Senior Associate, Cloud Security Architecture

Alvarez & Marsal; New York (NY); On-site; USD 150,000 - 190,000; Full time

Job summary

Alvarez & Marsal is seeking a Senior Associate to join our Global Cyber Risk Services team as Cloud Security Architecture expert. You will design, assess, and strengthen security across cloud and hybrid environments, collaborating with CISOs, cloud engineers, and deal teams to translate findings into pragmatic roadmaps.

You will contribute to tool rationalization, IAM and network security, secure DevSecOps practices, and risk-focused security architecture for AI/ML workloads, supporting M&A due

Qualifications

• Bachelor's degree in Computer Science, Information Systems, Cybersecurity, or related field; 4–7 years cloud security/architecture experience preferred.
• At least one active cloud certification (AWS/Azure/Google Cloud).
• Hands‑on experience securing production workloads on major cloud platforms (AWS/Azure/GCP).
• Knowledge of IAM, networking, encryption, logging and monitoring, shared responsibility models.

Responsibilities

• Lead cloud security architecture reviews and cloud configuration assessments across AWS, Azure, and GCP.
• Design and assess zero trust architectures and maturity, and develop phased roadmaps.
• Lead security tools rationalization and consolidation reviews; map tooling to capabilities and risk.
• Assess security controls across identity, networks, data protection, and key management.
• Design target‑state cloud security architectures, including secure landing zones and guardrails.
• Review IaC, CI/CD pipelines, container/Kubernetes environments for security gaps.
• Map cloud controls to compliance requirements (NIST, ISO 27001, SOC 2, PCI DSS).
• Evaluate CSPM/CNAPP, cloud workload protection, and cloud‑native detection tooling; advise on tool selection.

Skills

Cloud security architecture

DevSecOps

Zero trust

Security architecture reviews

Written communication

Education

Bachelor's degree in Computer Science or related field

Tools

Terraform

CI/CD security

Kubernetes security

Infrastructure as code ( Terraform / CloudFormation / Bicep )

Job description

About Alvarez & Marsal

Alvarez & Marsal (A&M) is a global consulting firm with entrepreneurial, action- and results-oriented professionals. We take a hands‑on approach to solving our clients' problems and helping them reach their potential. A&M is different by design: we give people ownership and impact from day one, fuel development through real opportunity, and provide direct access to leaders who invest in our growth. Our culture celebrates independent thinkers and doers who positively impact clients and shape our industry. Guided by A&M's core values of Integrity, Quality, Objectivity, Fun, Personal Reward, and Inclusive Diversity, our collaborative, globally minded environment is why our people love working at A&M.

Description

About Alvarez & Marsal

Alvarez & Marsal (A&M) is a global consulting firm with entrepreneurial, action- and results-oriented professionals. We take a hands‑on approach to solving our clients' problems and helping them reach their potential. A&M is different by design: we give people ownership and impact from day one, fuel development through real opportunity, and provide direct access to leaders who invest in our growth. Our culture celebrates independent thinkers and doers who positively impact clients and shape our industry. Guided by A&M's core values of Integrity, Quality, Objectivity, Fun, Personal Reward, and Inclusive Diversity, our collaborative, globally minded environment is why our people love working at A&M.

The Team

Alvarez & Marsal’s (A&M’s) Global Cyber Risk Services (GCRS) practice helps Boards and management teams understand and manage cyber risk, strengthen resilience, support transactions, and respond with confidence when incidents occur. As the cyber landscape continues to evolve, we help clients see that cybersecurity is not a technology issue, but a business issue. Our methods are grounded in guidance from the regulatory and industry frameworks and best practices that govern our clients’ specific business. Our team of cybersecurity experts provides prioritized findings, observations, recommendations, and a roadmap for gap closure, using expertly developed methodologies, tools, and techniques to identify vulnerabilities, system misconfigurations, and program deficiencies and improve our clients’ overall cyber posture and process maturity.

