Becoming a Security Architect: What 147 Open Postings Expect

The route to security architect, measured from 147 open architecture, solutions and consulting postings: the years they expect, the jobs people climb from, the frameworks and certificates they name, and the salaries they print.

A security architect decides how systems should be built so that they stay safe, then makes those decisions stick across teams the architect does not run: reviewing designs before they ship, writing the reference patterns engineers copy, setting the standards and guardrails, and weighing each risk against what the business needs to do. Almost nobody starts there. Across the postings behind this guide, the middle request was seven years of experience, only one seat was pitched at graduates, and the usual way in was several years as a security, cloud, network or software engineer, or as a presales engineer or consultant, before the architect title. The route below follows that evidence: what the work is, which of six kinds of architect fits you, what each kind asks for, and what each pays.

How the sample was drawn. The sample comes from CyberJobs.cc's full job feed as it stood on 12 November 2026: 2,150 open security roles, refreshed every hour from about 300 employers' own hiring systems. Two groups were pulled from it: the 140 roles in the board's security architecture and consulting specialty, and the 26 roles in other specialties whose title contains "architect" or "architecture". Each of those 166 postings was read in full. Nineteen were set aside because the work is something else: four offensive testing roles (three threat emulation consultants, and a penetration testing lead whose title says architect), five threat intelligence or threat response roles, a fraud response engineer, a ransomware readiness adviser, a security awareness adviser, a SOC customer liaison, two drone sales engineers for prisons and campuses, a phone hardware architect, a radar production architect, a database software engineer and a telemetry pipeline engineer. That leaves 147 postings from 62 employers. Counts use those 147 as their base except where a sentence says otherwise, and an item scores one per posting whether the employer requires it or merely prefers it. Eleven of the postings are in French, Korean, Japanese or German, where an English keyword search finds less, so their counts run a little low. Every salary figure comes from a range an employer published itself.

Some figures are live and are recounted each time this page is opened: the board's architecture and consulting specialty currently holds 140 open roles ( 55 fully remote), and their published salaries centre on $208k/yr.

Contents

1. What security architects actually do all week
2. Six kinds of security architect, and who hires each
3. What 147 postings ask for
4. The road to architect: years and earlier jobs
5. Skills and frameworks in a sensible order
6. Certifications, counted the way postings name them
7. What security architects are paid
8. Architect, principal engineer or manager: three ways up
9. On the vendor side: solutions architects, field engineers and consultants
10. Getting there from where you are now
11. Security architect careers: common questions

1. What security architects actually do all week

Begin with why the job exists at all. A company with a few engineers can keep its security decisions in one person's head. A company with hundreds of engineers ships thousands of design choices a year, each made by a team under deadline pressure, and most security failures are not exotic attacks but ordinary design choices nobody looked at from the attacker's side: a service that trusts another too much, a key readable by too many people, a tenant boundary that leaks. Security engineers can fix those one at a time. An architect exists to make fewer of them happen, by deciding the safe shape in advance and spreading it, so the default path for every team is already the secure one.

That purpose explains the five activities the in-house postings keep describing. Of the 41 postings for architects who secure their own employer's systems, 23 named threat modeling, 20 named design or architecture reviews, 22 named reference architectures or reusable patterns, and 23 named security standards, principles or guardrails.

Design reviews: where the decisions get made

The review is the architect's most visible ritual. A team brings a design for a new service, integration or platform change; the architect asks where the trust boundaries are, which identities can reach which data, what happens when a dependency is compromised, and which controls the design must include before it is built. AppsFlyer's security architect is asked to "Lead complex security design reviews for new technologies, systems, services, and strategic cross-tech initiatives" and to represent security in the company's architecture forums, and the posting wants someone with "the seniority and presence to engage R&D architects and senior stakeholders as a peer". WHOOP's architect reviews cloud platforms, applications, infrastructure and identity systems, and then reads penetration test results, vulnerability findings and incidents for "systemic architectural weaknesses", which is the step that turns a list of bugs into a design change.

Threat modeling is the method underneath most reviews. The Threat Modeling Manifesto boils the method down to four questions: "What are we working on?", "What can go wrong?", "What are we going to do about it?" and "Did we do a good enough job?" - Threat Modeling Manifesto. In the sample, threat modeling separated in-house architecture from the vendor side more sharply than any other skill: 23 of the 41 in-house postings named it, against 4 of the 76 customer-facing ones. Palo Alto Networks' information security architect is told to "Own the organization's threat modeling methodology", which at a large company means designing the process other people use, not running every session yourself.

