The work itself
What you would spend time doing
Turn business needs and threats into defensible design decisions. Explain trust boundaries, challenge assumptions and help teams deliver with understood residual risk.
Security architecture
Security Architect
Plan your move from technical delivery into security architecture: progression stages, practical projects, certification choices and evidence of readiness.
Explore the work, check your starting point and try one scoped task before committing to a course or exam.
Try this pathway in practiceThe route
From Senior Security Engineer to Security Architect
- Starting roleSenior Security Engineer
- Target roleSecurity ArchitectRead the broader role guide
A general route, not a personal plan. Linked guides describe the broader role family; a junior or support starting point may have a narrower remit. Compare the responsibilities with the actual vacancy.
Phased progression
Build on your existing experience, demonstrate the next responsibility and review it with the people who rely on your work.
Progress through demonstrated capability and agreed responsibility. These stages are not a fixed timetable or a salary ladder.
Establish your starting point
Engineering judgement
Practical focusBring a system you understand. Map its trust boundaries, data flows and operational constraints; explain the controls and incidents you have worked with.
Something to demonstrateAn annotated system diagram showing data flows and trust boundaries.
In focus System context · Trust boundaries
Make a defensible decision
Design a bounded change
Practical focusThreat-model one proposed change. Compare control options, record the trade-offs and agree residual risk with the accountable owner.
Something to demonstrateA threat model and a decision record explaining the options and accepted risk.
In focus Threat model · Decision record
Validate with delivery teams
Review implementation
Practical focusReview the design with engineers and operations. Test assumptions, capture exceptions and check that the agreed controls can be operated and evidenced.
Something to demonstrateA review record connecting design decisions to tested controls and exceptions.
In focus Design review · Control validation
Broaden responsibility
Guide decisions across systems
Practical focusDevelop reusable patterns, mentor reviewers and revisit decisions when risks change. Discuss the scope and accountability expected of an architect with your organisation.
Something to demonstrateA reusable pattern with its scope, owner and review conditions.
In focus Patterns · Governance
Your starting point
What to bring to this route
Bring examples of delivered systems, control decisions and stakeholder trade-offs. The route generally builds on prior technical or assurance work; a diagram or certification alone cannot establish that experience.
Ask a course provider or employerWhat decision authority does the architect have, and how are unresolved risks escalated and revisited?
The verdict
Security architecture makes design risks, assurance needs and residual risk explicit.
You've owned security delivery across multiple programmes. You enjoy designing for trust boundaries across cloud, on-prem and SaaS.
Diagrams need a path to delivery. Clarify design authority, assessment support and how exceptions and implementation evidence return to the architect.
Certification sequence
Study options, not a checklist. Choose for the work you need to demonstrate, then check the provider’s current requirements and renewal terms.
Primary
Explore these first
Compare the subject with the work you want to do. Check eligibility before committing.
Supporting
For a particular platform or gap
Choose one when its syllabus addresses a gap you need to practise.
- CCSPCloud architecture, data and application security, operations, and legal and risk considerations.
- SABSA
Detailed guide not yet available. Check the issuer's syllabus and entry requirements.
Long-term
As your responsibility grows
Revisit when your scope changes. Experience and renewal requirements still apply.
Practical projects
Produce something you can explain, test and improve with feedback.
A scoped starting exercise
Try the work before choosing the route
Review a fictional service with users, an API and a data store. Draw trust boundaries, identify two credible attack paths and compare two control options against delivery constraints.
What to keepA short design decision record with threats, options, recommendation, assumptions, residual risk and assurance questions.
Free text worksheet · no account needed. Add your checks, results and feedback as you work.
Review the evidence
- Can you explain why the chosen control is proportionate and how its implementation would be verified?
- Have you identified the risk owner and a condition that would cause you to revisit the design?
Label planned, simulated and completed work accurately. A practice exercise helps you test your interest and reasoning; it does not establish production experience or guarantee an interview.
Enterprise ArchitectSecurity ManagerPlatform Security Engineer
- ·GRC-led management track
- ·Platform security from the inside
Realistic expectations
Check these assumptions against the course, vacancy or team you are considering.
Misconception
An architecture title or a senior certification does not show that someone can make and defend design decisions.
Readiness check
Bring a design decision you can explain: the options, the trade-offs, who accepted the risk and how the controls were checked. Match that evidence to the authority the role actually carries.
What this is based on
Editorial route and career guidance. No separate external evidence review is recorded for this assessment.
Editorial evidence review: pending · UK market. Vendor facts and prices elsewhere on this page have their own sources and check dates.
Where this fits