enterprise-security-architect

---
name: enterprise-security-architect
description: |
  Guides enterprise-wide security architecture—reference architectures and domains (identity, data,
  application, network, endpoint), zero-trust and segmentation, framework mapping (NIST CSF, ISO
  27001, CIS), EA and risk alignment, architecture executive briefings, and BU/acquisition standards.
  Use for enterprise security reference models, zero-trust roadmaps, control catalogs, security ARB
  standards, or acquisition integration—not cloud landing zones (enterprise-cloud-architect), cloud
  IAM/terraform (cloud-security-engineer), control deployment/SIEM/EDR (information-security-engineer),
  product ADRs (senior-system-architecture), risk scoring (security-risk-analyst), GRC program
  (compliance-specialist), evidence automation (compliance-engineer), CI gates (devsecops), or CISO
  board program (chief-information-security-officer).
---

# Enterprise Security Architect

## When to Use

- Define **enterprise security reference architecture** — domains, layers, trust boundaries, patterns catalog
- Harmonize **security domains** — identity, data, application, network, endpoint, operations
- Design **zero-trust and segmentation** — identity-centric access, micro-segmentation, east-west controls
- Map **control frameworks** — NIST CSF, ISO 27001 Annex A, CIS, SOC 2 to architecture building blocks
- Integrate security with **enterprise architecture (EA)** — capability maps, standards, exception process
- Align architecture with **risk appetite** — control tiers, compensating controls, treatment themes
- Publish **BU and acquisition standards** — mandatory patterns, integration playbooks, sunset rules
- Run **security architecture review** — ARB criteria, threat-informed design gates, pattern exceptions
- Prepare **architecture executive briefings** — standards adoption, zero-trust roadmap, pattern gaps, acquisition integration (not CISO program KRIs)

## When NOT to Use

- Multi-BU cloud landing zones, CCoE, EA commits, regulated cloud placement, cloud guardrail catalog → `enterprise-cloud-architect`
- Single-product or single-account cloud target design → `cloud-architect`
- Implement SCPs, CSPM rules, cloud IAM policies, KMS wiring → `cloud-security-engineer`
- Deploy SSO connectors, SIEM pipelines, EDR, hardening runbooks → `information-security-engineer`
- Build risk registers, inherent/residual scoring, FAIR estimates → `security-risk-analyst`
- Entitlement modeling, access reviews, PAM vault configuration → `iam-specialist`
- GRC program scope, audit prep, questionnaire packs → `compliance-specialist`
- Automate control evidence from IdP, CI/CD, CSPM → `compliance-engineer`
- CI SAST/SBOM, pipeline scan gates, artifact signing only → `devsecops`
- Security program strategy, policies, vuln/IR program, pentest governance → `cybersecurity`
- Board program briefings, risk appetite, KRIs, crisis comms → `chief-information-security-officer`
- Product/service ADRs, C4 models, strangler migrations → `senior-system-architecture`
- Infrastructure capex portfolio and facility supply chain → `vp-of-infrastructure`

## Related skills

| Need | Skill |
|---|---|
| Enterprise cloud governance and landing zones | `enterprise-cloud-architect` |
| Product or account cloud architecture | `cloud-architect` |
| Cloud guardrails, CSPM, cloud IAM implementation | `cloud-security-engineer` |
| Control deployment, SIEM/EDR, secrets, hardening | `information-security-engineer` |
| Risk registers, scoring, treatment decisions | `security-risk-analyst` |
| IAM lifecycle, RBAC, federation, PAM detail | `iam-specialist` |
| GRC program, audits, framework scope | `compliance-specialist` |
| Technical control evidence automation | `compliance-engineer` |
| Secure SDLC pipeline implementation | `devsecops` |
| Security program strategy and policies | `cybersecurity` |
| CISO board narrative, risk appetite, program ops | `chief-information-security-officer` |
| Cross-service ADRs and integration architecture | `senior-system-architecture` |
| Infrastructure portfolio and executive infra narrative | `vp-of-infrastructure` |

## Core Workflows

### 1. Define scope and operating model

Clarify enterprise vs federated ownership, ARB authority, and mandatory vs recommended controls.

**See `references/enterprise_security_architect_scope.md`.**

### 2. Publish reference architecture

Layered model, domain map, pattern catalog, and integration points to EA.

**See `references/security_reference_architecture.md`.**

### 3. Design identity, data, and zero trust

Identity-centric access, data protection tiers, segmentation, and ZTNA/SASE alignment.

**See `references/identity_data_and_zero_trust.md`.**

### 4. Standardize application and integration security

Secure SDLC gates, API/B2B patterns, secrets, and third-party integration standards.

**See `references/application_and_integration_security.md`.**

### 5. Map governance, frameworks, and controls

Map frameworks to architecture blocks; define control tiers and exception lifecycle.

**See `references/governance_frameworks_and_controls.md`.**

### 6. Brief executives on architecture posture

Architecture packs for board/CISO: standards adoption, KPIs, investment cases, acquisition integration (program KRIs → `chief-information-security-officer`).

**See `references/executive_security_architecture_briefings.md`.**

### 7. Integrate acquisitions and new BUs

Apply assimilation playbook — identity, logging, segmentation, mandatory patterns by day 1/30/90.

**See `references/enterprise_security_architect_scope.md` (M&A stakeholders) and `references/executive_security_architecture_briefings.md` (acquisition summaries).**

## Outputs

- **Enterprise security reference architecture** — domains, layers, trust zones, pattern catalog
- **Zero-trust roadmap** — phases, dependencies, identity and segmentation milestones
- **Control-to-architecture matrix** — framework clauses mapped to building blocks and evidence owners
- **Security standards catalog** — mandatory, recommended, deprecated; BU adoption checklist
- **ARB/security review checklist** — threat-informed gates, exception template with expiry
- **Acquisition integration playbook** — identity, logging, data, network assimilation steps
- **Executive briefing deck outline** — posture, top gaps, investments, measurable outcomes

## Principles

- **Architecture before tooling** — patterns and control intent precede vendor selection
- **Identity is the perimeter** — authenticate, authorize, and continuously validate every access path
- **Defense in depth by domain** — no single control family carries the entire risk
- **Measurable standards** — every mandatory pattern has a validation method and owner
- **Federation with guardrails** — central standards, local delivery within approved patterns
- **Risk-informed exceptions** — time-bound, logged, tied to residual risk acceptance
- **Patterns before implementation** — `information-security-engineer` and `cloud-security-engineer` deploy; this skill defines intent and standards

• SKILL.md 7 KB
• references/application_and_integration_security.md 3 KB
• references/enterprise_security_architect_scope.md 4 KB
• references/executive_security_architecture_briefings.md 4 KB
• references/governance_frameworks_and_controls.md 3 KB
• references/identity_data_and_zero_trust.md 3 KB
• references/security_reference_architecture.md 3 KB