Job Title: Cloud Migration Architect – AWS (End-to-End Infrastructure Transformation)

Role Summary

The Lead Cloud Architect is the technical authority and design owner for cloud migration and modernisation programme. They are accountable for defining the end-to-end cloud strategy, shaping the Landing Zone architecture, and overseeing all technical designs and implementation across AWS infrastructure, security, identity, networking, migration planning, and EUC (Amazon WorkSpaces / Citrix modernisation).

The ideal candidate will have hands-on experience in designing, implementing, and governing migration strategies across infrastructure, applications, network, and security layers.

This role ensures that all architectural decisions are aligned to the functional, non-functional, financial, and security requirements, including resilience, Conditional Access, CIS/NCSC compliance, and cost efficiency. The Lead Architect provides technical governance across all phases: Discovery, Strategy & Design, Landing Zone Build, Amazon WorkSpaces deployment, Pilot & Full Migration, and BAU transition.

This role requires deep expertise in migration engineering, cloud architecture, security, and automation, with proven delivery of large-scale, zero/near-zero downtime migrations.

Key Responsibilities

1. Architectural Leadership & Technical Governance

- Act as the overall technical design authority, ensuring cohesion across all workstreams.

- Lead workshops with SMEs to validate requirements.

- Own and maintain the Cloud Architecture Blueprint.

- Conduct architecture assurance across offshore and onshore teams.

- Chair and drive the Technical Design Authority (TDA) process.

2. Discovery, Assessment & Cloud Strategy

- Lead and validate discovery findings.

- Develop Target Architecture and Migration Roadmap.

- Produce cloud adoption strategy aligned to public-sector frameworks.

3. Landing Zone Design & Governance Controls

- Design secure multi-account AWS Landing Zone.

- Define SCP guardrails, IAM role model, logging, monitoring, KMS strategy.

- Ensure compliance with CIS, NCSC, Cyber Essentials.

- Oversee network segmentation, VPC connectivity, and DR patterns.

4. EUC & Amazon WorkSpaces / Citrix Modernisation Design

- Lead architecture for virtual desktop estate.

- Oversee FSLogix, conditional access, MFA, RBAC.

- Provide technical assurance during UAT and rollout.

5. Migration Planning & Execution Governance

- Own migration architecture, runbooks, and cutover plans.

- Select pilot workloads and define success criteria.

- Oversee AWS MGN/CloudEndure migrations.

- Provide technical escalation during cutovers.

6. Security, Identity & Compliance Assurance

- Ensure encryption, MFA, identity federation, patching, and threat detection.

- Embed compliance into solution design.

- Oversee security engineer deliverables.

7. Operational Readiness, Hypercare & BAU Transition

- Define operational model, dashboards, alerting rules.

- Lead defect triage and tuning during hypercare.

- Shape steady-state governance and FinOps optimisation.

8. Infrastructure & Platform Migration

• Design and execute migration for:
  • Compute: EC2, Auto Scaling, AMI-based builds
  • Storage: S3, EBS, EFS, FSx (Windows & Lustre)
  • File Servers: NFS, SMB, DFS migration strategies
  • Backup & DR: AWS Backup, lifecycle policies, cross-region replication
  • Application servers (IIS, Apache, WebSphere, etc.)
  • File shares and network drives
  • Printer services and legacy dependencies

9. Monitoring, Operations & Optimization

• Implement observability:
  • CloudWatch, X-Ray, logging frameworks
• Define:
  • SLA/SLO metrics
  • Performance baselining
• Optimize:
  • Cost (FinOps principles)
  • Performance (right-sizing, autoscaling)

10. Security & Compliance

• Establish enterprise-grade cloud security posture:
  • Encryption (at rest/in transit via KMS)
  • Secrets management (Secrets Manager / Parameter Store)
  • Security monitoring (GuardDuty, Security Hub)
• Implement:
  • Firewall policies and intrusion detection/prevention
  • Compliance controls (ISO, SOC2, GDPR where relevant)

Required Qualifications

Experience

• 12+ years of IT experience, with:
  • 5+ years in AWS cloud architecture
  • Proven experience in large-scale migration programs
• Hands-on migration of:
  • Windows & Linux infrastructure
  • Active Directory and enterprise networks
  • Databases and file systems

Technical Skills

• Strong expertise in AWS services:
  • EC2, S3, VPC, IAM, RDS, EFS, FSx, Direct Connect
• Deep knowledge of:
  • Networking (BGP, VPNs, routing)
  • Firewalls and security architectures
• Experience with:
  • Backup & disaster recovery strategies
  • NFS/SMB file systems
  • Enterprise application hosting patterns

Tools & Technologies

• Migration tools:
  • AWS MGN (Application Migration Service)
  • AWS DMS
• IaC: Terraform / CloudFormation
• OS: Linux (RHEL, Ubuntu), Windows Server
• Monitoring: CloudWatch, Prometheus (optional)

Certifications (Preferred)

• AWS Certified Solutions Architect – Professional
• AWS Advanced Networking Specialty
• AWS Security Specialty

Key Deliverables

- Cloud Adoption Strategy

- Target Architecture (HLD/LLD)

- Landing Zone Architecture Pack

- Detailed Implementation Plan

- EUC/WorkSpaces/Citrix design

- Migration Strategy & Runbooks

- Security & Compliance Architecture

- Operational Readiness & Handover Packs

Required Skills & Experience

- 10+ years cloud architecture; 5+ years AWS in regulated sectors.

- Deep knowledge of: AWS Organisations, Control Tower, IAM, VPC, WorkSpaces, AppStream, FSLogix, AWS MGN, Terraform/CloudFormation, KMS, GuardDuty, CloudTrail, Entra ID.

- Strong stakeholder communication.

- Experience defining governance, stage-gate assurance.

Soft Skills

- Strong communicator

- Structured thinker

- Risk-focused

- Delivery-oriented

Preferred Certifications

- AWS Solutions Architect – Professional

- AWS Security Specialty

- AWS Networking Specialty

- ITIL