Security Architect - Sasha

Boots on the Ground

"Walk me through how this actually sits in the process — not how the vendor sold it."

Quick facts

Role

Works at the upper layers of a SABSA-style model: contextual and conceptual architecture (business processes, risk, control objectives) and logical services (how security should work). She does not sit in product consoles — that is the component and operational layer, owned by product owners, admins, and engineers who run the tech. Sasha talks to those people, and to vendors, then turns what she hears into architecture, delivery plans, and review-board conditions. Often owns a domain (EDR, IAM, email security, SIEM) rather than the whole stack.

A day/week in her calendar

• Designing security into business processes — working with teams to define how controls, tooling, and operating models should work before and as work is delivered.
• Vendor meetings: evaluating products, listening to what is being sold, and translating that into what the organisation would actually need to implement.
• Time with stakeholders on the ground (platform engineers, SOC, IAM, business owners) to understand how work really happens, then turning that into architecture and delivery plans.
• Sitting on review boards when new technology or projects are being approved — the person expected to challenge, condition, or sign off whether something is secure enough to proceed.

Objectives

• Get an accurate, evidenced picture of what's really deployed and used — not what procurement paperwork says was bought.
• Be believed. Findings need to survive scrutiny from Harry and, eventually, the board.
• Reduce the sheer manual grind of stack investigation so there's time for actual security work.
• Avoid being the one who "should have known" when an incident review turns up something she'd have found with more time.

Pain points

• The single biggest time sink is manual: chasing down who owns what, whether it's still deployed, whether it overlaps with something else — done from scratch, repeatedly, per category. Independent estimates put the stack at 45 cybersecurity tools (analysts actively using fewer than half on any given day)^[1] or 61 security tools each watching its own slice^[2]. In 2025, almost half of SaaS licenses paid for were never used (more than $20bn wasted spend)^[3].
• Tribal knowledge is scattered across people, not systems. APQC found only around 8% of organizations consistently capture knowledge from departing employees, and 16% make no attempt at all^[4] — meaning the people with the answer may have left, be on leave, or simply not remember.
• Discovery is incomplete by design — tools bought outside "the security budget line" by other departments don't show up in any inventory she controls.
• Her evidence is only as credible as her ability to document and defend it — informal "I checked, it's fine" doesn't survive an audit, and undocumented tribal knowledge is increasingly treated as a liability in due diligence, insurance, and regulatory contexts, not just an inefficiency.

Relationships

• Harry the Head of Cyber: reports up, is the primary source of the evidence base for every renewal/consolidation decision. Often feels her work is under-visible until something goes wrong.
• Simon the CISO: essentially no direct relationship; occasionally visible via incident write-ups or big consolidation wins.
• Paige the Procurement Officer: ad hoc, usually reactive — Paige asks "is this still needed" close to a renewal date, and Sasha has to drop something else to answer under time pressure.

Empathy Mapping

Says

Does

Thinks

Feels

Design & marketing angle

Not the buyer, but the credibility engine — if ESProfiler's evidence doesn't hold up to Sasha's scrutiny, Harry won't trust it either. She is the person most likely to be working in ESProfiler every day: running the investigation, maintaining the evidence, and keeping the estate picture current.

Product marketing/UX aimed here should emphasize speed (minutes, not weeks), rigor (structured evidence, not hallway knowledge), and making her existing tacit expertise visible and defensible upward, rather than replacing her.

The key play for ESProfiler at this level is force-multiplier not a replacement for her.

Sources

• [1] Secure.com, security tool sprawl — 45 tools; analysts use fewer than half on a given day
• [2] NHIMG / Securiti, tool sprawl and context loss — 61 security tools
• [3] Help Net Security — almost half of paid SaaS licenses unused
• [4] APQC via Argus Labs, The Tribal Knowledge Problem — 8% capture departing knowledge; 16% make no attempt