Best MazhinduBest Mazhindu
Open to Enterprise & Cloud Architecture Roles

Best
Mazhindu

Enterprise Architect | Cloud Architect | Cloud Security Architect | Secure AI Architect
Solutions Architecture · Security Architecture · AWS Architecture · Security-by-Design · Enterprise Governance

Designing secure, scalable and governed AWS architectures for enterprise transformation and responsible AI innovation.

View Architecture Work Get in Touch View CV
50+
Production Applications
15+
Client Environments
60%+
Less Over-Privileged Access
20–25%
AWS Cost Reduction
Best Mazhindu portrait
Best Mazhindu
Tech Lead · Enterprise & Cloud Architect
Zimbabwe · Remote GMT+2
Architecture hierarchy
Enterprise Architect
Identity
L01
Cloud Architect
Core specialisation
L02
Cloud Security Architect
Security specialisation
L03
Secure AI Architect
Emerging capability
L04
Supporting knowledge: Networking · Data · AI/ML · DevOps · Infrastructure · Automation · Software Engineering
Philosophy
Secure first.
Innovate later.
Architecture before technology hype
Security-by-design before deployment
Governance before uncontrolled growth
Secure cloud foundations before AI innovation

Not anti-AI — build secure, governed foundations first, then enable responsible AI-driven innovation on top of them.

About

An architect who understands implementation

I am an Enterprise and Cloud Architect specialising in secure AWS architecture, cloud security and technology governance. I design secure, governed AWS environments using security-by-design, grounded in hands-on delivery of 50+ production applications across 15+ client environments.

I reduced over-privileged access by over 60% through IAM standardisation and delivered 20–25% cost reductions for three clients. Today I lead enterprise cloud and security architecture at Analytics Hive, advising Heads of IT, Risk and Operations and guiding delivery teams on architecture, governance and risk.

My background spans enterprise systems, AWS cloud, security architecture, infrastructure, networking, governance, data, AI/ML and automation. MBA-qualified, I translate business requirements into secure, scalable cloud design.

Architecture
Primary
Security
Specialisation
Governance
Leadership layer
AI · Data · DevOps
Supporting breadth
Professional progression
  1. 01
    Software & Systems Engineering2016 – 2020

    Enterprise integration projects and grounding in financial-sector business systems.

  2. 02
    AWS Cloud Architecture2021 – 2025

    Production AWS environments, migration advisory, automation and operational delivery.

  3. 03
    Cloud Security ArchitectureDeepening

    IAM least privilege, network segmentation, security-by-design, logging, governance and risk.

  4. 04
    Enterprise Architecture2026 – Now

    Connecting business requirements, cloud platforms, security, governance, risk and delivery teams.

  5. 05
    Secure AI ArchitectureEmerging

    Extending architecture into secure AI/ML, AI governance and responsible AI.

Core Capabilities

Architecture specialisation

Architecture

Enterprise ArchitectureCloud & Solutions ArchitectureArchitecture GovernanceTechnology StrategySolution DesignAWS ArchitectureHybrid Cloud ArchitectureNetwork Architecture

Security & Governance

Cloud Security ArchitectureSecurity-by-DesignIAM / Least PrivilegeData ProtectionCloud GovernanceRisk ManagementAudit ReadinessSecurity Controls

AWS

AWS Well-ArchitectedMulti-account architectureOrganizationsControl TowerVPCTransit GatewayIAMKMSCloudTrailConfigGuardDutySecurity HubWAFShield

Secure AI

Amazon BedrockAmazon SageMakerAI GovernanceResponsible AISecure AI/ML architectureData protection for AI workloads

Framework awareness: AWS Well-Architected · CIS Benchmark-oriented controls · POPIA-aligned controls · GDPR-aware architecture · Responsible AI (working knowledge)

Architecture & Security Portfolio

Design rationale, not just diagrams

Portfolio reference architectures demonstrating design reasoning and decision-making. These are not production client deployments.