Reference architectures and secure defaults

A review catches problems one design at a time. A reference architecture prevents them at scale: a documented, approved way to build a common thing (a public API, a service-to-service call, a data pipeline, an AI agent with tools) that teams can copy without asking permission. Anaplan's senior security architect describes the goal plainly: "Engineers adopt good architecture because it is the better path." That role produces security patterns for its platform and AI components, works on tenant isolation and bring-your-own-key encryption, and helps turn the findings of an outside assessment into concrete design changes. WHOOP asks for "secure-by-default architecture patterns, reference designs, and reusable security controls" and wants those requirements turned into automated guardrails and policy as code, so that the pattern is enforced by the pipeline rather than by a meeting.

Standards and guardrails

Standards are the written rules the patterns rest on: which encryption, which authentication flows, which logging, which network exposure is acceptable. The good ones are short and testable. The identity architect posting from OpenLoop Health is unusually candid about why the role exists: "Architecture currently gets decided project by project, under delivery pressure. This role exists to change that." The job is to set "the standards, reference patterns, and decision records that make platform choices consistent rather than improvised per project". Decision records, short documents saying what was decided, why, and what was rejected, are the cheapest tool an architect has, because they stop the same argument from being held again every quarter.

Weighing risk against the business

An architect who says no to everything is soon routed around. The postings ask instead for judgment about trade-offs: 19 of the 41 in-house postings used the words trade-off or balance. PlayStation's staff security architect must design, review and approve security architecture "balancing business objectives, engineering constraints, and risk". Palo Alto Networks wants architectural risks translated "into actionable items for the Cybersecurity Risk Register" with their business impact explained to leadership. SailPoint's principal security architect goes a step further and is expected to "Secure leadership alignment and funding to convert prioritized opportunities into active projects", which is the part of the job that looks most like management without the reports.

Steering teams outside your own reporting line

Almost every architect influences people outside their own line of authority. "Influence" appeared in 16 of the 41 in-house postings, and the word "hands-on" in 34 of them, which corrects a common picture of the architect as someone who draws diagrams and never touches a system. Palo Alto Networks calls its role a "player-coach" that mentors staff and senior engineers; OpenLoop expects its architect to write Auth0 Actions, Okta Workflows and Terraform and to query the posture data warehouse personally, and to be able to "explain a design tradeoff to a staff engineer and to a CISO in the same week". The second clause is the real filter. The same decision has to be argued in technical terms to the people who build it and in business terms to the people who fund it.

2. Six kinds of security architect, and who hires each

"Security architect" covers jobs that share a craft but differ in who the customer is. Sorting the 147 postings by whose systems the architect designs for gives six groups.

The vendor side is the largest group, by far. Half the sample (76 postings) designs for customers while a product is being sold or rolled out. That is a structural fact about who posts architecture jobs, not a quirk: a security company needs a few architects to protect itself and dozens to help buyers deploy what it sells. Anyone searching for "security architect" will meet these roles constantly, and section 9 treats them on their own terms.

In-house architects are a minority, and many of them work at security companies. The three in-house groups add up to 41 postings, and 12 of them came from security vendors protecting their own platforms (Zscaler, Palo Alto Networks, SailPoint, Okta, BeyondTrust and others). Software and internet firms posted 11, cloud and data companies 11, finance and crypto companies 4.

Product architecture is the biggest in-house branch. Twenty-three postings design the security of something the company ships. Some secure an application ( Riskified's application security architect, Axonius's product security architect); some secure a whole product line (BeyondTrust's principal software security architect "owns security architecture for BeyondTrust's product suite end to end", from endpoint agents to its SaaS); some are software architects of a security product (Zscaler's proxy architect, JFrog's and Keeper's software architects for their security platforms); and a few sit deep in hardware and cryptography, such as OpenAI's software security architect for a consumer device's operating system, who defines secure boot, code signing, attestation and the privilege model, or IonQ's two cryptography architecture leads, who work to the post-quantum standards FIPS 203, 204 and 205.

Titles hide a lot of it. Ninety-three of the 147 titles contained architect or architecture, including 40 of the 41 in-house roles. On the vendor side only 41 of 76 did; the rest were called sales engineer, solutions engineer, domain consultant, field engineer, forward deployed engineer or advisor. The board's security architect title page gathers the titled roles, and the architecture and consulting list holds the wider specialty.

3. What 147 postings ask for

Tallying what employers actually write gives the closest thing this field has to a curriculum. The first chart shows which areas of security the postings named, in any role.

Cloud is the default context, not a specialty. Cloud came up in 102 postings (69%), network in 77, identity in 73. A security architect today is expected to reason about all three at once, because a modern attack path usually crosses them: a stolen identity reaches a cloud API, which reaches a network segment that was assumed to be private. Sixty-one postings mentioned at least one major cloud provider by name: AWS in 59, Azure in 50, Google Cloud in 47, and 43 named all three, usually as a list meaning "depth in one of these". Kubernetes or containers appeared in 36 and infrastructure as code in 21, and every one of the six in-house cloud architect postings named Kubernetes or containers.

