A security architect decides how your IT landscape is put together securely: which zones exist, how identities and data are protected, what a compliant cloud configuration looks like and which security principles every new project has to follow. Without that role, controls get invented project by project and you end up with a patchwork that is hard to operate and hard to defend in front of a regulator or auditor. MVPeople Group is a hyper-niche cybersecurity recruitment firm based in Amsterdam. We place security architects who understand both the big picture and the technical detail, for a fixed-term programme, a longer secondment or a permanent seat in your architecture team.
In short
You hire a security architect when security has to be designed into your systems, cloud platforms and networks rather than bolted on afterwards. MVPeople Group places security architects for cloud, zero trust, IAM and OT in the Netherlands, as interim specialists through MVPeople, on secondment through MVProfessionals or in permanent roles through MVPermanent.
A security architect translates business risk, regulation and your security policy into concrete design decisions. Typical outputs are a cloud reference architecture, a network segmentation model, a target architecture for identity and access management, or the security requirements every new application has to meet.
Day to day, the security architect writes architecture principles and patterns, reviews designs from other teams, runs threat modelling sessions and advises on vendor and tooling choices. Security architects often sit on an architecture board and have a voice in investment decisions.
The difference with a security engineer is the level of abstraction. Engineers build and configure; architects decide what should be built and why. The best architects have worked as engineers or consultants themselves, because a design that cannot be implemented in practice does not help anyone.
Demand for security architects usually follows change. Common triggers are a move to Azure, AWS or Google Cloud, a shift towards a zero trust model, merging IT environments after an acquisition, or replacing a legacy application landscape.
Regulation matters too. The NIS2 Directive, implemented in the Netherlands through the Cyberbeveiligingswet, requires essential and important entities to take appropriate risk management measures, including security in the acquisition, development and maintenance of network and information systems. DORA requires financial entities to maintain a documented ICT risk management framework. A security architect makes sure those requirements end up in the design, not just in policy documents.
Organisations also bring in a security architect when audit findings or a penetration test expose structural weaknesses. What you need then is not a one-off fix, but a design that stops the same issue from reappearing in ten other places.
Security architect is an umbrella term, and a good match starts with knowing which profile you are after.
An enterprise security architect works at organisation level and connects security to enterprise architecture and policy. A cloud security architect designs landing zones, guardrails and the security model for one or more cloud platforms; see also /expertise/cloud-security. An IAM architect focuses on identities, roles, privileged access and federation, closely linked to /expertise/iam. A solution security architect is attached to a programme or product and assesses the security of specific solutions.
In manufacturing, energy and water there is also the OT security architect, who works with industrial control systems and standards such as IEC 62443. That mix of IT security and process automation knowledge is scarce, so it pays to define the profile early and precisely.
Through MVPeople you hire an interim security architect, usually an independent specialist who sets up a programme or delivers a target architecture. This suits situations where you need senior capacity quickly for a defined period. An interim specialist can often start within 2 weeks.
Through MVProfessionals we second security architects who are employed by MVPeople. You get a dedicated team member for a longer period without becoming the employer yourself, which works well for multi-year cloud or transformation programmes.
If you want to build the capability in-house, MVPermanent recruits a security architect for a permanent position; see /services/mvpermanent. If you have a clearly scoped deliverable in mind, such as a complete reference architecture, it can also be run as a project through MVProjects.
For architects, a strong CV says little about actual level. We ask candidates to walk us through designs they produced, the trade-offs they made and what happened once the design met reality. A good security architect can explain why a control exists, which risk it addresses and what it costs you to leave it out.
We also assess the communication side. An architect who cannot win support from development, infrastructure and management produces documents that end up in a drawer. We look for experience with architecture boards, defending choices to senior leadership and working with suppliers.
We respond to your request within 4 hours. Suitable profiles are typically presented within 5 to 10 working days, depending on how scarce the profile is and any screening requirements.
The more specific the brief, the better the match. Describe which platform or domain is central, which outcomes you expect, such as a target architecture, a set of architecture principles or reviews of ongoing projects, and who the architect reports to.
Also state which frameworks apply: ISO 27001, BIO, NEN 7510, DORA or NIS2, and whether you use an internal architecture method such as TOGAF. An architect who already knows your frameworks becomes productive faster.
Not sure whether you need an architect, a CISO or a GRC specialist? We are happy to think it through with you. Strategic accountability sits with a CISO (/expertise/ciso), policy and compliance with /expertise/grc-compliance, and technical design with the security architect.
A security architect designs security; a security engineer builds and runs it. The architect sets principles, patterns and the target architecture, while the engineer configures firewalls, cloud policies, IAM tooling or monitoring according to that design. Many architects started as engineers, which helps them produce designs that can actually be implemented.
Commonly requested certifications are TOGAF, SABSA and CISSP-ISSAP for broad architecture work, and CCSP or platform certifications from AWS, Microsoft and Google for cloud. For OT environments, knowledge of IEC 62443 is relevant. Certifications are an indicator; proven design experience in a comparable environment carries more weight for us.
An interim security architect can often start within 2 weeks. We respond to your request within 4 hours and typically present suitable profiles within 5 to 10 working days. Scarce profiles, such as OT security architects, or additional screening can take longer.
Cost depends on seniority, domain and the type of engagement. Interim security architects work on a day rate, secondment is billed at a fixed hourly rate and a permanent hire involves a one-off fee. Contact us for a current market indication for your situation.
It is possible, but rarely the best use of the role. An ISO 27001 ISMS revolves around policy, risk management and governance, which is the territory of an information security officer or GRC specialist. The security architect makes sure the technical controls from that ISMS are designed properly. For the ISMS itself, see /expertise/grc-compliance.
Secure cloud infrastructure at scale. You design and implement AWS security controls, monitor for threats, and ensure compliance across cloud environments for a leading organisation.
Last updated by Mathijs Visser, Co-founder and Lead Consultant MVPeople Group.
Tell us about your challenge and we will respond within 4 hours with a first view of available profiles.
