions are practical, maintainable, and aligned with the overall platform strategy.
• Reliability & Continuous Improvement: Identify architectural risks and opportunities for improvement, and drive decisions that strengthen resilience, scalability, operational efficiency, and cloud cost optimization.

Required Skills & Qualifications

• Senior Azure Architecture Experience: 10+ years of experience across infrastructure engineering, cloud, platform engineering, SRE, or architecture, including at least 5 years of hands‑on experience designing enterprise‑scale Azure architectures. Deep expertise in Microsoft Azure is essential.
• Architecture & Technical Design: Proven experience translating complex requirements into end-to-end cloud architectures, architecture diagrams, technical documentation, and clear implementation guidelines for engineering teams.
• Azure Networking Expertise: Strong knowledge of enterprise Azure networking, including Hub-and-Spoke architectures, Azure Firewall, UDRs, ExpressRoute/VPN, Application Gateway WAF, and Private Endpoints.
• Azure Landing Zones & Governance: Extensive knowledge of Azure Landing Zones, Enterprise-Scale architecture, Microsoft Cloud Adoption Framework (CAF), Management Groups, Azure Policy, RBAC, and subscription provisioning models.
• PaaS & Zero Trust: Demonstrated experience designing secure, scalable cloud solutions with a PaaS‑first mindset and applying Zero Trust principles to enterprise environments.
• Security & Resilience: Strong understanding of cloud security architecture, identity and access management, encryption, compliance controls, high availability, disaster recovery, and operational resilience.
• Autonomy & Decision‑Making: A proactive, independent professional who challenges assumptions, anticipates architectural risks, evaluates alternatives, and takes ownership of technical decisions and their outcomes.
• Communication & Collaboration: Excellent written and spoken English is mandatory. You can explain complex architectural decisions clearly and collaborate effectively with distributed, international teams, including DevOps and Engineering colleagues.

Nice to Have

• Microsoft certifications such as Azure Solutions Architect Expert (AZ-305) and/or Azure Network Engineer Associate (AZ-700).
• Experience with hybrid or cross-cloud architectures, including integration with AWS and on‑premises environments.
• Familiarity with security and compliance standards in financial services or regulated environments, such as PCI DSS or SOC 2.

What We Offer

• International Collaboration: Join a diverse, international team with a collaborative culture and flat hierarchies.
• Meaningful Projects: Contribute to a major cloud transformation initiative involving cloud platform consolidation and the migration of business‑critical applications.
• Career Development: Access continuous training, coaching, and talent development opportunities.
• Flexible Working: Hybrid model with 2 days per week on-site in El Prat de Llobregat and 3 days working remotely, alongside flexible working arrangements and a summer schedule from mid‑June to mid‑September.
• Social Benefits: Flexible compensation options, including transport, childcare, training, and private insurance.
• On-Site Facilities: Breakfast and lunch services, a variety of menu options, and fruit packages.
• Accessible Location: Convenient public transport connections and on‑site parking.