Cloud Architect

Ascendion; Taguig; On-site; PHP 900,000 - 1,500,000; Full time

Job summary

Ascendion in Manila-based operations is seeking a Cloud Security Architect to design and review secure cloud architectures for Azure IaaS, PaaS, and SaaS integrations. You will ensure identity-centric access, data protection, and workload security across multi-cloud considerations.

The role requires applying CCM/NIST frameworks, Zero Trust principles, and CSPM/CWPP guidance while guiding data protection, governance, and policy alignment with stakeholders.

Qualifications

• 5-8 years of experience in cloud security architecture or related roles.
• Strong familiarity with Microsoft Azure services and cloud security concepts.
• Exposure to CSPM, CWPP, Purview DLP and related tooling.
• Knowledge of CCM or NIST frameworks and Zero Trust principles.

Responsibilities

• Design and review secure cloud architectures for Azure IaaS, PaaS, SaaS.
• Define patterns and guardrails for IAM, data classification, and workload security.
• Apply CCM/NIST frameworks to guide designs and control coverage.
• Incorporate Zero Trust principles into designs and access controls.
• Contribute to data protection and DLP considerations for cloud data.
• Provide guidance on CSPM and CWPP to monitor and harden workloads.
• Ensure designs align with security policies and risk management.
• Maintain internal cloud security documentation and standards.

Skills

Cloud security architecture

Azure security

Zero Trust

IAM & data protection

CSPM / CWPP

Data classification & labelling

DLP considerations

Stakeholder communication

Education

Azure Security Engineer

Azure Solutions Architect

CCSP

Tools

Purview DLP

CSPM

CWPP

Azure IaaS/PaaS security

Job description

• Design and review secure cloud architectures for IaaS, PaaS, and SaaS integrations, primarily within Microsoft Azure, with awareness of multi‑cloud considerations.
• Define and maintain cloud security architecture patterns, reference designs, and guardrails that address security controls such as identity and access management, data classification and protection and workload security
• Apply industry security frameworks (e.g., CSA Cloud Controls Matrix, NIST frameworks) to guide cloud security designs and ensure appropriate control coverage.
• Incorporate Zero Trust principles into designs and architectures, emphasizing identity‑centric access, least privilege, segmentation, and continuous verification.
• Participate in the design and testing of data protection and data loss prevention (DLP) considerations for data hosted or processed in cloud and SaaS services, including classification, labelling, encryption, and access controls.
• Provide architectural guidance related to Cloud Security Posture Management (CSPM) and Cloud Workload Protection (CWPP) capabilities to help ensure workloads are monitored, hardened, and resilient to attack.
• Ensure cloud security designs and recommendations align with WTW security policies, standards, and risk management expectations.
• Maintain and evolve internal intranet documentation related to cloud standards, approved architectures, and implementation guidance ensuring it current, usable, and trusted across the organization.
• Stay current with cloud and general security capabilities and technology trends to recommend architectural and security best practices.

Qualifications:

• 5-8 years of experience in cloud security architecture, secure cloud design, or closely related roles.
• Strong familiarity with Microsoft Azure services and cloud security concepts, including network security controls, identity and access concepts, secrets management and security considerations for Azure IaaS and PaaS services
• Exposure to modern cloud security tooling (e.g., CSPM, CWPP, Purview DLP and Information Protections) ideally with experience in their configuration and testing their capabilities.
• Solid understanding of core cloud security principles including identity‑centric and least‑privilege access, defense‑in‑depth and segmentation, secure service‑to‑service communication and protection of data in transit and at rest
• Strong working knowledge of broader cloud security domains, such as Data protection and data loss prevention (DLP), data classification and labelling, Cloud Security Posture Management (CSPM) concepts and workload hardening
• Proven experience designing cloud solutions with data protection and attack resistance as foundational requirements.
• Familiarity with cloud security frameworks and standards, such as CSA Cloud Controls Matrix (CCM) or NIST Cybersecurity Framework and/or NIST SP 800‑series guidance
• Working understanding of Zero Trust architecture principles and their application to cloud and SaaS environments.
• Strong collaboration and communication skills, with the ability to explain architectural decisions to both technical and non‑technical stakeholders.
• Ability to operate reasonably independently, proactively engaging stakeholders to clarify requirements, recommend solutions, and drive decisions forward.
• Specific experience using Microsoft Purview for Information Protection and Data Governance
• Awareness or hands‑on exposure to AWS security concepts and services.
• Experience mapping cloud security designs to CSA, NIST, or similar frameworks to support risk assessments or audit readiness.
• Experience working in regulated or risk‑sensitive environments.
• Relevant certifications such as Azure Security Engineer, Azure Solutions Architect, CCSP, or similar.