The rise of the Security Architect... Over the past 12 months (across Architecture vacancies) it’s been our most requested role to support on and we’ve helped to hire 3 alone in the past 3 months Most people say their challenge in recruiting these roles is because of salary expectations of Security Architects, but I don’t think that’s the main reason. I think it’s a supply issue, and the huge surge in demand So I did some digging and thought I’d share… - There are currently more Security Architect roles advertised than there are Security Architects that changed jobs last year… - Targeting Linkedin, there’s only a talent pool of sub 1500 people. Less than 8% of which are female. - The average tenure of a Security Architect is 1.9 years (I think that’s low compared to other Architecture roles because companies are putting together attractive packages to entice people away from their current companies) - Gas, Energy, Rail and Financial Services Organisations are the ones that have been making the lion’s share of hiring in this space With the number of companies seeking to appoint in this domain, I only think it’s going to get harder, but from a candidate point of view, a fantastic low supply, high demand market. + Be prepared for the interesting conversation of should the Sec Arch report into the CISO or Head of Architecture (or Head of Security Architecture in larger enterprises).
Tom, I've observed that in the financial services sector, architects have traditionally incorporated software security into their responsibilities. Over the last two decades, my role has involved making pivotal security decisions concerning Single Sign-On (SSO), IAM, biometrics, device profiling, step-up processing, and the safeguarding of PII through encryption and tokenization, and VCPs in cloud deployments. In addition to my core responsibilities, I've led efforts in fraud detection for the past two years, enriching my expertise in cybersecurity, fraud prevention, AML, and KYC protocols. The trend of segregating CISO and security architect roles has only become pronounced in the last five years. To address the talent gap, I propose that companies should seek out seasoned architects with extensive backgrounds similar to mine, coupled with a track record of success. Such professionals can be onboarded and trained in specialized security roles. I am confident that an architect with two decades of experience can swiftly adapt to these roles, and their application and delivery skills will significantly enhance the value they bring to the CISO domain within an organization, while also minimizing delivery risks.
Cloud adoption is rife with risk. It's amazing how a good old fashioned outage, or hack, bring us network and security architects back in vogue!
Very fair point, Tom.
ASc | CISSP | CISM | CCSP | CCSK | Network+ | MCP | MTA | NSE1 | NSE2 | NSE3 | ACE | 100W - OPSEC | Trustee | AZ900 | SC900 | P.I. | (***I am not a purchasing authority***)
5moI've been in an architectural role for about 5 years (with a short stint as a director/architect hybrid role). Depending on the organization security architect roles are broad, require a lot of width with depth in a handful of areas. Architects have to be able to communicate to business needs and strategy while being technical but not to a point where we lose the less technical. We should comprehend technology and communicate with highly technical experts. We also need to be able to understand how technologies interconnect, communicate, and should be secured. This all while understanding the many facets of governance, regulatory compliance, privacy, and risk. This usually requires upwards of 10-15 years of hands on technical experience across numerous domains, and some or a fair amount in a lead technical expert or subject matter expert role. We often report to senior leadership, have much tighter deadlines, and have a publicly visible side for promotion of the business. Yes the demand is very high, requirements are very high, and keeping architects can be a challenge.