[{"data":1,"prerenderedAt":832},["ShallowReactive",2],{"navigation_docs":3,"-design-personas-03-security-architect-sasha":369,"-design-personas-03-security-architect-sasha-surround":827},[4,8,72,102,220,266,280,301,365],{"title":5,"path":6,"stem":7},"Introduction","\u002Fintroduction","0.introduction",{"title":9,"icon":10,"path":11,"stem":12,"children":13,"page":67},"Company","i-lucide-building-2","\u002Fcompany","1.company",[14,18,22,26,30,34,38,42,46,50,54,68],{"title":15,"path":16,"stem":17},"About","\u002Fcompany\u002Fabout","1.company\u002F0.about",{"title":19,"path":20,"stem":21},"Values","\u002Fcompany\u002Fvalues","1.company\u002F1.values",{"title":23,"path":24,"stem":25},"Communication","\u002Fcompany\u002Fcommunication","1.company\u002Fcommunication",{"title":27,"path":28,"stem":29},"Competition","\u002Fcompany\u002Fcompetition","1.company\u002Fcompetition",{"title":31,"path":32,"stem":33},"Hybrid Working","\u002Fcompany\u002Fhybrid-working","1.company\u002Fhybrid-working",{"title":35,"path":36,"stem":37},"Manchester Office","\u002Fcompany\u002Foffice","1.company\u002Foffice",{"title":39,"path":40,"stem":41},"Operations","\u002Fcompany\u002Foperations","1.company\u002Foperations",{"title":43,"path":44,"stem":45},"Policies","\u002Fcompany\u002Fpolicies","1.company\u002Fpolicies",{"title":47,"path":48,"stem":49},"Problem Statement","\u002Fcompany\u002Fproblem-statement","1.company\u002Fproblem-statement",{"title":51,"path":52,"stem":53},"Product Strategy","\u002Fcompany\u002Fproduct-strategy","1.company\u002Fproduct-strategy",{"title":55,"path":56,"stem":57,"children":58,"page":67},"Products","\u002Fcompany\u002Fproducts","1.company\u002Fproducts",[59,63],{"title":60,"path":61,"stem":62},"Capability Exchange","\u002Fcompany\u002Fproducts\u002Fcapability-exchange","1.company\u002Fproducts\u002Fcapability-exchange",{"title":64,"path":65,"stem":66},"ESProfiler Platform","\u002Fcompany\u002Fproducts\u002Fesprofiler","1.company\u002Fproducts\u002Fesprofiler",false,{"title":69,"path":70,"stem":71},"Security","\u002Fcompany\u002Fsecurity","1.company\u002Fsecurity",{"title":73,"icon":74,"path":75,"stem":76,"children":77,"page":67},"People Ops","i-lucide-users","\u002Fpeople-ops","2.people-ops",[78,82,86,90,94,98],{"title":79,"path":80,"stem":81},"Compensation","\u002Fpeople-ops\u002Fcompensation","2.people-ops\u002Fcompensation",{"title":83,"path":84,"stem":85},"Education","\u002Fpeople-ops\u002Feducation","2.people-ops\u002Feducation",{"title":87,"path":88,"stem":89},"Expenses","\u002Fpeople-ops\u002Fexpenses","2.people-ops\u002Fexpenses",{"title":91,"path":92,"stem":93},"Holiday & Leave","\u002Fpeople-ops\u002Fleave","2.people-ops\u002Fleave",{"title":95,"path":96,"stem":97},"Onboarding","\u002Fpeople-ops\u002Fonboarding","2.people-ops\u002Fonboarding",{"title":99,"path":100,"stem":101},"Recruitment","\u002Fpeople-ops\u002Frecruitment","2.people-ops\u002Frecruitment",{"title":103,"icon":104,"path":105,"stem":106,"children":107,"page":67},"Engineering","i-lucide-rocket","\u002Fengineering","3.engineering",[108,151,155,175,196,200,208,212,216],{"title":109,"path":110,"stem":111,"children":112,"page":67},"Contributing","\u002Fengineering\u002Fcontributing","3.engineering\u002Fcontributing",[113,117,121,125,129,142],{"title":114,"path":115,"stem":116},"Development Setup","\u002Fengineering\u002Fcontributing\u002Fdevelopment-setup","3.engineering\u002Fcontributing\u002F1.development-setup",{"title":118,"path":119,"stem":120},"Engineering