Title: DMZ Cloud Architect
Duration: 12 Months
Location: Remote
Position overview
The DMZ Cloud Architect is responsible for designing secure, scalable, and resilient demilitarized zone environments primarily within public cloud platforms, with a primary focus on Microsoft Azure and strong working knowledge of AWS. This role focuses on architecture, design standards, and security controls rather than production implementation. The individual will play a critical role in enabling secure communication between internal enterprise systems and external facing applications while aligning with security best practices and regulatory requirements.
This position requires deep expertise in cloud networking and security architecture, with hands on design experience creating DMZ environments from the ground up in large scale enterprise settings. A strong foundational understanding of both Azure and AWS cloud platforms is critical, particularly as it relates to native networking and security constructs. Limited laboratory or proof of concept work may be required to validate designs and patterns.
Responsibilities
• Design cloud based DMZ architectures that securely separate internal networks from external access points while supporting business and application requirements, with a strong emphasis on Azure and AWS native architectures.
• Design and standardize Azure landing zones aligned with the Cloud Adoption Framework, including management group and subscription governance, Azure Policy, RBAC models, and secure network baselines.
• Define network segmentation strategies, routing models, and access control policies to reduce attack surfaces and enforce least privilege principles, leveraging cloud networking constructs such as virtual networks (VNETs/VPCs), subnets, route tables, and security boundaries.
• Architect hub-spoke and Azure Virtual WAN topologies that centralize security inspection and scale cleanly across regions and subscriptions.
• Architect firewall, proxy, load balancing, VPN, and intrusion detection and prevention solutions aligned with enterprise and regulatory standards, including Azure Firewall Premium and third party network virtual appliances such as Check Point CloudGuard and Palo Alto.
• Design secure ingress using Azure Front Door and Application Gateway WAF, including custom rules, managed rule tuning, OWASP Top 10 protections, bot protection, API security, and TLS enforcement.
• Develop secure ingress and egress traffic patterns for internet facing and partner integrated applications, including direct connectivity designs such as ExpressRoute and Direct Connect and IPSec VPN connectivity for partners and vendors.
• Apply deep understanding of cloud networking fundamentals, including routing behavior, user defined routes, security groups, NSGs and ASGs, network access control lists (NACLs), Private Link and Private Endpoints, and private versus public connectivity models within Azure and AWS.
• Collaborate with security, cloud, network, and application teams to ensure DMZ designs integrate cleanly with broader enterprise architecture and cloud landing zone standards.
• Evaluate security risks and provide architectural guidance to mitigate vulnerabilities in cloud DMZ environments, ensuring alignment with zero trust, micro-segmentation, and cloud native security principles, and with frameworks such as NIST 800-53, HIPAA, PCI-DSS, and ISO 27001.
• Integrate network and security telemetry with Azure Monitor, Log Analytics, and Microsoft Sentinel, and support incident response by providing architectural insight during investigations of DMZ related security events.
• Create and maintain detailed architecture diagrams, design documentation, standards, and operational guidance.
• Leverage automation and infrastructure as code, including reusable Terraform modules, GitHub Actions pipelines, and PowerShell, Bash, or Python scripting, to improve consistency, repeatability, and operational efficiency in DMZ designs.
• Stay current on emerging cloud security services, network security trends, and zero trust architecture principles across Azure and AWS ecosystems.
Qualifications
• Bachelor’s degree in Computer Science, Information Technology, Electrical Engineering, or a related field, or equivalent professional experience.
• Ten or more years of experience in enterprise network and cloud security architecture, including five or more years designing and managing enterprise DMZ environments.
• Demonstrated hands-on experience designing greenfield, cloud based DMZ environments in large scale enterprise settings, with deep expertise in Azure and solid experience in AWS.
• Deep Azure networking and security expertise, including Azure Front Door and Application Gateway WAF, Azure Firewall and Firewall Manager, DDoS Protection, NSGs and ASGs, UDRs and route tables, Private Link, and Virtual WAN.
• Strong foundational and practical understanding of cloud networking concepts, including virtual networks (VNETs/VPCs), subnets, routing, direct connectivity, and hybrid cloud integration.
• In depth experience with cloud native security controls, including security groups, network access control lists (NACLs), and native firewall services.
• Strong expertise with enterprise firewall platforms such as Palo Alto, Fortinet, Cisco, or Check Point, including experience integrating them into cloud hubs (for example, Check Point CloudGuard).
• In depth knowledge of networking concepts and protocols including TCP/IP, BGP, OSPF, DNS, HTTP/HTTPS, and SSL/TLS.
• Experience designing and integrating load balancers, proxies, and VPN solutions across both cloud native and enterprise technologies, such as F5 and IPSec VPN.
• Hands-on infrastructure as code experience with Terraform, CI/CD for security deployments (such as GitHub Actions), and scripting with PowerShell, Bash, or Python.
• Strong understanding of zero trust security models, micro-segmentation, and cloud native security architectures, including identity controls such as Entra ID, Conditional Access, and PIM.
• Working knowledge of compliance and governance frameworks such as NIST 800-53, HIPAA, PCI-DSS, and ISO 27001.
• Proven analytical and problem solving skills with a proactive security mindset.
• Ability to communicate complex architectural concepts clearly to technical and non technical stakeholders.
Preferred certifications
• Microsoft Azure Security Engineer Associate (AZ-500)
• Microsoft Azure Solutions Architect Expert (AZ-305 / AZ-104)
• AWS Certified Security Specialty
• AWS Certified Solutions Architect Professional
• TOGAF Enterprise Architecture Practitioner
Tools and technologies
• Public cloud networking and security services in Azure and AWS, including native virtual networking, routing, and security components
• Azure Front Door, Application Gateway WAF, Azure Firewall, Firewall Manager, and Virtual WAN
• Enterprise firewall platforms such as Check Point CloudGuard, Palo Alto, Fortinet, and Cisco
• Cloud load balancing and proxy services
• VPN, ExpressRoute, Direct Connect, and secure hybrid connectivity technologies
• Azure Monitor, Log Analytics, Microsoft Sentinel, and other network monitoring and logging solutions
• Terraform, GitHub Actions, and scripting tools (PowerShell, Bash, Python) for design validation and standardization
