Career roadmap
Cloud Architect
Design cloud systems that meet the requirement, survive the audit, and do not surprise finance.
Before you start Cloud Architect
- Working experience with at least one cloud provider
- Networking and Linux fundamentals
- Comfort writing design documents
Cloud fundamentals in depth
Know one provider deeply enough to design without reaching for the documentation.
IAM is where most cloud breaches begin and where most architecture reviews focus.
- Roles, policies and trust relationships
- Least privilege and permission boundaries
- Federation and SSO into the cloud
- Workload identity over static keys
VPC design decisions are expensive to reverse, which is why interviews dwell on them.
- VPC, subnets, route tables, NAT
- Private endpoints and service links
- Hybrid connectivity: VPN and direct connect
- DNS design and split-horizon
VMs, containers, serverless — and a defensible reason for the one you picked.
- VMs, autoscaling groups and spot capacity
- Managed Kubernetes trade-offs
- Serverless functions and cold starts
- Choosing between them for a workload
Durability, consistency and access patterns drive the choice, not familiarity.
- Object, block and file storage
- Managed relational vs NoSQL services
- Storage classes and lifecycle policies
- Backup, versioning and immutability
The shared vocabulary of cloud design reviews across every major provider.
- Operational excellence and reliability pillars
- Security and cost optimisation pillars
- Performance efficiency and sustainability
- Running a review and recording trade-offs
BuildDesign and deploy a three-tier application with private networking, managed data, and no public database.
Designing for scale and failure
Architecture is the set of decisions that are hard to change later. Make them explicitly.
Availability zones, regions, and what actually fails together.
- Multi-AZ vs multi-region
- Active/active vs active/passive
- Failover automation and DNS TTLs
- Quorum and split-brain avoidance
Where data lives dictates latency, cost and legal exposure simultaneously.
- Replication topologies and lag
- Read replicas and write scaling
- Data residency and sovereignty
- Polyglot persistence with justification
Event-driven versus request/response, and the operational cost of each.
- Queues, topics and event buses
- API gateways and service contracts
- Idempotency and exactly-once myths
- Choreography vs orchestration
Most cloud architecture work is moving something that already exists.
- The six Rs of migration
- Strangler fig for incremental cutover
- Data migration with minimal downtime
- Rollback planning
Usually the wrong answer, and being able to say so with reasons is the senior signal.
- Real drivers for multi-cloud
- Abstraction cost vs managed service benefit
- Exit strategy and portability
- Hybrid and on-premises integration
BuildA design document for a multi-region system with an availability target and a cost estimate.
Security, compliance and governance
In enterprise cloud work this is not a stage, it is a constraint on every decision.
Multi-account design is the foundation everything else sits on.
- Account and subscription strategy
- Organisational units and guardrails
- Centralised logging and audit accounts
- Network hub-and-spoke topology
Defence in depth, expressed as architecture rather than as a checklist.
- Encryption at rest and in transit, key management
- Network segmentation and zero trust
- Secrets and credential lifecycle
- Threat detection services
Preventive guardrails beat detective controls, and interviews like that answer.
- Service control policies and Azure Policy
- OPA and Conftest in pipelines
- Preventive vs detective controls
- Exception processes that do not rot
The reason architecture documents exist in regulated industries.
- SOC 2, ISO 27001, PCI DSS in outline
- GDPR and data residency implications
- Evidence collection and audit trails
- Shared responsibility model
A design that cannot be afforded is not a good design. This gets asked directly.
- Cost modelling before build
- Reserved capacity, savings plans, spot
- Tagging, showback and chargeback
- Detecting and fixing cost anomalies
BuildApply a landing zone with guardrails, policy as code, and a compliance mapping document.
Delivery and platform
An architecture that teams cannot build on is a diagram, not a platform.
Module design and state layout across many teams and environments.
- Module boundaries and versioning
- State isolation per environment
- Terragrunt and composition patterns
- Provisioning pipelines with approval gates
Architects who ship reusable defaults beat architects who ship documents.
- Golden paths and reference architectures
- Self-service provisioning
- Internal developer platform basics
- Adoption metrics
Deciding organisation-wide telemetry standards and who pays for them.
- Centralised vs federated telemetry
- Retention tiers and cost
- Standard instrumentation libraries
- Audit and security logging separation
The actual daily deliverable of the role. Interviews often ask for a writing sample.
- Architecture decision records
- C4 model diagrams
- Trade-off and options analysis
- Writing for executives and engineers at once
Influence without authority, applied to technical decisions.
- Design review structure
- Challenging a design constructively
- Recording rejected options
- Following through to implementation
BuildShip reusable infrastructure modules and a reference implementation another team can adopt unaided.
Certification and interviews
This is one of the few tracks where certification genuinely moves hiring decisions.
Consultancies and enterprises filter on it, and partner status depends on it.
- AWS Solutions Architect Professional
- Azure Solutions Architect Expert
- Google Professional Cloud Architect
- Study strategy and hands-on labs
A whiteboard design with cost, security and failure questions layered on.
- Requirements gathering before drawing
- Justifying every managed service choice
- Answering 'what if this region fails'
- Estimating monthly cost aloud
Common in consultancies: a written brief, a proposed architecture, a presentation.
- Reading a business brief for constraints
- Options analysis with trade-offs
- Migration phasing and risk
- Presenting to a non-technical panel
Architects who cannot build lose credibility fast, and interviewers test for it.
- Writing the reference implementation yourself
- Reading pipeline and IaC code
- Debugging a deployment
- Keeping current with service changes
The role is half technical, half negotiation. Both are assessed.
- Convincing a team to change direction
- Saying no to a requested technology
- Managing a migration with a deadline
- Handling a cost overrun conversation
BuildPass a professional-level architect certification and publish two reference architectures.
Cloud Architect tools on your CV
- AWS / Azure / GCP
- Terraform
- Kubernetes
- OPA
- Well-Architected Framework
- C4 / draw.io
- Cost management tooling
What Cloud Architect employers ask to see
- Two published reference architectures with cost estimates
- A landing zone implementation with policy guardrails
- An architecture decision record set from a real project
- A professional-level cloud certification
Senior, well-paid, and consistently listed in demand surveys. Consultancies, enterprises and regulated industries hire heavily; certification carries unusual weight here.
Content last reviewed 2026-08-31. Guidance only — no institute or paid placement is endorsed anywhere in this book.