Operations","\u002Fengineering\u002Fcontributing\u002Fengineering-operations","3.engineering\u002Fcontributing\u002F2.engineering-operations",{"title":122,"path":123,"stem":124},"Documentation","\u002Fengineering\u002Fcontributing\u002Fdocumentation","3.engineering\u002Fcontributing\u002F3.documentation",{"title":126,"path":127,"stem":128},"Agentic Coding","\u002Fengineering\u002Fcontributing\u002Fagentic-coding","3.engineering\u002Fcontributing\u002Fagentic-coding",{"title":130,"path":131,"stem":132,"children":133,"page":67},"Back End","\u002Fengineering\u002Fcontributing\u002Fback-end","3.engineering\u002Fcontributing\u002Fback-end",[134,138],{"title":135,"path":136,"stem":137},"API Guidelines","\u002Fengineering\u002Fcontributing\u002Fback-end\u002Fapi-guidelines","3.engineering\u002Fcontributing\u002Fback-end\u002Fapi-guidelines",{"title":139,"path":140,"stem":141},"LLM Prompts & Langfuse Integration","\u002Fengineering\u002Fcontributing\u002Fback-end\u002Fllm-prompts","3.engineering\u002Fcontributing\u002Fback-end\u002Fllm-prompts",{"title":143,"path":144,"stem":145,"children":146,"page":67},"Front End","\u002Fengineering\u002Fcontributing\u002Ffront-end","3.engineering\u002Fcontributing\u002Ffront-end",[147],{"title":148,"path":149,"stem":150},"Testing","\u002Fengineering\u002Fcontributing\u002Ffront-end\u002Ftesting","3.engineering\u002Fcontributing\u002Ffront-end\u002Ftesting",{"title":152,"path":153,"stem":154},"Production Database","\u002Fengineering\u002Fdatabase-connection","3.engineering\u002Fdatabase-connection",{"title":156,"path":157,"stem":158,"children":159},"Deployment","\u002Fengineering\u002Fdeployment","3.engineering\u002Fdeployment",[160,163,167,171],{"title":60,"path":161,"stem":162},"\u002Fengineering\u002Fdeployment\u002Fcapability-exchange","3.engineering\u002Fdeployment\u002Fcapability-exchange",{"title":164,"path":165,"stem":166},"Langfuse Deployment","\u002Fengineering\u002Fdeployment\u002Fecs-langfuse-deployment","3.engineering\u002Fdeployment\u002Fecs-langfuse-deployment",{"title":168,"path":169,"stem":170},"ESP Platform Configuration","\u002Fengineering\u002Fdeployment\u002Fesp-platform-configuration","3.engineering\u002Fdeployment\u002Fesp-platform-configuration",{"title":172,"path":173,"stem":174},"Platform","\u002Fengineering\u002Fdeployment\u002Fplatform","3.engineering\u002Fdeployment\u002Fplatform",{"title":176,"path":177,"stem":178,"children":179,"page":67},"Github","\u002Fengineering\u002Fgithub","3.engineering\u002Fgithub",[180,184,188,192],{"title":181,"path":182,"stem":183},"Packages","\u002Fengineering\u002Fgithub\u002Fpackages","3.engineering\u002Fgithub\u002Fpackages",{"title":185,"path":186,"stem":187},"Personal Access Token","\u002Fengineering\u002Fgithub\u002Fpersonal-access-token","3.engineering\u002Fgithub\u002Fpersonal-access-token",{"title":189,"path":190,"stem":191},"Troubleshooting","\u002Fengineering\u002Fgithub\u002Ftroubleshooting","3.engineering\u002Fgithub\u002Ftroubleshooting",{"title":193,"path":194,"stem":195},"Workflows","\u002Fengineering\u002Fgithub\u002Fworkflows","3.engineering\u002Fgithub\u002Fworkflows",{"title":197,"path":198,"stem":199},"Platform Ops","\u002Fengineering\u002Fplatform-ops","3.engineering\u002Fplatform-ops",{"title":172,"path":201,"stem":202,"children":203,"page":67},"\u002Fengineering\u002Fplatform","3.engineering\u002Fplatform",[204],{"title":205,"path":206,"stem":207},"useAPI","\u002Fengineering\u002Fplatform\u002Fuse-api","3.engineering\u002Fplatform\u002Fuse-api",{"title":209,"path":210,"stem":211},"Project