How To Become a Cyber Security Architect?

This is so that users may safely interact with the information systems and with minimal concern for the loss of data confidentiality, integrity, or availability.

Architects work with executive management, engineers, analysts, and other IT staff members to design and implement the security architecture.

Architects also design and allocate systems to properly manage the enterprise-level security risks.

A security architect also known as: Information Assurance (IA) Architect, Information Security Architect, or Security Solutions Architect.

Whatever the position is called, the role is the same.

Why Security Architecture Is Important to An Organization?

Security architecture provides a framework for the design and implementation of security measures. The architecture is a system of policies, procedures, and controls that define how security will be implemented and maintained within an organization.

Organizations also rely on the security architecture to understand their current security posture so they can make informed decisions about future investments in technology and security.

It’s a complex and strategic process that involves technical and non-technical elements.

What Are the Skills Required for Cyber Security Architect?

A cyber security architect needs to have a broad range of skills to effectively design the security architecture.

The skills required for this role vary depending on roles and responsibilities. However, there are some general security architect skills you’re expected to possess:

Operating Systems and Security Tools

Understand how Windows, MacOS, and Linux/Unix-based operating systems work. Much of the systems infrastructure you’ll be designing, and data collection/security tools your team will be using, are based upon any one of these operating systems as a foundation. And though you may not have access to any of the infrastructure and tools (to maintain a separation of duties), not fully understanding them will become a severe hinderance to your performance.

Coding / Software

Knowing how to code, how software is designed including its use cases and applications, how software interacts with the infrastructure and the vulnerabilities that result. While you won’t be doing any coding on your own, you will be working with a technical security team responsible for the development of the security components and tools that’ll protect your organization’s information systems.

Brush up on your soft skills

Don’t underestimate the importance of soft skills. We’ll talk about additional soft skills below but becoming a security architect requires you to be analytical, detail-oriented, have good research and problem-solving skills, and be able to provide creative solutions. It’s especially vital that you remain open-minded, receptive to new ideas, and willing to lean upon your analysts and engineers to fill in gaps in your knowledge.

Have the right mindset and perspective

Don’t focus on a particular area of the system. This position requires a deep and holistic understanding of entire information infrastructure. You’ll need the vision to creatively design a security solution with the latest and most tested tools and configurations available. This means understanding how the existing infrastructure combined with the security infrastructure will work with each other.

Communicate with your stakeholders

Cyber security architects also need excellent communication skills, both written and verbal, to effectively convey their findings and recommendations to other stakeholders within an organization. It’s vital to translate technical knowledge into a business language that’s easily understood by non-technical people. You may even find yourself in a position to justify some of your decisions to executive leaders based on necessity rather than cost.

Act like a leader

Being a subject matter expert (“SME”), your position lends itself into becoming a leader. This means you’ll also act as the “spokesperson” for your security team. This is especially true, if you’re in a smaller organization where you also act as the highest security team member. At this level, confidence in your abilities and mentoring your team is key!

You’re the one who’s accountable!

As the SME, you’re automatically held to the highest level of accountability. Know the specific details about how the security infrastructure operates. When a security breach occurs, everyone will look to you to understand what has happened. Work with the forensics team to understand how the investigation will proceed. Then determine what actions are needed to mitigate further harm and future security breaches (aka incident response).

Risk and Compliance

The entire reason why your position exists is to reduce organizational risks, which include the risk of security breaches. To reduce this risk, knowing how to read, understand, and implement security controls based on compliance standards such as: NIST SP 800-53, NIST CSF, ISO 27001/2, etc. is crucial. This also means incorporating results of threat models, risk and vulnerability assessments, and any other threats assessments as part of the architecture.

Know the network

This probably goes without saying but as a SME, you must know the design and operation of the entire network infrastructure, the software used to operate the network, as well as the resources and tools used maintain the network.

Working with teammates

Provide that critical link between management and engineering to help turn business requirements into technical design requirements. Get comfortable working across the organization with executive leadership, analysts, engineers, vendors, and other technical team members to help plan and execute the deployments of new systems or updates.

What about the money?

