Principal security architect

Band 8c · Security architect · 662 job evaluation points

UK GDaD PCF level: Principal security architect

Most often performed at Civil Service grade G6.

A principal security architect works on services of high complexity and risk, making decisions to enable the business to achieve its needs.
At this role level, you will:
work on projects with high strategic impact, setting a strategy that can be used in the long term and across the breadth of the organisation
communicate with a broad range of senior stakeholders and be responsible for defining the vision, principles and strategy for security architects
recommend security design across several projects or technologies, up to an organisational or inter-organisational level
have a deep and evolving level of technical expertise, so you can act as an exemplar
make and influence important business and architectural decisions
research, identify, validate and adopt new technologies and methodologies
be a recognised expert and demonstrate this expertise by solving unprecedented issues and problems
further the profession, demonstrating and sharing best practice within and outside the organisation

Contains public sector information from the UK Government Digital and Data Profession Capability Framework (https://understand-digital-data-roles-skills.service.gov.uk/), licensed under the Open Government Licence v3.0. © Crown copyright.

Responsibilities

Set the organisation's security architecture vision, principles, and strategy.
Advise the executive team and board on cyber security risk to patient care and services.
Make sure cyber resilience, including recovery from a major attack, is designed into critical clinical services.
Represent the organisation in cross-organisation cyber security and standards communities.
Lead the security architecture practice and develop its people.

Skills

Skill	Expected level	What this level means
AnalysisUK GDaD PCF	Expert (4)	You can: provide direction and lead on change regarding factors that feed into analysis monitor changes in the technical environment and assess whether risks are still at acceptable levels or whether previous decisions need to be revisited direct and influence others on best practice and policy
Communication (security architect)UK GDaD PCF	Expert (4)	You can: demonstrate expert understanding of security concepts and can apply them to a technical level, at the highest levels of risk complexity effectively translate and accurately communicate security and risk implications at the most senior levels across technical and non-technical stakeholders successfully respond to challenges manage stakeholder expectations across high risk and complexity or under constrained timescales
Designing secure systemsUK GDaD PCF	Expert (4)	You can: lead design and review solutions to complex problems with system architectures by defining and challenging patterns and principles create precedents and set direction
Enabling and informing risk-based decisionsUK GDaD PCF	Expert (4)	You can: act as a point of escalation be trusted by senior risk owners as an expert in security apply risk methodologies at the most complex levels of risk
Research and innovationUK GDaD PCF	Practitioner (3)	You can: contribute to and inform developments on security properties in technology identify new technologies and design the use of these in the business context across the organisation engage with the broader security community
Security technologyUK GDaD PCF	Expert (4)	You can: explain complex system architectures identify and explain how easy or difficult it will be to exploit vulnerabilities lead and influence security technology in the security industry
Understanding security implications of transformationUK GDaD PCF	Expert (4)	You can: challenge and lead changes to policy and processes to support business outcomes, business architecture, and legal and political implications
Understanding health and care servicesThis reference	Practitioner (3)	You can: analyse how a service fits into care pathways across organisations work with clinicians, care staff, and patients to shape digital services explain the effect of digital decisions on care, safety, and staff workload
Information governance and data protectionThis reference	Expert (4)	You can: set information governance policy and strategy advise the board on information risk and compliance represent the organisation with regulators and partners
Identity and access managementThis reference	Expert (4)	You can: set the identity and access strategy for staff, patients, and systems lead the adoption of new identity standards
Vulnerability managementThis reference	Practitioner (3)	You can: prioritise vulnerabilities by risk, including to patient services scope and manage penetration tests and remediation
Security operationsThis reference	Practitioner (3)	You can: investigate and contain security incidents write detection rules and threat hunts improve runbooks and tooling after incidents
Clinical risk managementThis reference	Practitioner (3)	You can: lead hazard identification and risk assessment for a product or change write and maintain hazard logs and clinical safety case reports agree risk controls with product teams and check that they work advise teams on applying clinical risk management standards
Medical device software regulationThis reference	Working (2)	You can: follow a software life cycle process that meets medical device standards produce the records that such a process requires
Organisational risk managementThis reference	Expert (4)	You can: design the organisation's risk management framework and appetite advise the board on strategic risks
People managementThis reference	Practitioner (3)	You can: line manage a team, setting objectives and running appraisals support wellbeing and manage attendance, performance, and conduct plan the team's development and succession

Typical qualifications and experience

Extensive experience of leading security architecture across organisations.

Band 8c outline

Knowledge: Expert knowledge, and wide organisational and sector understanding.
Autonomy: Sets strategy for a function; accountable to a director.
Scope: A function or department.
Leadership: Leads a function through several management layers.
Accountability: A function's performance, workforce, and budget.

Job evaluation (illustrative)

Factor	Level	Level summary	Points
Communication and relationship skills	6	Gives highly complex, highly contentious information where there are significant barriers to acceptance, using the highest level of communication skills.	60
Knowledge, training, and experience	8	Advanced knowledge (doctorate plus further training or equivalent), or specialist knowledge across more than one discipline built over a long period.	240
Analytical and judgemental skills	5	Judgements on highly complex facts or situations needing analysis, interpretation, and comparison of options.	60
Planning and organisational skills	5	Forms long-term strategic plans, with uncertainty and effects across the organisation.	60
Physical skills	2	Skills gained through practice, such as standard keyboard use or driving.	15
Responsibility for patient and client care	1	Helps patients, clients, or relatives during incidental contact.	4
Responsibility for policy and service development	5	Implements and develops a range of policies or services for a directorate.	45
Responsibility for financial and physical resources	3	Authorises payments, buys some assets or supplies, monitors or holds a delegated budget, or maintains assets.	21
Responsibility for people	3	Manages a group of staff day to day, teaches core or specialist training, or gives core HR advice.	21
Responsibility for information resources	6	Manages and develops information systems across the organisation as the main duty.	46
Responsibility for research and development	2	Regularly does research, development, trials, or equipment and system testing as part of the job.	12
Freedom to act	5	Works within general policies, and in most cases decides how to interpret them.	45
Physical effort	1	Sitting, standing, and walking, with little physical effort.	3
Mental effort	4	Frequent prolonged concentration, or occasional intense concentration.	18
Emotional effort	1	Rare exposure, or occasional indirect exposure, to distressing circumstances.	5
Working conditions	2	Occasional unpleasant conditions, frequent travel or outdoor work, or near-continuous screen use on most days.	7
Total (Band 8c: 630 to 674)			662