Management","\u002Fengineering\u002Fproject-management","3.engineering\u002Fproject-management",{"title":213,"path":214,"stem":215},"Releases","\u002Fengineering\u002Frelease","3.engineering\u002Frelease",{"title":217,"path":218,"stem":219},"Tools","\u002Fengineering\u002Ftools","3.engineering\u002Ftools",{"title":221,"icon":222,"path":223,"stem":224,"children":225,"page":67},"Design","i-lucide-palette","\u002Fdesign","4.design",[226,247,251,255,259,262],{"title":227,"path":228,"stem":229,"children":230,"page":67},"Personas","\u002Fdesign\u002Fpersonas","4.design\u002F0.personas",[231,235,239,243],{"title":232,"path":233,"stem":234},"CISO - Simon","\u002Fdesign\u002Fpersonas\u002F01-ciso-simon","4.design\u002F0.personas\u002F01-ciso-simon",{"title":236,"path":237,"stem":238},"Head of Cyber - Harry","\u002Fdesign\u002Fpersonas\u002F02-head-of-cyber-harry","4.design\u002F0.personas\u002F02-head-of-cyber-harry",{"title":240,"path":241,"stem":242},"Security Architect - Sasha","\u002Fdesign\u002Fpersonas\u002F03-security-architect-sasha","4.design\u002F0.personas\u002F03-security-architect-sasha",{"title":244,"path":245,"stem":246},"Procurement Officer - Paige","\u002Fdesign\u002Fpersonas\u002F04-procurement-officer-paige","4.design\u002F0.personas\u002F04-procurement-officer-paige",{"title":248,"path":249,"stem":250},"Design Thinking","\u002Fdesign\u002Fdesign-thinking","4.design\u002F1.design-thinking",{"title":252,"path":253,"stem":254},"Design & Development","\u002Fdesign\u002Fdesign-and-development","4.design\u002F3.design-and-development",{"title":256,"path":257,"stem":258},"Branding","\u002Fdesign\u002Fbranding","4.design\u002F4.branding",{"title":217,"path":260,"stem":261},"\u002Fdesign\u002Ftools","4.design\u002F5.tools",{"title":263,"path":264,"stem":265},"Customer Success","\u002Fdesign\u002Fworking-with-customers","4.design\u002F6.working-with-customers",{"title":267,"icon":268,"path":269,"stem":270,"children":271,"page":67},"Sales","i-lucide-dollar-sign","\u002Fsales","4.sales",[272,276],{"title":273,"path":274,"stem":275},"Customer Onboarding","\u002Fsales\u002Fonboarding","4.sales\u002Fonboarding",{"title":277,"path":278,"stem":279},"Sales Tools","\u002Fsales\u002Ftools","4.sales\u002Ftools",{"title":281,"icon":282,"path":283,"stem":284,"children":285,"page":67},"Marketing","i-lucide-book-image","\u002Fmarketing","5.marketing",[286,290,294,297],{"title":287,"path":288,"stem":289},"Content","\u002Fmarketing\u002Fcontent","5.marketing\u002Fcontent",{"title":291,"path":292,"stem":293},"Messaging","\u002Fmarketing\u002Fmessaging","5.marketing\u002Fmessaging",{"title":217,"path":295,"stem":296},"\u002Fmarketing\u002Ftools","5.marketing\u002Ftools",{"title":298,"path":299,"stem":300},"Website","\u002Fmarketing\u002Fwebsite","5.marketing\u002Fwebsite",{"title":302,"icon":303,"path":304,"stem":305,"children":306,"page":67},"AI & Data Ops","i-lucide-database","\u002Fdata-ops","6.data-ops",[307,315,319,344,361],{"title":60,"path":308,"stem":309,"children":310,"page":67},"\u002Fdata-ops\u002Fcapability-exchange","6.data-ops\u002FCapability Exchange",[311],{"title":312,"path":313,"stem":314},"Leaderboard Calculation","\u002Fdata-ops\u002Fcapability-exchange\u002Fleaderboard-calculation","6.data-ops\u002FCapability Exchange\u002Fleaderboard-calculation",{"title":316,"path":317,"stem":318},"Account Portal (CAS)","\u002Fdata-ops\u002Faccount-portal","6.data-ops\u002Faccount-portal",{"title":320,"path":321,"stem":322,"children":323,"page":67},"Data Management","\u002Fdata-ops\u002Fdata-management","6.data-ops\u002Fdata-management",[324,328,332,336,340],{"title":325,"path":326,"stem":327},"Adding Products","\u002Fdata-ops\u002Fdata-management\u002Fadding-products","6.data-ops\u002Fdata-management\u002Fadding-products",{"title":329,"path":330,"stem":331},"Adding Vendors","\u002Fdata-ops\u002Fdata-management\u002Fadding-vendors","6.data-ops\u002Fdata-management\u002Fadding-vendors",{"title":333,"path":334,"stem":335},"Framework Mapping","\u002Fdata-ops\u002Fdata-management\u002Fframework-mapping","6.data-ops\u002Fdata-management\u002Fframework-mapping",{"title":337,"path":338,"stem":339},"Refreshing Vendors","\u002Fdata-ops\u002Fdata-management\u002Frefreshing-vendors","6.data-ops\u002Fdata-management\u002Frefreshing-vendors",{"title":341,"path":342,"stem":343},"Reviewing Draft Vendors","\u002Fdata-ops\u002Fdata-management\u002Freviewing-draft-vendors","6.data-ops\u002Fdata-management\u002Freviewing-draft-vendors",{"title":345,"path":346,"stem":347,"children":348,"page":67},"LLM Ops","\u002Fdata-ops\u002Fllm-ops","6.data-ops\u002Fllm-ops",[349,353,357],{"title":350,"path":351,"stem":352},"Agents","\u002Fdata-ops\u002Fllm-ops\u002Fagents","6.data-ops\u002Fllm-ops\u002F1.agents",{"title":354,"path":355,"stem":356},"ESPi Architecture & Query Flow","\u002Fdata-ops\u002Fllm-ops\u002Fespi-architecture","6.data-ops\u002Fllm-ops\u002F2.espi-architecture",{"title":358,"path":359,"stem":360},"Evaluating Agents","\u002Fdata-ops\u002Fllm-ops\u002Fevaluations","6.data-ops\u002Fllm-ops\u002F3.evaluations",{"title":362,"path":363,"stem":364},"Message Queues","\u002Fdata-ops\u002Fmessage-queues","6.data-ops\u002Fmessage-queues",{"title":366,"path":367,"stem":368},"Glossary","\u002Fglossary","glossary",{"id":370,"title":240,"body":371,"description":820,"extension":821,"links":822,"meta":823,"navigation":824,"path":241,"seo":825,"stem":242,"__hash__":826},"docs\u002F4.design\u002F0.personas\u002F03-security-architect-sasha.md",{"type":372,"value":373,"toc":800},"minimark",[374,379,386,390,459,464,468,479,483,499,503,517,521,584,588,608,612,617,646,650,680,684,714,718,748,752,755,758,765,769],[375,376,378],"h2",{"id":377},"boots-on-the-ground","Boots on the Ground",[380,381,382],"blockquote",{},[383,384,385],"p",{},"\"Walk me through how this actually sits in the process — not how the vendor sold it.\"",[375,387,389],{"id":388},"quick-facts","Quick facts",[391,392,393,404],"table",{},[394,395,396],"thead",{},[397,398,399,402],"tr",{},[400,401],"th",{},[400,403],{},[405,406,407,419,429,439,449],"tbody",{},[397,408,409,416],{},[410,411,412],"td",{},[413,414,415],"strong",{},"Title",[410,417,418],{},"Security Architect, Senior Security Engineer",[397,420,421,426],{},[410,422,423],{},[413,424,425],{},"Company profile",[410,427,428],{},"10,000+ employees, $1bn+ revenue",[397,430,431,436],{},[410,432,433],{},[413,434,435],{},"Budget authority",[410,437,438],{},"None — influences spend heavily through the evidence she surfaces",[397,440,441,446],{},[410,442,443],{},[413,444,445],{},"Reports to",[410,447,448],{},"Harry the Head of Cyber \u002F Chief Security Architect",[397,450,451,456],{},[410,452,453],{},[413,454,455],{},"Primary motivation",[410,457,458],{},"Be believed — her findings need to survive scrutiny all the way to the board",[460,461],"mermaid",{":zoom":462,"code":463},"1","flowchart TD\n    Harry[\"Harry the Head of Cyber\"]\n    Sasha[\"Sasha the Security Architect\"]\n    Owners[\"Vendors, product owners, admins\u003Cbr\u002F>(people who run the tech)\"]\n\n    Harry --> Sasha\n    Sasha -.