Genuine hands-on fluency in cloud security architecture and networking: can independently size a VPC CIDR range, determine subnetting needs for a multi-tier architecture, explain routing, security groups, and NACLs, and articulate the value of VPC Flow Logs as a forensic and audit-evidence control, not just recognize the terms. Personally review and approve security architecture for new products, features, and infrastructure changes, including hands-on evaluation of network design (VPC and subnet layout, routing, security groups, NACLs, NAT and internet gateways, multi-AZ design, VPC Flow Logs as a forensic and audit-evidence control).