What an IT security architect does, and what federal data says about pay
General notes
- CISA publishes a Security Architect work role (code 652) whose tasks include performing security reviews, identifying gaps in security architecture and developing a security risk management plan.
- The work shows up as artifacts. Diagrams, threat models, design review findings, control traceability and decision records are the deliverables.
- The federal occupation system has no "security architect" category, so there is no official salary figure for the title. The closest federal statistics are proxies.
- In May 2025 BLS data, the median annual wage was $129,180 for information security analysts and $134,050 for computer network architects.
Job titles in security drift. “Security architect” can mean an enterprise strategist, a cloud platform specialist, or the person who signs off on application designs. The most stable description is the one the federal workforce framework uses, and the most useful one is the list of things the role actually produces.
What is the official description of the role?
CISA publishes the NICE Framework Security Architect work role, code 652.[1] Its core tasks include, among others:
- “Employ secure configuration management processes.” (T0084)
- “Identify and prioritize critical business functions in collaboration with organizational stakeholders.” (T0108)
- “Perform security reviews, identify gaps in security architecture, and develop a security risk management plan.” (T0177)
- Tasks on developing and integrating cybersecurity designs (T0071), documenting the organization’s security architecture (T0082), keeping acquired or developed systems consistent with that architecture (T0090), assessing the security impact of new systems and interfaces (T0268), and evaluating proposed security architectures and designs (T0328).
What does a security architect produce?
The tasks above turn into artifacts. If you are hiring for the role or moving into it, these are what to look for in a portfolio or a work sample:
| Artifact | What it shows | Related SP 800-53 control |
|---|---|---|
| Data-flow diagram with trust boundaries | Understands the system as built, not as sold | PL-8 Security and Privacy Architectures |
| Threat model | Can say what goes wrong, systematically | SA-11(2) Threat Modeling and Vulnerability Analyses |
| Design review findings | Can find gaps and get them fixed | CA-2 Control Assessments |
| Control traceability | Can speak the organization’s compliance language | PL-2 System Security and Privacy Plans |
| Decision records and accepted risks | Makes trade-offs explicit | RA-3 Risk Assessment |
The artifact list and its control associations are ours. They summarize common practice and the CISA tasks above; they are not an official job standard.
How much does a security architect earn?
There is no official answer for that exact title. None of the 15 detailed computer occupations in the 2018 Standard Occupational Classification, which BLS uses for wage statistics, is a security architect.[3] Wage data is published for occupations, not titles, so architects are counted in whichever occupation their employer reports.
We show the two occupations that we judge closest by name and scope. This is a proxy choice, not a BLS classification of the title:
| Occupation (SOC) | 10th pct. | 25th | Median | 75th | 90th | Employment |
|---|---|---|---|---|---|---|
| Information Security Analysts (15-1212) | $75,090 | $97,810 | $129,180 | $163,500 | $199,850 | 190,650 |
| Computer Network Architects (15-1241) | $79,900 | $104,620 | $134,050 | $168,200 | $202,680 | 179,740 |
Source: BLS Occupational Employment and Wage Statistics, May 2025 estimates, national, all industries.[2]
How to read it:
- Architects sit high in these distributions. The role is usually senior, so the 75th and 90th percentiles of these occupations are more relevant to most architect roles than the median. That is our inference from the role’s seniority, not a BLS figure.
- These are wages, not total pay. OEWS wages are straight-time gross pay; BLS lists exclusions that include non-production and year-end bonuses, profit-sharing payments and stock bonuses.[4] A pay site that counts salary, bonus and equity together can therefore show a higher figure for the same job.
- Location changes the picture. BLS also publishes estimates for states and roughly 530 metropolitan areas; national numbers hide regional differences.
Why do salary websites disagree so much?
Because they measure different things. Self-reported and job-posting samples differ by title spelling, seniority, company size, region and pay components. A page that reports “security architect” pay is reporting whatever its sample called a security architect. Treat any single number as a sample from a range, check what it includes, and anchor on the official distributions above when you need a defensible figure.
How do people move into the role?
Most paths run through hands-on work in an adjacent area (infrastructure, application development, security engineering, or governance) followed by responsibility for designs rather than implementations. Credentials can help signal architectural scope; we compare them, with issuer-verified details, in security architect certifications.
The most direct preparation is practice on the artifacts above. Run a STRIDE worksheet on a system you know, then a design review on the same system, and write up three findings with controls and owners.
References
- Security Architect (Work Role Code 652). Cybersecurity and Infrastructure Security Agency.Official documentation · checked 11/04/2026 (page)
- Occupational Employment and Wage Statistics, May 2025 (national, SOC 15-1212 and 15-1241). U.S. Bureau of Labor Statistics, 2025-05.Official dataset · checked 11/04/2026 (dataset)
- 2018 Standard Occupational Classification System: major groups (15-1200 Computer Occupations). U.S. Bureau of Labor Statistics, 2018.Official classification · checked 11/04/2026 (page)
- OEWS frequently asked questions: wage definition. U.S. Bureau of Labor Statistics.Official documentation · checked 11/04/2026 (page)
- SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations (OSCAL release 5.2.0). National Institute of Standards and Technology (Joint Task Force), 10/22/2026.Official standard (machine-readable) · checked 11/04/2026 (dataset)
Revisions
| Rev | Date | Description |
|---|---|---|
| 0 | First issue. |
Related sheets
ISSAP, Microsoft SC-100, CompTIA SecurityX and AWS Security Specialty side by side, with prerequisites and exam details checked on issuer pages.
A practical workflow for security design reviews, from scoping and diagrams to findings traced to NIST SP 800-53, CSF 2.0 and SP 800-171 controls.
How to apply STRIDE per element to a data-flow diagram, with a worked example of a document upload service and candidate NIST SP 800-53 controls for each threat.
More in Role and career.