Cloud Security Architecture Services – Offshore 

1. Purpose of the Work Package

To recruit, onboard, and operationalise a specialised offshore Cloud Security Architecture capability that supports enterprise cloud programmes across Azure, AWS, and GCP. This work package defines the roles, competencies, deliverables, governance, and KPIs required to establish an offshore architecture function that complements onshore strategic security leadership.

2. Scope of Offshore Cloud Security Architecture Services

2.1 Architecture Design & Assurance

• Cloud security architecture design for new workloads

• Secure‑by‑Design reviews for cloud solutions

• Architecture assurance for projects and change initiatives

• Multi‑cloud security pattern development

• Zero Trust architecture alignment

• Data protection and encryption architecture

• Identity architecture (Entra ID, IAM, SSO, federation)

• Network segmentation and cloud perimeter architecture

• Logging, monitoring, and detection architecture

• Cloud resilience and recovery architecture

2.2 Governance & Standards

• Cloud security standards and guardrails

• Architecture decision records (ADR)

• Cloud landing zone security governance

• Policy and control mapping (NIST, ISO, CIS)

• Architecture risk assessments

• Cloud threat modelling

2.3 Advisory & Support

• Architecture support for engineering teams

• Architecture guidance for DevOps and platform teams

• Review of IaC designs for security alignment

• Architecture input into CSPM/CIEM strategy

• Architecture support for compliance programmes

3. Offshore Team Roles & Competency Requirements

3.1 Cloud Security Architect (Azure / AWS / GCP)

Core Competencies:

• Deep understanding of cloud security architecture

• Identity architecture (MFA, Conditional Access, IAM roles/policies)

• Network architecture (segmentation, private endpoints, WAF)

• Encryption, key management, secrets architecture

• Logging, monitoring, SIEM/SOAR integration patterns

• Zero Trust principles and enforcement

• Cloud landing zone architecture

• Threat modelling and risk analysis

Preferred Certifications:

• Azure Solutions Architect Expert

• AWS Solutions Architect Professional

• GCP Professional Cloud Architect

• CCSP or CISSP

3.2 Senior Cloud Security Architect / Offshore Architecture Lead

Competencies:

• Multi‑cloud architecture leadership

• Architecture governance and standards creation

• Complex workload architecture (financial services, regulated industries)

• Cloud threat modelling at scale

• Architecture review board participation

• Leading offshore architecture teams

• Reviewing engineering designs for architectural alignment

Certifications:

• Azure Expert / AWS Pro

• CISSP / CCSP

• SABSA (preferred)

3.3 Cloud Security Controls Architect

Competencies:

• Mapping controls to cloud services

• Designing control implementations for Azure/AWS/GCP

• CSPM/CIEM control strategy

• Compliance alignment (ISO, NIST, CIS)

• Control assurance and validation

4. Recruitment Deliverables

4.1 Role Definition Pack

• Detailed job descriptions

• Skills and competency matrix

• Certification and experience requirements

• Architecture scenario‑based interview rubrics

• Cloud architecture technical assessment criteria

4.2 Candidate Screening & Assessment

• Cloud architecture case study challenge

• Threat modelling exercise

• Architecture pattern design test

• Multi‑cloud scenario evaluation

• Communication and stakeholder management assessment

• Final scoring and ranking

4.3 Recruitment Output

• Shortlisted candidates

• Final selection report

• Skills gap analysis

• Salary benchmarking (offshore region)

• Contracting and onboarding recommendations

5. Onboarding Deliverables

5.1 Architecture Knowledge Transfer

• Cloud landing zone architecture walkthrough

• Secure‑by‑Design framework briefing

• Architecture governance model

• Standards, patterns, and reference architectures

• Tooling access (CSPM, CIEM, SIEM, DevOps platforms)

5.2 Architecture Playbooks

• Cloud architecture review playbook

• Threat modelling playbook

• Identity architecture playbook

• Network segmentation architecture playbook

• Zero Trust architecture playbook

• Architecture decision record (ADR) templates

6. Operating Model

6.1 Governance Structure

• Onshore Enterprise Security Architect (Accountable)

• Offshore Senior Cloud Security Architect (Responsible)

• Weekly architecture review sessions

• Monthly architecture maturity reporting

• Architecture backlog management

6.2 Delivery Cadence

• Architecture sprint cycles

• Architecture review board participation

• SLA‑based architecture assessments

• Change control for architectural decisions

• Continuous improvement of patterns and standards

7. KPIs & Performance Metrics

• % of cloud workloads reviewed through Secure‑by‑Design

• Architecture defect reduction rate

• Time to complete architecture assessments

• Compliance alignment (ISO, NIST, CIS)

• Architecture quality score (peer review)

• Reduction in cloud security risks identified by CSPM/CIEM

• Adoption rate of architecture patterns

8. Work Package Outputs

• Fully staffed offshore Cloud Security Architecture team

• Architecture standards, patterns, and governance artefacts

• Architecture review board participation

• Monthly architecture performance dashboards

• Cloud security architecture maturity roadmap

9. Commercial Model Options

• Dedicated offshore architecture pod (monthly retainer)

• Hybrid onshore/offshore architecture model

• Outcome‑based architecture review packages

• Time‑and‑materials for specialist architecture tasks

10. Value Proposition

This offshore architecture work package provides:

• Access to high‑calibre cloud architects at reduced cost

• Scalable architecture capability for multi‑cloud environments

• Standardised Secure‑by‑Design governance

• Faster architecture reviews and project assurance

• Improved cloud security posture and compliance alignment

• Strong alignment with Zero Trust and modern cloud operating models