Cloud architect

What does a cloud architect do?

A cloud architect designs how an organisation runs its systems on cloud platforms such as AWS, Azure and Google Cloud.

You choose how applications, data, networks and security fit together. You then document the design so engineers can build it.

In Singapore, the role sits in the technology team of a bank, government agency, telco, software company or consultancy. Job ads sometimes call it solution architect or enterprise architect. It usually reports to a head of infrastructure or technology.

You work with cloud engineers, security teams, developers, product owners and finance. You also deal with vendors and, in regulated firms, with risk and compliance staff.

What the work involves

• Meet product owners and developers to learn what a new system must do, how many people will use it and what it can cost.
• Draw and write up designs for hosting, networking, identity, data storage and security.
• Review infrastructure code and design proposals from cloud engineers and give written feedback.
• Check cloud bills and usage reports, then suggest changes that cut waste without hurting performance.
• Plan the move of existing applications from on-premises servers to cloud, including order of work and fallback steps.
• Test new cloud services and decide whether the organisation should adopt them.

Pay in Singapore

Back to top

Skills a cloud architect needs

Back to top

Cloud architect job description

We are hiring a cloud architect to design and guide our work on public cloud.

You turn business needs into designs for hosting, networking, security and cost. You review engineers' work and set standards that teams follow.

Responsibilities

• Turn business needs and constraints into cloud designs covering compute, storage, networking, identity and data.
• Write architecture documents and diagrams, and present them for technical and management review.
• Set security, resilience and cost standards for cloud use across teams.
• Review designs and infrastructure code from engineers and give clear feedback.
• Plan migrations of applications from on-premises systems to cloud, including cutover and rollback steps.
• Estimate cloud running costs and recommend ways to reduce them.
• Work with security, risk and compliance teams so designs meet internal policy and Singapore regulations.
• Assess new cloud services and decide where they fit in the organisation's technology.
• Guide engineers during delivery and help settle design problems as they arise.

Requirements

• Diploma or degree in computer science, information technology or engineering is common. Some employers accept strong hands-on experience instead.
• Typically 5 to 8 years in infrastructure, cloud or software roles, with some time spent designing systems.
• Hands-on work with at least one major platform (AWS, Azure or Google Cloud). A solutions architect certification is often preferred.
• Experience with infrastructure as code such as Terraform, and with containers and Kubernetes.
• Sound grasp of networking, identity and access, encryption and logging.
• Clear writing and speaking, since you produce design documents and explain trade-offs to non-technical managers.

Back to top

Cloud architect career path

Most cloud architects start as cloud, infrastructure or software engineers and move into design after several years of hands-on work.

Senior steps widen your scope from single projects to the technology direction of the whole organisation.

1. Cloud engineer

   Entry

   You build and run cloud environments from designs set by others, write infrastructure code and fix faults.

2. Cloud architect

   Mid

   You design cloud solutions for projects, write the design documents and guide engineers during delivery.

3. Senior cloud architect

   Senior

   You own designs for large or regulated systems, handle migrations across many applications and coach other architects.

4. Principal or lead architect

   Lead

   You set cloud standards across business units, review major designs and advise senior management on platform choices.

5. Head of cloud or enterprise architecture

   Head

   You run the architecture function, own the cloud strategy and budget, and report to technology leadership.

The titles are ones commonly used in Singapore; employers may name the levels differently.

Related jobs and their pay

Back to top

Cloud architect interview questions

We wrote these questions from the skills this job needs. They are not an official question bank.

1. How would you structure AWS accounts or Azure subscriptions for a company with several product teams?

   What a good answer covers

   • Separate production, non-production, security and shared services
   • Central identity with single sign-on and role-based access
   • Guardrails set by policy, such as service control policies or Azure Policy
   • Central logging and a shared network design
   • Tagging rules so costs map to teams

2. How do you design an application for high availability and disaster recovery?

   What a good answer covers

   • Starts with recovery time and recovery point targets from the business
   • Compares multiple zones with multiple regions and their cost
   • Covers data replication and backup methods
   • Includes failover tests, not only a written plan
   • Explains which parts of the system can fail safely

3. Walk me through how you would secure a new web application running in the cloud.

   What a good answer covers

   • Least-privilege access for people and services
   • Encryption in transit and at rest, with managed keys
   • Private networking, with only the load balancer exposed
   • Secrets kept in a secrets service, not in code
   • Central logging, alerts and regular configuration checks

