Cloud Security Architect
PROJECT INFORMATION:
Industry: Healthcare/ Pharmacy
Start: ASAP (flexible).
Rate: depending on experience.
Contract: B2B 12 months + prolongations.
Remote: up to 100%
Location: remote/ Warsaw.
Project language: English.
Business trips: some occasional included.
Recruitment process: 2 interviews.
Job Description
We are looking for a Staff Cloud Security Architect, AI Solutions to design and enable secure Azure-based architectures for AI applications that consume enterprise data from platforms such as Databricks.
This is a hands-on role for someone who can define architecture, security patterns, and technical standards while also working directly with engineering teams to implement them. The role is not primarily a Databricks platform architect role; the focus is on secure cloud architecture, AI application infrastructure, DevOps modernization, and compliant engineering foundations.
The architect will help teams build secure, scalable, and well-governed AI-enabled applications on Azure. This includes patterns for AI agents, sandboxed code execution, runtime isolation, network segregation, secrets management, CI/CD, Terraform, and GitHub Enterprise.
This role owns architectural design and technical standards but is not accountable for platform or application delivery.
The applications are currently non-GxP, but the architecture should support future GxP validation through traceability, controlled releases, documentation, and audit-ready engineering practices.
Significant experience in cloud architecture, cloud security architecture, platform engineering, or senior cloud engineering roles is required. The role demands proven hands-on experience designing and implementing secure Azure solutions and supporting engineering teams in building production-ready cloud applications.
Main Responsibilities
Design secure Azure cloud architectures for AI applications, data-driven applications, and internal digital products.
Define architecture patterns for AI applications that consume data from Databricks and other enterprise data platforms.
Establish secure patterns for AI agents, sandboxed Python/code execution, runtime isolation, network segregation, and controlled access to data and services.
Design and implement standards for secrets management, identity, access control, encryption, logging, monitoring, and secure connectivity.
Use Terraform to define, review, and enable repeatable cloud infrastructure patterns.
Help drive the migration from Azure DevOps to GitHub Enterprise.
Establish new GitHub-based CI/CD patterns, including repository standards, branching, pull requests, code reviews, automated testing, approvals, deployment gates, and release evidence.
Define technical standards for secure software delivery, release traceability, and audit-ready engineering practices.
Partner with engineering teams to implement reference architectures, reusable templates, pipelines, and secure cloud patterns.
Review solution designs, identify security risks, and guide teams toward practical, compliant, and maintainable implementations.
Collaborate with cloud, security, data, AI, quality, compliance, and product teams.
Mentor engineers and improve engineering practices across cloud, security, DevOps, and AI infrastructure.
Key Requirements
Strong hands-on experience with Microsoft Azure cloud architecture.
Strong cloud security expertise, including identity, networking, encryption, secrets management, logging, monitoring, and secure access patterns.
Experience designing secure infrastructure for AI applications, AI agents, APIs, data-consuming applications, or internal developer platforms.
Experience with sandboxed code execution, Python runtime environments, containerized workloads, or isolated compute patterns.
Strong knowledge of network segregation, private endpoints, firewalls, virtual networks, controlled egress, and runtime isolation.
Strong experience with Terraform for infrastructure provisioning and cloud architecture enablement.
Strong experience with GitHub Enterprise, GitHub Actions, repository governance, branch protection, pull requests, and secure CI/CD patterns.
Experience with Azure DevOps, ideally including migration from Azure DevOps to GitHub.
Experience with secrets management, key vaults, managed identities, service principals, RBAC, and Microsoft Entra ID.
Understanding of secure software delivery, release controls, traceability, and audit-ready engineering practices.
Ability to work hands-on with engineers while also setting architecture direction and technical standards.
A Bachelor's degree in Computer Science, Software Engineering, Information Technology, Cybersecurity, Engineering, Mathematics, or equivalent practical experience is mandatory.
Nice to Have
Experience with Azure AI services, Azure OpenAI, agent frameworks, or secure GenAI application patterns.
Experience with Databricks as a data source for downstream applications.
Experience with containers, Kubernetes, Azure Container Apps, Azure Functions, or similar runtime platforms.
Experience with GitHub Advanced Security, code scanning, secret scanning, dependency scanning, or policy-as-code.
Familiarity with life sciences, pharmaceuticals, healthcare, or another regulated industry.
Understanding of GxP, CSV, CSA, SDLC controls, or validation documentation, especially for future validation readiness.
Preferred Master's degree in a relevant technical field, along with certifications like Microsoft Certified: Azure Solutions Architect Expert, Microsoft Certified: Azure Security Engineer Associate, Microsoft Certified: DevOps Engineer Expert, GitHub Actions or GitHub Advanced Security certification, and HashiCorp Terraform certification.