AI systems are already part of the brief. Fifty-three postings (36%) described securing AI systems themselves (language models, agents, prompt injection, model or training data protection), and among in-house architects the share was 20 of 41. PlayStation's staff architect is to design mitigations for "prompt injection, insecure tool use, excessive agency, sensitive-data disclosure" and similar risks; Anaplan wants AI guardrails drawn from MITRE ATLAS and the OWASP list for language model applications; OpenLoop wants an identity architecture for AI agents because, as its posting puts it, service accounts and AI agents "are on track to outnumber the people we govern". Qualtrics posted a dedicated AI security architect. The board's AI security jobs list collects roles of this kind across specialties.

Code is a plus, not the job. A language for code or scripts was listed in 37 postings, Python most often (28). In-house roles leaned harder on it (17 of 41) than vendor-side ones (14 of 76), and product architects most of all, since several of them must read the code they are judging.

The three groups ask for different days. The second chart sets the in-house architects against the vendor-side and consulting roles on six activities.

The pattern is clean. In-house architects model threats, review designs and write patterns; none of the 41 postings mentioned travel. Vendor-side architects run demonstrations, proofs of concept and sales cycles (presales language appeared in 64 of 76), talk to customers' executives (47 of 76) and travel (33 of 76). Consultants sit between the two. The same job title therefore describes two quite different working lives, and the choice between them matters more than the choice between, say, cloud and network specialization.

4. The road to architect: years and earlier jobs

Security architecture is posted as a destination. The level words in the titles show it.

Read the "no level word" row with care. On the vendor side and in consulting, an unlevelled title such as "Security Solutions Architect" or "Security Consultant" is often a mid-career seat, which is why its middle request (five years) is lower than the overall figure. In-house, an unlevelled "Security Architect" is already senior work: WHOOP's asks for seven years, Nebius's for six, BJAK's for five.

Across the 112 postings giving a minimum, the median was seven years, and 38 wanted ten or more. In-house roles set the highest bar (a median of eight over 31 postings, 14 of them at ten or above), vendor-side roles a median of seven over 60, and consulting five over 19. At the top, PlayStation's staff security architect asked for fifteen years, Rubrik's staff cloud security architect for fifteen with at least six in cloud security architecture, and Palo Alto Networks' network security architect for twelve in large enterprise networking.

The years are mostly years of something else. What the postings count is rarely time spent with the title. They ask for experience in the work that feeds architecture:

• In-house roles asked for security engineering, cloud or infrastructure security, application security or DevSecOps. AppsFlyer's seven years may be in "security architecture, cloud/infrastructure security, application security, or DevSecOps roles"; Zscaler's in-house architect needs seven years in security engineering, cloud, application or platform security "with direct implementation ownership". Product architects often asked for software engineering itself: Keeper and Thales's data security product each wanted ten years of software development.
• Vendor-side roles asked for presales: 39 of the 76 named sales engineering, solutions engineering or presales experience. Zscaler's principal specialist sales engineer, for instance, needs five years of presales including three selling security or networking products.
• Consulting roles asked for consulting: Thales's Toulouse architecture consultancy wants five years of cybersecurity consulting, Long View Systems' security architect eight.

The clearest statement of the bar comes from WHOOP: "You don't need to have held the title of Security Architect or previously built an enterprise architecture program, but you should have the technical depth, judgment, and curiosity to identify architectural risks and develop practical solutions." Architects are made from engineers, presales engineers and consultants who have already been doing parts of the job.

The doors with the fewest years. Twelve postings set the bar at three years or below, and together they mark where the early steps are. Darktrace's graduate solutions engineer in Munich (German and English required) is the only seat in the sample pitched at graduates; it designs client integrations and defines solution architectures inside a presales team. Bitdefender's advisory consultant asks for two years, Arctic Wolf's German security advisors two to three, Check Point's sales engineer and two Palo Alto Networks domain consultant seats three, Axonius's temporary product security architect three years in application or product security, and Dragos's senior ICS consultant three to five years with industrial systems. None is an architecture job on day one in the in-house sense; each is a seat where you practise the craft for customers while the years accumulate. For openings at the start of a career in any specialty, see the board's entry-level security roles.

Degrees matter less than experience. A degree came up in only 50 postings (34%), and 29 of them let relevant experience stand in for it. The stricter rules are national: Thales's French postings ask for an engineering degree or its equivalent (its defense systems architect wants a "BAC+5" with a cybersecurity specialization), one of Coupang's Korean postings a bachelor's degree, and Trellix's Tokyo consultant counts seven years of working life.

Clearances are rare but decisive where they appear. Six postings required a government clearance, or eligibility for one. Okta's security architect for the US public sector requires TS/SCI with polygraph, at $216,000 to $297,000; Palantir's forward deployed security engineer and CoreWeave's federal field engineer need an active Secret or Top Secret. Roles of this kind are collected on the cleared roles page.

