Security architect

What it answers for

• A design whose failure modes were considered before it was built.
• Control choices that are justified against a stated threat rather than a product feature.
• Patterns that the teams building them can actually implement.

What it is measured on

• Designs that survive their first real incident without a redesign.
• Adoption of the patterns, which is the only proof they were usable.
• Exceptions requested, which measures whether the architecture fits the organisation it serves.

Who else has a stake

• The teams who will operate the result long after the architect has moved to the next design.
• Procurement, whose purchase is constrained by an architectural decision they did not attend.
• Whoever inherits the exception register, which is the true record of where the architecture bent.

What it takes

• Enough depth in networks, identity and platforms to be wrong in front of specialists and recover.
• The judgement to accept a risk deliberately rather than escalating everything.
• Writing. An architecture that exists only in conversation is not an architecture.
• Tolerance for being overruled commercially, and the discipline to record the decision anyway.

The published sources

• NICCS, CISA - the NICE Workforce Framework for Cybersecurity, which defines the work roles, tasks and skills used across public, private and academic sectors
• NIST SP 800-53 Rev. 5 - the control catalogue that security architecture and policy work is written against in practice

Where it leads

• Security engineerWho defends it
• Network security engineerWho defends it
• Security leaderWho defends it
• Network consulting engineerWho deploys it

Roles that lead here

• Governance, risk and compliance analystWho defends it

The work itself

The Practice covers how this work is done — triage, escalation, evidence, handover — across the whole corpus.

• Reading a design you did not writeInheriting a system somebody else designed is one of the most common situations in this work, and the first act is not to judge the design but to recover the constraints it was answering. Almost everything that looks wrong is a decision whose reason has left the building, and the parts that are genuinely wrong are indistinguishable from the parts that are not until you know which is which.
• What acceptance testing is actually forAcceptance testing is not a demonstration that the system works. Its real function is to write down what "working" was agreed to mean, while both parties still want to agree — so that the argument arriving eighteen months later has a document instead of two memories.
• The runbook nobody can follow, and whyRunbooks fail when they are written by the person who least needs them, at the moment they understand the system best, for a reader they imagine to be themselves. The fix is not more detail — it is writing for a specific reader in a specific state, and then letting that reader break it before you need it.
• Handover: the moment a project becomes an operationHandover is treated as a document transfer and is actually a transfer of judgement — and judgement is the one thing that cannot be handed over in a meeting. What can be transferred is the reasoning behind the decisions, the list of things that were left unfinished, and the name of somebody who will answer the phone.
• Baselines — knowing what normal looks like before you need toA baseline is not monitoring and not documentation. It is the answer to the only question that matters in the first ten minutes of an incident — has this always been like that — and it is the one artefact that can only be made when nothing is wrong.
• What a baseline cannot tell youA baseline records what happened during the period it was taken and silently promotes that period's conditions to the status of normal. It answers whether something changed, which is worth having — but it cannot tell you whether the thing it recorded was ever right, and the difference between those two questions is where confident wrong answers come from.
• Change windows, and the arithmetic of a rollbackA change window is not the time the change takes. It is the time the change takes plus the time to discover it went wrong plus the time to put it back — and the third number is the one nobody measures, which is why windows overrun and rollbacks get abandoned halfway.
• Naming, addressing, and the cost of getting them wrong earlyNaming and addressing are decided in an afternoon by whoever is free, and they outlast every other decision in the estate — not because they are technically hard to change, but because everything else quietly comes to depend on them. The cost is paid years later, by somebody else, in a currency nobody budgeted.

Read The Practice