ICT Manager
Posted 21
views
Description
Job Purpose
This hands-on Manager role works as a Cloud Security Architect and defines and leads the organisation's infrastructure environment, along with any analysis of on-premise infrastructure vs well-governed cloud services, (such as Microsoft Azure and AWS). The postholder will set the future-state cloud security architecture and migration roadmap, with particular focus on identity, privileged access, Zero Trust and security controls, guiding the organisation towards a secure, cloud-first operating model.
This is a hands-on role: the postholder builds and proves the patterns they design and embeds DevSecOps practices so that security is built into delivery rather than added afterwards. Sitting within Integrated Solutions and Architecture as a key execution arm of the Head of Architecture & Security, they lead two engineers, mentor graduates and explain cloud risk and opportunity clearly to technical and non-technical audiences.
Role and Key Responsibilities
The successful hire will be involved in the following activities:
Leading a structured assessment of the current estate (on-premise data centre, VDI, networks, Active Directory, Microsoft 365, Azure and AWS), documenting dependencies, risks, technical debt and security posture as an agreed baseline for change.
Designing and owning the future-state cloud security architecture and phased migration roadmap, selecting the right approach for each workload (rehost, replatform, refactor, replace or retire) in line with Enterprise Architecture principles and policy guardrails.
Designing secure Azure landing zones (management groups, subscriptions, hub-and-spoke networking, Azure Policy, RBAC, logging and monitoring) and equivalent AWS patterns (Organizations, Control Tower, SCPs and IAM), underpinned by Zero Trust network architecture covering hybrid connectivity, segmentation, firewalls and private endpoints.
Leading identity and device modernisation from Active Directory and Group Policy to Microsoft Entra ID, Intune and cloud-native policy, maintaining secure coexistence throughout, and governing hybrid identity, federation (SAML, OIDC), Entra B2B and cross-tenant access.
Defining and implementing privileged access controls, including Entra PIM, PAM tooling, tiered administration, just-in-time access, break-glass accounts, access reviews and Conditional Access.
Defining cloud security standards and controls aligned to recognised frameworks (for example Microsoft Cloud Security Benchmark, CIS Benchmarks and NCSC Cloud Security Principles), using Microsoft Defender for Cloud, Microsoft Sentinel and AWS Security Hub to measure and improve security posture.
Embedding DevSecOps so that security controls are automated, repeatable and auditable: Infrastructure as Code (Terraform, Bicep, CloudFormation), GitOps, secure pipelines, secrets management, code, dependency and container scanning, and policy-as-code.
Leading threat modelling of new and changed designs and tracking cloud penetration test findings through to remediation.
Remaining hands-on to build, prove and hand over the patterns designed, including leading proofs of concept and pilots, and providing senior technical escalation for complex issues.
Designing backup, disaster recovery and resilience for cloud and hybrid services, with defined and tested recovery objectives (RTO/RPO).
Securing the adoption of container, PaaS, data and AI platforms (for example AKS, Power Platform, Dynamics 365 and Azure AI Foundry).
Producing version-controlled architecture artefacts (HLDs, LLDs, architecture decision records, security designs and risk assessments) and presenting options, risks, costings and business cases at design authority and governance forums.
Providing technical assurance over vendor and partner proposals, challenging recommendations and ensuring delivered solutions meet internal security standards.
Maximising the value of existing Microsoft 365, Entra and security tooling licences before proposing new spend, and contributing to cloud cost governance.
Leading and setting priorities for two engineers and mentoring graduates, building cloud, automation and secure engineering capability across the team.
Position, goals, and measures
Reports to: Head of Architecture & Security.
Direct reports: Two engineers, plus mentoring of graduates.
Key goals include: an approved current-state assessment, future-state cloud security architecture and migration roadmap; secure, automated Azure (and AWS) foundations built on Zero Trust principles; modernised identity and privileged access with reduced reliance on legacy on-premise controls; security embedded into delivery through DevSecOps and threat modelling; resilient services with tested disaster recovery; and growing capability within the team.
