1] Security Architect role

Business requires Security Architects (SAs) to deliver secure solutions and services that securely support activities such as increased profits and productivity, improved customer service, innovation, and faster time-to-market for new products and services .

Following is the definition of Solution Architect according to Forrester

"The technical role responsible for ensuring that business solution designs meet security and compliance requirements. The SA works with stakeholders across the organization to securely implement the functional requirements of the business plan. The SA is the technical authority for the information security architecture within the organization. "

Business and Technical Skills for Security Architects

1] Risk Management

Identifying and communicating risk education, managing risk impacts associated with specific business solutions is a core competency of SA.
Mitigate Risk - Once business leaders have made a decision on a proposed solution or course of action, it is the SA's responsibility to design a secure solution that balances functional needs with security and compliance requirements.

2] Architecture and Threat Modeling

Architectural capabilities for the "extended enterprise" - Due to the explosion of mobile business and the rise of cloud services, the business processes of the extended enterprise are rarely, if ever, isolated within the four walls of the company. In today's extended enterprise, successful SAs must possess core security knowledge, as well as internal and external knowledge of API-driven application environments and federated identities.
The ability to think like an attacker - threat modeling is the process of identifying threats and vulnerabilities in a system and finding ways to exploit them.

Non-Technical Skills for Security Architects

Have strong writing and presentation skills - SAs must be able to communicate with all levels of the organization
Negotiation, Persuasion and Influencing Skills – This is especially true in organizations that do not have a compliance mandate requiring a specific course of action. In this case, influencing the decision is much harder and requires more skill

organizational structure

The relationship between Security Architecture and Enterprise Architecture (EA) is very important. EA Group helps create a business-centric enterprise architecture that links strategy and technology. Security has to be part of EA. Regardless of the organizational structure, the security architect should work closely with the enterprise architect and the chief information security office. See Fig. for more details.

figure 1

2] Information Security Architect

The role of an information security architect requires business insight, technical acumen, and the ability to think, communicate, and write at different levels of abstraction.

roles and responsibilities

Work closely with Enterprise Architects, other functional area architects and security experts to ensure adequate security solutions are in place across all IT systems and platforms to adequately mitigate identified risks and meet business objectives and regulatory requirements.
Develop the business, information, and technical components that make up enterprise information security architectures and solutions.
Serve as a security expert in application development, database design, networking, and/or platform (operating system) work, helping project teams comply with corporate and IT security policies, industry regulations, and best practices.
Contributes to the alignment of Security Governance with EA Governance, Project and Portfolio Management (PPM).
Research, design, and advocate for new technologies, architectures, and security products to support the security needs of the enterprise and its customers, business partners, and suppliers.
Contributes to the development and maintenance of an information security strategy.
Evaluate and develop security solutions against approved security architectures. Analyze business impact and risk based on emerging security threats, vulnerabilities and risks.
Communicate security risks and solutions to business partners and IT staff.

3] Chief Information Security Officer

The CISO is responsible for establishing and maintaining a company-wide information security management program to ensure that information assets are adequately protected. This role is responsible for identifying, assessing and reporting on information security risks in a manner consistent with compliance and regulatory requirements, and in line with and supporting the enterprise's risk posture. The CISO position requires a visionary leader with a solid knowledge of business management and a working knowledge of information security technologies. The CISO will proactively work with the business to implement practices consistent with the stated policies and standards for information security.

responsibility

Develop, implement and monitor a strategic, comprehensive enterprise information security and IT risk management program to ensure the integrity, confidentiality and availability of information owned, controlled or processed by the organization.
Manage the enterprise's information security organization, including direct reporting and indirect reporting (such as individuals in business continuity and IT operations). This includes recruitment, training, staff development, performance management and annual performance reviews.
Promote information security governance by implementing a hierarchical governance plan, including the establishment of an information security steering or advisory committee.
Develop, maintain and publish up-to-date information security policies, standards and guidelines. Oversee the approval, training and dissemination of security policies and practices.
Create, communicate and implement a risk-based supplier risk management process, including assessing and addressing potential risks from partners, consultants and other service providers.
Develop and manage information security budgets and monitor variances.
Create and manage an information security and risk management awareness training program for all employees, contractors and approved system users.
Work directly with the business to facilitate the IT risk assessment and risk management process, and work with stakeholders across the enterprise to determine acceptable levels of residual risk.
Regularly report to the enterprise risk team, senior business leadership, and the board of directors on the status of the information security program as part of the enterprise risk management strategic plan.
Establish a framework for roles and responsibilities for information ownership, classification, accountability and protection.
Develop and enhance an information security management framework based on, if one exists or is identified, plugged into it.
Provide strategic risk guidance for IT projects, including assessment and recommendations of technical controls.
Liaise with the enterprise architecture team to ensure alignment between the security architecture and the enterprise architecture, thereby coordinating the strategic planning implicit in those architectures.
Coordinate information security and risk management projects with resources from the IT organization and business unit teams.
Create and manage a unified, flexible control framework to integrate and standardize the diverse and ever-changing requirements arising from global laws, standards and regulations.
Ensure security programs comply with relevant laws, regulations and policies to minimize or eliminate risks and audit findings.
Liaise with the Information Security team and Corporate Compliance, Audit, Legal and Human Resource management teams as needed.
Define and facilitate the information security risk assessment process, including reporting and monitoring efforts to address negative findings.
Manage security incidents and incidents to protect corporate IT assets, including intellectual property, regulated data, and corporate reputation.
Monitors emerging threats within the external threat environment and advises relevant stakeholders on appropriate courses of action.
Liaise with external agencies such as law enforcement and other advisory bodies as necessary to ensure that the organization maintains a strong security posture.
Coordinates the use of external resources involved in the information security program, including but not limited to interviewing, negotiating contracts and fees, and managing external resources.

