Senior Security Architect

The Senior Security Architect is the security subject matter expert on assigned IT projects, from

initiation to go-live. The role applies the organization's Secure by Design (SbD) framework so that

security is built into solutions.

The role is the single security point of contact for the project lead, solution architect and project

manager. It gathers inputs from the other Information Security teams (Privacy, SOC, Vulnerability

Management and Cyber Assurance), passes them to the project, and makes sure their outputs are

delivered before go-live. The role also maintains the security architecture practice and mentors the

Security Architect.

• Act as the security SME for each assigned project through every SbD phase: initiation, service profiling, design, build, assurance and go-live approval.
• Engage with project proponents early. Explain the SbD process, help them raise the SbD request and complete service profiling to set the project's risk level.
• Define security requirements for each project from the controls matrix, the requirements catalog, applicable policies and regulations.
• Review high-level and low-level designs (HLD and LLD) for security and alignment with the architecture principles. Raise design issues and follow them up until they are fixed.
• Run threat modelling on new or significantly changed solutions.
• Carry out security architecture assurance: confirm that what was built matches the endorsed design and that all required controls are in place.
• Give security endorsement at project gates (for example, before procurement, before infrastructure build and before go-live), and keep evidence of each decision.

• Broker inputs and outputs. Collect inputs from each team, pass them to the project lead, solution architect or project manager, and track that the outputs are delivered on time.
• Privacy team. Obtain privacy controls and requirements for the solution, including data protection and data sharing requirements, and include them in the project's security requirements.
• SOC team. Identify the log sources the solution must send to Microsoft Sentinel, and define the abuse cases and use cases the SOC needs to build detections and alerts.
• Vulnerability Management team. Make sure solutions are free of open vulnerabilities before go-live, including code scanning (SAST), software composition analysis (SCA) and dynamic testing (DAST) findings. Track remediation of anything raised.
• Penetration testing and Cyber Assurance team. Arrange assurance checks for SaaS solutions and penetration testing for on-premises solutions before go-live. Make sure findings are fixed or risk-assessed.

• Run cyber risk assessments for each project, combining findings from design reviews, threat models, scans, assurance checks and penetration tests.
• Record every finding in the risk register with a risk rating, recommended controls, risk owner and treatment plan.
• Present risks to project stakeholders and decision-makers, and obtain formal risk acceptance at the right authority level where a risk is not treated.
• Track treatment actions until the risk is closed or formally accepted.

• Maintain and improve practice assets: security architecture templates, risk assessment templates, the security controls matrix, the reusable security requirements catalog and the SbD profiling guide.
• Develop and maintain reusable security architecture patterns, such as SaaS and single sign-on (SSO) integration with Microsoft Entra .
• Map controls to regulatory requirements (NCA ECC, CCC and PDPL) and to the organization's security roadmap.
• Identify gaps and inconsistencies in the SbD framework and propose improvements.

• Review changes submitted to the Change Advisory Board (CAB) for security impact and alignment with architecture standards.
• Write security requirements for RFPs, prepare vendor security questions, and evaluate the security sections of vendor proposals.
• Review contracts and data processing agreements for security clauses.

• Mentor the Security Architect on SbD delivery, risk assessment and stakeholder engagement.
• Review the Security Architect's deliverables (requirements, design reviews, assurance evidence and risk entries) before they are issued.
• Act as the escalation point for complex, high-risk or disputed projects.

• Bachelor's…