5. Skills and frameworks in a sensible order

Architecture is breadth resting on depth, so sequence matters: every layer supplies the words you will need for the one above it. Learn a framework before you have built anything and you can list controls without being able to see which one a design lacks.

First: depth in one domain you have actually run

Every architect in the sample is expected to be credible in at least one technical domain, usually the one they came from: networks (77 postings), identity (73), cloud (102) or applications (43). Credibility means you have built and broken things there, so your design comments are specific. The OpenLoop identity architect, AvePoint's identity architects (twelve years in identity infrastructure, and for two of the four postings eight in Active Directory architecture) and Palo Alto Networks' network architect are all specialists first.

Second: the other domains, well enough to see attack paths

The jump from engineer to architect is mostly a jump in breadth. A network specialist must learn how cloud identity and application authorization work; an application security engineer must learn segmentation, key management and logging. GuidePoint's senior security architect needs "Broad architecture knowledge across various network, cloud, identity, application, data, and infrastructure security domains" to run its architecture maturity reviews. A useful self-test: can you trace, on a whiteboard, how a stolen laptop session could reach your company's most sensitive data, and name the control that should stop each step?

Third: threat modeling as a habit

Learn one structured method (STRIDE was named in four postings, all in-house) and then practise it until it is a habit you run in every design discussion. Write the four manifesto questions at the top of your notes for any new system. The postings that ask for threat modeling usually ask for the output, prioritised and turned into work: Anaplan wants threat models turned "into prioritised, actionable" changes.

Fourth: frameworks, as a shared vocabulary

Frameworks were named in plenty of postings but rarely as the point of the job. They are how an architect explains a design to auditors, customers and executives in terms those audiences already trust.

• NIST in some form (48 postings) is the commonest reference. The Cybersecurity Framework, whose version 2.0 NIST released on 26 February 2024 with a new Govern function beside Identify, Protect, Detect, Respond and Recover - NIST, 26 February 2024, was named in 11 postings, every one of them vendor-side or consulting, where it frames maturity assessments. SP 800-53, which "provides a catalog of security and privacy controls for information systems and organizations" - NIST SP 800-53 Rev. 5, appeared in 12, concentrated in consulting and government-facing seats.
• ISO 27001 (30) and SOC 2 (16) matter most where customers demand audit evidence. Six of the twelve enterprise postings named SOC 2; Zscaler's compliance architect must design across SOC 2, C5, GDPR, ISO 27701, FedRAMP High and DoD IL5.
• Zero trust (29) was named far more often than its defining document: no posting cited NIST SP 800-207 by number. That publication defines a zero trust architecture as one that "uses zero trust principles to plan industrial and enterprise infrastructure and workflows", moving defenses "from static, network-based perimeters to focus on users, assets, and resources" - NIST SP 800-207, August 2020. CISA's maturity model gives the practical yardstick, five pillars (Identity, Devices, Networks, Applications and Workloads, and Data) with three cross-cutting capabilities (Visibility and Analytics, Automation and Orchestration, and Governance), measured in stages from Traditional to Initial, Advanced and Optimal - CISA Zero Trust Maturity Model 2.0, April 2023. GuidePoint sells exactly that kind of assessment as a consulting product. Read both documents once; they are short enough, and interviewers use their vocabulary.
• MITRE ATT&CK (11), "a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations" - MITRE ATT&CK, lets an architect argue that a design covers real attacker behaviour rather than a checklist. Eight of its eleven mentions were vendor-side.
• CIS (18) and OWASP (11) are the hands-on references: hardening benchmarks and controls on one side, application risks on the other.

Fifth: an enterprise architecture method, if your target employer uses one

TOGAF and SABSA are the two methods built for architecture itself, and they were named rarely: SABSA in 4 postings, TOGAF in 2, all in-house or consulting. The Open Group describes the TOGAF Standard, now in its 10th edition, as "a proven Enterprise Architecture methodology and framework used by the world's leading organizations" - The Open Group. SABSA calls itself "a proven methodology for developing business-driven, risk and opportunity focused Security Architectures" - SABSA Institute. The idea worth taking from SABSA even if you never certify is that every control should trace back to a business requirement, which is precisely the argument an architect has to win in section 1's trade-off conversations. In this sample they surfaced at a telehealth company (OpenLoop Health), two software and identity vendors ( Commvault and SailPoint) and a consultancy (GuidePoint Security); the cloud providers, AI labs and most product companies never mentioned them.

Sixth: writing that gets decisions made

Eighty-two postings mentioned writing or documentation, and every in-house role implies it. The documents that matter are short: a decision record, a one-page pattern, a threat model summary with three prioritised changes, an assessment report an executive can act on (GuidePoint's architect must "write clear assessment reports and present recommendations to C-Suite leadership"). Practise them now, in whatever job you hold.