Secure Banking Cloud Architecture

Reference architecture — not a production banking deployment
Context
A regulated bank needs resilient, segmented, auditable hosting with controlled connectivity to on-premises systems.
Design
Multi-AZ VPC with tiered subnets, Transit Gateway hub-and-spoke, Direct Connect-aware hybrid connectivity, Route 53 + CloudFront with WAF/Shield, private Multi-AZ RDS.
Key decisions
  • Transit Gateway over VPC peering for scalable routing control
  • Private over public connectivity for data tiers
  • Multi-AZ over single-AZ for availability
Security & governance
IAM roles with least privilege instead of long-lived credentials, KMS encryption, network segmentation, centralised logging. POPIA-aligned controls; Well-Architected security and reliability pillars.
Outcome
A design that supports high availability, controlled connectivity, data protection and audit-ready evidence.
Transit GatewayMulti-AZWAF / ShieldKMSRDS

Enterprise Cloud Governance & Security Architecture

Architecture portfolio project
Context
A growing multi-account AWS estate needs consistent guardrails and central visibility without slowing delivery teams.
Design
AWS Organizations → Control Tower → SCPs → Config → CloudTrail → Security Hub → GuardDuty.
Key decisions
  • Centralised governance with team autonomy inside preventive guardrails
Security & governance
Preventive and detective controls, CIS Benchmark-oriented checks, centralised logging for audit readiness.
Outcome
Standardisation, account governance, central visibility, reduced configuration drift and controlled cloud growth.
OrganizationsControl TowerSCPsSecurity HubGuardDuty

Secure AI & Data Architecture

Architecture portfolio project — supporting capability
Context
Organisations adopting generative AI need data protection and governance built in from the start.
Design
Bedrock and SageMaker on S3 with lifecycle policies.
Key decisions
  • Managed services over self-managed infrastructure to reduce operational and security burden
Security & governance
IAM least privilege, KMS encryption, Bedrock Guardrails, AI governance and Responsible AI considerations, with privacy requirements designed in.
Outcome
A governed pattern for deploying AI workloads without weakening data-protection posture.
BedrockSageMakerGuardrailsKMSS3

Secure CI/CD & Container Architecture

Architecture portfolio project — implementation awareness
Context
Delivery teams need repeatable, secure releases without environment drift.
Design
Docker → ECR → CodePipeline / GitHub Actions → Terraform / CloudFormation with zero-downtime deployment.
Key decisions
  • Led a Kubernetes vs. ECS evaluation that informed the platform decision on complexity and cost
Security & governance
Security controls built into the pipeline; infrastructure defined as reviewable code.
Outcome
Repeatable, auditable deployments with security controls built into the pipeline.
ECRCodePipelineGitHub ActionsTerraformECS

Diagrams & repositories: github.com/Best-Mazhindu

Architecture Patterns

Cloud architecture patterns

Secure AWS Application Architecture
Internet
Users
Route 53
DNS
CloudFront
Edge
WAF
Filtering
ALB
Load balancer
App tier
Private
DB tier
Private
Cross-cutting controlsIAMKMSCloudTrailCloudWatchSecurity groups
Enterprise Multi-Account Governance
Organization
Root
Control Tower
Landing zone
Accounts
Workloads
SCPs
Preventive
Config
Detective
CloudTrail
Audit
Security Hub
Posture
GuardDuty
Threats
Cross-cutting controlsCentralised loggingCIS-oriented checksGuardrails
Secure AI Architecture
Data
Sources
S3
Governed store
IAM / KMS
Access + crypto
Bedrock / SM
Models
Guardrails
Safety
Application
Consumers
Monitoring
Governance
Cross-cutting controlsLeast privilegeEncryptionResponsible AIPrivacy by design
Production Engineering Evidence

I design architectures and have operated them

Hands-on production work that grounds the architecture practice — real environments, real clients, real operational responsibility.

Terraform / CloudFormation IaC

Terraform / CloudFormation IaC

Reusable Terraform and CloudFormation modules built for client environments at Poshi Creative.

TerraformCloudFormation
CI/CD Automation

CI/CD Automation

Pipeline-based delivery with GitHub Actions and CodePipeline, Docker and ECR.

GitHub ActionsCodePipelineDocker
Monitoring & Audit Logging

Monitoring & Audit Logging

CloudWatch alarms with SNS and CloudTrail audit logging across 15+ environments.

CloudWatchSNSCloudTrail
Container Platform Evaluation

Container Platform Evaluation

Kubernetes vs. ECS evaluation informing the platform decision on complexity and cost.

KubernetesECS
ML Workloads on AWS

ML Workloads on AWS

SageMaker-based ML experience — a supporting capability behind secure AI architecture.

SageMakerPython
Multi-Tenant Client Hosting

Multi-Tenant Client Hosting

Multi-tenant AWS environment (EC2, VPC, RDS, S3, IAM) running 50+ production applications.

