Azure Architect - Active SC Clearance Required - Remote - Outside IR35

We are urgently seeking a Senior Azure Architect with current, active SC clearance for a discovery and assessment engagement supporting a UK software and services provider to the public sector.

The project involves separating approximately a dozen customer Azure subscriptions from an existing parent tenant into a new, independently governed tenant, supporting data sovereignty and compliance requirements. This is an operational separation rather than a sale or divestiture.

The initial phase will focus on understanding the existing estate, identifying dependencies and defining a safe migration and cutover approach. Some subscriptions operate within security-sensitive environments, making active SC clearance essential.

Key responsibilities

• Lead discovery and assessment across the Azure subscriptions, documenting bespoke IaaS and PaaS workloads, configurations and dependencies.
• Run discovery sessions with development and operations teams to capture application dependencies, service requirements, SLAs and operational constraints.
• Assess the implications of a tenant change across Microsoft Entra ID, access controls, application identities and integrations.
• Review existing networking, private connectivity, DNS and dependencies across subscriptions and external systems.
• Assess the target tenant’s architecture and governance requirements, including landing zones, management groups, Azure Policy and subscription controls.
• Identify migration risks, service continuity considerations and prerequisites for a safe transition.
• Produce clear assessment reports, dependency maps, network diagrams, risk and issue logs, and a proposed cutover approach.
• Work closely with a Programme Manager and technical design authority to inform decisions and plan subsequent phases.

• Current, active SC clearance, which must be verified before engagement.
• Senior Azure architecture experience within enterprise, regulated or security-sensitive environments.
• Practical experience of tenant-to-tenant migration or subscription transfers between tenants, including the identity impact of a directory change.
• Strong Microsoft Entra ID/Azure AD knowledge, covering SSO, RBAC, Conditional Access, PIM, application registrations and service principals.
• Experience designing and assessing Azure landing zones, management groups, Azure Policy and subscription governance.
• Strong Azure networking knowledge, including virtual networks, hub-and-spoke architectures, peering, VPN/ExpressRoute, DNS and private connectivity.
• Experience assessing mixed Azure estates with bespoke IaaS and PaaS workloads.
• Proven discovery and design capability, including stakeholder workshops, dependency analysis and architectural documentation.
• Clear written communication and the ability to translate technical findings into practical recommendations.

Desirable experience

• Microsoft certifications such as AZ-305, AZ-104 or SC-300.
• Experience assessing Azure DevOps or other CI/CD pipelines, particularly their dependencies on tenant identity.
• Background in public sector, policing or other security-sensitive environments.
• Experience working within a small advisory team alongside programme management and technical design leadership.

Please note

This engagement requires strong discovery, assessment and architecture design experience. A background focused solely on hands-on build and implementation will not meet the requirement.