A security architect designs and builds secure solutions.
Security architect role levels
There are 3 security architect role levels, from security architect to principal security architect.
The typical responsibilities and skills for each role level are described in the sections below. You can use this to identify the skills you need to progress in your career, or simply to learn more about each role in the Government Digital and Data profession.
1. Security architect
A security architect creates and designs security for a system or service, maintains security documentation and develops architecture patterns and security approaches to new technologies.
At this role level, you will:
recommend security controls and identify solutions that support a business objective
provide specialist advice and recommend approaches across teams and various stakeholders
communicate widely with other stakeholders
advise on important security-related technologies and assess the risk associated with proposed changes
inspire and influence others to execute security principles
You can:apply the approach to real problems and consider all relevant informationapply appropriate rigour to ensure a full solution is designed and achieves the business outcome
You can:demonstrate a deep understanding of security concepts and can apply them to a technical leveleffectively translate and accurately communicate security and risk implications to technical and non-technical stakeholderssuccessfully respond to challengesmanage stakeholder expectations and be flexible, adapting to stakeholder reactions to reach consensus
You can:work with risk owners to advise and give feedbackadvise on risk impact and whether it’s within risk tolerancedescribe different risk methodologies and how these are applied, as well as the proportionality of risk
You can:interpret and apply an understanding of policy and process, business architecture, and legal and political implications to assist the development of technical solutions or controls
2. Lead security architect
A lead security architect undertakes complex work of a high risk level, often working on several projects.
At this role level, you will:
interact with senior stakeholders across departments
reach and influence a wide range of people across larger teams and communities
research and apply innovative security architecture solutions to new or existing problems and be able to justify and communicate design decisions
develop vision, principles and strategy for security architects for one project or technology
work out subtle security needs
understand the impact of decisions, balancing requirements and deciding between approaches
produce particular patterns and support quality assurance
be the point of escalation for architects in lower grade roles
You can:monitor the analysis of a technical solution and ensure analysis is reused for similar problem setsreview solutions and identify areas for changedrive the collection of information that is used and analysedfeed back on policy and requirements
You can:demonstrate a deep understanding of security concepts and can apply them to a technical leveleffectively translate and accurately communicate security and risk implications to technical and non-technical stakeholderssuccessfully respond to challengesmanage stakeholder expectations and be flexible, adapting to stakeholder reactions to reach consensus
You can:work with higher impact or more complex risks, advising on the impact and whether it’s within risk toleranceapply different risk methodologies in proportion to the risk
You can:contribute to and inform developments on security properties in technologyidentify new technologies and design the use of these in the business context across the organisationengage with the broader security community
You can:explain complex system architecturesidentify and explain how easy or difficult it will be to exploit vulnerabilitieslead and influence security technology in the security industry
You can:interpret and apply understanding across a complex areastart influencing policy and process, business architecture, and legal and political implications
3. Principal security architect
A principal security architect works on services of high complexity and risk, making decisions to enable the business to achieve its needs.
At this role level, you will:
work on projects with high strategic impact, setting a strategy that can be used in the long term and across the breadth of the organisation
communicate with a broad range of senior stakeholders and be responsible for defining the vision, principles and strategy for security architects
recommend security design across several projects or technologies, up to an organisational or inter-organisational level
have a deep and evolving level of technical expertise, so you can act as an exemplar
make and influence important business and architectural decisions
research, identify, validate and adopt new technologies and methodologies
be a recognised expert and demonstrate this expertise by solving unprecedented issues and problems
further the profession, demonstrating and sharing best practice within and outside the organisation
You can:provide direction and lead on change regarding factors that feed into analysismonitor changes in the technical environment and assess whether risks are still at acceptable levels or whether previous decisions need to be revisiteddirect and influence others on best practice and policy
You can:demonstrate expert understanding of security concepts and can apply them to a technical level, at the highest levels of risk complexityeffectively translate and accurately communicate security and risk implications at the most senior levels across technical and non-technical stakeholderssuccessfully respond to challengesmanage stakeholder expectations across high risk and complexity or under constrained timescales
You can:lead design and review solutions to complex problems with system architectures by defining and challenging patterns and principlescreate precedents and set direction
You can:act as a point of escalationbe trusted by senior risk owners as an expert in securityapply risk methodologies at the most complex levels of risk
You can:contribute to and inform developments on security properties in technologyidentify new technologies and design the use of these in the business context across the organisationengage with the broader security community
You can:explain complex system architecturesidentify and explain how easy or difficult it will be to exploit vulnerabilitieslead and influence security technology in the security industry