EC2VPCRDSIAM
Experience

Architecture track record

Tech Lead | Enterprise & Cloud Architect
Jan 2026 – Present
Analytics Hive — International data, analytics and IT consultancy · South Africa, UK, Zimbabwe
  • Lead enterprise cloud and security architecture for enterprise and public-sector clients, embedding IAM least privilege, network security and security-by-design into solution designs aligned to the AWS Well-Architected Framework.
  • Provide technical direction to a cross-functional team of 7 across architecture, cloud engineering and data/AI, running architecture reviews for security, scalability and cost.
  • Advise Heads of IT, Risk and Operations on cloud, security and AI transformation, and shape architecture governance standards and delivery methodology.
  • Direct AWS partner and go-to-market architecture, structuring cloud, security, data and secure AI/ML capabilities into enterprise offerings via AWS Partner Central; led a parallel Microsoft 365 / Dynamics 365 commercial portfolio.
  • Established SharePoint-based governance, compliance and training resources to standardise departmental practice.
AWS Cloud Architect
2021 – 2025
Poshi Creative — Cloud consultancy for SMEs, schools and microfinance · Southern Africa
  • Architected and operated a multi-tenant AWS environment (EC2, VPC, RDS, S3, IAM) supporting 50+ live production applications across 15+ client accounts.
  • Designed layered VPC architectures with subnet segmentation, NAT routing and security-group policy, limiting cross-environment exposure.
  • Standardised IAM across client accounts (role hierarchies, enforced MFA, quarterly audits), reducing over-privileged access by over 60%.
  • Established monitoring and audit logging (CloudWatch alarms with SNS, CloudTrail) across 15+ environments.
  • Redesigned cost architecture for three major clients (rightsizing, Reserved Instances, S3 Intelligent-Tiering), achieving 20–25% reductions without degrading SLAs.
  • Advised 10+ clients on migration strategy and built reusable Terraform/CloudFormation modules.
Software & Systems Engineer
2016 – 2020
IS Systems Solutions — Financial and commercial clients
  • Delivered four multi-system enterprise integration projects, building grounding in enterprise integration and financial-sector systems.
Selected Outcomes

The business value of secure architecture

Production Scale

50+ production applications across 15+ client environments.

Security

Over 60% reduction in over-privileged access through IAM standardisation.

Cost Architecture

20–25% AWS cost reductions for three clients without degrading SLAs.

Architecture Leadership

Technical direction to a team of 7 across architecture, cloud engineering and data/AI.

Governance

Architecture governance standards, security controls, audit readiness and AWS Well-Architected practice.

Technology

Focused technology stack

Cloud Architecture

Primary
AWSEC2VPCTransit GatewayRDSS3CloudFrontRoute 53

Security

Primary
IAMKMSWAFShieldGuardDutySecurity HubCloudTrailConfig

Infrastructure & Delivery

Supporting
TerraformCloudFormationDockerGitHub ActionsCodePipelinePythonBoto3Bash

AI

Supporting
BedrockSageMakerAI Governance
Certifications

Validated credentials

AWS Architecture & Security
  • AWS Certified Solutions Architect – Professional (SAP-C02)Certified
  • AWS Certified Solutions Architect – Associate (SAA-C03)Certified
  • AWS Certified Security – SpecialtyCertified
AI
  • AWS Machine Learning – AssociateCertified
In Progress
  • CISSPIn progress — not yet certified
  • TOGAFIn progress — not yet certified
  • DPO / Data ProtectionIn progress — not yet certified

Training: DevSecOps · MLOps · Responsible AI · ITIL 4

Academic & Research Focus

AI Governance, Evaluation & Safety

My academic direction explores AI governance, evaluation and safety at the intersection of artificial intelligence, enterprise architecture, security, responsible AI and technology governance — a natural extension of building secure, governed foundations before scaling AI.

View Academic CV
MBA — AI & Business Strategy
Zimbabwe Open University · 2022
BSc Information Technology
Midlands State University · 2015 · 16 distinctions
Architecture Opportunities

Secure foundations first,
responsible innovation next.

Open to remote international roles in enterprise, cloud and cloud security architecture — and to architecture and cloud security advisory conversations.

best@bestmazhindu.com LinkedIn View CV
+263 77 552 6709Zimbabwe · Remote GMT+2github.com/Best-Mazhindu
For the curious
best@architecture:~$
best@arch:~$help
Available: about · focus · stack · certs · contact · clear
best@arch:~$