Cloud Security Architect (Manager)

Eames Consulting; Ipswich; On-site; GBP 80,000 - 90,000; Full time

Job summary

Eames Consulting is recruiting a hands-on Cloud Security Architect at manager level for an on-premise to cloud migration journey. You will define the cloud security architecture across Azure and AWS, lead a small team, and embed DevSecOps practices from design through delivery.

The role focuses on identity, privileged access and Zero Trust, reporting to the Head of Architecture and Security. Based in Ipswich or Caerphilly, the position is permanent with on-site requirements.

Qualifications

• Substantial, current hands-on experience in cloud architecture, engineering or security.
• Track record of delivering on-premise to cloud migrations end to end.
• Deep Azure security expertise (landing zones, networking, Azure Policy, RBAC, Key Vault, Defender for Cloud, Sentinel) and strong working knowledge of AWS.
• Strong Entra ID and hybrid identity knowledge, including Conditional Access, SAML/OIDC federation and migrating Group Policy to Intune.
• Practical privileged access and Zero Trust design experience.
• Hands-on DevSecOps skills: Terraform, Bicep or CloudFormation, PowerShell or Python, Azure DevOps or GitHub Actions, and Kubernetes/AKS.
• Working knowledge of ISO 27001, UK GDPR and the security requirements of a regulated UK environment.
• Experience leading small technical teams and mentoring junior engineers.
• Excellent communication skills and a commercially aware, pragmatic approach.

Responsibilities

• Lead assessment of current estate (on-prem data centre, VDI, AD, M365, Azure and AWS) to set a baseline for change.
• Define and own the future-state cloud security architecture and migration roadmap.
• Build secure Azure landing zones and AWS patterns with Zero Trust network design.
• Lead identity and device modernisation from AD and GPO to Entra ID and Intune.
• Define and implement privileged access controls, including Entra PIM and PAM tooling.
• Set cloud security standards aligned to NCSC principles, CIS Benchmarks and Microsoft benchmarks.
• Embed DevSecOps through IaC, secure pipelines, secrets management and policy-as-code.
• Lead threat modelling, track pen test findings to remediation, design tested DR.
• Present options, risks, costings and business cases at governance forums.
• Provide technical assurance over vendor and partner proposals.

Skills

Cloud architecture

Security engineering

Leadership

Communication

DevSecOps

Tools

Terraform

Bicep

CloudFormation

PowerShell

Python

Azure DevOps

GitHub Actions

Kubernetes/AKS

Entra ID

Intune

Job description

Cloud Security Architect (Manager)

Permanent | Ipswich or Caerphilly | £80,000 to £90,000 per annum

Eames Consulting is partnering with a regulated UK organisation to hire a hands-on Cloud Security Architect at manager level. This is a chance to shape a secure, cloud-first future from the ground up: setting the target architecture, building the patterns yourself and leading a small team through a major on-premise to cloud journey.

The role

You will define and lead the organisation’s cloud security architecture and migration roadmap across Microsoft Azure and AWS, with a strong focus on identity, privileged access and Zero Trust. Reporting to the Head of Architecture and Security, you will lead two engineers, mentor graduates and act as the go-to voice on cloud risk and opportunity for technical and non-technical stakeholders alike.

This is not an advisory seat. You will build, prove and hand over what you design, and embed DevSecOps so that security is built into delivery from the start.

What you’ll be doing

• Leading an assessment of the current estate (on-premise data centre, VDI, Active Directory, Microsoft 365, Azure and AWS) to set an agreed baseline for change
• Designing and owning the future-state cloud security architecture and phased migration roadmap
• Building secure Azure landing zones and equivalent AWS patterns, underpinned by Zero Trust network architecture
• Leading identity and device modernisation from Active Directory and Group Policy to Entra ID and Intune
• Defining and implementing privileged access controls, including Entra PIM, PAM tooling, tiered administration and just-in-time access
• Setting cloud security standards aligned to frameworks such as NCSC Cloud Security Principles, CIS Benchmarks and the Microsoft Cloud Security Benchmark
• Embedding DevSecOps through Infrastructure as Code, secure pipelines, secrets management and policy-as-code
• Leading threat modelling, tracking pen test findings to remediation and designing tested backup and disaster recovery
• Presenting options, risks, costings and business cases at design authority and governance forums
• Providing technical assurance over vendor and partner proposals

What you’ll bring

• Substantial, current hands-on experience in cloud architecture, engineering or security
• A track record of delivering on-premise to cloud migrations end to end
• Deep Azure security expertise (landing zones, networking, Azure Policy, RBAC, Key Vault, Defender for Cloud, Sentinel) and strong working knowledge of AWS
• Strong Entra ID and hybrid identity knowledge, including Conditional Access, SAML/OIDC federation and migrating Group Policy to Intune
• Practical privileged access and Zero Trust design experience
• Hands-on DevSecOps skills: Terraform, Bicep or CloudFormation, PowerShell or Python, Azure DevOps or GitHub Actions, and Kubernetes/AKS
• Working knowledge of ISO 27001, UK GDPR and the security requirements of a regulated UK environment
• Experience leading small technical teams and mentoring junior engineers
• Excellent communication skills and a commercially aware, pragmatic approach

Nice to have

• Certifications such as SC-100, AZ-500, Azure Solutions Architect Expert, AWS Security Specialty, CISSP or CCSP
• Experience with Azure Virtual Desktop or Windows 365, or migrating Exchange and SharePoint
• Experience securing Power Platform, Dynamics 365 or Azure AI Foundry
• FinOps or cloud cost governance experience
• Experience supporting audit of cloud and identity controls

Working pattern

Full-time and based in Ipswich or Caerphilly, with regular on-site attendance for workshops, architecture reviews and team leadership. Some occasional work outside core hours for cutovers and major change.