The security architect never works alone, even in an organisation that employs only one. Every boundary the architect designs is built by one team, run by another and answered for by a third, and it holds only as far as those neighbours know it and can act on it. This chapter places the role among the CISO, the enterprise architect, the AI architect, the platform and product teams, risk, audit and the roles the usage modes have created; it uses Team Topologies and Conway's law to explain where the role can sit, settles the seams that AI systems have opened and ends with a responsibility assignment for decisions that cross roles. It concerns Shift 2, from gatekeeper to boundary designer, because a boundary designer needs written, shared decision rights, and Shift 4, from sole author to conductor of an AI team, because the architect's own agents join the map as tools without decision rights. Forums and gates belong to Chapter 17.
Chapter 4 wrote the mandate as a role charter, but a charter cannot say what happens at the edge of the role, because the edge is shared. The European Cybersecurity Skills Framework keeps its Cybersecurity Architect profile separate from the CISO's (40, ENISA, 2022), and the NICE Framework describes security architecture as a work role with its own tasks and skills (33, Petersen et al., 2020); however, neither says who decides when two roles disagree. Fowler (2003) locates the architect's value in identifying the important decisions (71, Fowler, 2003), and Hohpe (2020) has the architect riding the elevator between strategy and the engine room (72, Hohpe, 2020).
The CISO owns the security risk strategy and answers upward for it. Under Article 20 of NIS 2, management bodies approve the cybersecurity risk-management measures, oversee their implementation, can be held liable and must follow training (6, European Union, 2022); DORA Article 5 places the same responsibility on a financial entity's management body, and Article 6 requires a documented, reviewed ICT risk-management framework (9, European Union, 2022). ISO/IEC 27001 clause 5.3 expects top management to assign the responsibilities and authorities of security roles (23, ISO/IEC, 2022). Therefore someone must show how those duties are discharged in design, and the CISO and the architect do that together (Chapters 18 and 19).
Primary topics explored
- A role among roles
- The CISO and the security architect
- The enterprise architect and the AI architect
- Platform and product teams
- Enabling, embedded or platform
- Conway's law and boundaries
About The Transformed Security Architect
The Transformed Security Architect is Book 6 of The Transformed Architecture. It describes how the security architect role is transformed when architecture is code, when AI drafts and acts, and when adversaries move at machine speed: the craft, the architect's own AI team, the role in the organisation, the competences and the career, for European enterprises and public authorities.
It builds on the conclusions of Architecture as Code, AI Governance, AI Platform and Security, AI Red Team and AI Threat.
Security architects, CISOs and heads of security architecture, enterprise, solution and AI architects, engineering leads, competence and hiring leads, procurement and programme leaders, and risk, compliance and audit.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 16: The Role Map: CISO, Enterprise Architect, AI Architect, Platform and Product Teams in The Transformed Security Architect gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “The Role in the Organisation” and is one of 31 drawn from the manuscript.