Cloud/Infra Architect

1. Architecture Leadership & Technology Strategy

• Define and maintain the enterprise target-state architecture for cloud, infrastructure, cybersecurity, platform engineering, cloud-native services and AI enablement.
• Translate business strategy, risk appetite, regulatory needs and technology trends into actionable architecture roadmaps and investment priorities.
• Establish architecture principles, reference architectures, decision frameworks and reusable patterns for global technology delivery.
• Lead architecture governance through Architecture Review Board / TDA-style forums, ensuring early design alignment before delivery execution.
• Own architecture standards for landing zones, connectivity, identity, security, monitoring, automation, resilience, workload onboarding and operational readiness.
• Provide executive-level technology advisory, clearly explaining architectural trade-offs, risk implications, cost impacts and transformation benefits.
• Ensure architecture decisions are documented through architecture decision records, design standards, patterns, exceptions and lifecycle governance.
• Drive architecture maturity from reactive delivery to repeatable, governed engineering patterns, aligned with TMF’s stated architecture direction for reusable blueprints, governance and platform scale.

2. Cloud Transformation & Hybrid Infrastructure Modernization

• Lead the evolution of TMF’s Azure-first cloud architecture, including platform landing zones, management groups, subscriptions, policy, identity, connectivity and shared services.
• Define architecture patterns for hybrid cloud integration across Azure, on-premises Microsoft HCI / Azure Stack HCI, Azure Arc, data centers and public cloud services.
• Guide modernization of legacy infrastructure into scalable, resilient, secure and automation-enabled platforms.
• Establish standards for subscription segmentation, environment isolation, resource organization, tagging, cost allocation, network topology, DNS, private endpoints and region strategy.
• Design and govern hybrid connectivity patterns including ExpressRoute, VPN, hub-spoke networking, Azure Firewall, Azure WAF, Azure Front Door, private DNS and secure egress.
• Lead infrastructure lifecycle modernization, including technical debt reduction, operating system refresh, data center transformation, platform migration and cloud optimization.
• Drive resilience-by-design across backup, disaster recovery, failover, high availability, observability and recovery testing.
• Ensure cloud architecture aligns with CAF / Azure Landing Zone principles for identity, resource organization, network topology, security, governance, management and platform automation.

3. Cybersecurity Architecture, Governance & Risk Reduction

• Define enterprise security architecture patterns across identity, network, endpoint, cloud, application, data, container, AI and platform layers.
• Embed secure-by-design and Zero Trust principles into all architecture decisions.
• Govern implementation of security controls across Microsoft Entra ID, RBAC, Privileged Identity Management, Conditional Access, MFA, managed identities, Key Vault, private endpoints and network segmentation.
• Define architecture standards for cloud security posture management, vulnerability management, public exposure controls, privileged access, service accounts, secrets management and certificate lifecycle.
• Partner with cybersecurity, risk, compliance and engineering teams to align architecture with CIS, NIST, ISO 27001, SOC 2, GDPR and internal policy expectations.
• Drive architecture-level remediation plans for audit findings, red-team findings, CSPM gaps, insecure configurations and exception governance.
• Establish secure patterns for DevSecOps, CI/CD, code scanning, container image scanning, secrets scanning, infrastructure policy enforcement and automated compliance.
• Maintain audit-ready evidence of architecture decisions, design approvals, risk acceptances and security exceptions.

4. Cloud Operating Model, Platform Engineering & DevSecOps

• Define TMF’s cloud operating model across platform teams, application teams, cybersecurity, operations, FinOps and governance functions.
• Lead the design of internal developer / platform engineering capabilities that enable self-service, governed workload onboarding and repeatable infrastructure provisioning.
• Establish golden paths and reusable platform blueprints for compute, networking, identity, observability, security, CI/CD, IaaC and service onboarding.
• Govern Infrastructure-as-Code standards using Terraform, Bicep, ARM templates or equivalent enterprise tooling.
• Define DevSecOps patterns using Azure DevOps, GitHub Actions or equivalent platforms, including build, test, deploy, security validation, rollback and change governance.
• Implement policy-as-code, guardrails, automated compliance checks and deployment gates to reduce delivery risk.
• Drive FinOps architecture practices, including cost visibility, tagging, reserved capacity, rightsizing, budget alerts and cloud optimization.
• Ensure HLD, LLD, SOP, runbook, KT and support sign-off are treated as mandatory transition gates for production readiness, consistent with TMF’s internal architecture direction.