4] Information Security Analyst

Information security analysts are senior members of the information security team and work closely with other team members to develop and implement a comprehensive information security plan. This includes defining security policies, procedures and standards. Security analysts work with IT to select and deploy technical controls to meet specific security needs, and to define processes and standards to ensure that secure configurations are maintained.

Collaborate with business units and other risk functions to identify security requirements using a methodology that may include risk and business impact assessments. Components of this campaign include, but are not limited to:
¨ Business system analysis.
¨ Communicate, facilitate and build consensus.
Assist in coordinating and completing information security operations documentation.
Collaborate with Information Security leadership to develop strategies and plans to enforce security requirements and address identified risks.
Report residual risks, vulnerabilities, and other security risks, including misuse of information assets and breaches, to management.
Act as a consultant on application development or acquisition projects to assess security needs and controls and ensure that security controls are implemented as planned.
Collaborate on critical IT projects to ensure security issues are addressed throughout the project lifecycle.
Work with IT and Information Security team members to identify, select, and implement technical controls.
Develop security processes and procedures and support service level agreements (SLAs) to ensure security controls are managed and maintained.
Advises security administrators on normal and exception-based handling of security authorization requests.
Research, evaluate, and recommend information security-related hardware and software, including developing a business case for security investments.

This article: https://architect.pub/security-architecture-team
Discussion: Knowledge Planet [Chief Architect Circle] or add WeChat trumpet [ca_cto] or add QQ group [792862318]
No public	【jiagoushipro】【Super Architect】 Brilliant graphic and detailed explanation of architecture methodology, architecture practice, technical principles, and technical trends. We are waiting for you, please scan and pay attention.
WeChat trumpet	[ca_cea] 50,000-person community, discussing: enterprise architecture, cloud computing, big data, data science, Internet of Things, artificial intelligence, security, full-stack development, DevOps, digitalization.
QQ group	[285069459] In-depth exchange of enterprise architecture, business architecture, application architecture, data architecture, technical architecture, integration architecture, security architecture. And various emerging technologies such as big data, cloud computing, Internet of Things, artificial intelligence, etc. Join the QQ group to share valuable reports and dry goods.
video number	[Super Architect] Quickly understand the basic concepts, models, methods, and experiences related to architecture in 1 minute. 1 minute a day, the structure is familiar.
knowledge planet	[Chief Architect Circle] Ask big names, get in touch with them, or get private information sharing.
Himalayas	[Super Architect] Learn about the latest black technology information and architecture experience on the road or in the car.	[Intelligent moments, Mr. Architecture will talk to you about black technology]
knowledge planet	Meet more friends, workplace and technical chat.	Knowledge Planet【Workplace and Technology】
LinkedIn	Harry	https://www.linkedin.com/in/architect-harry/
LinkedIn group	LinkedIn Architecture Group	https://www.linkedin.com/groups/14209750/
Weibo‍‍	【Super Architect】	smart moment‍
Bilibili	【Super Architect】
Tik Tok	【cea_cio】Super Architect
quick worker	【cea_cio_cto】Super Architect
little red book	[cea_csa_cto] Super Architect
website	CIO (Chief Information Officer)	https://cio.ceo
website	CIOs, CTOs and CDOs	https://cioctocdo.com
website	Architect practical sharing	https://architect.pub
website	Programmer cloud development sharing	https://pgmr.cloud
website	Chief Architect Community	https://jiagoushi.pro
website	Application development and development platform	https://apaas.dev
website	Development Information Network	https://xinxi.dev
website	super architect	https://jiagou.dev
website	Enterprise technical training	https://peixun.dev
website	Programmer's Book	https://pgmr.pub
website	developer chat	https://blog.developer.chat
website	CPO Collection	https://cpo.work
website	chief security officer	https://cso.pub ‍
website	CIO cool	https://cio.cool
website	CDO information	https://cdo.fyi
website	CXO information	https://cxo.pub

Thank you for your attention, forwarding, likes and watching.

"Enterprise Security Architecture" EA874: Enterprise Security Architecture Team