Learning Paths, Certification, Hiring and Upskilling · The Transformed Security Architect: the course

All courses / The Transformed Security Architect / Module 5 / Chapter 22

Learning objectives

After the lesson the participant can:

Compare the four starting points for the role by what each is strong in, what to add first and the failure to watch.
Design a learning path on the four principles, with levels gated by demonstration and the first draft by the learner.
Explain what a certification validates and why a named certificate should not be a precondition in an advertisement.
Design an interview exercise with seeded flaws that runs in an unassisted and an assisted condition.

Key concepts

Four starting points: Security engineer, enterprise architect, developer and auditor. Each brings part of the framework and lacks another, so every path begins with an individual gap assessment against the six domains, not with a course catalogue.
Four principles of a learning path: Practice on real artefacts, fast feedback that the path manufactures, levels gated by demonstration instead of course completion, and protected unassisted practice under the rule: first draft by the learner, then the assistant.
Certification as a floor: A certification validates knowledge on the day of an examination, a real and inexpensive signal, but not one of judgement on the organisation's estate. Practical demonstration is the gate for levels in the competence record.
Two-condition exercise: An interview exercise run unassisted, showing what the candidate can design, and assisted, showing what the candidate can verify. The difference between the two scores is information about judgement.
Cooling-off period: A recorded interval before a person assures a system they helped to build, because an architect who designs a boundary and then assures it marks their own work. The chapter takes twelve months as a sensible default.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Interactive exercise 1 · Match

Four starting points and what to watch

Match each starting point for the role to the failure the chapter says to watch for.

Interactive exercise 2 · Scenario

Upskill, hire or contract

Apply the chapter's questions for choosing between upskilling and hiring.

Teaching plan

15 min	Lecture on the four starting points and the four principles of a learning path; participants identify their own starting point and the domain to add first.
10 min	The teacher walks through the certification table; groups rewrite a job advertisement that demands a named certificate, tool names and years of experience.
15 min	Read Hansa's profile HP-HM-2027-01 and exercise IX-HM-2027-01: sittings, counterbalanced order, seeded flaws, the decoy and why version B is the telling one.
30 min	Exercise: participants design an interview exercise for one decision in their role charter, with a flaw catalogue and scoring criteria.
5 min	Wrap-up on the entry route and the four responses an organisation controls.

Discussion

The chapter argues that an examination's power to separate doers from recallers weakens as assistants improve, and labels that its own conclusion. What follows for how you read a candidate's credentials?
Nordvik upskills its post-holder with an external mentor and builds a deputy; Hansa hires from outside for one post. Which questions in the upskilling-or-hiring table decided each case?
A contracted architect who leaves nothing behind adds dependence. What three conditions does the chapter set for such engagements, and how would you check them?

Written exercise

Exercise · 30 minutes

Design an interview exercise that tests judgement

Following the chapter's guide, design an interview exercise for a security architect post in your organisation. Choose one decision from the role charter, for example the boundary of a Mode 5 agent acting on a core system. Write a short scenario for a fictional organisation so that no confidential configuration is disclosed. List five to eight seeded flaws of different kinds, structural, authority, evidential, scope and reversibility, described as design mistakes, plus one decoy that is unusual but sound. Write scoring criteria that reward finding each flaw, explaining its consequence and proposing a remedy. Set the two conditions, their timings and order, and state the data policy for candidates' answers.

Deliverable: An exercise specification with scenario outline, restricted flaw catalogue, decoy, scoring criteria, the two sittings with timings and a candidate-data policy.

Your work

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

What is the chapter's rule for the use of an assistant during learning tasks?
Show the answer
D. First draft by the learner, then the assistant, used as reviewer or tutor
The rule is first draft by the learner, then the assistant, used as reviewer or tutor, because unrestricted assistance during practice lowers unaided performance afterwards. Supervised practice with Mode 3 tools comes only after the task can be done unaided.
In Hansa's hiring profile HP-HM-2027-01, how are applications screened?
Show the answer
B. By human review against the required levels, with no AI ranking of candidates
Screening is human review against the required levels with ai_ranking_of_candidates set to false, and the profile does not screen on tool names, years of experience or a named certificate. AI used to filter applications is high-risk under Annex III, point 4(a).
Which starting point does the chapter say is usually strong in law and evidence, and must add design and code first?
Show the answer
A. The auditor, who brings independence
The auditor is usually strong in law and evidence and adds design and code first; the failure to watch is fault found without a design owned. Nordvik's post-holder is closest to this path.