6. Certifications, counted the way postings name them

Certification is a weak gate for this job. Of the 147 postings, 94 (64%) named no certification at all, and about four made one a firm requirement: Thales's cybersecurity consultant in Singapore (CRISC and CISA), GuidePoint's security operations architect (an architecture credential such as the CISSP, ISSAP or SABSA, plus SIEM, automation and cloud certificates), GuidePoint's senior data security architect (an Azure, Databricks or equivalent CISSP or CISM credential) and ePlus's principal security consultant (CRISC, CISA, CISSP). Everywhere else a certificate sits under "preferred", "a plus" or "such as".

Who names which certificate. The CISSP was the only certificate named often (48 postings, 33%), and its mentions were lopsided: 28 came from vendor-side roles and 12 from consulting, against 8 from in-house architects. That makes sense once you see who reads the certificate. A customer meeting a vendor's architect, or a client hiring a consultancy, has little else to judge expertise by before the first conversation; an internal hiring manager can test the person directly. The audit and risk credentials followed the same logic: CISA and CRISC were named mostly by consulting postings (6 of 9 and 4 of 6), and CISM was split between vendor-side advisers (10) and consultants (7). Cloud provider certificates came up in only thirteen postings in all, usually as a generic "cloud certification" rather than a named exam.

The ISSAP is the architect's certificate, and almost nobody asks for it. ISC2's architecture concentration tests four domains: governance, risk and compliance (21%), security architecture modeling (22%), infrastructure and system security (32%), and identity and access management architecture (25%), in 125 questions over three hours, on an outline effective from 1 August 2025 - ISC2 ISSAP exam outline. Its content maps neatly onto the job, which makes it a decent study plan. As a hiring signal it is nearly invisible: two postings named it, OpenLoop Health and GuidePoint Security, each as one choice in a list.

A sensible order. Do not collect certificates before you have the years they assume; under ISC2's five-year rule an early pass earns only Associate status anyway. If you aim at vendor-side or consulting architecture, the CISSP earns its keep, because it is the certificate those postings name. If you aim at an in-house seat, put the same time into a portfolio of designs and threat models (section 10), and add the CISSP when a target posting or a government contract requires it. A cloud certificate is worth it when your target employer runs on that cloud and you want structure for learning it. The board's certifications page recounts every certificate across open postings each hour, the CISSP and CCSP comparison and the CISSP and CISM comparison set the common pairs side by side, and the best-paid certifications page ranks them by the salaries printed beside them.

7. What security architects are paid

Of the 147 postings, 51 published an annual pay range in US dollars, spread over 24 employers. Four of those ranges were corrected by hand from the posting text, where the board's reader had caught only one figure (ePlus's two consulting seats, a Proofpoint consultant whose posting lists three regional ranges, of which the highest was used, and one AvePoint duplicate); a Zscaler range in Canadian dollars was left out. The middle range midpoint was about $213,600; the typical bottom of a range was $175,000 and the typical top $251,250. Half of all midpoints fell between $182,500 and $237,500.

By kind of architect. Pay tracks whose systems you design for more closely than it tracks the title.

The in-house group's 16 ranges came from nine employers: eight from security companies securing their own platforms (Zscaler, Palo Alto Networks, Okta and SailPoint) and four from AvePoint, which posted the same two identity architect roles in two cities. The figure therefore says as much about how a handful of vendors pay their own architects as about in-house work in general. The vendor-side figure splits sharply. Seven customer-facing ranges at OpenAI and Anthropic (applied AI architects for security customers and forward deployed engineers) had a middle of $320,000; Anthropic's applied AI architect for cyber was posted at $300,000 to $400,000 and OpenAI's forward deployed security engineer at $266,000 to $445,000. The other 20 vendor-side ranges, from security, data and cloud companies and resellers, centred on $210,025. Consulting stated the least, $166,325 across eight ranges, which follows from how a services firm earns: it sells hours, and an engineer's salary has to fit under the rate a client will pay for them.

By level. Titles with no level word centred on $214,550 (25 ranges), senior titles on $187,500 (12) and principal or distinguished titles on $225,000 (12); one staff range (Kraken, $127,200 to $254,400) and one manager range (OpenAI, $217,000 to $241,000) are too few to read. Senior sitting below unlevelled is a sampling effect, not a law: seven of the eight AI lab ranges carry no level word, while the senior group is mostly resellers' and vendors' customer-facing roles, several of which print base pay alone.

