MindGraph Hiring! Full Time Cloud Security Solutions Architect (Alibaba) in Federal Territory - Ricebowl

Role summary

Senior Alibaba Cloud Architect to own the cloud architecture of a high-traffic, public-facing mobile platform serving users at national scale. You will design, secure and run an Alibaba Cloud environment that handles sensitive personal data, sudden demand surges and strict public-sector compliance requirements, and you will be the technical authority in front of client stakeholders. Security is the primary design constraint of this role: you are accountable for the platform's cloud security posture, not only its availability and scale.

Responsibilities

Architecture and design

· Own the end-to-end Alibaba Cloud architecture for a mobile backend: compute, containers, databases, caching, messaging, storage and networking.

· Design for high availability and elastic scale, including multi-zone deployment and auto-scaling for sudden traffic spikes driven by public announcements.

· Define landing zone, account/resource structure, VPC design and connectivity (VPN, Express Connect, CEN) to client and third-party systems.

· Produce architecture documents, design decisions and capacity plans suitable for client technical review boards.

Security and compliance

· Own the cloud security architecture end to end, applying security-by-design, least privilege and zero-trust principles to every layer.

· Run threat modelling for new features and integrations; maintain the platform's risk register and security architecture documentation.

· Protect sensitive personal and health-related data: encryption at rest and in transit, key and secrets management (KMS), data classification and data-loss controls (Data Security Center), and certificate management.

· Enforce identity and access controls: RAM with MFA, role-based access, privileged access through Bastionhost, and regular access reviews.

· Secure the network and perimeter: VPC segmentation, Cloud Firewall, WAF, Anti-DDoS and bot protection for public mobile APIs.

· Secure the mobile API surface against the OWASP API Security Top 10, including authentication, rate limiting and abuse detection.

· Build DevSecOps into CI/CD: code and dependency scanning, container image scanning, IaC policy checks and secrets detection before release.

· Centralise security logging (ActionTrail, Simple Log Service, Config) and integrate with the client's SOC/SIEM for 24x7 monitoring.

· Own cloud incident response playbooks, including containment, forensics support and regulatory incident reporting.

· Ensure data residency in Malaysia and alignment with PDPA 2010, the Cyber Security Act 2024 and public-sector cloud and security policies.

· Lead VAPT scoping and remediation, and supply evidence for ISO 27001 and client security audits.

Operations and reliability

· Define observability, alerting and incident response using CloudMonitor, Simple Log Service and ARMS.

· Own backup, disaster recovery and business continuity design, with tested RPO/RTO targets.

· Lead performance and load testing ahead of major releases and expected peak events.

· Drive FinOps: cost visibility, reserved/savings plans and rightsizing.

Delivery and stakeholders

· Implement infrastructure as code (Terraform or Resource Orchestration Service) and CI/CD pipelines with the development team.

· Act as primary technical counterpart to client IT, security and Alibaba Cloud account/solution teams.

· Guide and review the work of DevOps and backend engineers; contribute to presales solutioning and estimates when required.

Requirements

· Degree in Computer Science, Engineering or equivalent experience.

· 8+ years in infrastructure, cloud or platform engineering; 3+ years designing and running production workloads on Alibaba Cloud.

· Hands-on depth across core Alibaba Cloud services: ECS, ACK (Kubernetes), Function Compute, ApsaraDB RDS/PolarDB, Tair (Redis), OSS, CDN, ALB/SLB, API Gateway, ApsaraMQ, VPC, RAM, KMS, WAF and Anti-DDoS.

· Proven delivery of a high-availability, internet-facing platform serving at least 1 million users or comparable peak load.

· Strong Kubernetes, containerisation and infrastructure-as-code skills (Terraform preferred).

· Working knowledge of mobile backend patterns: API design, authentication (OAuth 2.0/OIDC), push notifications, rate limiting and caching.

· Experience designing for sensitive personal data and regulatory compliance in Malaysia or a comparable regulated environment.

· Able to present architecture and trade-offs to senior client stakeholders, in writing and in person.

· Fluent English; Bahasa Malaysia is an advantage for public-sector engagements.

Cybersecurity requirements

· 4+ years designing and operating cloud security controls for production systems holding sensitive personal data.

· Hands-on with Alibaba Cloud security services: Security Center, Cloud Firewall, WAF, Anti-DDoS, KMS, Bastionhost, ActionTrail and Data Security Center.

· Demonstrated experience with threat modelling, security architecture review and closing VAPT findings to sign-off.