보안 아키텍트
보안 아키텍트는 환자 정보가 기밀로 유지되고, 정확하며, 돌봄에 필요할 때 쓸 수 있도록 조직의 디지털 헬스 서비스의 보안을 설계한다. 보안 패턴과 통제를 정하고, 새로운 설계와 공급자의 보안 리스크를 평가하며, 서비스를 임상의와 환자가 안전하고 쓰기 쉽게 유지하는 리스크 기반 판단을 팀이 내리도록 돕는다.
이 글은 AI 어시스턴트가 영어를 한국어로 번역한 것이며, 한국어 원어민의 검토는 아직 받지 않았습니다. 영국 정부 디지털·데이터 전문직 역량 프레임워크(UK GDaD PCF)와 ESCO의 인용문은 영어 그대로 두었습니다.
- 직군
- 아키텍처
- UK GDaD PCF 역할
- Security architect (Architecture)
- ESCO 직업
- ICT system architect (ISCO-08 2511); cybersecurity risk manager (ISCO-08 2529)
수준
| 밴드 | 역할 수준 | UK GDaD PCF 수준 | 공무원 등급 | 직무평가 점수 |
|---|---|---|---|---|
| 8a | 보안 아키텍트 | Security architect | HEO/SEO/G7 | 560 |
| 8b | 리드 보안 아키텍트 | Lead security architect | G7/G6 | 613 |
| 8c | 프린시펄 보안 아키텍트 | Principal security architect | G6 | 662 |
디지털 헬스 조직에서
- 의료 기관은 랜섬웨어와 데이터 탈취의 표적이 되기 쉽고 공격은 임상 서비스를 멈출 수 있으므로, 가용성은 기밀성만큼 중요하다.
- 보안 통제가 긴급한 돌봄을 방해해서는 안 되므로, 설계는 강력한 인증과 임상 현장에서의 빠른 접근 사이의 균형을 맞춘다.
- 연결된 의료기기와 오래된 임상 시스템은 곧바로 패치를 적용하지 못하는 경우가 많으므로, 아키텍트는 세그먼테이션 같은 보완 통제를 설계한다.
- 많은 직원, 파트너 조직, 공급자가 환자 기록에 접근해야 하므로, 아이덴티티, 역할 기반 접근, 감사가 중심이 된다.
- 보안 설계는 정보 거버넌스 의무와 ISO/IEC 27001 같은 공표된 보안 표준을 뒷받침해야 한다.
UK GDaD PCF 역할 설명
A security architect designs and builds secure solutions.
ESCO 직업과 스킬
ESCO는 각 직업에 대해 고용주가 보통 필요로 하는(필수) 또는 필요로 할 수 있는(선택) 스킬과 지식을 나열합니다. 성장에 관한 대화의 체크리스트로 쓰세요.
ICT system architect
ICT system architects design architecture, components, modules, interfaces, and data for a multi-components system to meet specified requirements.
필수 스킬과 지식(23)
스킬과 역량
- acquire system component
- align software with system architectures
- analyse business requirements
- apply ICT systems theory
- assess ICT knowledge
- create data models
- define technical requirements
- design enterprise architecture
- design information system
- implement ICT security policies
- integrate system components
- manage database
- manage system testing
- use an application-specific interface
- use markup languages
지식
선택 스킬과 지식(69)
스킬과 역량
- apply technical communication skills
- build business relationships
- design cloud architecture
- design database in the cloud
- design database scheme
- design for organisational complexity
- design process
- develop with cloud services
- manage cloud data and storage
- manage staff
- manage standards for data exchange
- perform resource planning
- plan migration to cloud
- provide cost benefit analysis reports
- solve ICT system problems
- use object-oriented programming
지식
- ABAP
- AJAX
- APL
- ASP.NET
- Agile project management
- Assembly (computer programming)
- C#
- C++
- COBOL
- CoffeeScript
- Common Lisp
- Erlang
- Groovy
- Haskell
- ICT process quality models
- ICT project management methodologies
- ICT security legislation
- ICT system integration
- ICT system programming
- Java (computer programming)
- JavaScript
- Lisp
- MATLAB
- ML (computer programming)
- Microsoft Visual C++
- Objective-C
- OpenEdge Advanced Business Language
- Oracle WebLogic
- PHP
- Pascal (computer programming)
- Perl
- Process-based management
- Prolog (computer programming)
- Python (computer programming)
- R
- Ruby (computer programming)
- SAP R3
- SAS language
- Scala
- Scratch (computer programming)
- Smalltalk (computer programming)
- Swift (computer programming)
- TypeScript
- VBScript
- Visual Basic
- computer programming
- defence standard procedures
- image recognition
- information structure
- lean project management
- model based system engineering
- security engineering
- task algorithmisation
cybersecurity risk manager
Cybersecurity risk managers identify, analyse, assess, estimate and mitigate cybersecurity-related risks of ICT infrastructures such as systems or services. They manage these aspects by planning risk analysis, applying, reporting, assessing, communicating, and treating them. They establish a risk management strategy for the organisation and ensure that risks remain at an acceptable level for the organisation by selecting mitigation actions and controls.
필수 스킬과 지식(22)
스킬과 역량
- advice on security risk management
- communicate with stakeholders
- engage with stakeholders
- ensure adherence to organisational ICT standards
- establish an ICT security prevention plan
- establish an Information Security Management System
- implement ICT risk management
- manage system security
지식
- ICT network security risks
- ICT performance analysis methods
- ICT security standards
- assessment of risks and threats
- attack vectors
- cyber attack counter-measures
- cyber security
- ethical hacking principles
- information security strategy
- internal risk management policy
- risk management
- security engineering
- security threats
기타
선택 스킬과 지식(50)
스킬과 역량
- define security policies
- define technology strategy
- design for organisational complexity
- develop information security strategy
- develop with cloud services
- execute ICT audits
- identify ICT security risks
- implement ICT security policies
- implement a firewall
- implement a virtual private network
- implement anti-virus software
- implement cloud security and compliance
- implement spam protection
- lead disaster recovery exercises
- manage disaster recovery plans
- manage keys for data protection
- remove computer virus or malware from a computer
- solve ICT system problems
- use ICT ticketing system
- use an application-specific interface
- use back-up and recovery tools
지식
- ICT encryption
- ICT problem management techniques
- ICT process quality models
- ICT project management
- ICT quality policy
- ICT recovery techniques
- ICT security legislation
- ICT system user requirements
- Internet of Things
- Open source model
- Outsourcing model
- audit techniques
- cloud monitoring and reporting
- cloud security and compliance
- computer forensics
- decision support systems
- domain name service
- hybrid model
- information confidentiality
- internet governance
- investment analysis
- legal requirements of ICT products
- levels of software testing
- mobile device management
- organisational resilience
- service-oriented modelling
- systems development life-cycle
- tools for ICT test automation
- web application security threats
Contains ESCO v1.2.1 data (https://esco.ec.europa.eu/). © European Union. Reuse authorised under Commission Decision 2011/833/EU.