Skip to content

Secure System Architecture & Design

Secure System Architecture & Design is the designing of an IT system to meet its security requirements, balancing this with its functional requirements.

Secure System Architecture & Design icon

More about a career in Secure System Architecture & Design

Working in Secure Architecture & Design, you're responsible for solving complex security problems by selecting the best available solutions from a range of technological components and structures. The decisions you make fundamentally determine whether an organisation can manage its data, information systems and communications networks securely. Your recommendations - on the choice of components, their configuration and the high-level structure in which they all sit -  guide the work of developers, implementers and operators of the systems and networks. You cost out designs as accurately as possible, since budget overruns can affect the timely delivery of the network installation.

While very technical, this role involves a substantial amount of co-operation with other specialists, including external suppliers. You understand the business context in which the technologies are used and the operations they support.

You confidently assert and prove the correctness of your recommendations while maintaining positive relationships with the other people. Sometimes, you don't have the knowledge or skill needed to solve a particular problem, so you consult with others, explaining the unresolved parts of the problem so they can provide ideas.

Although your primary responsibility is to ensure that new systems or changes to existing ones are secure, you also take account of higher, enterprise-level security requirements, and the broader requirements for any information processing system such as meeting user needs. You balance competing requirements and decide on the minimum level of security that's acceptable. In this, you typically apply risk management principles and consult with colleagues, including business managers, to take into account their views.

When systems are being built or changed, you usually review the work periodically to ensure that it conforms to the agreed design.

You document your recommendations for development teams clearly and, at least of the some of the time, present them to senior managers. This is especially important if the recommended solutions are expensive or might compromise a system’s ability to meet other important requirements, such as transaction speed. Design documents such as LLDs (Low Level Design) and HLDs (High Level Design) must be produced, to ensure they're available for reference should they be needed by other teams.

Working in this specialism, you decide on the essential security structure of the information systems which an organisation develops and runs, and verify that the delivered systems conform to the design.

In detail, you may:

  • agree high-level business requirements with non-technical colleagues
  • plan, research and design secure software development and delivery systems, with objectives like security, speed, scalability and robustness at the core
  • create technical requirements and specifications for major software systems and subsystems
  • estimate costings related to new designs and/or additions
  • ensure that systems are developed and implemented securely, according to the agreed design and relevant industry standards
  • report on and present recommended solutions to technical and non-technical stakeholders
  • review installations of new network devices
  • provide expert software security advice (on design, coding, testing, etc.) to software developers, system operators and other colleagues
  • research, including by consultation with specialist colleagues, potential cyber security threats
  • stay up to date with emerging cyber security principles, standards and technologies
  • oversee testing of final designs
  • develop roadmaps of future cyber security technology developments and the implications for the organisation’s systems
  • assist with capability, capacity, and operational planning activities

Most organisations outsource all system development and maintenance work to providers, or buy off-the-shelf software or cloud-based services. However, organisations which do develop systems themselves - whether for themselves, for clients or for general sale - need to ensure they are securely designed.

Many organisations which develop systems will include security architecture responsibilities within overall architecture responsibilities, and security design responsibilities with system design responsibilities. This requires designers and architects to take account of all requirements, not just security ones.

However, large development teams will generally have separate security architecture and design teams. In these:

  • practitioners focus on the security design of individual components
  • senior practitioners focus on the secure architecture of whole systems

Personal attributes

  • interpreting requirements of a wide variety of types
  • judging the relative importance of requirements
  • analysing complex problems
  • a logical and methodical approach
  • interpreting and applying formal standards
  • written, spoken and drawn descriptions of complex designs
  • confidence in defending ideas against challenges
  • evaluating the probable social, commercial, cultural, ethical and environmental consequences of an action

Specialist skills

  • creating an integrated view of business requirements, enterprise security plans, cyber security standards and regulatory constraints
  • understanding and applying vulnerability analyses to design decisions
  • thinking like an adversary
  • experience with PKI (Public Key Infrastructure)
  • producing system architecture specifications and designs
  • designing secure systems to run on cloud platforms
  • applying the Zero Trust principle
  • using the result of a risk assessment to design a management measure for the risk
  • complying with data protection and other regulations

CIISec Skills Groups* (additional Skills Groups may also be relevant to particular jobs)

C1 – Enterprise Security Architecture


  • working with Enterprise Architects, takes customer security requirements and assists in the development of an Enterprise Information Security Architecture
  • interprets relevant security policies and threat/risk profiles into secure architectural solutions that mitigate the risks and conform to legislation and regulations, and relate to business needs
  • applies common architectural frameworks (e.g., TOGAF, SABSA)
  • presents security architecture solutions as a view within broader IT architectures
  • maintains awareness of the security advantages and vulnerabilities of common products and technologies
  • designs robust and fault-tolerant security mechanisms and components appropriate to the perceived risks
  • develops and implements appropriate methodologies, templates, patterns and frameworks

C2 – Technical Security Architecture


  • contributes to the development of Computer, Network and Storage Security Architecture, incorporating hosting, infrastructure applications and cloud-based solutions as covered by the role of Chief Security Architect
  • interprets relevant security policies and threat/risk profiles into secure architectural solutions that mitigate the risks, conform to legislation and regulations and relate to business needs
  • presents security architecture solutions as a view within broader IT architectures
  • applies security architecture principles to networks, IT systems, Control Systems (e.g., SCADA, ICS), infrastructures and products
  • devises standard solutions that address requirements delivering specific security functionality whether for a business solution or for a product
  • maintains awareness of the security advantages and vulnerabilities of common products and technologies; designs robust and fault-tolerant security mechanisms and components appropriate to the perceived risks
  • uses appropriate methodologies and frameworks


*Non-Commercial - No Derivatives (BY-NC-ND) license. 2021 Copyright © The Chartered Institute of Information Security. All rights reserved. Chartered Institute of Information Security®, CIISec. Chartered Institute of Information Security®, CIISec®, AfCIIS®, ACIIS®, MCIIS®, FCIIS® and the CIISec graphic logo are trademarks owned by The Chartered Institute of Information Security and may be used only with express permission of CIISec.

