Senior Consultant - Cloud Security Architect

Role Overview

Senior Consultant - Cloud Security Architect at KPMG. The role combines hands-on technical expertise in cloud security architecture with high-level client advisory responsibilities across multiple cloud environments.

Role Purpose

Deliver high-quality cloud security consulting engagements by designing and implementing secure cloud architectures, advising clients on compliance and governance, and supporting both small independent projects and large transformation programs.

Key Responsibilities

Client Advisory & Engagement Delivery

• Understand clients' business challenges, cloud ambitions, regulatory requirements, and threat landscape.
• Advise clients on secure cloud adoption, lift-and-shift migration, and landing zone security design.
• Build constructive and trusted relationships with clients at technical and senior stakeholder levels.
• Act as a trusted advisor and role model for quality, integrity, and risk management practices.
• Translate complex cybersecurity topics into clear business risk, impact, and remediation advice.
• Support small and medium-sized engagements independently and participate as a key team member in larger transformation programs.

Security Architecture & Design

• Design and implement security controls across Azure landing zones, including identity, networking, logging, governance, encryption, workload protection, and monitoring.
• Support security architecture across Azure, Microsoft 365, AWS, and OCI environments.
• Help clients optimize their digital and technical security controls across multiple layers of the cloud architecture stack.
• Assess existing cloud environments against security baselines such as CIS, NIST, ISO, CAF, and cloud provider best practices.
• Experience assessing, designing, or implementing security controls across multiple layers of the IT architecture stack.

Compliance, Governance & Risk Management

• Help clients navigate cybersecurity regulations, security frameworks, and cloud compliance requirements.
• Advise on cloud security governance, operating models, control frameworks, and risk management.
• Conduct cloud security assessments, security configuration reviews, privacy and regulatory risk assessments, and control framework mapping.

Security Transformation & Automation

• Use security architecture to define and support broader security transformation programs.
• Deliver automation of security controls, security posture reporting, and risk dashboards where relevant.

Business Development & Knowledge Building

• Support presales, proposal development, and business development activities.
• Contribute to the continued development of KPMG's cloud security services and professional network.

Qualifications & Experience

• Proven experience in cloud security architecture with strong hands-on experience in Microsoft Azure and Microsoft 365.
• Practical experience with secure cloud migration, lift-and-shift scenarios, and Azure landing zone design or implementation.
• Strong understanding of Azure landing zone security, including management groups, subscriptions, RBAC, Azure Policy, Defender for Cloud, logging, network security, private endpoints, Key Vault, backup, and workload protection.
• Strong knowledge of Identity and Access Management, including Microsoft Entra ID, Conditional Access, Privileged Identity Management, workload identities, and identity governance.
• Experience delivering cybersecurity services in a commercial or consulting environment.
• Experience in one or more cloud service provider environments: Microsoft Azure, AWS, OCI, or GCP.
• Previous Big4 experience is required for this role.

Skills & Competencies

• Ability to analyze complex problems, identify core issues, and recommend practical and proportionate solutions.
• Ability to communicate clearly with both technical teams and senior stakeholders.
• Ability to work at sustained levels of high intensity while maintaining quality, structure, and professionalism.
• Experience with DevSecOps concepts, infrastructure-as-code, policy-as-code, security automation, and continuous control monitoring is highly desirable.

Additional Information

Certifications

The following certifications are highly valued. Candidates need not hold all of them, but one or more is strongly preferred:

• Microsoft Certified: Cybersecurity Architect Expert – SC-100
• Microsoft Certified: Cloud and AI Security Engineer Associate – SC-500
• Microsoft Certified: Identity and Access Administrator Associate – SC-300
• Microsoft Certified: Information Security Administrator Associate – SC-401
• Microsoft Azure architecture or administrator certifications such as AZ-104 or AZ-305
• AWS Certified Security – Specialty
• AWS Certified Solutions Architect – Professional
• Google Cloud Professional Cloud Security Engineer
• CISSP, CISM, CCSP, or comparable cybersecurity experience
• SABSA, TOGAF, or comparable architecture experience