Example measures include: delivery of the assessment, architecture and roadmap to agreed timescales; workloads migrated against the roadmap; percentage of infrastructure deployed through Infrastructure as Code; improvement in Microsoft Secure Score, Defender for Cloud Secure Score and AWS Security Hub findings; reduction in standing privileged access; GPOs retired or migrated to cloud-native policy; percentage of new designs with a completed threat model; time to remediate penetration test findings; percentage of critical services with tested disaster recovery meeting RTO/RPO; and designs passing design authority and security gates first time.
Other Job information
Work Conditions and Environment
LocationCaerphilly, with regular on-site attendance for workshops, architecture reviews and team leadership, and occasional travel to other sites. This is not a remote-first role.
Working patternFull-time, with occasional work outside core hours for migration cutovers, major incidents and change activity.
Working principlesOperate within a regulated and audited environment, adhering to change management, security and documentation standards and maintaining auditable records of designs, security decisions and risk acceptances.
Demonstrate sound security judgement, embedding security pragmatically to enable delivery rather than block it, with a preference for automation and repeatable patterns over manual effort.
Culture and personal fitThe organisation values pace, outcomes and pragmatic decision-making. The successful candidate will be collaborative and sociable while maintaining high standards, and able to lead conversations with the business at the right level.
Technical environment contextThe organisation operates a 100% VDI, hybrid environment with an on-premise data centre, Active Directory and Group Policy, a small Azure footprint, Microsoft 365 and AWS.
Essential Experience and Capabilities
Substantial, current hands-on experience in cloud architecture, cloud engineering or cloud security roles, rather than purely advisory or historic exposure.
Proven experience of planning and delivering on-premise to cloud migrations, from current-state assessment through target architecture to cutover.
Deep, current expertise in Microsoft Azure security (landing zones, networking, Azure Policy, RBAC, Key Vault, Defender for Cloud and Sentinel), with strong working knowledge of AWS.
Strong knowledge of Microsoft Entra ID and hybrid identity (Entra Connect / Cloud Sync, Conditional Access, SAML/OIDC federation, B2B and cross-tenant access), and of Active Directory and Group Policy, including migrating policy to Intune and cloud-native management.
Practical experience designing and implementing privileged access controls, including Entra PIM, PAM tooling, tiered administration and just-in-time access.
Strong understanding of Zero Trust architecture and cloud network security, including hybrid connectivity, segmentation, firewalls and private networking.
Hands-on DevSecOps experience, including Infrastructure as Code (Terraform, Bicep, CloudFormation), scripting (PowerShell, Python), pipelines (Azure DevOps, GitHub Actions), container platforms (Kubernetes/AKS), security scanning and policy-as-code.
Experience designing resilient, supportable cloud services (monitoring, logging, backup, disaster recovery and incident response) and producing high- and low-level designs for handover to operational teams.
Working knowledge of security frameworks and regulatory requirements relevant to a regulated UK environment (for example NCSC Cloud Security Principles, CIS Benchmarks, Microsoft Cloud Security Benchmark, ISO 27001 and UK GDPR).
Excellent communication skills, able to explain architecture, risk and trade-offs to senior, technical and non-technical stakeholders and to present costed options and business cases for approval.
Experience leading small technical teams and mentoring graduates or junior engineers.
Commercially aware, making full use of existing products and licensing and recommending new technology only where it adds clear value.
Desirable Experience and Qualifications
Current security and cloud certifications, for example Microsoft Certified: Cybersecurity Architect Expert (SC-100), Azure Solutions Architect Expert or Azure Security Engineer Associate (AZ-500); AWS Certified Solutions Architect or AWS Certified Security – Specialty; CISSP or CCSP.
Experience with Azure Virtual Desktop or Windows 365, and with migrating Microsoft 365 workloads such as Exchange and SharePoint.
Experience securing PaaS, data and AI platforms (for example Power Platform, Dynamics 365 and Azure AI Foundry).
FinOps or cloud cost governance experience, with a track record of delivering measurable savings.
Experience supporting internal and external audit of cloud and identity controls in a regulated environment.
