BEST MAZHINDU ENTERPRISE ARCHITECT | CLOUD ARCHITECT | CLOUD SECURITY ARCHITECT| SECURE AI ARCHITECT Solutions Architect · Security Architect · AWS Architecture · Security-by-Design · Enterprise Governance Zimbabwe | Remote GMT+2 | Open to International Opportunities best@bestmazhindu.com · +263 77 552 6709 · bestmazhindu.com · linkedin.com/in/best-mazhindu · github.com/Best-Mazhindu |  |
EXECUTIVE PROFILE
Enterprise and Cloud Architect who designs secure, governed AWS environments using security-by-design, grounded in hands-on delivery of 50+ production applications across 15+ client environments. Reduced over-privileged access by over 60% through IAM standardisation and delivered 20-25% cost reductions for three clients. Now leads enterprise cloud and security architecture at Analytics Hive, advising Heads of IT, Risk and Operations and guiding delivery teams on architecture, governance and risk. MBA-qualified, translating business requirements into secure, scalable cloud design.
CORE COMPETENCIES
‣Architecture: Enterprise Architecture · Cloud & Solutions Architecture · Architecture Governance · Technology Strategy · Solution Design
‣Security & Governance: Cloud Security Architecture · Security-by-Design · IAM / Least Privilege · Data Protection · Cloud Governance · Risk Management · Audit Readiness
‣Framework Awareness: AWS Well-Architected · CIS Benchmark-oriented controls · POPIA-aligned controls · GDPR-aware architecture · Responsible AI (working knowledge)
‣Leadership: Technical Leadership · Stakeholder & Client Advisory · Cross-Functional Delivery Guidance · Architecture Decision-Making
PROFESSIONAL EXPERIENCE
Jan 2026 – PresentTech Lead | Enterprise & Cloud Architect
Analytics Hive — International data, analytics and IT consultancy - South Africa, UK, Zimbabwe
‣Lead enterprise cloud and security architecture for enterprise and public-sector clients, embedding IAM least privilege, network security and security-by-design into solution designs aligned to AWS Well-Architected Framework.
‣Provide technical direction to a cross-functional team of 7 across architecture, cloud engineering and data/AI, running architecture reviews for security, scalability and cost.
‣Advise Heads of IT, Risk and Operations on cloud, security and AI transformation, and shape architecture governance standards and delivery methodology.
‣Direct AWS partner and go-to-market architecture, structuring cloud, security, data and secure AI/ML capabilities into enterprise offerings via AWS Partner Central; led parallel Microsoft 365 / Dynamics 365 commercial portfolio.
‣Established SharePoint-based governance, compliance and training resources to standardise departmental practice.
2021 – 2025AWS Cloud Architect
Poshi Creative — Cloud consultancy - SMEs, schools, microfinance - Southern Africa
‣Architected and operated multi-tenant AWS environment (EC2, VPC, RDS, S3, IAM) supporting 50+ live production applications across 15+ client accounts.
‣Designed layered VPC architectures with subnet segmentation, NAT routing and security-group policy, limiting cross-environment exposure.
‣Standardised IAM across client accounts (role hierarchies, enforced MFA, quarterly audits), reducing over-privileged access by over 60%.
‣Established monitoring and audit logging (CloudWatch alarms with SNS, CloudTrail) across 15+ environments.
‣Redesigned cost architecture for three major clients (rightsizing, Reserved Instances, S3 Intelligent-Tiering) achieving 20-25% reductions without degrading SLAs.
‣Advised 10+ clients on migration strategy and built reusable Terraform/CloudFormation modules.
2016 – 2020Software & Systems Engineer
IS Systems Solutions — Financial and commercial clients
‣Delivered four multi-system enterprise integration projects, building grounding in enterprise integration and financial-sector systems.
SELECTED ARCHITECTURE PROJECTS
Portfolio reference architectures - design rationale and decision-making, not production client deployments.
Secure Banking Cloud Architecture Reference architecture / portfolio project — not a production banking deployment.
Context: A regulated bank needs resilient, segmented, auditable hosting with controlled connectivity to on-premises systems.
Design & decisions: Multi-AZ VPC with tiered subnets, Transit Gateway hub-and-spoke, Direct Connect-aware hybrid connectivity, Route 53 + CloudFront with WAF/Shield, private Multi-AZ RDS. Transit Gateway over VPC peering for scalable routing control; private over public connectivity for data tiers; Multi-AZ over single-AZ for availability.
Security & governance: IAM roles with least privilege instead of long-lived credentials, KMS encryption, network segmentation, centralised logging. POPIA-aligned controls; Well-Architected security and reliability pillars.
Outcome: A design that supports high availability, controlled connectivity, data protection and audit-ready evidence.
Enterprise Cloud Governance & Security Architecture Architecture portfolio project
Context: A growing multi-account AWS estate needs consistent guardrails and central visibility without slowing delivery teams.
Design & decisions: AWS Organizations → Control Tower → SCPs → Config → CloudTrail → Security Hub → GuardDuty. Centralised governance with team autonomy inside preventive guardrails.
Security & governance: Preventive and detective controls, CIS Benchmark-oriented checks, centralised logging for audit readiness.
Outcome: Standardisation, account governance, central visibility, reduced configuration drift and controlled cloud growth.
Secure AI & Data Architecture Architecture portfolio project — supporting capability
Context: Organisations adopting generative AI need data protection and governance built in from the start.
Design & decisions: Bedrock and SageMaker on S3 with lifecycle policies; managed services chosen over self-managed infrastructure to reduce operational and security burden.
Security & governance: IAM least privilege, KMS encryption, Bedrock Guardrails, AI governance and Responsible AI considerations, with privacy requirements designed in.
Outcome: A governed pattern for deploying AI workloads without weakening data-protection posture.
Secure CI/CD & Container Architecture Architecture portfolio project — implementation awareness supporting architecture leadership
Context: Delivery teams need repeatable, secure releases without environment drift.
Design & decisions: Docker → ECR → CodePipeline / GitHub Actions → Terraform / CloudFormation with zero-downtime deployment. Led a Kubernetes vs. ECS evaluation that informed the platform decision on complexity and cost.
Outcome: Repeatable, auditable deployments with security controls built into the pipeline.
Architecture diagrams and repositories: bestmazhindu.com · github.com/Best-Mazhindu
CERTIFICATIONS
‣AWS Certified Solutions Architect – Professional (SAP-C02) — Certified
‣AWS Certified Solutions Architect – Associate (SAA-C03) — Certified
‣AWS Certified Security – Specialty — Certified
‣CISSP — In Progress · TOGAF — In Progress · DPO / Data Protection — In Progress
Training: DevSecOps, MLOps, Responsible AI, ITIL 4
EDUCATION
‣MBA (AI & Business Strategy) — Zimbabwe Open University, 2022
‣BSc Information Technology — Midlands State University, 2015 · 16 distinctions
TECH STACK
‣Cloud: AWS, EC2, VPC, Transit Gateway, RDS, S3, CloudFront, Route 53
‣Security: IAM, KMS, WAF, Shield, GuardDuty, Security Hub, CloudTrail, Config
‣Infra / CI/CD: Terraform, CloudFormation, Docker, GitHub Actions, CodePipeline, Python, Boto3, Bash
‣AI: Bedrock, SageMaker, AI Governance