Design the security infrastructure according to the budgetary constraints of the project. If the organization cannot afford the design, development, or maintenance of the security infrastructure, there is a chance the organization may fail to properly operate such infrastructure due to inadequate resources. To design a cost-effective solution agreeable to stakeholders, realize that customers don’t enjoy wasting money, especially when it comes to IT security.

Are project management skills important?

Keep a project on time, under budget, and manage stakeholder needs. If you don’t possess these abilities, you won’t stand a chance of being able to manage large, complex development and deployment processes. If you have little experience in this area, consider senior-level security engineering or systems admin roles with a PMP certification.

Cyber Security Architect Qualifications

Take a look at the basic qualifications needed for a cyber security architect:

How much experience is needed?

The time it takes for you have enough knowledge will always depend on your abilities and your security exposure. Expect to possess a minimum of 5-10 years of experience in information security with the bulk of that time spent as a security engineer, system administrator, or a combination of both. You won’t have the requirements of a security architect with anything less.

What do I need exposure to?

As an architect, maintain a wide variety of exposure to networking and security roles. Coding, networking, development, security, etc. are all pieces of what it takes to become an IT security architect. Take every opportunity to gain exposure in different roles even if that means occasionally switching jobs.

Security Architect Certification Path

Security Certification: A security architect certification doesn’t imply that you’re an expert, but it does help employers understand the minimum level of knowledge you possess. Once you reach this level the Security+ cert isn’t good enough; most employers will look for the following certifications:

Certified Information Systems Security Professional by ISC2 (CISSP)
Information Systems Security Architecture Professional by ISC2 (CISSP-ISSAP)
Certified Information Security Manager by ISACA (CISM)
GIAC Security Expert (GSE)
GIAC Defensible Security Architecture (GDSA)
CompTIA Advanced Security Practitioner (CASP+)

Keep in the mind that the choice of certification is less relevant than the actual knowledge you possess.

If you possess at least one of these certs, you should be fine; although if you have the CISM, it might be a good idea to get one more as it’s slightly less technical in nature.

Enterprise Architecture Framework: In addition to the security certification, it’s a good idea to also obtain an architectural framework certification to showcase your foundational knowledge of architectural design. Each framework differs in its approach or area of specialization. SABSA is a highly recommended enterprise security architecture framework but research which framework works for you. Here’s a non-exhaustive list of frameworks; however, this should help you to get a head start.

The Open Group Architectural Framework(TOGAF)
Sherwood Applied Business Security Architecture(SABSA)
Department of Defense Architectural Framework(DoDAF)
Zachman

What Does a Cyber Security Architect Do?

Security architects generally blend execution and management.

You’ll still be heavily involved in the technical aspects of the job, but you’re not always the person performing the implementation (no scripting, troubleshooting, server setups, etc).

Other teams will worry about the technical challenges of deploying the solution. You must know the specific challenges they face and develop solutions to overcome them.

In smaller organizations, the security architect responsibilities are slightly less defined, and you’re likely to have multiple responsibilities.

You may find that your duties range from cyber strategy, generally reserved for Cyber Security Directors or CISOs, to cyber development and integration, usually performed by security engineers.

In larger organizations, the position is much more defined because the information systems are highly scaled and much more complex. You may have several security architects, each responsible for their own areas of specialization such as: cloud security architect, data security architect, network security architect, etc.

Research & Strategy

As part of implementing any new or updated infrastructure, you’ll need to evaluate the business requirements, resource constraints, security technology, and threat landscape to determine a solution that will work best for the organization. Due to the evolving threat landscape, keep yourself updated with the latest knowledge. By understanding having this knowledge in the background, you’re able to offer employers and clients with the most technologically sound and cost-effective solutions.

Document everything

At the onset of any new implementation, you’ll participate in design or structural change-related activities. Heavy amounts of documentation (drawing, reading, writing, reviewing, and approving) are expected at nearly every point of the design lifecycle.

The image below should give you a brief understanding of the types of documentation required to implement a successful security architecture.

