The Transformed Security Architect

Welcome to the documentation portal for The Transformed Security Architect: Role, Craft and Career in the Age of AI in European Enterprises and Public Authorities, Book 6 of The Architecture as Code Series by Gunnar Nordqvist. This site publishes the manuscript in a web-friendly format so that you can explore the chapters, diagrams and appendices directly in your browser. The source files are available in the repository at GitHub.

About the book

The earlier volumes of the series made architecture, governance, the AI platform and cyber defence executable, and examined the AI threat. All of them depend on the same person: the security architect, who designs the boundaries, the policy points, the containment, the identity model, the evidence chain and the stop paths on which their conclusions rest. The Transformed Security Architect describes what has happened to that person. Its thesis is that the role is being transformed, not abolished, through four shifts: Shift 1, from documents to code; Shift 2, from gatekeeper to boundary designer; Shift 3, from periodic to continuous, at machine speed; and Shift 4, from sole author to conductor of an AI team. What remains scarce, and therefore defines the role, is accountable human judgement: deciding what a boundary should be, verifying that code and AI output are sound, and answering for the decision to a board, a supervisor or a court. The book's conclusion qualifies the thesis: judgement must also keep pace with the volume that agents produce, the transformation is uneven between shifts and organisations, and the role can be lost through a sequence of reasonable delegations rather than by a decision.

The book is written for security architects and those who want to become one, for CISOs and heads of security architecture, for enterprise, solution and AI architects and engineering leads, for the people who hire and develop architects, and for procurement, risk, compliance and audit functions that depend on the architecture being sound. It covers the craft, the architect's own AI team, the role in the organisation, competence and career, and a year in the role at two fictional organisations: Nordvik Region, a regional public authority whose single security architect holds boundaries mostly through procurement, and Hansa Mutual, an insurance group whose team of six must keep architecture decisions in step with agents that act in production. Security content is defensive only.

The Architecture as Code Series

  1. Architecture as Code, published at aac.geon.se, supplies the underlying discipline.
  2. AI Governance, published at aig.geon.se, covers the regulatory map, risk management, governance as code, assurance, organisation and leadership.
  3. AI Platform and Security, published at aips.geon.se, covers the platform, DevSecMLOps, infrastructure, security and operations.
  4. AI Red Team, published at aired.geon.se, puts AI to work as an active part of cyber defence.
  5. AI Threat, published at aithreat.geon.se, examines the evidence for AI as a threat to people, society and control.
  6. The Transformed Security Architect (this book) describes what the security architect role has become and must become.

Each book stands on its own. Where a topic belongs to an earlier volume, this book summarises it and refers to that volume by chapter number.

How to use this site

  • Start with the Introduction for the thesis, the four shifts in brief and the two organisations that run through the book.
  • Follow the parts in order: the role in question, the craft, the architect's AI team, the role in the organisation, competence and career, and experience and conclusions.
  • Use the appendices for the glossary, the code examples, the templates and tools, and the bibliography.

All 27 chapters exist as first drafts and are under review. The Book Blueprint records the brief and status of every chapter, and Series Foundations records the conclusions from the earlier volumes that the book builds on. Contributors should also read the Chapter Authoring Guide.

Suggestions and corrections are welcome as issues or pull requests in the repository.