Our Services

• Cyber Risk Advisory: program maturity assessments (ISO 27001, NIST, CIS Controls), risk-based program prioritization, security and privacy governance, data privacy and cyber compliance (GDPR, CCPA, NYDFS, HIPAA, PCI‑DSS), third‑party risk, AI security assessments, and board reporting.
• Incident Response & Forensic Investigations: breach and ransomware response, cyber war room management, comprehensive forensic investigations and log analysis, malware reverse engineering, Microsoft 365 investigations, AI incident response, expert witness and litigation support, and incident response retainers.
• Cyber Resilience: incident response program development, ransomware readiness and playbooks, cyber threat simulations and tabletop exercises, red teaming and penetration testing, threat hunting and compromise assessments, application, network, cloud and OT security assessments, and secure DevOps.
• Cybersecurity Transaction Advisory: buy‑side, sell‑side, and carve‑out cybersecurity due diligence, Day 1 readiness, separation and integration support (IMO/SMO), TSA governance and exit planning, and post‑close performance improvement.

How You Will Contribute

Our Global Cyber Risk Services (GCRS) team is seeking a Senior Associate - Cloud Security Architecture. You will be a key part of the continued growth of our practice. Working with organizations across all industries, you will develop your career by listening to and understanding our clients and communicating creative solutions for their specific needs, in a field where there really are no off‑the‑shelf recommendations.

As a Senior Associate within our Cloud Security Architecture practice, you will help clients design, assess, and strengthen the security of their cloud and hybrid environments. You will work with CISOs, cloud engineering and DevOps leaders, and deal teams to evaluate how cloud platforms are architected, configured, and governed, and to translate technical findings into pragmatic, prioritized roadmaps.

Our cloud work spans the full lifecycle: zero trust architecture and maturity assessments, security tools rationalization, cloud security architecture reviews and configuration assessments, secure landing zone and zero trust design, DevSecOps and infrastructure‑as‑code reviews, cloud due diligence on M&A targets, carve‑out and separation architecture, and security architecture for AI, AIOps, and MLOps workloads. You will also support our incident response and cyber resilience teams where cloud expertise is needed.

As cyber‑crime continues to threaten businesses large and small, threat actors are improving their tactics, techniques, and procedures faster than corporate security teams can keep up, and are increasingly organized, collaborative, and AI‑enabled. When our clients do not have the knowledge or resources to take on the threat of a cyber‑attack, they look to us for expertise and partnership.

Key Responsibilities

• Lead and perform cloud security architecture reviews and cloud configuration assessments across AWS, Microsoft Azure, and Google Cloud Platform, benchmarked against frameworks such as CIS Benchmarks, the Cloud Security Alliance Cloud Controls Matrix, NIST, and provider well‑architected security pillars.
• Design and assess zero trust architectures and maturity (e.g., CISA Zero Trust Maturity Model), across identity, devices, networks, applications, and data, and develop phased adoption roadmaps.
• Lead security tools rationalization and consolidation reviews: inventory and map security tooling to capabilities and risk, identify overlap and gaps, and recommend a right‑sized, cost‑effective security architecture.
• Assess identity and access management, network segmentation, data protection and encryption, key management, logging and monitoring, and secrets management in multi‑account, multi‑subscription, and multi‑cloud environments.
• Design and recommend target‑state cloud security architectures, including secure landing zones, zero trust patterns, hybrid connectivity, and guardrails for cloud adoption and migration.
• Review infrastructure‑as‑code (e.g., Terraform, CloudFormation, Bicep), CI/CD pipelines, container and Kubernetes environments, and serverless architectures to identify security gaps and recommend DevSecOps improvements.
• Map cloud and architecture controls to compliance and assurance requirements (e.g., NIST, ISO/IEC 27001, SOC 2, PCI DSS, HIPAA) and advise clients operating in regulated industries on meeting them in the cloud.
• Evaluate cloud security posture management (CSPM/CNAPP), cloud workload protection, and cloud‑native detection and response tooling, and advise clients on tool selection, rationalization, and implementation, in a vendor‑agnostic manner.
• Assess the security architecture of AI and ML workloads and platforms (e.g., Amazon Bedrock and SageMaker, Azure OpenAI and Azure AI, Google Vertex AI), including model access control, data pipelines, retrieval‑augmented generation and vector stores, secrets and API exposure, and agent‑to‑tool integrations.
• Support cybersecurity M&A due diligence, carve‑out and separation planning, and post‑close integration by assessing target cloud estates, identifying risk, and estimating standalone and remediation requirements.
• Support cloud‑related incident response and resilience efforts, including cloud logging readiness, detection engineering, and cloud recovery architecture.
• Develop high‑quality written deliverables, architecture diagrams, and executive presentations that translate technical findings into business risk and prioritized, actionable roadmaps.
• Contribute to GCRS cloud assessment methodologies, scripts, and reusable assets, and mentor junior team members.