5. AKS, Containers & Cloud-Native Architecture

• Own enterprise architecture standards for Azure Kubernetes Service (AKS) and related Azure cloud-native services.
• Define production-grade AKS architecture patterns covering private clusters, Azure CNI, node pools, workload isolation, ingress/egress, WAF, API server security, autoscaling, upgrade strategy, backup, DR and multi-region design where required.
• Establish standards for Azure Container Registry, image governance, image signing/scanning, authorized registries, vulnerability scanning and container supply-chain security.
• Define GitOps-based cluster bootstrapping and configuration management using Flux v2, Argo CD or equivalent approaches.
• Govern Kubernetes policy enforcement using Azure Policy for AKS, OPA Gatekeeper, Kyverno or equivalent policy engines.
• Define architecture for observability across AKS and container workloads using Azure Monitor, Log Analytics, Dynatrace, Grafana, Application Insights, Open Telemetry and distributed tracing.
• Define cloud-native architecture standards for microservices, APIs, event-driven architectures, serverless workloads, containerized applications, PaaS services and resilient distributed systems.
• Ensure AKS designs align with Microsoft AKS baseline guidance, including observability, secure networking, private endpoints for services such as Azure Container Registry and Key Vault, private cluster considerations, GitOps, and workload / cluster operations. AKS Well-Architected guidance also emphasizes reliability, security, cost optimization, operational excellence and performance efficiency across cluster and workload responsibilities.

6. AI Platform Architecture & Enterprise AI Enablement

• Define the enterprise architecture for AI platform enablement across Azure AI Foundry, Azure OpenAI, Azure AI Services, Azure AI Search, Azure Machine Learning, Azure Bot Service, Microsoft Fabric / Databricks integrations and agentic AI platforms.
• Design and govern AI Landing Zone patterns covering management groups, subscriptions, network isolation, private endpoints, RBAC, managed identities, data classification, cost controls, logging and monitoring.
• Establish architecture standards for secure AI integration patterns including Retrieval Augmented Generation, embeddings, vector stores, grounding data, API gateways, model endpoints and enterprise knowledge integration.
• Define responsible AI governance requirements including AI impact assessment, model risk assessment, prompt-injection controls, content safety, guardrails, human-in-the-loop checkpoints, transparency, explainability, audit trails and feedback loops.
• Partner with data, security, legal, compliance and business teams to define AI usage policies, approved data pathways, data residency requirements, privacy controls and enterprise AI adoption guardrails.
• Govern Azure OpenAI and Foundry deployments for data security, including private networking, identity-based access, monitoring, abuse prevention, content filtering, prompt/response logging policies and data-retention considerations.
• Drive AI adoption roadmaps that prioritize use cases by business value, technical feasibility, data readiness, risk and operational maturity.
• Support AI-powered operations, intelligent automation, copilots and agent-based workflows while ensuring adoption is governed, secure and measurable.
• Microsoft’s responsible AI guidance recommends identifying, measuring, mitigating and operating against potential AI harms, while Microsoft Foundry architecture supports governance through a top-level Foundry resource, project-level development boundaries and connected Azure services such as Storage, Key Vault and Azure AI Search with separate governance boundaries. Azure OpenAI / Foundry data privacy guidance states that prompts, completions, embeddings and training data are not available to other customers and are not used to train generative AI foundation models without permission or instruction.

7. Stakeholder Management, Governance Forums & Strategic Roadmaps

• Work closely with senior stakeholders across Technology, Security, Operations, Product, Data, Finance, Risk and business functions.
• Chair or actively guide architecture governance forums, ensuring decisions are transparent, traceable and aligned to enterprise standards.
• Build multi-year roadmaps for cloud modernization, infrastructure transformation, AKS adoption, platform engineering, cybersecurity architecture and AI enablement.
• Support technology due diligence, M&A integration architecture, platform onboarding, global rollout planning and integration risk assessment.
• Evaluate emerging technologies, vendors and platforms, producing recommendations based on business value, security, scalability, operational fit and total cost of ownership.
• Mentor architects, engineers and technical leads, raising architecture quality and building enterprise-wide technical capability.