Chapter 21 gave the competence framework: six domains, four levels and the evidence that demonstrates each competence. This chapter describes the journey and its gates: how people reach the role, what they learn and in which order, what a certificate tells an employer, how to hire for judgement, and when to grow a security architect rather than buy one. It concerns Shift 4, from sole author to conductor of an AI team, because the person who conducts an AI team must be able to verify what it proposes, and verification is learned through practice and cannot be bought as a credential. It also concerns Shift 1, from documents to code, because learning paths, hiring profiles, exercises and competence records are artefacts in version control.
The chapter builds on three earlier conclusions. Architecture as Code (Chapter 18) held that certifications validate knowledge while practical demonstration shows capability (161, Nordqvist, 2025). AI Governance, Chapter 14, concluded that AI literacy is role-specific and must be evidenced, that upskilling is the strategy and hiring is for scarce specialisms, and that assessment results are personal data (162, Nordqvist, 2026). AI Threat, Chapters 6 and 14, concluded that reliance on AI reduces effort and checking, and that automating junior work removes the route by which experts are made (165, Nordqvist, 2026), a conclusion that rests on findings such as Lee and colleagues' survey, in which knowledge workers who trusted the AI more reported less critical thinking (109, Lee et al., 2025). Apprenticeship inside a working team stays in Chapter 15.
People reach the role from four directions, and each brings part of the framework and lacks another.
Primary topics explored
- Four starting points
- Learning paths
- Certifications and their limits
- AI literacy for the architect
- Hiring profiles
- Interview exercises
About The Transformed Security Architect
The Transformed Security Architect is Book 6 of The Transformed Architecture. It describes how the security architect role is transformed when architecture is code, when AI drafts and acts, and when adversaries move at machine speed: the craft, the architect's own AI team, the role in the organisation, the competences and the career, for European enterprises and public authorities.
It builds on the conclusions of Architecture as Code, AI Governance, AI Platform and Security, AI Red Team and AI Threat.
Security architects, CISOs and heads of security architecture, enterprise, solution and AI architects, engineering leads, competence and hiring leads, procurement and programme leaders, and risk, compliance and audit.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 22: Learning Paths, Certification, Hiring and Upskilling in The Transformed Security Architect gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “Competence and Career” and is one of 31 drawn from the manuscript.