Security architect

What does a security architect do?

A security architect designs how an organisation's systems stay secure.

The job sets out the controls, patterns and standards that engineering teams follow when they build or change applications, networks and cloud platforms.

The role sits in the technology or information security function. It often reports to the chief information security officer (CISO) or the head of enterprise architecture. Banks, government agencies, telcos and large technology firms in Singapore employ security architects.

You work with security engineers, cloud and infrastructure teams, application developers, risk and compliance staff, and business owners. You also advise senior management on new technology and the risks it brings.

What the work involves

• Review project designs and check that they follow the organisation's security standards.
• Set out security requirements for new systems with business owners and IT teams.
• Draw up standard patterns and configurations, such as approved ways to connect cloud workloads to internal networks.
• Handle requests for exceptions to standards and record the risk that the organisation accepts.
• Study the current architecture for weak points and propose fixes.
• Assess new security tools and technologies and advise senior management on cost, benefit and risk.

Pay in Singapore

Back to top

Skills a security architect needs

Back to top

Security architect job description

A security architect is needed to design and review secure architectures for applications, cloud platforms and infrastructure.

You will set security standards, guide project teams and advise management on cyber risk. You should explain technical trade-offs clearly to business stakeholders.

Responsibilities

• Define security architecture requirements and keep them in line with the organisation's IT strategy and business priorities.
• Design standard security patterns and configurations for cloud, network, identity and application layers.
• Review solution designs for new projects and confirm that the technical solution covers security needs.
• Lead threat modelling and design reviews with development and infrastructure teams.
• Manage exceptions to security standards and track the risks they create.
• Check that designs follow company security policies and industry regulations.
• Review the current architecture on a regular basis, find weaknesses and propose improvements.
• Research new security technologies and advise senior management on cost, benefit and risk.
• Keep security governance in step with enterprise architecture governance.
• Maintain documentation of security standards, patterns and decisions.

Requirements

• A degree in computer science, information technology, cybersecurity or a related field is common. Employers may accept equivalent experience.
• Typically 7 to 10 years in security engineering, infrastructure, network or software roles, with some design ownership.
• Hands-on knowledge of cloud security on at least one major platform, plus identity and access management and network security.
• Working knowledge of ISO 27001 and the NIST frameworks. Roles in finance often add familiarity with MAS technology risk expectations.
• Certifications such as CISSP or TOGAF are often listed. OSCP or cloud vendor certifications may also be asked for.
• Clear writing and presentation skills, as you will explain designs to engineers and senior management.

Back to top

Security architect career path

Most security architects start in hands-on security or infrastructure work and move into design after several years.

The step beyond is usually a lead architect or a security leadership role.

1. Cybersecurity analyst

   Entry

   Monitor alerts, investigate incidents and learn how controls work in practice.

2. Security engineer

   Mid

   Build and run security controls across cloud, network and identity systems, and start to shape designs.

3. Security architect

   Senior · SkillsFuture title

   Design secure architectures, set standards and review projects across the organisation.

4. Principal security architect

   Lead

   Own the security architecture strategy, guide other architects and advise senior management on major decisions.

5. Chief information security officer

   Head

   Lead the security function, report on cyber risk to the board and set the security strategy.

Steps marked "SkillsFuture title" follow the career pathway in the SkillsFuture Skills Framework. The others are titles commonly used in Singapore.

Related jobs and their pay

Back to top

Security architect interview questions

We wrote these questions from the skills this job needs. They are not an official question bank.

1. How would you design a secure landing zone for a new cloud workload that holds sensitive data?

   What a good answer covers

   • Separates accounts or subscriptions by environment and sensitivity
   • Sets network segmentation, private connectivity and controlled internet egress
   • Applies least-privilege roles and central logging from the start
   • Uses guardrails such as policy-as-code to block unsafe configurations
   • Plans monitoring and a clear owner for each control

2. Explain zero trust. How would you apply it to a company that still relies on a VPN for staff access?

   What a good answer covers

   • States the principle: verify each request, do not trust by network location
   • Starts with identity, device health and strong authentication
   • Moves access to application level in stages, beginning with the highest-risk systems
   • Describes how to keep legacy systems working during the move
   • Names the logs and signals used to judge each access decision

3. Design identity and access management for a firm with staff, contractors and service accounts across cloud and on-premises systems.