Coming soon

Roles at all levels in this specialism require the application of a thorough understanding of information technology, cyber security threats and effective controls. It is, therefore, very difficult to gain significant transferable skills in jobs other than those which already involve such knowledge.

However, other types of role - those requiring the application of deep, expert knowledge to the analysis and solving of complex design problems - may give you some advantage in obtaining a job in Security Architecture and Design, if you also have the relevant IT and cyber security knowledge. Such roles include:

  • architecture
  • urban or transport planning
  • engineering (civil, mechanical, electrical, production)

Working in a cyber security role requires specialist knowledge, and some roles require a lot. Such knowledge can be acquired in several ways and, although the requirements for any given role are described here in terms of Knowledge Areas (KAs) from the Cyber Security Body of Knowledge (CyBOK), this doesn't mean that a cyber security specialist must read the relevant sections of CyBOK.

Increasingly, however, cyber security qualifications, training and skills definitions are being mapped to CyBOK - so the KAs are a good way of describing the knowledge associated with a specialism.

As an experienced practitioner in a Secure Architecture and Design role, you'll typically use the knowledge in the KAs listed below, although not always to the same level of detail. You're most likely to need a very good understanding of the Core Knowledge, which is essential to performing the role. You may still need a good understanding of the Related Knowledge but not to quite the same degree. You may need a much less detailed understanding of the elements of Wider Knowledge, which provides context for your work.

Coming into such a role, you will not be expected to have all his knowledge initially, but you do need a solid understanding of the Secure Software Lifecycle and Authentication, Authorisation & Accountability KAs and a fair knowledge of the other Core KAs.

Core knowledge

Secure Software Lifecycle

The application of security software engineering techniques in the whole systems development lifecycle resulting in software that is secure by default.

Authentication, Authorisation & Accountability

All aspects of identity management and authentication technologies, and architectures and tools to support authorisation and accountability in both isolated and distributed systems.

Operating Systems & Virtualisation

Security Operating systems protection mechanisms, implementing secure abstraction of hardware, and sharing of resources, including isolation in multi-user systems, secure virtualisation, and security in database systems.

Distributed Systems Security

Security mechanisms relating to larger-scale coordinated distributed systems, including aspects of secure consensus, time, event systems, peer-to-peer systems, clouds, multitenant data centres and distributed ledgers.

If you're working in a role which includes responsibility for the security of public-facing system, you'll also need:

Web & Mobile Security

If you are working in a role which includes responsibility for the security of industrial control systems (ICSs) you will need:

Cyber-Physical Systems Security

Security challenges in cyber-physical systems, such as the Internet of Things and Industrial Control Systems, attacker models, safe-secure designs, and security of large-scale infrastructures.

Related knowledge

Software Security

Known categories of programming errors resulting in security bugs, and techniques for avoiding these errors - both through coding practice and improved language design - and tools, techniques and methods for detection of such errors in existing systems.


Core primitives of cryptography as presently practised and emerging algorithms, techniques for analysis of these, and the protocols that use them.

Privacy & Online Rights

Techniques for protecting personal information, including communications, applications, and inferences from databases and data processing. It also includes other systems supporting online rights touching on censorship and circumvention, covertness, electronic elections, and privacy in payment and identity systems.

Law & Regulation

International and national statutory and regulatory requirements, compliance obligations, and security ethics, including data protection and developing doctrines on cyber warfare.

Risk Management & Governance

Security management systems and organisational security controls, including standards, best practices, and approaches to risk assessment and mitigation.

Wider knowledge

Network Security

Security aspects of networking and telecommunication protocols, including the security of routing, network security elements, and specific cryptographic protocols used for network security.

Hardware Security

Security in the design, implementation and deployment of general-purpose and specialist hardware, including trusted computing technologies and sources of randomness.

You may be able to start in this specialism as a junior Secure Architecture and Design practitioner as a graduate, if you have substantial programming experience and a degree in:

  • software engineering
  • computer science
  • cyber security or information security

Or, you might move into this specialism from another role in IT or another cyber security specialism:

Given the very high level of technical knowledge required to work in this specialism, it's unlikely that you'd move into most other cyber security specialisms, with the exceptions of:

From a practitioner role, you might take a more senior role in Secure Architecture and Design, or transition from a role as a secure designer to a become a senior practitioner in secure architecture.

From a senior practitioner role, you might progress into an enterprise-level architecture role, or become a Chief Information Officer or CISO.

For practitioner roles, typical titles include:

  • Security Architect
  • Secure Systems Architect
  • Application Security Architect
  • Software Cloud Architect
  • Software Applications Security Architect | Cloud
  • Software Security Architect
  • Cybersecurity Technical Architect

Senior practitioner titles include:

  • Chief Cloud Security Architect
  • Chief Security Architect
  • Senior Security Architect
  • Lead Cloud Security Architect

A security architect might earn between £50,000 and £90,000 a year. The median figure in March 2021 was £77,500.

A senior security architect might earn between £60,000 and £130,000. The median figure in March 2021 was £83,000.

Salary ranges are based on job vacancy advertisements published online in March 2021. Only a small proportion of job vacancy advertisements for these roles included salary figures, so the sample size is small and may not be representative of jobs of all jobs in Secure Architecture & Design, especially in the public sector. Median salary figures are taken from calculations performed by