Read vendor ranges carefully: some are base pay, some include commission. Zscaler, Trace3, CoreWeave and Pure Storage printed base salary, and Zscaler and Trace3 say outright that commission or bonus is extra. Qualys marked its range as on-target earnings, Cohesity and Databricks print on-target earnings for commissioned roles, Anthropic does so for sales roles, and Palo Alto Networks gives base plus commission target for sales roles. A $200,000 base with a variable plan and a $200,000 on-target figure are different offers, so ask which one you are looking at.

Working from home carried no premium. The 22 fully remote ranges centred on a midpoint of $210,806, against $220,500 for the 29 hybrid or office-based ones.

Lowest and highest. At the bottom sat Long View Systems' security consultant in Houston at $115,840 to $152,040 and Trace3's governance, risk and AI governance architect at $135,000 to $163,000. Away from the two AI labs, the highest were Databricks' principal security field engineer at $270,300 to $371,700 and Palo Alto Networks' distinguished forward deployed engineer at $248,700 to $341,250; OpenAI's in-house architect for a device operating system stated $268,000 to $342,000. Five postings gave Canadian dollars instead: Long View's two principal architect seats at CAD 143,500 to 188,370 and its consultant at CAD 82,100 to 107,730, Zscaler's Canadian sales engineer at CAD 170,625 to 243,750, and OpenAI's applied AI architect in Canada at CA$236,000 to CA$262,500.

Live figures. The security architecture salary page rebuilds the specialty's band hourly from all of its open roles and breaks it down by level, work arrangement and employer. At this moment the specialty's median published salary reads $208k/yr, with a typical band running from $175k/yr to $343k/yr. The chart below reads the same figures for the specialties architects most often come from or move to.

Beside the government's numbers. No federal occupation is called security architect. The closest occupation in the Bureau of Labor Statistics handbook, computer network architects, earned a median $134,050 in May 2025 across 181,800 jobs, with growth of 8% projected from 2025 to 2035 and, notably for this guide, five years or more of experience in a related occupation as the usual entry condition - Bureau of Labor Statistics, page updated 27 August 2026. Information security analysts earned a median $129,180 - BLS analyst profile, updated 27 August 2026. The postings here state far more because the employers that print pay are mostly US technology and security companies hiring experienced people, not because the national figures are wrong. To place a specific offer, the salary calculator compares it with open roles at a similar level, and the ranking of best-paid security jobs shows where the architect title sits among the others.

8. Architect, principal engineer or manager: three ways up

Past senior level, a security career forks, and architecture is only one of the branches. The difference between them is what you own.

A principal or staff engineer owns a technical area and builds in it. Their output is systems and code: a detection platform, an identity service, a hardened build pipeline. They set direction for their area and are judged on whether it works. The security engineer guide covers that track.

An architect owns the decisions that many teams' systems must follow. Their output is patterns, standards, reviews and decision records, and they are judged on whether the whole estate converges on the safe shape. In the sample, principal and distinguished architecture titles centred on $225,000. The board's title pages put the two tracks side by side: late on 11 November the security architect title page showed a typical $188,000 to $336,000 across 87 roles, and the principal and staff engineer page $203,000 to $383,000 across 332. The engineering track reaches at least as high, so pay is a poor reason to pick architecture. The pivotal question is whether you get more satisfaction from building one thing well or from making a hundred things built by others safer.

A manager owns people and budget. Three postings in the sample managed architects: Nebius's security architect manager, who must lead the architecture function with seven years in security plus three managing technical teams; OpenAI's manager for its team of applied AI architects in cyber, who hires and coaches the team and balances presales against post-sale work; and Long View's principal architect team lead. Beyond management sits the security leadership track, with the CISO at its end, which our guide to the CISO role follows from the postings.

The tracks connect. Architecture is a natural step towards the CISO seat, because it trains the two things a CISO needs most: a view of the whole estate and the habit of explaining risk in business terms. It also prepares people for the vendor-side field CISO, an executive adviser who represents a security company to its customers' leaders, and an architect who misses building can return to principal engineering. None of these moves is final, and the postings are relaxed about the order: SailPoint's principal security architect may bring ten years in "cybersecurity, enterprise architecture, or security engineering".

9. On the vendor side: solutions architects, field engineers and consultants

Half the sample works for customers rather than for its own employer. These seats ask for fewer years than in-house architecture, travel more, and in presales are paid partly on results. They are also a practical route to in-house architecture later, because they compress design exposure: a sales engineer meets more customers' architectures in a year than most in-house engineers see in several.

Presales at vendors and resellers

A presales architect, whether titled solutions architect, sales engineer, domain consultant or field engineer, is the technical half of a sales team. The work follows the sale: discovery calls to understand the customer's environment, a design of how the product fits it, a demonstration, a proof of concept run against the customer's real data, written answers to security questionnaires and requests for proposals, and finally the technical win that lets the account executive close. Darktrace's graduate posting lists exactly that sequence, from proof of value engagements to "defining solution architectures" and presenting to "C-level Executives".

