Security Architect

What is a Cybersecurity Architect?

Security Architects are very experienced security pros. Their role is highly technical and has a management side to it. As such, they are just one step away from the C-level positions in the field. Designing and supervising the security strategy of their organization and managing IT/security teams is part of their duties. As managers, they also deal with some other aspects such as planning and discussing IT/security budgets.

Are you considering a career as a Security Architect? Or are you an employer who wants to know if this is the cyber pro you need to hire? Read more to find out.

The profile

Cybersecurity is a realm where professionals are multiskilled. All infosec positions need some degree of knowledge in a wide range of security topics, tools and practices. Security Architects are no exception, and they can be considered a sort of engineer+manager power-combo. They are highly seasoned professionals with a considerable amount of previous experience in building, implementing and protecting systems, software and networks. More than that, they also know how to manage projects and teams and have the necessary knowledge about the specific industry and organization they work in.

This means their responsibilities encompass three main domains: technical, management and business/financial. Specifically, they design (architect) systems and the other components needed for an effective security strategy. They need to have a big-picture perspective and strong knowledge of vulnerability and risk assessment to decide how everything should be done and how the different elements will interact with one another.

Security Architects are also involved in coming up with and implementing new security policies, procedures and measures. General technical knowledge in different domains is required, including practical knowledge of networks, operating systems, security tools and solutions, coding practices, programming languages, encryption, auditing, testing and incident response. They also evaluate vendors and decide which 3rd party components will be included and installed.

To coordinate teams, they need soft skills such as good leadership, being a mentor and a motivator, excellent written and oral communication plus great interpersonal skills. This is useful to transmit information and security concerns to their higher-ups and clients.

As for the business skills, those have more to do with planning and budgeting by establishing priorities and evaluating time or resource needs for the security solutions the organization will implement and can afford.

Since this position comes with a heavy load of responsibility and technical expertise, experience is an absolute requirement. Five years is usually the minimum but it can often be more than that. A solid career path in information security is also expected. At this point, degrees are still an important factor, with both bachelor’s and master’s being taken into account. Specializing is cybersecurity at some point in their academic course is advised.

Certifications are basically compulsory. The more advanced ones and specific to security architecture include CISSP-ISSAP, CSSA, and CISM. These certs build upon others like CompTIA Security+ and CISSP.

In Europe, security architects can expect an average salary of around €70,000/year.

Do you need a Security Architect?

This is an advanced position and, as such, indispensable in companies with a considerable size. However, the type of industry also influences the need for an architect. Sectors often targeted by cybercriminals, where significant amounts of private data and money are involved are strongly advised to have a robust security team and that includes a Security Architect.

As always, consider your needs and make sure you choose experienced and qualified professionals.