Cybersecurity architecture is a concept, perspective, and end product. Cybersecurity architecture is utilized in the general sense as the overall development of a cybersecurity program. Likewise, cybersecurity architecture refers to the end-product of moving from a logical cybersecurity service to a deployable cybersecurity tool. Cybersecurity architecture is holistic to the enterprise, subsidiaries, business units, and departments to securely enable business. Cybersecurity architects across government, corporate, commercial, and product perspectives require a standardized view of common competencies and tasks. Standardization is a core objective to ensure that cybersecurity architects represent the proper skill sets of their primary focus area and account for niche areas.
Main Purpose
The main purpose of this focus area is to develop a consistent, standardized perspective for skills relevant to enterprise cybersecurity architects across government, corporate, commercial, and product role areas. Document core competencies and tasks common across all types of enterprise cybersecurity architects. Ensure competency areas and tasks are aligned with the NIST NICE Framework and Skills for the Information Age (SFIA). Expand on the NIST NICE Framework, where it falls short in overall competencies and relevance. Integrate the SFIA to provide a well-rounded view.
Capability
When conducting an architecture capability assessment, one part of the process is developing the skills and capability of the architects conducting cybersecurity architecture work efforts. The contained competencies and tasks provide a consistent and standardized view of capability. The competencies provide input to architecture capability assessments. A gap analysis is then generated to determine architecture capability. The gap analysis and capability assessment inform cybersecurity strategy and the cybersecurity program’s target operating model for the training needed to mitigate gaps in capability.
Competency
Competency areas are broken down into areas of commonality that all enterprise cybersecurity architects would need to have as a standardized competency view. The common core competencies provide standardized competency areas consistent across all enterprise architecture roles and functions.
Tasks
Task areas are broken down into areas of commonality that Enterprise cybersecurity architects would be fulfilling as part of day-to-day work efforts. The core task areas provide standardized areas consistent with enterprise architecture roles and functions. Task areas may differ based on the architecture framework, methodology, and practice adopted by an organization’s architecture functions. Tasks are generalized but include or assume TOGAF and SABSA integration.
Cybersecurity architecture types are divided into government, corporate, commercial, and product to differentiate core differences between those who consult and integrate and enterprise cybersecurity architects who design and develop cybersecurity tools and technologies.
One of the critical elements of standardization around competencies and tasks is developing consistent job descriptions and titles. Currently, the variation and variety of job descriptions and titles in the cybersecurity architecture space are immense and inconsistent or not standardized. In addition, there are many odd variations, a lack of understanding of the roles and functions, a misunderstanding of necessary or needed skill sets, or a general misunderstanding of the differences between architects and engineers. Subsequently, this leads to confusion about what the role should be doing or encompass from a skill set perspective. Likewise, hiring managers should not mix engineering and architecture roles and functions. They are not the same and have different focus areas.
The skills, competencies, and tasks are presented in a manner that hiring managers can pull from to develop a consistent set of job descriptions. The premise presented here will help reduce job descriptions and title variations while producing more targeted and appropriate roles and functions within cybersecurity architecture. As a result, companies across industry sectors can standardize their job descriptions, position titles, and position levels. Likewise, hiring managers can develop a skillset and competency view across their teams to define empirically where they have actual skillset shortages or deficiencies.
Government
Government cybersecurity architects work in government environments, integrating cybersecurity technology stacks that are generally commercial (COTS) and government-off-the-shelf (GOTS) products. As a result, they span across cybersecurity domains, enterprise technologies (on-premises, cloud, hybrid), federal agencies, state agencies, county agencies, and DoD components. Some cybersecurity architects will have a domain specialization. However, all cybersecurity architects have core competencies, even if they specialize in a particular domain.
Niche competencies are noteworthy in identity and access management, application security, database security, and the Internet of Things (IoT), coinciding with industrial control systems (ICS), Industrial Internet of Things (IIoT), and operations technologies (OT).
The main difference here is security clearance requirements.
Roles and functions will follow the NIST NICE Framework.
Prime and subcontractors would fall more into this category.
Corporate
Corporate cybersecurity architects work in corporate environments, integrating commercial-off-the-shelf (COTS) products. As a result, they span cybersecurity domains and enterprise technologies (on-premises, cloud, hybrid). Some cybersecurity architects will have a domain specialization. However, all cybersecurity architects have core competencies, even if they specialize in a particular domain.
Niche competencies are noteworthy in identity and access management, application security, database security, and the Internet of Things (IoT), coinciding with industrial control systems (ICS), Industrial Internet of Things (IIoT), and operations technologies (OT).
Commercial
Commercial cybersecurity architects can be divided into two distinct functional areas. The two functional areas consistently focus on consulting or cybersecurity solutions development. Commercial cybersecurity architects have a similar perspective as corporate cybersecurity architects. Some may work within companies on a contract basis for staff augmentation.
The primary takeaway for commercial cybersecurity architects is they work for consulting companies, integrators, and value-added resellers.
Cybersecurity solutions architects in this space are not necessarily similar to their cybersecurity architect counterparts. Instead, they focus on specific solutions within a cybersecurity domain and the delivery of those solutions. As a result, cybersecurity solutions architects have a narrower view and scope of their functional role. However, they must have a firm understanding of cybersecurity architects’ conceptual areas and concerns.
Security clearance requirements may exist if working directly with government agencies, a prime, or a subcontractor.
Product
Product cybersecurity architects focus on developing the architecture of a vendor’s primary and secondary products or their overall platform ecosystem cybersecurity. Their emphasis is on the specific product, features, and architecture, from hardware to the primary application. Product cybersecurity architects at this level are more in-depth with a vendor product or cybersecurity tool.
Product cybersecurity architects deliver a narrow focus. The product side is not designing an enterprise cybersecurity architecture to fulfill the needs of a cybersecurity program. Instead, they are creating a product or cybersecurity tool ecosystem that will eventually be deployed in an enterprise or operated as a SaaS platform. For this reason, there is a heavier emphasis on a skill set in the areas of:
- computer engineering;
- electrical engineering;
- systems engineering;
- higher-level mathematics;
- digital logic and processor architectures;
- programming and scripting languages;
- operating system kernel development; and
- product development lifecycles.
Security clearance requirements may exist if working directly with government agencies, a prime, or a subcontractor.
Cybersecurity Architect Skills Matrix
The cybersecurity architect skills matrix combines the Skills for the Information Age (SFIA) and the NIST NICE Framework. The spreadsheet helps align skills for roles and functions.
Currently, the skills matrix is under construction.
Architecture Related Certifications
One of the key issues surrounding job descriptions for cybersecurity architecture roles is the type and nature of certifications they require or note. They tend to be a little off, which is an unusual issue that may indicate the job description was written by someone unfamiliar with cybersecurity architecture. This is an attempt to document certifications that are more relevant and related to cybersecurity architecture. People may have acquired other certifications throughout their careers, but they are not specific to architecture.
Getting certifications is a personal choice. It is generally up to the individual to decide whether they want to put the time, effort, and money into achieving them. Some hiring managers want to see them, while others do not. Additionally, please note that the mileage may vary depending on the quality of learning outcomes associated with certifications.
General Certifications
Cloud Oriented Certifications
Framework Oriented Certifications
Specialty Certifications
As a working cybersecurity professional, every attempt is made to separate professional and personal endeavors in a manner consistent with reducing conflicts of interest and maintaining ethics. Statements contained within this site are the explicit and implicit goals, objectives, endorsements, and educated opinion of the author of this site and not those of current or former employers.