4. How would you organise Terraform code for several environments and teams?

   What a good answer covers

   • Reusable modules with clear inputs and outputs
   • Remote state with locking, split by environment or component
   • Changes go through code review and a pipeline that runs plan before apply
   • Policy checks and drift detection
   • Version pinning for providers and modules

5. When would you choose Kubernetes, and when would you pick a simpler managed service instead?

   What a good answer covers

   • Kubernetes suits many services, portability needs and teams with the skills to run it
   • Managed container or serverless options cut operating work for smaller workloads
   • Names the cost of upgrades, networking and security in Kubernetes
   • Considers the team's skills and support hours
   • Prefers the managed Kubernetes offering over self-built clusters

6. How would you connect an on-premises data centre to your cloud environment?

   What a good answer covers

   • Compares a VPN with a dedicated private link on cost, speed and reliability
   • Plans IP address ranges that do not overlap
   • Covers DNS and routing between both sides
   • Adds a redundant path for failure
   • Tests latency for the applications that will use the link

7. How would you use an AI coding assistant such as Claude Code in your architecture work, and what limits would you set?

   What a good answer covers

   • Uses it to draft Terraform, diagrams or documents that you then review
   • Checks every output against standards and tests it in a sandbox
   • Never pastes secrets, customer data or confidential designs into prompts
   • Follows the organisation's policy on approved AI tools
   • Keeps a human accountable for design decisions

1. A retailer wants to move 40 on-premises applications to cloud. How do you plan it?

   What a good answer covers

   • Starts with an inventory of applications, owners and dependencies
   • Sorts each one: move as is, adjust, rebuild or retire
   • Builds a landing zone with network, identity and logging first
   • Groups applications into waves, starting with low-risk ones
   • Defines cutover, rollback and success checks for each wave

2. The monthly cloud bill has doubled. How do you find the cause and respond?

   What a good answer covers

   • Breaks down cost by account, service and tag
   • Looks for new resources, idle resources and data transfer charges
   • Speaks to the owning teams before changing anything
   • Fixes the cause, for example right-sizing or storage tiers
   • Adds budgets, alerts and tagging rules to prevent a repeat

3. A developer wants a public storage bucket for a quick demo, but the security team has refused. What do you do?

   What a good answer covers

   • Asks what the demo needs and who must see it
   • Offers a safe option, such as time-limited access links
   • Explains the risk without jargon
   • Uses policy guardrails so public buckets are blocked by default
   • Records any exception with an owner and an end point

1. Tell me about a design decision you made and later changed. What happened?

   What a good answer covers

   • Describes the original reasoning and its limits
   • Names the signal that showed the design was wrong
   • Explains the cost and effort of changing it
   • States what you now check earlier
   • Takes responsibility without blaming others

2. How do you handle an engineering team that disagrees with your design?

   What a good answer covers

   • Listens to the concern and tests it against the requirements
   • Uses data such as load tests, cost estimates or risk ratings
   • Is willing to change the design when the team is right
   • Records the decision and the reasons
   • Escalates only when the disagreement is about risk or policy

3. Describe a time you explained a technical trade-off to a manager with no technical background.

   What a good answer covers

   • Frames the choice in cost, risk and delivery time
   • Avoids jargon or explains it briefly
   • Gives a clear recommendation, not only options
   • Confirms the manager understood the decision
   • Shows the outcome of the choice

1. Your application stores customers' personal data. How does the Personal Data Protection Act (PDPA) affect your cloud design?

   What a good answer covers

   • Identifies which data is personal and where it is stored
   • Applies reasonable security, such as encryption and access control
   • Considers rules on sending personal data outside Singapore
   • Sets retention and deletion rules
   • Plans a process for detecting and reporting data breaches, and works with the data protection officer

2. You are designing cloud hosting for a bank regulated by the Monetary Authority of Singapore (MAS). What do you take into account?

   What a good answer covers

   • Follows MAS expectations on technology risk and outsourcing
   • Plans for resilience, with tested recovery and an exit plan from the provider
   • Keeps detailed audit logs and strong access control
   • Considers dependence on a single provider
   • Involves risk, compliance and audit teams early

Common questions about a cloud architect job

Sources