Roadmaps Security roadmaps Application, engineering and product security
Design systems that are secure by structure: reference architectures, defence in depth, threat modelling, design review and zero trust across identity, network and data.
Estimated time: 15–26 months · At about 10 hours a week.
Click a topic to see what to learn and where. Mark topics as you go; your progress is saved in this browser only.
Least privilege, defence in depth, fail secure, separation of duties, minimise attack surface and keep it simple. Every design decision should trace to a principle.
Draw the system, find what can go wrong, decide what to do about it and check you did. STRIDE and attack trees are the common starting tools.
Security lives at the boundaries between components with different trust. Map the data flows and the boundaries before placing any control.
Preventive, detective and corrective controls, layered so that no single failure is fatal. Learn to reason about what each layer catches.
SABSA, TOGAF and the NIST frameworks give structure to architecture work. Use them as scaffolding, not as a substitute for thinking.
Learn to read network, application and data diagrams quickly and to draw your own clearly. Architecture is communicated through diagrams.
Verify explicitly, use least privilege and assume breach. Identity, device and context decide access, not network location.
Strong identity for users, devices and workloads is the foundation of zero trust. Design authentication, authorisation and policy decision points.
Segmentation, micro-segmentation and ZTNA replace the flat trusted network. Design so that compromise of one segment stays contained.
Landing zones, account structure, identity federation and guardrails. Cloud architecture mistakes are expensive to fix later.
Authentication at the edge, authorisation in the service, secrets handling and secure defaults. Set patterns that teams can reuse.
Review proposals early, ask the right questions, and give findings that teams can act on. A good review is a conversation, not a gate.
Write the standard patterns for common needs, such as a public web service or a data pipeline, so teams build securely by default.
Architecture choices are risk choices. Learn to quantify and compare options and to explain trade-offs to the business.
Most estates mix old and new. Design compensating controls for what cannot change and realistic paths for what can.
Assume components will fail or be compromised. Design for containment, recovery and graceful degradation, not only prevention.
Standards, review boards and exception processes keep architecture consistent without blocking delivery. Design the process as carefully as the systems.
AI systems, confidential computing and post-quantum cryptography each change the architecture. Learn to evaluate new technology against principles.
Set the multi-year direction for the security architecture, aligned to business strategy and technology change, and the standards that enforce it.
Architects rarely own the teams that build. Persuade with clear trade-offs, reusable patterns and early involvement.
Track adoption of reference patterns, zero trust maturity, exceptions and design review coverage. Show the architecture reducing risk.
Security architecture decides where controls go and how systems fit together so that security holds even when individual parts fail. It works at the level of designs, patterns and principles rather than single tools.
Zero trust is the dominant modern architecture: never trust by network location, always verify identity and device, and grant the least access needed. The role spans threat modelling new designs, reviewing proposals, setting reference patterns and translating risk into technical decisions.
Many breaches come from systems that were insecure by design, not by bug. Organisations need architects who can shape designs before they are built and lead the shift to zero trust across sprawling estates.
Take them in roughly this order. Costs and details for the ones marked with a link are on the Certifications page.
A common progression. Titles vary between companies.
All security roadmaps Back to top
Last reviewed: . Found a mistake, or want a roadmap written sooner? Contact