---

name: enterprise-security-architect description: | Guides enterprise-wide security architecture—reference architectures and domains (identity, data, application, network, endpoint), zero-trust and segmentation, framework mapping (NIST CSF, ISO 27001, CIS), EA and risk alignment, architecture executive briefings, and BU/acquisition standards. Use for enterprise security reference models, zero-trust roadmaps, control catalogs, security ARB standards, or acquisition integration—not cloud landing zones (enterprise-cloud-architect), cloud IAM/terraform (cloud-security-engineer), control deployment/SIEM/EDR (information-security-engineer), product ADRs (senior-system-architecture), risk scoring (security-risk-analyst), GRC program (compliance-specialist), evidence automation (compliance-engineer), CI gates (devsecops), or CISO board program (chief-information-security-officer).

Enterprise Security Architect

When to Use

• Define enterprise security reference architecture — domains, layers, trust boundaries, patterns catalog
• Harmonize security domains — identity, data, application, network, endpoint, operations
• Design zero-trust and segmentation — identity-centric access, micro-segmentation, east-west controls
• Map control frameworks — NIST CSF, ISO 27001 Annex A, CIS, SOC 2 to architecture building blocks
• Integrate security with enterprise architecture (EA) — capability maps, standards, exception process
• Align architecture with risk appetite — control tiers, compensating controls, treatment themes
• Publish BU and acquisition standards — mandatory patterns, integration playbooks, sunset rules
• Run security architecture review — ARB criteria, threat-informed design gates, pattern exceptions
• Prepare architecture executive briefings — standards adoption, zero-trust roadmap, pattern gaps, acquisition integration (not CISO program KRIs)

When NOT to Use

• Multi-BU cloud landing zones, CCoE, EA commits, regulated cloud placement, cloud guardrail catalog → enterprise-cloud-architect
• Single-product or single-account cloud target design → cloud-architect
• Implement SCPs, CSPM rules, cloud IAM policies, KMS wiring → cloud-security-engineer
• Deploy SSO connectors, SIEM pipelines, EDR, hardening runbooks → information-security-engineer
• Build risk registers, inherent/residual scoring, FAIR estimates → security-risk-analyst
• Entitlement modeling, access reviews, PAM vault configuration → iam-specialist
• GRC program scope, audit prep, questionnaire packs → compliance-specialist
• Automate control evidence from IdP, CI/CD, CSPM → compliance-engineer
• CI SAST/SBOM, pipeline scan gates, artifact signing only → devsecops
• Security program strategy, policies, vuln/IR program, pentest governance → cybersecurity
• Board program briefings, risk appetite, KRIs, crisis comms → chief-information-security-officer
• Product/service ADRs, C4 models, strangler migrations → senior-system-architecture
• Infrastructure capex portfolio and facility supply chain → vp-of-infrastructure

Related skills

Need	Skill
Enterprise cloud governance and landing zones	enterprise-cloud-architect
Product or account cloud architecture	cloud-architect
Cloud guardrails, CSPM, cloud IAM implementation	cloud-security-engineer
Control deployment, SIEM/EDR, secrets, hardening	information-security-engineer
Risk registers, scoring, treatment decisions	security-risk-analyst
IAM lifecycle, RBAC, federation, PAM detail	iam-specialist
GRC program, audits, framework scope	compliance-specialist
Technical control evidence automation	compliance-engineer
Secure SDLC pipeline implementation	devsecops
Security program strategy and policies	cybersecurity
CISO board narrative, risk appetite, program ops	chief-information-security-officer
Cross-service ADRs and integration architecture	senior-system-architecture
Infrastructure portfolio and executive infra narrative	vp-of-infrastructure

Core Workflows

1. Define scope and operating model

Clarify enterprise vs federated ownership, ARB authority, and mandatory vs recommended controls.

See references/enterprise_security_architect_scope.md.

2. Publish reference architecture

Layered model, domain map, pattern catalog, and integration points to EA.

See references/security_reference_architecture.md.

3. Design identity, data, and zero trust

Identity-centric access, data protection tiers, segmentation, and ZTNA/SASE alignment.

See references/identity_data_and_zero_trust.md.

4. Standardize application and integration security

Secure SDLC gates, API/B2B patterns, secrets, and third-party integration standards.

See references/application_and_integration_security.md.

5. Map governance, frameworks, and controls

Map frameworks to architecture blocks; define control tiers and exception lifecycle.

See references/governance_frameworks_and_controls.md.

6. Brief executives on architecture posture

Architecture packs for board/CISO: standards adoption, KPIs, investment cases, acquisition integration (program KRIs → chief-information-security-officer).

See references/executive_security_architecture_briefings.md.

7. Integrate acquisitions and new BUs

Apply assimilation playbook — identity, logging, segmentation, mandatory patterns by day 1/30/90.

See references/enterprise_security_architect_scope.md (M&A stakeholders) and references/executive_security_architecture_briefings.md (acquisition summaries).

Outputs

• Enterprise security reference architecture — domains, layers, trust zones, pattern catalog
• Zero-trust roadmap — phases, dependencies, identity and segmentation milestones
• Control-to-architecture matrix — framework clauses mapped to building blocks and evidence owners
• Security standards catalog — mandatory, recommended, deprecated; BU adoption checklist
• ARB/security review checklist — threat-informed gates, exception template with expiry
• Acquisition integration playbook — identity, logging, data, network assimilation steps
• Executive briefing deck outline — posture, top gaps, investments, measurable outcomes

Principles

• Architecture before tooling — patterns and control intent precede vendor selection
• Identity is the perimeter — authenticate, authorize, and continuously validate every access path
• Defense in depth by domain — no single control family carries the entire risk
• Measurable standards — every mandatory pattern has a validation method and owner
• Federation with guardrails — central standards, local delivery within approved patterns
• Risk-informed exceptions — time-bound, logged, tied to residual risk acceptance
• Patterns before implementation — information-security-engineer and cloud-security-engineer deploy; this skill defines intent and standards