安全架构师
安全架构师设计组织数字健康服务的安全，使患者信息保持保密、准确，并在照护需要时可用。他们制定安全模式和控制措施，评估新设计和供应商的安全风险，并帮助团队作出基于风险的决策，使服务既安全又便于临床医生和患者使用。
本文由人工智能助手从英文翻译而来，尚未经过母语人士审校。引自英国政府数字与数据专业能力框架（UK GDaD PCF）和 ESCO 的内容保留英文原文。
- 职族
- 架构
- UK GDaD PCF 角色
- Security architect (Architecture)
- ESCO 职业
- ICT system architect (ISCO-08 2511); cybersecurity risk manager (ISCO-08 2529)
级别
| 职级 | 角色级别 | UK GDaD PCF 级别 | 英国公务员职等 | 岗位评估分数 |
|---|---|---|---|---|
| 8a | 安全架构师 | Security architect | HEO/SEO/G7 | 560 |
| 8b | 首席安全架构师 | Lead security architect | G7/G6 | 613 |
| 8c | 主任安全架构师 | Principal security architect | G6 | 662 |
在数字医疗卫生组织中
- 医疗卫生组织经常成为勒索软件和数据窃取的目标，一次攻击就可能使临床服务停摆，因此可用性与保密性同样重要。
- 安全控制措施不得妨碍紧急照护，因此设计要在强身份验证与临床环境中的快速访问之间取得平衡。
- 联网医疗器械和遗留临床系统往往无法快速打补丁，因此架构师设计网络分段等补偿性控制措施。
- 许多员工、合作组织和供应商需要访问患者记录，因此身份、基于角色的访问和审计是核心。
- 安全设计必须支持信息治理义务和 ISO/IEC 27001 等已发布的安全标准。
UK GDaD PCF 角色描述
A security architect designs and builds secure solutions.
ESCO 职业与技能
ESCO 列出了雇主对每种职业通常需要（必备）或可能需要（可选）的技能和知识。可将其用作发展谈话的检查清单。
ICT system architect
ICT system architects design architecture, components, modules, interfaces, and data for a multi-components system to meet specified requirements.
必备技能和知识（23）
技能与能力
- acquire system component
- align software with system architectures
- analyse business requirements
- apply ICT systems theory
- assess ICT knowledge
- create data models
- define technical requirements
- design enterprise architecture
- design information system
- implement ICT security policies
- integrate system components
- manage database
- manage system testing
- use an application-specific interface
- use markup languages
知识
可选技能和知识（69）
技能与能力
- apply technical communication skills
- build business relationships
- design cloud architecture
- design database in the cloud
- design database scheme
- design for organisational complexity
- design process
- develop with cloud services
- manage cloud data and storage
- manage staff
- manage standards for data exchange
- perform resource planning
- plan migration to cloud
- provide cost benefit analysis reports
- solve ICT system problems
- use object-oriented programming
知识
- ABAP
- AJAX
- APL
- ASP.NET
- Agile project management
- Assembly (computer programming)
- C#
- C++
- COBOL
- CoffeeScript
- Common Lisp
- Erlang
- Groovy
- Haskell
- ICT process quality models
- ICT project management methodologies
- ICT security legislation
- ICT system integration
- ICT system programming
- Java (computer programming)
- JavaScript
- Lisp
- MATLAB
- ML (computer programming)
- Microsoft Visual C++
- Objective-C
- OpenEdge Advanced Business Language
- Oracle WebLogic
- PHP
- Pascal (computer programming)
- Perl
- Process-based management
- Prolog (computer programming)
- Python (computer programming)
- R
- Ruby (computer programming)
- SAP R3
- SAS language
- Scala
- Scratch (computer programming)
- Smalltalk (computer programming)
- Swift (computer programming)
- TypeScript
- VBScript
- Visual Basic
- computer programming
- defence standard procedures
- image recognition
- information structure
- lean project management
- model based system engineering
- security engineering
- task algorithmisation
cybersecurity risk manager
Cybersecurity risk managers identify, analyse, assess, estimate and mitigate cybersecurity-related risks of ICT infrastructures such as systems or services. They manage these aspects by planning risk analysis, applying, reporting, assessing, communicating, and treating them. They establish a risk management strategy for the organisation and ensure that risks remain at an acceptable level for the organisation by selecting mitigation actions and controls.
必备技能和知识（22）
技能与能力
- advice on security risk management
- communicate with stakeholders
- engage with stakeholders
- ensure adherence to organisational ICT standards
- establish an ICT security prevention plan
- establish an Information Security Management System
- implement ICT risk management
- manage system security
知识
- ICT network security risks
- ICT performance analysis methods
- ICT security standards
- assessment of risks and threats
- attack vectors
- cyber attack counter-measures
- cyber security
- ethical hacking principles
- information security strategy
- internal risk management policy
- risk management
- security engineering
- security threats
其他
可选技能和知识（50）
技能与能力
- define security policies
- define technology strategy
- design for organisational complexity
- develop information security strategy
- develop with cloud services
- execute ICT audits
- identify ICT security risks
- implement ICT security policies
- implement a firewall
- implement a virtual private network
- implement anti-virus software
- implement cloud security and compliance
- implement spam protection
- lead disaster recovery exercises
- manage disaster recovery plans
- manage keys for data protection
- remove computer virus or malware from a computer
- solve ICT system problems
- use ICT ticketing system
- use an application-specific interface
- use back-up and recovery tools
知识
- ICT encryption
- ICT problem management techniques
- ICT process quality models
- ICT project management
- ICT quality policy
- ICT recovery techniques
- ICT security legislation
- ICT system user requirements
- Internet of Things
- Open source model
- Outsourcing model
- audit techniques
- cloud monitoring and reporting
- cloud security and compliance
- computer forensics
- decision support systems
- domain name service
- hybrid model
- information confidentiality
- internet governance
- investment analysis
- legal requirements of ICT products
- levels of software testing
- mobile device management
- organisational resilience
- service-oriented modelling
- systems development life-cycle
- tools for ICT test automation
- web application security threats
Contains ESCO v1.2.1 data (https://esco.ec.europa.eu/). © European Union. Reuse authorised under Commission Decision 2011/833/EU.