The numbers describe a customer-facing life. Of the 76 vendor-side postings, 64 used presales language, 47 mentioned customers' executives and 33 asked for travel; where a share was stated it ran from 20 to 30% at Qualys and 30 to 50% at Elastic to up to 75% for Thales's senior data security sales engineer in Bucharest. Thirty-nine asked for presales experience by name, so the usual first step is a junior or mid-level sales engineering seat: Check Point's sales engineer for exposure management wanted three years as a sales or solutions engineer, Palo Alto Networks' domain consultants three years of presales.

Two kinds of employer post these jobs. Security vendors sell their own products, so their architects go deep on one platform. Resellers and integrators (Trace3, Myriad360, GuidePoint Security, Long View Systems and Exclusive Networks in the sample) sell many vendors' products and design the combination; Trace3's regional principal architect works across Wiz, Palo Alto Networks and CrowdStrike, at $225,000 to $250,000, and Myriad360's presales architects need ten years in network engineering and security. Reseller roles give broader exposure; vendor roles give deeper knowledge of one platform.

Forward deployed engineers and applied AI architects

A newer variant sits after the sale. Forward deployed engineers embed with large customers to make a product work in production, writing code and integrations as they go. OpenAI posted three such seats for security (its forward deployed engineers for cyber in New York and San Francisco at $185,000 to $300,000 with travel up to 50%, and a forward deployed security engineer for public sector customers), Palantir one for US government customers, and Palo Alto Networks a distinguished one for its AI security product. The AI labs also post applied AI architects for security customers: Anthropic's describes the role as joining account teams that own the relationship, where "You bring the security depth they don't have time to build", and moving customers from one-off code scanning to sustained security work in their development and operations. Such roles want software engineering (OpenAI's forward deployed engineers want five years of it) as much as security, and they pay the most of anything in the sample.

Consultants and professional services

Consultants design for clients on paid projects. The 27 consulting postings came from services firms (GuidePoint, Thales's consulting practices, Long View, ePlus, Trellix, Bitdefender, Arctic Wolf) and from vendors' professional services teams, which deploy the vendor's product for a fee (Elastic, Zscaler, Proofpoint, GitLab, Cato Networks, SentinelOne, Palo Alto Networks, Darktrace). Their work ranges from architecture maturity reviews (GuidePoint's senior architect delivers security architecture reviews, zero trust maturity assessments and ransomware readiness assessments) to hands-on deployment (Long View's consultant rolls out Microsoft Defender and documents conceptual, logical and physical designs).

Consulting is the most accessible door in the sample, with a middle request of five years and several seats at two to three, and the least paid, centred on $166,325. It also carries the discipline of utilization: ePlus's managing consultant must keep a team to "documented utilization targets", which means a share of every week billed to clients. The trade is breadth for pay. A few years in a consultancy shows you more environments than a decade in one company, which is exactly the exposure an in-house architect posting assumes. The board's consulting and managed services employers page lists every open role at these firms.

OT and industrial systems

Three postings designed security for physical operations. Dragos posted a principal consultant in Singapore leading architecture reviews, threat assessments and executive tabletop exercises for power, oil and gas, water and manufacturing clients (ten years required), and a senior consultant in Australia asking three to five years of hands-on industrial control systems work with travel up to 30%. Thales's Eurosam joint venture wanted a cybersecurity architect for air defense systems, with a five-year engineering degree in cybersecurity and experience with radars and missile systems. The niche is small on this board, and it rewards people who come from the engineering side of plants and utilities as much as from IT security; the standard there, IEC 62443, appeared in two product postings (Neura Robotics).

10. Getting there from where you are now

The postings agree on the ingredients: years in a technical domain, breadth across the others, a habit of threat modeling, and evidence that you can make other people adopt a design. Where you start decides which ingredient you are missing.

From security engineering. You have depth and probably some reviews behind you. What you add is breadth and influence. Volunteer for the design reviews of systems outside your area, write the pattern for something your team does repeatedly, and keep a decision record for every non-trivial choice. When you can point to a pattern other teams adopted, you have the evidence an in-house posting looks for. Staff-level engineering is a real alternative at that point (section 8).

From cloud, platform or network engineering. You know how systems are actually built, which is what most architecture reviews lack. Add the attacker's view (identity escalation paths, lateral movement, what logs miss) and the language of risk. For the security side of cloud work, read the cloud security engineer guide. Network specialists have an unusually direct road: Palo Alto Networks' network security architect and Myriad360's presales architects both counted network engineering years.

From software engineering or application security. Product security architecture is your branch, and 23 postings sat in it. Product architects asked for software years most often of any group; BeyondTrust's principal role wanted ten years of hands-on software engineering and security architecture together. Add threat modeling across a whole product, cryptography and key management basics, and tenant isolation. The board's application security overview maps the neighbouring field.

