Cloud Security Architect (337)

WSP is one of the world’s leading professional services firms operating in over 50 countries and employs approximately 75,000 professionals, known as Visioneers. Together they pioneer solutions and deliver innovative projects in the transportation, infrastructure, environment, building, energy, water, and mining and metals sectors. Position Summary This role is a hands-on, senior individual contributor responsible for designing, building, and operating secure, scalable Azure platform capabilities, while enforcing enterprise guardrails and compliance requirements. The successful candidate will work in a consultative capacity, owning platform roadmaps and backlogs, responding to intake requests, and providing architectural guidance and sign-off. You will have a governance dotted line to the Corporate Security & Compliance team, ensuring alignment with enterprise security policy. Main Responsibilities

Security Architecture Design • Design and maintain the security architecture for the Digital Services Azure platform across all regions, including network segmentation, Private Endpoint strategy, and zero-trust network posture. • Architect the controls that align with enterprise security, compliance, and operational standards. • Define security patterns for vendor application teams: authentication flows, secrets management, API security, data-at-rest and data-in-transit encryption standards. • Identify gaps, risks, and opportunities for improvement across Azure environments. • Contribute to standards, patterns, and reference architectures.

Detection Engineering • Design and govern detection engineering. • Define the security telemetry strategy: what gets collected, where it’s stored, how long it’s retained, and how it aligns with regional data residency constraints (noting that security telemetry is centralised by design).

Governance & Compliance Architecture • Implement corporate security and compliance requirements within the Digital Services platform using policy-as-code (Azure Policy, custom initiatives) and automated evidence capture. • Design the compliance evidence architecture so that audit readiness is a continuous state. • Own security exception governance: assess exception requests, document risk acceptance, and ensure appropriate approval chains. • Contribute to architecture decision records (ADRs) for all security-impacting design decisions.