Skills And Attributes For Success

• Combine deep technical cloud knowledge with the ability to explain architecture decisions and trade‑offs to both engineers and executives.
• Design pragmatic solutions that fit the client’s existing technology investments and operating model rather than defaulting to a single vendor or platform.
• Stay current with rapidly evolving cloud services, attack techniques against cloud environments, and security considerations for generative and agentic AI.
• Take responsibility for managing workstreams, including ownership of client communication, coordination of internal resources, and planning and execution of assessment or response activities.
• Communicate information security and technology issues verbally and in writing, formally and informally, to all levels of client staff, from senior executives to technical users, and produce high‑quality written reports and documents.
• Work independently to manage and execute multiple engagements in diverse client environments, keep management apprised of status, bring engagements to completion, and follow up with clients on results.
• Develop tools, scripts, and documentation for internal team use, and actively contribute to the maintenance and enhancement of team systems, playbooks, and processes.
• Develop and complete an education plan to grow your skills consistent with client needs, and support the development of junior team members through coaching and feedback.
• Promote awareness of the team by building relationships, publishing whitepapers or advisories, contributing to marketing materials, or presenting at conferences.

Qualifications

Required

• Bachelor's degree in Computer Science, Information Systems, Cybersecurity, or a related field (or equivalent experience), supported by approximately 4‑7 years of relevant experience in cloud security, cloud architecture, or cloud engineering; consulting experience is strongly preferred.
• At least one active professional‑level cloud certification. Required: AWS Certified Solutions Architect (Associate or Professional), and/or an equivalent architect‑ or security‑level certification from Microsoft Azure (e.g., AZ‑305, AZ‑500, SC‑100) or Google Cloud (e.g., Professional Cloud Architect, Professional Cloud Security Engineer).
• Hands‑on experience designing, securing, or assessing production workloads in at least one major cloud platform (AWS, Azure, or GCP), with working knowledge of a second.
• Strong working knowledge of cloud IAM, networking and segmentation, encryption and key management, logging and monitoring, and shared‑responsibility models.
• Experience with infrastructure‑as‑code and DevSecOps practices and tooling (e.g., Terraform, CI/CD security, container and Kubernetes security).
• Familiarity with one or more compliance and control frameworks, such as NIST CSF, NIST SP 800‑53, ISO/IEC 27001, CIS Controls, CSA CCM, HIPAA, PCI DSS, or SOC 2, and the ability to connect architecture decisions to governance, risk, and compliance (GRC) requirements.
• Working knowledge of zero trust principles and security architecture concepts (e.g., NIST SP 800‑207, CISA Zero Trust Maturity Model).
• Ability to occasionally work weekends and/or off hours as necessary to meet client needs, including time‑sensitive, high‑pressure situations
• Ability and willingness to travel as needed
• Strong written and verbal communication skills, with the ability to interact effectively with stakeholders from technical staff to Board members
• Strong analytical skills, solid attention to detail, and a penchant for accuracy
• History of balancing competing priorities and adapting to changing client needs while meeting deadlines
• Proven ability to create and maintain technical documentation for enterprise‑level clients

Preferred / Plus

• Additional certifications such as AWS Certified Security – Specialty, CISSP, CCSP, CCSK, TOGAF or SABSA, CISM, GIAC cloud certifications (e.g., GCLD, GPCS, GCSA), Certified Kubernetes Security Specialist (CKS), or OSCP.
• Experience delivering zero trust assessments or roadmaps, security tools rationalization programs, or enterprise security architecture and strategy for large or regulated enterprises.
• Understanding of security architecture and threats for AI/ML platforms, including LLM applications and agentic AI (e.g., prompt injection, insecure agent‑tool integrations, data poisoning, model and data exfiltration), and familiarity with the NIST AI RMF, OWASP Top 10 for LLM Applications, and MITRE ATLAS.
• Experience with AIOps/MLOps security architecture, DevSecOps, or source code analysis; development experience