   What a good answer covers

   • Uses a central identity provider with single sign-on and multi-factor authentication
   • Defines role-based or attribute-based access and a joiner, mover and leaver process
   • Handles privileged access with just-in-time elevation and session recording
   • Manages service account secrets and rotation
   • Plans periodic access reviews and clear ownership

4. How do you run threat modelling on a new web application before development starts?

   What a good answer covers

   • Draws the data flows and trust boundaries first
   • Uses a method such as STRIDE to list threats
   • Ranks threats by likelihood and impact
   • Turns the findings into design requirements and test cases
   • Revisits the model when the design changes

5. How do ISO 27001 and the NIST frameworks differ, and how would you choose between them or combine them?

   What a good answer covers

   • Explains that ISO 27001 is a certifiable management system standard
   • Explains that NIST frameworks give control catalogues and a structured way to describe maturity
   • Considers what customers, regulators and auditors ask for
   • Maps controls between the two to avoid duplicate work
   • Ties the choice to the organisation's risk and size

6. How would you build security into an architecture process that follows TOGAF?

   What a good answer covers

   • Adds security requirements at the vision and business architecture stages
   • Describes security views in the data, application and technology architectures
   • Uses architecture review boards as a checkpoint
   • Records decisions and approved exceptions in the architecture repository
   • Links security principles to the organisation's wider principles

7. Your company wants to add an AI assistant that answers questions from internal documents. What security and governance controls do you design?

   What a good answer covers

   • Enforces the document access rights of each user in retrieval
   • Prevents sensitive data from leaving approved boundaries or being used to train outside models
   • Defends against prompt injection and unsafe outputs
   • Logs prompts and answers for audit, with privacy limits
   • Sets an approval and review process with risk and legal teams

8. How do you design encryption and key management for data held across several cloud services?

   What a good answer covers

   • Classifies data to decide what needs encryption and how strong
   • Covers data at rest, in transit and, where needed, in use
   • Chooses between provider-managed and customer-managed keys, with reasons
   • Uses a hardware-backed key store and separates key custodians from data owners
   • Plans key rotation, backup and recovery

1. A project team asks for an exception to your standards so it can go live next week. How do you respond?

   What a good answer covers

   • Asks what the standard protects against and what the team needs
   • Looks for a safe alternative or a temporary compensating control
   • Records the risk, an owner and an expiry date for the exception
   • Escalates to the risk owner if the residual risk is high
   • Uses the case to check whether the standard needs to change

2. A penetration test finds a design flaw in a system already in production. Fixing it will delay a business launch. What do you do?

   What a good answer covers

   • Rates the real impact and likelihood with evidence
   • Offers short-term mitigations such as monitoring or access limits
   • Presents options and costs to the business owner without jargon
   • Gets a documented risk decision if the launch goes ahead
   • Sets a fix date and tracks it

3. A business unit wants to buy a software-as-a-service tool that will store customer data. How do you assess it?

   What a good answer covers

   • Reviews the vendor's security certifications and audit reports
   • Checks where data is stored and who can access it
   • Looks at single sign-on, logging and data export or deletion options
   • Reviews how the tool connects to internal systems
   • Sets contract and exit requirements with procurement and legal

1. Describe a time you persuaded developers to adopt a security control they did not want.

   What a good answer covers

   • Explains the risk in terms the team cared about
   • Listened to the team's constraints and adjusted the design
   • Offered tooling or patterns that reduced the effort
   • Shows the outcome with a specific result

2. Tell us about an architecture decision you got wrong. What did you change afterwards?

   What a good answer covers

   • Describes the decision and its reasoning honestly
   • Explains how the problem was found
   • Shows the fix and who was involved
   • Names a lasting change to the review process or standards

1. You are designing a customer platform that holds personal data of people in Singapore. How does the architecture support Personal Data Protection Act (PDPA) obligations?

   What a good answer covers

   • Maps where personal data is collected, stored and shared
   • Limits access and retention to what is needed
   • Builds in encryption, logging and a way to handle access and correction requests
   • Plans breach detection and a route to notify the right parties
   • Involves the data protection officer early

2. You join a Singapore bank. How would you align your security architecture with the Monetary Authority of Singapore (MAS) expectations on technology risk?

   What a good answer covers

   • Reads the current MAS guidelines and notices that apply to the institution
   • Maps architecture standards to the expected control areas
   • Pays attention to access control, resilience, outsourcing and cloud use
   • Keeps evidence ready for internal audit and supervisory review
   • Works with risk and compliance teams on gaps

Common questions about a security architect job

Sources