Content Metamodel Overview — *Source: The Open Group, L.L.C.*

Implementation & Test

Security solutions sometimes presents a challenge (or aren’t usable at all) and require a modification to the environment. As such, you’ll work directly with the security team, engineers, and analysts throughout the development process. These team members will work with you to implement and test these modifications.

Attend project reviews

Project meetings and reviews to discuss strategy, documentation, and implementation occur daily. During this time, you’ll provide guidance on all security-related matters. Expect to spend time reviewing the security architecture with stakeholders, vendors, and engineering teams to explain technical details.

How Much Does a Cyber Security Architect Make?

Considering the salary displayed by the following websites, the average salary of a security architect is around $135k ($65/hour).

Keep in mind, this is this the medium value, the upper and lower range can vary significantly.

Salary.com: $141,000 or $68/hour
PayScale: $131,000 or $63/hour
ZipRecruiter: $146,000 or $70/hour
Glassdoor: $120,000 or $58/hour

Do I Need a Degree for Cyber Security?

Yes, because you’re now the SME, your looked upon as the expert by most employers. Employers want to ensure the architect being hired is fully capable of taking on the responsibilities of this role and have the academic background to prove it.

Therefore, having a bachelor’s degree is a minimum requirement at this level. While it’s difficult to find a “security architect” degree, you can research several alternatives to get your foot in the door:

Information Technology (with a concentration in security, administration, or development)
Network Administration
System Administration
Computer Science
Computer Engineering
Network Engineering
Software Engineering
Cyber Security
Information Security

Cyber Security Engineer Vs Cyber Security Architect

Security engineers and architects, though highly skilled, have very different roles.

Cyber security engineers work to ensure the safety of a company’s information systems from a technical aspect.
They implement solutions, developed by the architect, by applying their knowledge of computer science and engineering. A cyber security engineer develops, troubleshoots, manages and maintains various information systems in order to keep them secure.

Cyber security architects focus on the business aspects of security by designing the overall security architecture to withstand an attack. While there is a heavy technical component to this role, it’s more managerial in nature.
A cyber security engineer does not need to have a background in business or management, although it can help, but a cyber security architect must understand these topics before entering this role.

How to Become a Security Architect?

Look at the steps below to help you get started on your security architect career path:

Determine what line of security architect do you prefer? Interested in application-based security, or more infrastructure-based security? Do some research into the requirements and responsibilities of job descriptions that match those interests.
Explore the two separate routes to become a security architect: Security Engineer or System Administrator. Determine how to can obtain one of these positions; either one is fine if you can stick with it. Expect to spend around four to five years in this line of work.
If you’re a security engineer or system administrator, don’t stick with your current set of responsibilities for too long. You’ll need a broad amount of experience while you’re here so seek out opportunities to learn new things. If you’re finding that difficult, start looking for jobs that do allow you to grow. In the meantime, start really working on those soft skills.
Study for the security certifications and architectural frameworks that will help you learn the necessities of becoming a security architect. Passing these certifications shows employers you’re technically qualified to move toward a higher role.
If you have the time and resources, you might consider getting your MBA. It’ll teach you some of the business aspects of becoming a security architect and looks great on your resume. Some MBAs offer concentrations in IT or information systems which is even more beneficial.

Can I Take a Security Architect Training Course?

Yes, you can take a security architect course but be warned!

It isn’t a substitute for the experience and the exposure requirements discussed above.

Because a security architect position is not an entry-level position, I was able to find only two security architect bootcamps provided by Udacity and SANS.

Fair warning, the SANS course is a prep course specifically designed to help pass the GIAC Defensible Security Architecture (GDSA) exam, but it’s still an option to think about.

Interested in More…

Cyber Security vs Computer Science: Know the Difference!
What Is the Best Job in Cyber Security?
The Best Method to Become a Security Auditor!
Wondering How to Be a SOC Analyst?

Author

Amit Doshi

Driven by a vision to bridge the cybersecurity talent gap, I’m dedicated to fostering a community where budding enthusiasts and seasoned experts come together. Join me in building a network where we collaborate, learn, and fortify the digital frontier together.
View all posts

Table of Contents

What Is a Cyber Security Architect?