Solution architect - Infrastructure (Cloud & Network)
Posted Updated
Summary
Recruiter-placed, delivery-embedded Solution Architect roles in Auckland's Infrastructure & Cloud Services team. Stream A designs secure multi-cloud platforms (GCP/AWS/Azure, DBaaS, Kubernetes, DevSecOps/CNAPP); Stream B drives network security and Zero Trust (ZTNA, micro-segmentation, SD-WAN, firewalls), authoring ADRs, guardrails and Terraform-validated patterns mapped to APRA/RBNZ requirements.
Job Title: Solution Architect – Cloud Infrastructure & Network Security
About the Role:
An exciting opportunity has arisen for two delivery-embedded Solution Architects to join the Infrastructure & Cloud Services team. You will operate directly inside delivery squads, acting as an enabler to design and embed reusable patterns, guardrails, and implementation-ready backlog items.
We are actively seeking specialists across two core domains:
Stream A: (Cloud Infra, Platforms & DB):
About the Role:
An exciting opportunity has arisen for two delivery-embedded Solution Architects to join the Infrastructure & Cloud Services team. You will operate directly inside delivery squads, acting as an enabler to design and embed reusable patterns, guardrails, and implementation-ready backlog items.
We are actively seeking specialists across two core domains:
- Stream A: Cloud Infrastructure & Database Security: Championing secure-by-design architectures across hybrid multi-cloud (GCP, AWS, Azure), DBaaS, Kubernetes/serverless platforms, CNAPP, and DevSecOps pipelines.
- Stream B: Network Security & Zero Trust (ZTNA): Driving enterprise Dynamic Trust, micro-segmentation, SD-WAN, next-gen perimeter/cloud firewalls, and automated NetSec observability.
- Embed & Enable: Work inside cross-functional delivery squads to ensure infrastructure, cloud platforms, and network connectivity are secure-by-design and compliant-by-default.
- Pattern & Guardrail Design: Author and review architecture blueprints, Architecture Decision Records (ADRs), guardrails, and delivery-ready backlog items; defend designs at architecture review forums.
- Hands-On Validation: Test controls and configurations in live accounts/sandboxes before publishing patterns, using infrastructure and policy as code (Terraform, CI/CD pipelines).
- Regulatory & Resilience Mapping: Translate regulatory standards (such as APRA CPS 230/234, RBNZ) and operational resilience requirements into actionable controls and measurable evidence.
- Risk & Trade-off Advisory: Articulate technical risk, control gaps, and compensating measures in clear, non-dogmatic language that engineering, cyber, and business stakeholders can execute against.
Stream A: (Cloud Infra, Platforms & DB):
- Multi-Cloud Expertise: Proven design and delivery across GCP, AWS, Azure, covering account/project vending, policy baselines, and identity. Main preference is GCP.
- Data & Platform Engineering: Deep familiarity with managed databases (RDS, Cloud SQL, Spanner, Azure SQL), database encryption/masking, and container platforms (EKS, GKE, Cloud Run).
- DevSecOps & Posture Management: Hands-on exposure to pipeline security (IaC scanning, GitHub Advanced Security) and CNAPP operating models (vulnerability burn-down, exception governance).
- Relevant cloud credentials are highly regarded (e.g., AWS Solutions Architect Pro/Security, Google Cloud Architect/Security, Azure Solutions Architect/Security).
- Dynamic Trust & ZTNA: Hands-on design and enterprise rollout of Zero Trust Network Access policies, application publishing, and identity-aware access controls.
- Micro-Segmentation & Firewalls: Proven experience delivering segmentation (e.g., Illumio), application dependency mapping, and modern firewall policy lifecycles (Check Point, cloud-native firewalls).
- Network Ecosystems: Practical knowledge across SD-WAN, proxy/DLP (Netskope), DNS security (Akamai, Route 53), WAF/F5 BIG-IP, and NetSec telemetry into SIEM.
- Relevant networking certifications are advantageous (e.g., AWS Advanced Networking, Azure Network Engineer, Check Point CCSE, or vendor equivalents).