Designs, develops and oversees the implementation of network and computer security structures for an organization, ensuring security requirements are adequately addressed in all aspects of the infrastructure, and the system supports an organization’s processes.
On this page
NICE framework reference
Securely provision, SP-ARC 002, security architect.
Consequence of error or risk
Error, neglect, outdated information or poor judgment could result in flawed designs or architectures that could fail or experience exploitable vulnerabilities which could place IT systems upon which the organization relies in jeopardy. Lack of a full appreciation of the business needs for security will jeopardize the security posture of the organization in the face of evolving threats.
Development pathway
Primarily following education and a career pathway from an existing enterprise architect role, this is an emerging specialist role primarily employed in large tech-enabled organizations, shared services or systems or security providers.
Other title
Enterprise security architect
Related National Occupational Classifications
2147 – Computer engineers (except software engineers and designers)
Tasks
- Collaborate with key stakeholders to establish an effective cyber security risk management program
- Ensure compliance with the changing laws and applicable regulations
- Define and review an organization’s technology and information systems, and ensure security requirements
- Recognize appropriate disaster recovery plans and business continuity functions, including any failover or backup requirements for system restoration
- Plan, research, and develop robust security architectures for systems and networks
- Research current and emerging technologies to understand capabilities of required networks or systems
- Prepare cost estimates and identify integration issues
- Conduct vulnerability testing, risk analyses and security assessments
- Research and develop a system security context, and define security assurance requirements based on industry standards and cyber security policies and practices
- Ensure the acquired or developed systems and architectures are consistent with an organization’s cyber security policies and practices
- Perform security reviews and identify gaps or determine the capability of security architectures and designs (e.g. firewall, virtual private networks, routers, servers, etc.), and develop a security risk management plan
- Prepare technical reports that document the architecture development process
- Document and address an organization’s information security, cyber security architecture, and systems security engineering requirements throughout a system life cycle
- Advise on security requirements and risk management process activities
- Support incident management and post-analysis advising on recovery operations
- Develop, deliver, and oversee related cyber security training material and educational efforts related to role
Required qualifications for education
Post-secondary education in IT infrastructure and architecture (e.g. computer engineering, IT systems architecture).
Required training
Specialized training in security architecture concepts, principles, and practices. Training to support security tools needed to support role.
Required work experience
Previous training and experience in IT security infrastructure, requirements analysis or program management is preferred – 5 to 10 years of relevant IT experience for advanced-level.
Tools and technology
- Strategic and business plans
- Threat and risk assessments
- Systems architectures
- IT mapping tools and applications
- Incident management processes and procedures
- Security event and incident management systems and/or incident reporting systems and networks
- Cyber security risk management processes & policies
- Privacy and security legislation
- Organizational security infrastructure and reporting systems
Competencies
Underpinning this occupation are those competencies demonstrated for an executive level which include those identified within the NICE framework.
Advanced application of the following knowledge, skills, and abilities (KSAs):
- Business needs for security
- Legal, policy and compliance requirements
- Integrated/organizational security concepts, principles and practice (software, system, data, physical and personnel)
- Preventative technical, operational and management controls available and organizational responsibilities for those controls
- Sector/context relevant threats, business needs and technical infrastructure
- Project management and security requirements throughout the project lifecycle
- Cryptography and cryptographic key management concepts
- Virtual Private Network devices and encryption
- Engineering concepts and practices as applied to systems security and systems architecture
- Security architecture concepts and enterprise architecture reference models
- Security assessment and authorization processes
- Authentication, authorization, and access control methods
- System testing and evaluation methodologies and processes
- Application security system concepts and functions
- System life cycle management principles, including software security and usability
- Industry standards and organizationally accepted analysis principles and methods
- Configuring and using software-based computer protection tools
- Designing hardware and software solutions
- Cyber security program management, measures and monitoring
- Incident management and system recovery planning and operations
Future trends affecting key competencies
- The increased reliance on virtualized and/or "cloud-based" services will require deep knowledge at the intersection between organizational and service providers architectures to determine and manage cyber security risks.
- If practiced within the organization, there will be a requirement to fully understand the security implications of "bring your own devices" (BYOD) and how security controls are integrated into the organizational infrastructure.
- Increased use of automated tools, aided by artificial intelligence, will require understanding of how the tools will be integrated into the overall security architecture and infrastructure and the implications to personnel, resources, procedures, and policies.
- Increased use of automated tools by threat actors pose challenges for organizations that do not have complementary defensive tools. Accordingly, creative, locally relevant mitigation strategies will be required that will need to be integrated into the security architecture.
- Mechanisms to support the required level of trust and organizational risk will need to be in place to support monitoring and reporting of results from automated tools. Consequently, there will be a need to understand organizational risks posed, measures of security and what policies, processes, or procedures need to be in place to support an integrated security architecture.