This hands-on Manager role works as a Cloud Security Architect and defines and leads the organisation's infrastructure environment, along with any analysis of on-premise infrastructure vs well-governed cloud services, (such as Microsoft Azure and AWS). The postholder will set the future-state cloud security architecture and migration roadmap, with particular focus on identity, privileged access, Zero Trust and security controls, guiding the organisation towards a secure, cloud-first operating model.
This is a hands-on role: the postholder builds and proves the patterns they design and embeds DevSecOps practices so that security is built into delivery rather than added afterwards. Sitting within Integrated Solutions and Architecture as a key execution arm of the Head of Architecture & Security, they lead two engineers, mentor graduates and explain cloud risk and opportunity clearly to technical and non-technical audiences.
Role and Key Responsibilities
The successful hire will be involved in the following activities:
Leading a structured assessment of the current estate (on-premise data centre, VDI, networks, Active Directory, Microsoft 365, Azure and AWS), documenting dependencies, risks, technical debt and security posture as an agreed baseline for change.
Designing and owning the future-state cloud security architecture and phased migration roadmap, selecting the right approach for each workload (rehost, replatform, refactor, replace or retire) in line with Enterprise Architecture principles and policy guardrails.
Designing secure Azure landing zones (management groups, subscriptions, hub-and-spoke networking, Azure Policy, RBAC, logging and monitoring) and equivalent AWS patterns (Organizations, Control Tower, SCPs and IAM), underpinned by Zero Trust network architecture covering hybrid connectivity, segmentation, firewalls and private endpoints.
Leading identity and device modernisation from Active Directory and Group Policy to Microsoft Entra ID, Intune and cloud-native policy, maintaining secure coexistence throughout, and governing hybrid identity, federation (SAML, OIDC), Entra B2B and cross-tenant access.
Defining and implementing privileged access controls, including Entra PIM, PAM tooling, tiered administration, just-in-time access, break-glass accounts, access reviews and Conditional Access.
Defining cloud security standards and controls aligned to recognised frameworks (for example Microsoft Cloud Security Benchmark, CIS Benchmarks and NCSC Cloud Security Principles), using Microsoft Defender for Cloud, Microsoft Sentinel and AWS Security Hub to measure and improve security posture.
Embedding DevSecOps so that security controls are automated, repeatable and auditable: Infrastructure as Code (Terraform, Bicep, CloudFormation), GitOps, secure pipelines, secrets management, code, dependency and container scanning, and policy-as-code.
Leading threat modelling of new and changed designs and tracking cloud penetration test findings through to remediation.
Remaining hands-on to build, prove and hand over the patterns designed, including leading proofs of concept and pilots, and providing senior technical escalation for complex issues.
Designing backup, disaster recovery and resilience for cloud and hybrid services, with defined and tested recovery objectives (RTO/RPO).
Securing the adoption of container, PaaS, data and AI platforms (for example AKS, Power Platform, Dynamics 365 and Azure AI Foundry).
Producing version-controlled architecture artefacts (HLDs, LLDs, architecture decision records, security designs and risk assessments) and presenting options, risks, costings and business cases at design authority and governance forums.
Providing technical assurance over vendor and partner proposals, challenging recommendations and ensuring delivered solutions meet internal security standards.
Maximising the value of existing Microsoft 365, Entra and security tooling licences before proposing new spend, and contributing to cloud cost governance.
Leading and setting priorities for two engineers and mentoring graduates, building cloud, automation and secure engineering capability across the team.
Position, goals, and measures
Reports to: Head of Architecture & Security.
Direct reports: Two engineers, plus mentoring of graduates.
Key goals include: an approved current-state assessment, future-state cloud security architecture and migration roadmap; secure, automated Azure (and AWS) foundations built on Zero Trust principles; modernised identity and privileged access with reduced reliance on legacy on-premise controls; security embedded into delivery through DevSecOps and threat modelling; resilient services with tested disaster recovery; and growing capability within the team.
