AWS Cloud Architect

Job description

An extraordinarily talented group of individuals work together every day to drive TNS' success, from both professional and personal perspectives. Come join the excellence! Overview The AWS Cloud Architect is a senior strategic and technical leadership role responsible for the design, governance, and evolution of enterprise cloud architecture across multi-region AWS environments. This position will drive the assessment and migration of legacy on-premises workloads to cloud-native architectures, define and enforce infrastructure and delivery standards, and govern hybrid environments that span both on-premises data centres and AWS. Operating within the payments industry, the successful candidate will ensure all architectural decisions are aligned with organisational objectives, PCI DSS compliance obligations, and industry best practices. The role requires strong collaboration with engineering teams, operations, security, and executive stakeholders to define scalable, secure, and cost-effective cloud strategies — while providing technical leadership, mentoring, and architectural governance across the broader engineering organisation. Responsibilities Key Responsibilities Define and own the cloud architecture strategy across multi-region AWS environments, ensuring alignment with business objectives, security requirements, and compliance obligations. Lead the planning and execution of cloud migration programmes, taking legacy on-premises workloads through lift-and-shift and progressively re-architecting them to cloud-native patterns. Architect and govern hybrid environments spanning on-premises data centres and AWS, including private connectivity, identity federation, hybrid DNS, and unified observability. Design highly available multi-region architectures incorporating active-active and active-passive configurations, automated failover, global load balancing, and data replication strategies. Define infrastructure-as-code standards using Terraform and Terragrunt, including module governance, policy-as-code guardrails, and multi-account state management strategies. Architect and oversee GitLab-based CI/CD platforms, setting delivery standards for infrastructure and application pipelines across multiple engineering teams. Ensure all cloud architecture meets the compliance and regulatory requirements of the payments industry, including PCI DSS, SOC 2, and regional data sovereignty obligations. Produce and maintain architecture documentation, reference architectures, Architecture Decision Records (ADRs), and multi-year technology roadmaps. Lead architecture review processes, providing technical governance across major engineering initiatives and acting as the final escalation point for complex infrastructure decisions. Mentor and uplift senior and mid-level engineers, fostering a culture of architectural rigour, security-first thinking, and continuous improvement. Essential Skills Cloud Architecture & AWS 8+ years of cloud infrastructure or platform engineering experience, with at least 4 years in a senior architect or principal engineer capacity. Deep, broad AWS expertise spanning EC2, EKS, ECS, RDS Aurora, DynamoDB, S3, CloudFront, Route 53, IAM, KMS, WAF, Shield, Transit Gateway, Direct Connect, and AWS Organizations. AWS Solutions Architect – Professional certification required; additional AWS specialty certifications (Networking, Security) highly regarded. Proven ability to produce clear, comprehensive architecture documentation and communicate architectural decisions to both engineering teams and executive stakeholders. Multi-Region Architecture Demonstrated experience designing and operating multi-region AWS architectures including active-active deployments, Route 53 global traffic management, and automated region failover. Deep knowledge of multi-region data replication patterns including Aurora Global Clusters, DynamoDB Global Tables, and S3 Cross-Region Replication. Experience defining and testing Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO), including regular DR testing and chaos engineering programmes. Understanding of data sovereignty, regulatory, and latency considerations that inform multi-region deployment decisions. Migration: Lift & Shift to Cloud Native End-to-end cloud migration programme experience from initial portfolio assessment and wave planning through to production cutover and post-migration optimisation. Proficiency with migration frameworks such as the AWS Migration Acceleration Program (MAP) and the 6 Rs (Rehost, Replatform, Repurchase, Refactor, Retire, Retain). Hands-on experience with AWS migration tooling: Application Migration Service (MGN), Database Migration Service (DMS), Schema Conversion Tool (SCT), and DataSync. Experience migrating databases and messaging systems to managed AWS equivalents (e.g., Oracle to Aurora, on-premises Kafka to Amazon MSK, RabbitMQ to Amazon MQ). Skilled at containerising legacy applications and progressively decomposing monolithic architectures into microservices deployed on EKS. Hybrid On-Premises & Cloud Environments Extensive experience designing hybrid cloud architectures