Every cloud estate carries the marks of early decisions: how accounts were split, how the networks connect, who can assume which role, and what happens if a region goes dark. A cloud architect makes those decisions on purpose, writes them down and defends them, usually before anyone has provisioned a single production resource. Get them wrong and the fix can take a long, expensive migration of your own making.
This page offers a copy-ready cloud architect job description, plus advice on levels, screening, frequent ad mistakes and hiring models. Cloud architect and cloud engineer are often advertised as if they were one job, so we also explain how to tell them apart. If you mainly need someone to build and run what is already designed, the template adapts easily, and the notes below show you what to change.
Cloud architect job description template
Name one primary cloud in the brackets wherever you can. For a cloud engineer post, change the title and swap the design duties for the build and operate duties described in the level section.
About the role
[Company] is hiring a Cloud Architect to design the foundations of our [AWS / Azure / Google Cloud] estate. You will shape our landing zone, network and identity structure, set resilience and cost standards, and guide engineering teams as they build on them. You will work with [engineering, security and finance leaders], report to [manager title] and be based in [city / remote].
Responsibilities
- Design and evolve the landing zone, including account or subscription structure, guardrails and shared services.
- Define cloud networking: address planning, hub-and-spoke connectivity, private access to services and links to on-premises sites over [Direct Connect / ExpressRoute / Cloud Interconnect].
- Set the identity model with federated access, least-privilege roles and break-glass procedures, working with cloud security engineers.
- Agree recovery time and recovery point objectives with the business, then design high availability and disaster recovery to match.
- Assess applications for migration and choose an approach for each, from rehosting to refactoring.
- Produce reference architectures and Terraform patterns that teams can reuse.
- Record significant choices in architecture decision records, with the trade-offs stated.
- Model the cost of designs before they are built, and review commitment purchases and tagging with [finance contact].
- Review designs from product teams against the [AWS / Azure / Google Cloud] Well-Architected Framework or our internal standard.
Requirements
- [X] years in infrastructure or cloud engineering, including [X] years designing production environments.
- Deep knowledge of [AWS / Azure / Google Cloud] compute, storage, networking and identity services.
- Experience designing or substantially reworking a landing zone.
- Strong networking fundamentals: CIDR planning, routing, DNS, load balancing and private connectivity.
- Experience planning and delivering at least one large migration or disaster recovery design.
- Working Terraform knowledge, enough to review code and set module standards.
- Ability to explain trade-offs to non-technical leaders, in writing and in person.
Nice to have
- A professional-level credential, such as [AWS Certified Solutions Architect Professional / Azure Solutions Architect Expert / Google Cloud Professional Cloud Architect].
- Hands-on Kubernetes design experience.
- Exposure to a second cloud provider, or to hybrid estates with on-premises data centres.
- FinOps experience, including commitment planning and unit cost reporting.
What we offer
- [Compensation band] and [benefits summary].
- [Remote, hybrid or site-based] arrangement.
- Access to [sandbox accounts and certification support].
How the cloud architect role changes by level
Cloud engineer
This is the neighbouring role and the usual feeder into architecture. A cloud engineer builds and operates what has been designed: writing Terraform, standing up networks and clusters, handling service limits, patching and day-to-day requests. If that is your need, retitle the post and ask for hands-on provisioning experience, not design authority.
Cloud architect
The architect is judged on decisions, not tickets. They own the design for a product area or a whole estate, run reviews and still read code. Requirements should ask for designs the person authored and lived with, including something that later turned out to be a mistake.
Principal or enterprise cloud architect
At this level the person works across business units, sets multi-year cloud strategy, advises on provider commitments and leads a community of architects. Hands-on time falls away, so ask how they stay close to the technology. Only advertise at this level if you run several large environments.
Cloud architect skills that matter most, and how to check them
- Landing zone judgement. Ask how they would split accounts or subscriptions for a company with two products and a compliance-heavy customer. Good answers cover isolation, billing visibility, guardrails such as AWS service control policies or Azure Policy, and what they would deliberately leave for later.
- Network design. Hand them overlapping address ranges from an acquired business that must reach your private services. Look for clear reasoning on private connectivity options, DNS and the cost of data transfer.
- Resilience trade-offs. Ask what multi-region would cost a mid-sized product, and whether it should be built at all. Candidates who start with the recovery objectives and the data layer have usually done this for real.
- Cost modelling. Ask them to estimate a design on a whiteboard and name its biggest line items. Weak candidates skip this entirely, while strong ones raise data transfer, managed service premiums and commitment discounts on their own.
- Communication. Request a sample decision record, or give them a scenario and ask for a one-page recommendation to a CTO. An architect whose reasoning stays in their head delivers little value.
The best work sample is a design review. Share a diagram with a few planted weaknesses, such as a single NAT gateway or a database in a public subnet, and ask what they would change first and why.
Common cloud architect job description mistakes
- Writing one post for two jobs. Architect in the title with a list of daily Terraform tickets disappoints senior applicants, and it brings engineers who cannot yet design. Fix: decide whether the deliverable is decisions or builds, then title the post to match.
- Demanding expert depth in all three clouds. Few people have it, and many who claim it are thin on each. Fix: name your primary provider and treat others as a bonus.
- Treating a certificate as proof. Passing an architect exam does not show that someone has lived with their design. Fix: keep credentials under nice to have and ask for specific estates they shaped.
- Leaving out the authority of the role. An architect who can only advise, with no say in standards, tends to leave. Fix: state which decisions the person owns and who signs them off.
- Ignoring cost. Ads focused on technology alone attract designers who have never seen the bill. Fix: make cost modelling an explicit responsibility and name the partner in finance.
Contract, contract-to-hire or permanent: which suits a cloud architect
Architecture is well suited to contract work when the need has edges: a first landing zone, a data centre exit, a disaster recovery design or a review before an audit. You get someone who has made these decisions several times. Require decision records and reusable Terraform patterns as outputs, otherwise the reasoning leaves when the contract ends.
Contract-to-hire works when a growing company wants to confirm that the person can influence its engineers as well as produce diagrams. Influence is difficult to judge in an interview, and a live programme of work reveals it quickly.
Permanent hiring is the right choice when the estate keeps evolving and you want one person accountable for it over years, or when you are hiring cloud engineers to run the environment day to day. Zilo AI can support either type of role: we hire cloud architects in India on contract, contract-to-hire or permanent terms, and cloud engineers on the same basis. Teams with several gaps can look across the IT hiring page.
Frequently asked questions
What should a cloud architect job description include?
Name the provider, the size and state of the estate, the design decisions the person will own, the current project and who they answer to. Also describe how much hands-on building you expect, because that varies more than any other part of this role.
What is the difference between a cloud architect and a cloud engineer?
The architect decides how the environment should be structured and why, and answers for those decisions. The engineer builds and runs it. A useful test: if the first project needs a design document, hire the architect, and if the design already exists, hire the engineer.
How does a cloud architect differ from a DevOps engineer?
The architect works on the structure of the estate, such as networks, identity and resilience. A DevOps engineer works on the delivery path that puts software into it, such as CI/CD and deployment automation. The two collaborate closely on Terraform standards.
Should a cloud architect still write code?
Most good ones do, at least enough to prototype patterns and review Terraform. An architect who no longer touches anything tends to produce designs that are awkward to build. Say in the ad how much of this you expect.
Do small companies need a cloud architect?
Often not full time. A contract architect can set up the foundations, then a cloud or DevOps engineer can run them. A permanent architect makes sense once several teams build on the estate.
Want candidates with real design work behind them? Zilo AI can handle the search and screening. Send us a brief covering your provider, your current setup and the decisions you need made.