Example measures include: delivery of the assessment, architecture and roadmap to agreed timescales; workloads migrated against the roadmap; percentage of infrastructure deployed through Infrastructure as Code; improvement in Microsoft Secure Score, Defender for Cloud Secure Score and AWS Security Hub findings; reduction in standing privileged access; GPOs retired or migrated to cloud-native policy; percentage of new designs with a completed threat model; time to remediate penetration test findings; percentage of critical services with tested disaster recovery meeting RTO/RPO; and designs passing design authority and security gates first time.
Other Job information
Work Conditions and Environment
LocationCaerphilly, with regular on-site attendance for workshops, architecture reviews and team leadership, and occasional travel to other sites. This is not a remote-first role.
Working patternFull-time, with occasional work outside core hours for migration cutovers, major incidents and change activity.
Working principlesOperate within a regulated and audited environment, adhering to change management, security and documentation standards and maintaining auditable records of designs, security decisions and risk acceptances.
Demonstrate sound security judgement, embedding security pragmatically to enable delivery rather than block it, with a preference for automation and repeatable patterns over manual effort.
Culture and personal fitThe organisation values pace, outcomes and pragmatic decision-making. The successful candidate will be collaborative and sociable while maintaining high standards, and able to lead conversations with the business at the right level.
Technical environment contextThe organisation operates a 100% VDI, hybrid environment with an on-premise data centre, Active Directory and Group Policy, a small Azure footprint, Microsoft 365 and AWS.
Essential Experience and Capabilities
Substantial, current hands-on experience in cloud architecture, cloud engineering or cloud security roles, rather than purely advisory or historic exposure.
Proven experience of planning and delivering on-premise to cloud migrations, from current-state assessment through target architecture to cutover.
Deep, current expertise in Microsoft Azure security (landing zones, networking, Azure Policy, RBAC, Key Vault, Defender for Cloud and Sentinel), with strong working knowledge of AWS.
Strong knowledge of Microsoft Entra ID and hybrid identity (Entra Connect / Cloud Sync, Conditional Access, SAML/OIDC federation, B2B and cross-tenant access), and of Active Directory and Group Policy, including migrating policy to Intune and cloud-native management.
Practical experience designing and implementing privileged access controls, including Entra PIM, PAM tooling, tiered administration and just-in-time access.
Strong understanding of Zero Trust architecture and cloud network security, including hybrid connectivity, segmentation, firewalls and private networking.
Hands-on DevSecOps experience, including Infrastructure as Code (Terraform, Bicep, CloudFormation), scripting (PowerShell, Python), pipelines (Azure DevOps, GitHub Actions), container platforms (Kubernetes/AKS), security scanning and policy-as-code.
Experience designing resilient, supportable cloud services (monitoring, logging, backup, disaster recovery and incident response) and producing high- and low-level designs for handover to operational teams.
Working knowledge of security frameworks and regulatory requirements relevant to a regulated UK environment (for example NCSC Cloud Security Principles, CIS Benchmarks, Microsoft Cloud Security Benchmark, ISO 27001 and UK GDPR).
Excellent communication skills, able to explain architecture, risk and trade-offs to senior, technical and non-technical stakeholders and to present costed options and business cases for approval.
Experience leading small technical teams and mentoring graduates or junior engineers.
Commercially aware, making full use of existing products and licensing and recommending new technology only where it adds clear value.
Desirable Experience and Qualifications
Current security and cloud certifications, for example Microsoft Certified: Cybersecurity Architect Expert (SC-100), Azure Solutions Architect Expert or Azure Security Engineer Associate (AZ-500); AWS Certified Solutions Architect or AWS Certified Security – Specialty; CISSP or CCSP.
Experience with Azure Virtual Desktop or Windows 365, and with migrating Microsoft 365 workloads such as Exchange and SharePoint.
Experience securing PaaS, data and AI platforms (for example Power Platform, Dynamics 365 and Azure AI Foundry).
FinOps or cloud cost governance experience, with a track record of delivering measurable savings.
Experience supporting internal and external audit of cloud and identity controls in a regulated environment.