The security architect existed, and was valued, before any of the shifts this book describes. The role grew out of information-security management and network design, took its frame from ISO/IEC 27001, SABSA and TOGAF, and worked through risk registers, layered design documents, reference architectures, review boards and signatures. Those methods were not mistakes. They answered the conditions of their time: a few hundred systems, quarterly releases, a defined perimeter, suppliers who delivered products rather than services, and adversaries who worked at human speed. This chapter describes the practice fairly, says why it was valuable and shows where it stopped scaling, so that later chapters can keep what was right and replace only what no longer works.
The chapter concerns all four shifts, because it describes the baseline from which each departs: documents, which Shift 1, from documents to code, replaces with versioned artefacts; the gate, which Shift 2, from gatekeeper to boundary designer, replaces with boundaries that hold whatever anyone intends; the annual and quarterly rhythm, which Shift 3, from periodic to continuous, at machine speed, replaces with verified properties; and the architect as sole author, the starting point of Shift 4, from sole author to conductor of an AI team.
Security architecture became a distinct role where two routes met: the information-security officer, who needed policy translated into buildable designs, and network design, where security was a concern of the people who designed firewalls, zones and remote access before it became their title. The security architect sat close enough to policy to know what the organisation had promised and close enough to engineering to know what could be built.
Primary topics explored
- Where the role came from
- Risk-based security management
- Layered, business-driven design
- Review boards and sign-off
- Reference architectures as documents
- The department of no
About The Transformed Security Architect
The Transformed Security Architect is Book 6 of The Transformed Architecture. It describes how the security architect role is transformed when architecture is code, when AI drafts and acts, and when adversaries move at machine speed: the craft, the architect's own AI team, the role in the organisation, the competences and the career, for European enterprises and public authorities.
It builds on the conclusions of Architecture as Code, AI Governance, AI Platform and Security, AI Red Team and AI Threat.
Security architects, CISOs and heads of security architecture, enterprise, solution and AI architects, engineering leads, competence and hiring leads, procurement and programme leaders, and risk, compliance and audit.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 2: What the Security Architect Did: The Role Before the Transformation in The Transformed Security Architect gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “The Role in Question” and is one of 31 drawn from the manuscript.