From presales or a vendor's support team. You already present designs to customers. To move in-house, add depth: run your own lab, contribute to the product's reference architectures, and learn the controls your product does not cover. To stay on the vendor side, the path runs to principal or specialist architect and eventually field CISO.

From GRC, audit or risk. You know the frameworks and how to argue risk, which is half of the architect's conversation. The gap is technical credibility in a design review. Consulting architecture roles that blend assessment with technology (Trace3's architect for GRC and AI governance, Long View's consultant) are the natural bridge, and the GRC analyst guide describes the earlier step.

From operations or incident response. You know how designs fail, from the inside of incidents. Use it: write up the architectural root cause of the next incident you work, propose the pattern that would have prevented it, and get it adopted. That single artifact is a stronger application than any certificate.

The portfolio that substitutes for the title. Hiring managers for this job want to see judgment. Four artifacts show it: a threat model of a real (or realistic) system with its prioritised mitigations; a reference architecture for one common pattern, with the reasoning for each control; two or three decision records showing trade-offs you weighed; and a short assessment of a system against a framework such as the CISA zero trust maturity model, written for an executive reader. Keep them generic enough to share. Our cybersecurity resume guide explains how to turn them into résumé lines, and design and scenario questions of the kind architecture interviews favour are worked through in the interview questions guide. For the full map of specialties and how people move between them, see cybersecurity career paths.

11. Security architect careers: common questions

How many years before someone becomes a security architect?

Typically seven to ten years in technical security, engineering or presales work. Among postings giving a minimum, the median ask was seven years (eight for in-house roles), and 38 of 112 asked for ten or more. Consulting and vendor-side architecture can come sooner, with several seats at two to five years.

Can a security architect job be your first job?

Almost never. Only one of 147 postings, Darktrace's graduate solutions engineer, was pitched at graduates, and it is a presales seat. The realistic first steps are security or infrastructure engineering, a sales engineering seat at a vendor, or a junior consulting role, followed by a move into architecture once you can show designs you shaped.

Do security architects need a degree?

Less than you might expect. Only 50 of 147 postings mentioned a degree, and 29 of them would take equivalent experience in its place. Thales's French postings and a Korean one from Coupang are stricter, and Thales's air defense posting wanted a five-year engineering degree.

What certification should a security architect get?

The one postings name most is the CISSP (48 of 147), mostly in vendor-side and consulting roles, while 94 postings named no certificate at all. ISC2's architecture concentration, the ISSAP, matches the job closely but was named only twice. For in-house roles a portfolio of designs and threat models carries more weight than any certificate.

How much does a security architect earn?

Across the 51 sampled postings with US dollar ranges, the middle midpoint was about $213,600. In-house architects centred on $222,750, vendor-side roles at AI labs on $320,000 and other vendor-side roles on $210,025, and consultants on $166,325. Right now the specialty's live median reads $208k/yr.

Security architect vs security engineer: what separates them?

An engineer builds and runs controls; an architect decides which controls the systems of many teams must have and makes that decision spread, through reviews, patterns and standards. In practice the line is soft: 34 of the 41 in-house architecture postings described the work as hands-on.

What does a cloud security architect do differently?

A cloud security architect applies the same craft to cloud accounts, identity, networks and clusters, and usually expects infrastructure as code. In the sample, cloud and platform architects asked for Kubernetes or containers in all six postings, and cloud appeared in 102 of all 147 postings, so every kind of architect now needs working cloud knowledge.

Is security architecture a remote job?

Partly. Fifty-three of the 147 postings (36%) were fully remote. The share was lowest for in-house architects (9 of 41) and highest for consultants (13 of 27) and vendor-side roles (31 of 76), though those often involve travel to customers. Current remote openings, with the countries each one hires from, are on the remote architecture roles page.

Is a solutions architect the same as a security architect?

Not quite. A solutions architect at a security vendor designs how the vendor's product fits a customer's environment as part of a sale; an in-house security architect designs the employer's own systems. They share the craft, and the design exposure of a solutions role carries over well to in-house architecture. On this board, 76 of the 147 architecture postings were vendor-side roles of that kind.

Will AI replace security architects?

The postings suggest the opposite: 53 of the 147 asked architects to secure AI systems themselves, from prompt injection to identities for AI agents, and the best-paid roles in the sample were architecture and deployment seats at AI labs. AI is taking over some of the repetitive reviewing, and WHOOP already expects AI-assisted analysis in its threat modeling, with human oversight. The judgment about which risks a business should accept is the part employers keep paying for.

Security architecture is one of ten specialties this board tracks; the security architecture specialty guide describes it alongside the others, and readers who have never held a security job will find the first steps in our guide to getting into cybersecurity.