Cloud Security Architect

The Cloud Security Architect is a hands-on security leader with deep expertise in designing, securing, and assessing enterprise-scale public cloud environments. As a lead member of the Warner Bros. Discovery (WBD) Cloud Security team, the role partners closely with engineering and product teams to embed security into cloud architectures, platforms, and workflows across AWS, with a working knowledge of Azure and GCP required for emergency support and maintenance.

• Serve as a Cloud Security Subject Matter Expert (SME) for Warner Bros. Discovery's Information Security organisation, providing authoritative guidance on public cloud security architecture and engineering.
• Proactively identify cloud security risks across AWS, Azure, and GCP environments, design pragmatic mitigation strategies, and lead or influence implementation efforts in partnership with engineering teams.
• Design and produce clear, actionable architecture and security design artifacts, and develop and maintain cloud security documentation including architectural standards, reference designs, configuration guidelines, and operational processes.
• Partner closely with product and platform engineering teams to design, review, and validate secure network, compute, container, and serverless architectures.
• Provide hands-on IAM guidance, including policy design and review, to ensure least-privilege access models are consistently implemented across cloud environments.
• Review cloud architecture and AI/ML workloads to advise development teams on secure design patterns, data protection, identity controls, and potential security gaps prior to deployment.
• Engage with public cloud service providers to evaluate and influence security features and roadmap capabilities, and assess cloud security vendors and tools (including CSPM/CNAPP platforms) through proof-of-value assessments, recommending solutions based on technical fit and risk reduction.
• Mentor and support junior cloud security team members through technical guidance, design reviews, and knowledge sharing.
• Collaborate with senior leadership and cross-functional stakeholders to assess current and future cloud security requirements and align solutions with business and technology strategy.
• Continuously stay current with emerging cloud threats, attack techniques, and security tooling, applying this knowledge to improve WBD's cloud security posture.

• Bachelor's degree in computer science, Information Security, or a related technical discipline, or equivalent practical experience with 6-8 years of strong experience.
• Strong hands-on understanding of public cloud infrastructure components and architectures, with demonstrated ability to identify and mitigate security risks in decentralised, hybrid, and multi-account cloud environments.
• Solid understanding of information security principles, risk management, and compliance frameworks, and how they apply to large-scale public cloud platforms.
• Proven experience designing, building, and securing AWS-based cloud environments, with meaningful hands-on experience in Azure.
• Ability to automate security processes end-to-end and collaborate closely with cloud engineering and product teams to integrate security into CI/CD pipelines and development workflows.
• Proficiency in at least one modern scripting or programming language (e.g., Python, Go, or Node.js) for automation, tooling, and integrations.
• Strong foundational knowledge of IP networking concepts, including routing, VPNs, DNS, and network segmentation in cloud environments.
• Hands-on experience in several of the following areas: cloud security administration across AWS, Azure, and/or GCP
• Designing and securing serverless applications and managed cloud services
• Infrastructure-as-code tools such as Terraform, CloudFormation, or Ansible
• Command-line tooling (Bash, PowerShell, AWS CLI, Azure CLI)
• Container and orchestration technologies (Docker, Kubernetes)
• Cloud network architecture and VPC/VNet engineering
• Cloud-native security services (e.g., AWS GuardDuty, Azure Defender for Cloud, GCP Security Command Centre, WAF)
• And source control and pipeline security (e.g., GitHub Security features).

• One or more current cloud provider certifications demonstrating advanced knowledge of cloud architecture and security, such as AWS Solutions Architect (Associate or Professional) or Security – Specialty, Azure Fundamentals or Azure Solutions Architect Expert
• Or GCP Associate Cloud Engineer or Professional Cloud Security Engineer.
• Industry-recognised security certifications reflecting a strong security foundation, such as CISSP or CompTIA Security+.
• Hands-on experience with cloud security platforms and tooling, including CSPM/CNAPP solutions (e.g., Wiz), SIEM and observability tools (e.g., Splunk), and cloud risk or asset management platforms (e.g., Brinqa).
• Experience integrating security tooling and workflows with engineering collaboration platforms such as Slack, Jira, and CI/CD pipelines.
• Exposure to GCP.

• Hybrid schedule: 3 days per week onsite from the DC or Silver Spring office.

• Actual salaries vary based on job-related factors including geographic location, external market data, internal equity, skill set, experience, training, education, and/or performance.

• Health insurance coverage
• Employee wellness programme
• Life and disability insurance
• Retirement savings plan
• Paid holidays, sick time, and vacation
• Additional rewards may include annual bonuses, short- and long-term incentives, and programme-specific awards