Security Architect for Amazon Seller Central

We are an Amazon Solution Provider with 50 remote international contractors (personal Windows/Mac devices) accessing Seller Central via Amazon's Solution Provider Portal. We do not operate an SP-API application. Certain screens display Amazon Customer PII; we don't download, export, or store it elsewhere. Amazon's updated Data Protection Policy (effective 8/25/26) requires device encryption, endpoint protection, a 15-minute screen lock, MFA, formal access management, and restricts access to Amazon data from personal/unmanaged devices unless secured via MDM/UEM or an equivalent controlled environment. What we need - A gap assessment of our current environment against the new DPP/AUP/SPP Agreement requirements - A recommended approach, with tradeoffs — we're open to managed BYOD (e.g., Intune/Entra), a virtual desktop/DaaS solution (Windows 365, Azure Virtual Desktop, or lower-cost alternatives like Kasm Workspaces or V2 Cloud), or a hybrid. Please weigh cost, security coverage, and rollout complexity for each rather than assuming one path. - A phased rollout plan, flagging what's achievable quickly vs. what needs more lead time Documentation we can present to Amazon as compliance evidence We're cost-conscious favoring a right-sized solution over the most feature-complete one. This engagement covers assessment and recommendation. Implementation may be awarded as a separate follow-on. The ideal candidate has experience securing BYOD/remote-contractor environments and evaluating DaaS/VDI options across vendors (not just Microsoft). Comfortable working from source policy documents, which we'll provide.