Cloud & hybrid security architecture
A migration or merger programme is moving, security is on the critical path, and nobody can say whether the target design will pass audit.
Cloud programmes rarely fail on technology. They fail when the security design is settled too late to influence the build, leaving the assurance function to object to decisions that are already load-bearing.
What this looks like in practice
Design authority during the programme. The value is in being in the room while the choices are still cheap to change.
Identity as the control plane. In hybrid and multi-cloud estates, identity is where the real perimeter sits. That means conditional access policies and persona frameworks that cover service principals and workload identities as seriously as they cover people.
Migration-phase controls. A design that is secure in its target state can be badly exposed halfway through a migration. The interesting question is usually what holds during the transition.
Post-merger and carve-out work
Integrations concentrate risk. Two estates with different assumptions, a deadline set by the deal rather than the engineering, and a period where both environments are trusted. I have worked this pattern through a large-scale migration ahead of an operational merger. The sequencing decisions made early determine how much exposure the programme carries later.