Security Architect

Role Purpose:

The Security Architect applies the organization's Secure by Design (SbD) framework to assigned IT

projects, from initiation to go-live, with guidance and review from the Senior Security Architect.

The role works with project leads, solution architects and project managers, and coordinates with

the Privacy, SOC, Vulnerability Management and Cyber Assurance teams. A key part of the role is

doing assurance checks directly to confirm that security controls are in place before go-live.

Key Responsibilities:

1. Secure by Design delivery

• Act as the security point of contact for assigned projects, typically lower and medium-risk

projects, and support the Senior Security Architect on high-risk projects.

• Help project proponents raise SbD requests and complete service profiling.

• Draft security requirements using the controls matrix, requirements catalog and templates.

• Review HLD and LLD documents for security, and raise issues for follow-up. Escalate complex

or disputed design issues to the Senior Security Architect.

• Support threat modelling and prepare threat model documentation.

• Prepare gate endorsement recommendations and evidence for review by the Senior Security

Architect.

2. Assurance checks

• Check that agreed security controls are actually in place before go-live, using one or more of

these methods:

– Screen-share walkthroughs with the system owner or vendor.

– Logging in to the solution directly with read-only or reviewer access.

– Reviewing screenshots and configuration evidence provided by the project team.

• Typical checks include SSO and MFA through Microsoft Entra ID, role-based access, admin

access controls, encryption, logging to Microsoft Sentinel, and backup settings.

• Record the result of each check with evidence, and note any gap or deviation from the endorsed

design.

3. Coordination with Information Security teams

• Privacy team. Collect privacy controls and requirements from the Privacy team and add them

to the project's requirements.

• SOC team. Identify log sources for Microsoft Sentinel and draft abuse cases for the SOC to

build detections.

• Vulnerability Management team. Request SAST, SCA and DAST scans and track remediation of

findings with the project team.

• Penetration testing and Cyber Assurance team. Arrange SaaS assurance checks and onpremises penetration tests before go-live, and follow up on findings.

• Keep the project lead, solution architect or project manager updated on what each team needs

and what is outstanding.

4. Risk assessment and risk register

• Run risk assessments for assigned projects using the standard templates, with review from the

Senior Security Architect.

• Draft risk register entries with a proposed risk rating, recommended controls and risk owner.

The Senior Security Architect reviews entries before they are finalized.

• Track treatment actions and update the register as risks are closed or accepted.

5. Practice support

• Use the team's templates, patterns and controls matrix, and suggest improvements based on

project experience.

• Support CAB change reviews and vendor security questionnaires when assigned.

Support and Development

The Security Architect will receive regular guidance from the Senior Security Architect, including

review of deliverables, joint sessions on complex projects and coaching on risk assessment and

stakeholder engagement. The role is expected to take on more complex projects with less

supervision over time.

Required Qualifications:

• Bachelor's degree in Computer Science, Information Security, Engineering or a related field.

• 3 to 5 years of information security experience, such as security engineering, security

operations, vulnerability management, GRC or security architecture.

• Working knowledge of NCA ECC, CCC and PDPL.

• Hands-on familiarity with cloud or SaaS platforms and Microsoft Entra ID.

Preferred

• A security certification such as CISSP, CISM, or an associate-level equivalent, or progress

toward one.

• Exposure to Microsoft Sentinel, SAST, DAST or SCA tools.

Technical Knowledge

• Identity and access management: SSO, MFA, role-based access and privileged access.

• Network security basics: segmentation, firewalls and web application firewalls.

• Cloud and SaaS security configuration.

• Logging and monitoring concepts and SIEM use cases.

• Vulnerability scanning and secure development basics.

Skills and Behavior's:

• Methodical and evidence-focused when checking controls.

• Communicates clearly with technical teams, vendors and business owners.

• Knows when to escalate and asks for help early.

• Manages several projects at once and keeps trackers up to date.

• Keen to learn and to grow into a senior role.