integrating on-premises infrastructure with AWS via Direct Connect and Site-to-Site VPN. Strong understanding of hybrid identity management including Active Directory integration, AWS IAM Identity Center (SSO), and federated authentication. Experience with hybrid DNS architecture using Route 53 Resolver, hybrid networking via Transit Gateway, and unified monitoring across on-premises and cloud segments. Familiarity with on-premises hypervisor platforms (VMware, Nutanix) and their integration or migration pathways into AWS. Ability to define consistent governance, tagging, cost allocation, and security posture management across mixed on-premises and cloud estates. Infrastructure as Code — Terraform & Terragrunt Advanced Terraform expertise including custom module frameworks, provider management, policy-as-code with Sentinel or OPA, and large-scale multi-account state management. Terragrunt proficiency for managing complex multi-environment, multi-account configurations with DRY principles and remote state strategies. Experience governing IaC across AWS Organizations using Service Control Policies (SCPs) and AWS Control Tower or Landing Zone frameworks. GitLab, Argo & CI/CD Strong GitLab platform experience including pipeline architecture, GitLab Runners at scale, environment governance, and integration with AWS deployment targets. Argo CD experience for GitOps-driven delivery and Argo Rollouts for progressive deployment strategies including blue/green and canary releases. Ability to define and govern platform-wide CI/CD standards, enabling multiple product teams to deliver independently, safely, and consistently. Istio & Service Mesh Architect-level Istio expertise covering control plane configuration, sidecar injection, traffic policies, fault injection, and observability stack integration. Experience defining mTLS, RBAC, and Istio AuthorizationPolicies to enforce zero-trust service communication across Kubernetes namespaces and clusters. Payments Industry & Compliance 3+ years of architecture experience within the payments industry or an equivalent regulated financial services environment. Deep familiarity with PCI DSS requirements as applied to multi-region cloud architecture, including network segmentation, encryption, audit logging, and access control. Experience engaging with auditors, compliance officers, and risk teams to evidence architectural controls and support certification programmes. Understanding of payment processing ecosystems — acquiring, issuing, switching, or payment gateway infrastructure — is strongly preferred. Desirable Skills Experience with AWS Control Tower and Landing Zone for multi-account governance and automated account vending at scale. Knowledge of FinOps practices and cloud cost optimisation tooling such as AWS Cost Explorer. Familiarity with Argo Workflows and Argo Events for Kubernetes-native pipeline orchestration and event-driven automation. Observability stack experience, particularly in OpenTelemetry — particularly in multi-region and hybrid contexts. Experience with HashiCorp Vault for enterprise secrets management including Kubernetes auth methods and dynamic credential issuance. Background in application security, threat modelling, or cloud security architecture using CSPM or CNAPP tooling. Exposure to additional cloud platforms (Azure, GCP) in a multi-cloud or migration context. Experience with Helm or Kustomize for Kubernetes manifest management alongside Argo CD. Personal Attributes Visionary yet pragmatic — able to define a compelling long-term architectural direction while making sensible, incremental decisions that account for business realities and delivery constraints. Exceptional communicator with the gravitas and clarity to influence senior stakeholders and the ability to translate complex architectural concepts for non-technical audiences. Strong leadership presence — inspires confidence in engineering teams, fosters psychological safety, and leads by example in terms of quality and rigour. Collaborative by nature, with a track record of building effective relationships across engineering, security, operations, product, and executive functions. Deep sense of ownership and accountability — takes responsibility for architectural outcomes and is proactive in identifying and addressing technical risk. Highly security-conscious, with a natural inclination to embed compliance and security thinking into every architectural decision. Intellectually curious and a continuous learner, staying ahead of developments in cloud technology, payments regulation, and infrastructure tooling. Calm under pressure with strong judgment in high-stakes incident situations and the ability to make well-reasoned decisions with incomplete information. Qualifications If you are passionate about technology, love personal growth and opportunity, come see what TNS is all about! TNS is an equal opportunity employer. TNS evaluates qualified applicants without regard to race, color, religion, gender, national origin, age, sexual orientation, gender identity or expression, protected veteran status, disability/handicap status or any other legally protected characteristic.