Chapter 21 opens Part V: Competence and Career. The earlier parts described what the transformed security architect does; this chapter asks what a person must be able to do to hold the role, and how anyone, the person included, can tell. It gives a competence framework kept as code, with six domains, four levels from Foundation to Expert, and for each competence the evidence that demonstrates it in practice rather than the certificate that claims it. It maps the framework to ECSF, SFIA 9 and NICE, and shows what a competence record may contain and how it connects to the role charter of Chapter 4.
The chapter concerns all four shifts. Shift 1, from documents to code makes the framework and the records versioned artefacts. Shift 2, from gatekeeper to boundary designer moves the centre of the design domain to designing boundaries. Shift 3, from periodic to continuous, at machine speed puts machine-speed defence into the adversary domain. Shift 4, from sole author to conductor of an AI team creates the AI domain and changes how every domain is evidenced, because when AI drafts much of the visible work, that work no longer shows who could have done it.
Most organisations describe the security architect through a job description, a grading decision, preferred certifications and the informal judgement of colleagues. None of these answers the question this book takes up from AI Governance, Chapter 14: how competence is evidenced when AI does much of the visible work and certificates measure knowledge rather than judgement (162, Nordqvist, 2026).
Primary topics explored
- Why a framework, and why as code
- Six domains
- Levels
- Evidence of competence
- Mapping to ECSF, SFIA and NICE
- Competence records as personal data
About The Transformed Security Architect
The Transformed Security Architect is Book 6 of The Transformed Architecture. It describes how the security architect role is transformed when architecture is code, when AI drafts and acts, and when adversaries move at machine speed: the craft, the architect's own AI team, the role in the organisation, the competences and the career, for European enterprises and public authorities.
It builds on the conclusions of Architecture as Code, AI Governance, AI Platform and Security, AI Red Team and AI Threat.
Security architects, CISOs and heads of security architecture, enterprise, solution and AI architects, engineering leads, competence and hiring leads, procurement and programme leaders, and risk, compliance and audit.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 21: Competences of the Transformed Security Architect: A Framework in The Transformed Security Architect gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “Competence and Career” and is one of 31 drawn from the manuscript.