SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillsenterprise-security-architect

enterprise-security-architect

Security & auditing

View repository

Updated 10-16 04:57

About this skill

Enterprise Security Architect

When to Use

  • Define enterprise security reference architecture — domains, layers, trust boundaries, patterns catalog
  • Harmonize security domains — identity, data, application, network, endpoint, operations
  • Design zero-trust and segmentation — identity-centric access, micro-segmentation, east-west controls
  • Map control frameworks — NIST CSF, ISO 27001 Annex A, CIS, SOC 2 to architecture building blocks
  • Integrate security with enterprise architecture (EA) — capability maps, standards, exception process
  • Align architecture with risk appetite — control tiers, compensating controls, treatment themes
  • Publish BU and acquisition standards — mandatory patterns, integration playbooks, sunset rules
  • Run security architecture review — ARB criteria, threat-informed design gates, pattern exceptions
  • Prepare architecture executive briefings — standards adoption, zero-trust roadmap, pattern gaps, acquisition integration (not CISO program KRIs)

When NOT to Use

  • Multi-BU cloud landing zones, CCoE, EA commits, regulated cloud placement, cloud guardrail catalog → enterprise-cloud-architect
  • Single-product or single-account cloud target design → cloud-architect
  • Implement SCPs, CSPM rules, cloud IAM policies, KMS wiring → cloud-security-engineer
  • Deploy SSO connectors, SIEM pipelines, EDR, hardening runbooks → information-security-engineer
  • Build risk registers, inherent/residual scoring, FAIR estimates → security-risk-analyst
  • Entitlement modeling, access reviews, PAM vault configuration → iam-specialist
  • GRC program scope, audit prep, questionnaire packs → compliance-specialist
  • Automate control evidence from IdP, CI/CD, CSPM → compliance-engineer
  • CI SAST/SBOM, pipeline scan gates, artifact signing only → devsecops
  • Security program strategy, policies, vuln/IR program, pentest governance → cybersecurity
  • Board program briefings, risk appetite, KRIs, crisis comms → chief-information-security-officer
  • Product/service ADRs, C4 models, strangler migrations → senior-system-architecture
  • Infrastructure capex portfolio and facility supply chain → vp-of-infrastructure

Related skills

Need Skill
Enterprise cloud governance and landing zones enterprise-cloud-architect
Product or account cloud architecture cloud-architect
Cloud guardrails, CSPM, cloud IAM implementation cloud-security-engineer
Control deployment, SIEM/EDR, secrets, hardening information-security-engineer
Risk registers, scoring, treatment decisions security-risk-analyst
IAM lifecycle, RBAC, federation, PAM detail iam-specialist
GRC program, audits, framework scope compliance-specialist
Technical control evidence automation compliance-engineer
Secure SDLC pipeline implementation devsecops
Security program strategy and policies cybersecurity
CISO board narrative, risk appetite, program ops chief-information-security-officer
Cross-service ADRs and integration architecture senior-system-architecture
Infrastructure portfolio and executive infra narrative vp-of-infrastructure

Core Workflows

1. Define scope and operating model

Clarify enterprise vs federated ownership, ARB authority, and mandatory vs recommended controls.

See references/enterprise_security_architect_scope.md.

2. Publish reference architecture

Layered model, domain map, pattern catalog, and integration points to EA.

See references/security_reference_architecture.md.

3. Design identity, data, and zero trust

Identity-centric access, data protection tiers, segmentation, and ZTNA/SASE alignment.

See references/identity_data_and_zero_trust.md.

4. Standardize application and integration security

Secure SDLC gates, API/B2B patterns, secrets, and third-party integration standards.

See references/application_and_integration_security.md.

5. Map governance, frameworks, and controls

Map frameworks to architecture blocks; define control tiers and exception lifecycle.

See references/governance_frameworks_and_controls.md.

6. Brief executives on architecture posture

Architecture packs for board/CISO: standards adoption, KPIs, investment cases, acquisition integration (program KRIs → chief-information-security-officer).

See references/executive_security_architecture_briefings.md.

7. Integrate acquisitions and new BUs

Apply assimilation playbook — identity, logging, segmentation, mandatory patterns by day 1/30/90.

See references/enterprise_security_architect_scope.md (M&A stakeholders) and references/executive_security_architecture_briefings.md (acquisition summaries).

Outputs

  • Enterprise security reference architecture — domains, layers, trust zones, pattern catalog
  • Zero-trust roadmap — phases, dependencies, identity and segmentation milestones
  • Control-to-architecture matrix — framework clauses mapped to building blocks and evidence owners
  • Security standards catalog — mandatory, recommended, deprecated; BU adoption checklist
  • ARB/security review checklist — threat-informed gates, exception template with expiry
  • Acquisition integration playbook — identity, logging, data, network assimilation steps
  • Executive briefing deck outline — posture, top gaps, investments, measurable outcomes

Principles

  • Architecture before tooling — patterns and control intent precede vendor selection
  • Identity is the perimeter — authenticate, authorize, and continuously validate every access path
  • Defense in depth by domain — no single control family carries the entire risk
  • Measurable standards — every mandatory pattern has a validation method and owner
  • Federation with guardrails — central standards, local delivery within approved patterns
  • Risk-informed exceptions — time-bound, logged, tied to residual risk acceptance
  • Patterns before implementation — information-security-engineer and cloud-security-engineer deploy; this skill defines intent and standards