Cloud Platform Architect Azure

Giesecke & Devrient GmbH; el Prat de Llobregat; On-site; EUR 110,000 - 150,000; Full time

Job summary

Giesecke & Devrient GmbH in Spain (El Prat de Llobregat) seeks an experienced Azure Cloud Architect to design, govern, and scale our enterprise Azure platform across regions.

You will drive a PaaS-first architecture, enforce Zero Trust, align with CAF, and collaborate with DevOps, Security, and Engineering to deliver secure, resilient cloud solutions.

Qualifications

• Bachelor’s degree in CS/IS or related field; 10+ years infra/platform engineering or architecture roles.
• 5+ years hands-on experience as Azure Cloud Architect for large multi-region environments.
• In-depth knowledge of enterprise Azure networking: Hub-and-Spoke, Firewall, UDRs, ExpressRoute/VPN, WAF, Private Endpoints.
• Strong PaaS/SaaS focus with Zero Trust principles for enterprise workloads.
• Experience with CAF, Azure Management Groups, Policy, RBAC, and governance.

Responsibilities

• Design, govern, and scale a global Azure platform aligned with CAF and Enterprise-Scale.
• Enforce governance using Azure Policy, Management Groups, and subscription vending.
• Champion PaaS-first architecture and secure patterns for App Services, Databricks, Event Hubs.
• Architect cross-cloud integrations and ADRs, maintain landing zone blueprints.
• Ensure security, compliance, and operational resilience across teams.

Skills

Azure networking

PaaS & Zero Trust

Azure governance

Autonomy

English communication

Education

Bachelor’s degree in Computer Science / Information Systems

Tools

Azure Policy

Azure Management Groups

RBAC

ExpressRoute/VPN

Job description

Select how often (in days) to receive an alert:

Together with the Business Cloud Services (BCS) team, the Azure Cloud Architect will design, govern, and scale our enterprise-grade global cloud platform on Microsoft Azure. Operating within an international setup across multiple countries, you will play a strategic role in evolving our Azure Landing Zones, driving a PaaS-first architecture, enforcing Zero Trust networking, and maintaining robust cloud governance. You will collaborate closely with DevOps, Security, and Engineering teams to deliver secure, resilient, and highly scalable cloud solutions for mission-critical services worldwide.

Key Responsibilities

• Enterprise Landing Zones & Governance: Design, maintain, and scale our global Azure Landing Zone architecture (Enterprise-Scale) aligned with the Microsoft Cloud Adoption Framework (CAF). Enforce governance using Azure Policy, Management Groups, and subscription vending models.
• Enterprise Landing Zones, Security & Compliance: Design, implement, and maintain Azure Landing Zones following Microsoft Cloud Adoption Framework (CAF) and Enterprise-Scale architecture principles. Establish governance guardrails through Azure Policy, Management Groups, RBAC, and subscription vending. Ensure adherence to security and compliance requirements by implementing Zero Trust principles, Defender for Cloud recommendations, secure networking patterns, identity governance, vulnerability management, and continuous compliance monitoring.
• PaaS-First & Cloud-Native Architecture: Champion PaaS and SaaS solutions over traditional IaaS to minimize management overhead. Design secure patterns for platform services (e.g., Azure App Services, Databricks, Event Hubs, Azure Virtual Desktop) and ensure enterprise-grade security posture.
• Hybrid & Cross-Cloud Integration: Architect secure connectivity and integration patterns between global Azure regions, legacy on-premises systems, and external cloud platforms (e.g., AWS interconnections, secure API integrations).
• Architecture Decision Records (ADRs) & Blueprints: Maintain architectural standards, document Technical Designs and Architecture Decision Records (ADRs), and establish reusable landing zone blueprints for application teams.
• Security & Operational Resilience: Mitigate architecture risks, enforce encryption standards, and collaborate closely with Security, DevOps, and Operations teams to maintain platform reliability, compliance, and cost efficiency.

Required Skills & Qualifications

• Experience & Degree: Bachelor’s degree in Computer Science, Information Systems, or a related field. 10+ years in infrastructure engineering, platform engineering, SRE, or architecture roles, with 5+ years of hands-on experience as an Azure Cloud Architect designing and supporting large-scale, multi-region enterprise environments.
• Deep Azure Networking Expertise: In-depth knowledge of enterprise Azure networking architectures, including Hub-and-Spoke, Azure Firewall, UDRs, ExpressRoute/VPN, Application Gateway WAF, and Private Endpoints.
• Strong PaaS & Zero-Trust Mindset: Demonstrated experience prioritizing PaaS/SaaS over traditional IaaS and applying Zero Trust principles to enterprise workloads.
• Azure Enterprise Scale & Governance: Strong understanding of Azure Management Group structures, Azure Policy, RBAC, subscription vending models, and Microsoft Cloud Adoption Framework (CAF) guidelines.
• Self-Starter Mentality & Autonomy: High degree of autonomy and proactive leadership. We are looking for someone who does not simply accept technical requirements, but actively identifies architectural risks, proposes solutions, drives technical decisions, and takes ownership of platform design while collaborating effectively with the wider team.
• Communication & Agile: Excellent oral and written communication skills in English, with experience collaborating effectively in distributed, multi-cultural international teams.

Nice to Have / Preferred

• Certifications: Microsoft Certified: Azure Solutions Architect Expert (AZ-305) and/or Azure Network Engineer Associate (AZ-700).
• Knowledge of security and compliance standards relevant to financial services or regulated environments (e.g., PCI-DSS, SOC2).
• Familiarity with Spanish is a plus.

What We Offer

• Culture and Diversity:Join a people oriented environment with different nationalities and a great team spirit, flat hierarchies (everyone speaks to everyone). Equal Opportunity Employer and LGBT+ friendly.
• Global Collaboration:Enjoy collaborative work in Agile/SCRUM teams and with stakeholders around the globe.
• Open working spacewith Best-in-class equipment: High-performance PC with huge monitors.
• Innovative Products:Design and develop business processes and IT solutions for innovative products and digital solutions.
• Career Development:Continuous training and coaching, talent program.
• Social Benefits:flexible compensation (transport tickets, childcare vouchers, training, private insurance) and in-house parking.
• Flexible work time and remote work:M-Th 8.30 – 17.30 and Fri 8.30 – 15.30, hybrid model.
• Own Canteen:Take a break with our breakfast and lunch service: Choose between a big range of menus, salad desk and sandwich service. Fruit packages.
• Location:El Prat de Llobregat. Easy communication by public transport (Bus 88 and 110, Metro L10 Riu Vell from Barcelona, PR4 from El Prat) o private transport.

Learn more about G+D

Explore what makes G+D unique – check out this video:

The personal data you provide will be processed to manage your application in accordance with the GDPR and our Privacy Policy, available at Data Privacy | G+D .

$$ We are an equal opportunity employer! We promote diversity in all its forms and create an inclusive work environment, free from prejudice, discrimination and harassment, in which all employees feel a sense of belonging. We warmly welcome all applications regardless of gender, age, race or ethnic origin, social and cultural background, religion, disability and sexual orientation.