Cloud-Control Evidence Architecture Director — Global Market Data

The mandate

Three cloud platforms produce overlapping screenshots, tickets and policy attestations that cannot prove control operation for regulated feeds. Many records omit resource scope, collection identity or the state that existed at review time, leaving later assessors unable to reproduce management's claim. The defined problem is to create one evidence architecture connecting technical state, accountable review and customer obligations without launching a wider governance-platform replacement.

Required artefacts are a control-to-telemetry map, evidence schemas, collection patterns, exception workflow, retention design, assurance dashboard and operating manual. The architecture must distinguish continuous configuration facts from periodic human judgment, retain failed collections rather than overwrite them and identify assertions that still require sampling because telemetry cannot demonstrate business operation.

Milestone one on 30 October 2026 establishes the obligation and evidence inventory; 18 December delivers approved schemas and pilot controls; 12 February 2027 concludes automated collection and auditor reperformance; final acceptance on 31 March requires client-operated evidence packs across all clouds. Every review must record claims rejected, narrowed or retained as manual so later reporting cannot silently reinstate them.

The CISO, internal audit and two customer-assurance leads will accept delivery when sampled claims reproduce from source, identities and timestamps are trustworthy, exceptions retain decisions and operators generate packs without consultant intervention. Internal audit will deliberately sample changed, inherited and failed resources, while customer assurance verifies that mappings do not exaggerate scope. Final payment depends on passing those tests within the agreed discrepancy tolerance.

The client provides read-only cloud access, policy mappings, audit requests, engineering owners and a privacy-approved test environment, with blocked requests escalated within two business days. The consultant cannot certify compliance, change production configuration or sign regulatory responses; management remains responsible for remediating or accepting any failure discovered through collection.

Why this is external work

Control owners created the current attestations and cannot independently challenge their evidential value. Audit teams lack engineering capacity to design collection at source. External specialism supplies a bounded bridge between cloud telemetry and defensible assurance.

What you will own

• Map each material obligation to technical state, human judgment, frequency, evidence owner, affected resource population and retention need.
• Define immutable evidence schemas containing source identity, collection time, scope, reviewer and exception context.
• Prototype collection for identity, encryption, network, logging, vulnerability and backup controls across three clouds.
• Design exception records that preserve risk acceptance, compensating evidence, expiry and accountable renewal.
• Test evidence lineage through auditor reperformance and deliberately altered cloud states.
• Quantify collection coverage, stale evidence, failed controls and unsupported assertions without misleading aggregation.
• Transfer versioned code, schemas, runbooks and assurance calendars through two independently client-generated reporting cycles.

Candidate qualifications

• Designed cloud-control evidence architecture for a regulated multi-cloud platform spanning inherited accounts, production change and customer assurance.
• Can demonstrate telemetry-backed proof accepted by internal audit, regulators or demanding financial clients.
• Integrated cloud-native configuration, identity and logging sources without relying on screenshot collection.
• Defined evidential integrity, failed-collection treatment, retention and time-bounded exception handling for automated assurance.
• Led engineers, control owners and auditors through contested interpretations at director level, recording why claimed mappings were narrowed or rejected.
• Handed evidence automation to operators who reproduced complete packs after consulting exit.

Non-negotiables

• Available for London, Dublin and Frankfurt milestone sessions.
• Independent of cloud providers and assurance-platform vendors under consideration.
• Will contract against reproducibility rather than compliance certification.
• Has director or partner-equivalent cloud assurance authority.

1. 49 words maximum. Which cloud-control claim is most often supported by evidence that proves too little?
2. 49 words maximum. Describe an automated artefact an auditor successfully reperformed from source.
3. 49 words maximum. How would you prove an exception approval had not silently outlived its context?