\"architecture conversations:\u003Cbr\u002F>process, risk, fit\".-> Owners\n    Sasha -.\"plans, review-board\u003Cbr\u002F>conditions, findings\".-> Harry\n\n    classDef focal fill:#fef3c7,stroke:#92400e,stroke-width:2px,color:#000\n    class Sasha focal\n",[375,465,467],{"id":466},"role","Role",[383,469,470,471,478],{},"Works at the upper layers of a ",[472,473,477],"a",{"href":474,"rel":475},"https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FSherwood_Applied_Business_Security_Architecture",[476],"nofollow","SABSA","-style model: contextual and conceptual architecture (business processes, risk, control objectives) and logical services (how security should work). She does not sit in product consoles — that is the component and operational layer, owned by product owners, admins, and engineers who run the tech. Sasha talks to those people, and to vendors, then turns what she hears into architecture, delivery plans, and review-board conditions. Often owns a domain (EDR, IAM, email security, SIEM) rather than the whole stack.",[375,480,482],{"id":481},"a-dayweek-in-her-calendar","A day\u002Fweek in her calendar",[484,485,486,490,493,496],"ul",{},[487,488,489],"li",{},"Designing security into business processes — working with teams to define how controls, tooling, and operating models should work before and as work is delivered.",[487,491,492],{},"Vendor meetings: evaluating products, listening to what is being sold, and translating that into what the organisation would actually need to implement.",[487,494,495],{},"Time with stakeholders on the ground (platform engineers, SOC, IAM, business owners) to understand how work really happens, then turning that into architecture and delivery plans.",[487,497,498],{},"Sitting on review boards when new technology or projects are being approved — the person expected to challenge, condition, or sign off whether something is secure enough to proceed.",[375,500,502],{"id":501},"objectives","Objectives",[484,504,505,508,511,514],{},[487,506,507],{},"Get an accurate, evidenced picture of what's really deployed and used — not what procurement paperwork says was bought.",[487,509,510],{},"Be believed. Findings need to survive scrutiny from Harry and, eventually, the board.",[487,512,513],{},"Reduce the sheer manual grind of stack investigation so there's time for actual security work.",[487,515,516],{},"Avoid being the one who \"should have known\" when an incident review turns up something she'd have found with more time.",[375,518,520],{"id":519},"pain-points","Pain points",[484,522,523,559,578,581],{},[487,524,525,526,529,530,538,539,542,543,550,551,558],{},"The single biggest time sink is manual: chasing down who owns what, whether it's still deployed, whether it overlaps with something else — done from scratch, repeatedly, per category. Independent estimates put the stack at ",[413,527,528],{},"45"," cybersecurity tools (analysts actively using fewer than half on any given day)",[531,532,533],"sup",{},[472,534,537],{"href":535,"rel":536},"https:\u002F\u002Fwww.secure.com\u002Fblog\u002Fsoc\u002Fsecurity-tool-sprawl",[476],"[1]"," or ",[413,540,541],{},"61"," security tools each watching its own slice",[531,544,545],{},[472,546,549],{"href":547,"rel":548},"https:\u002F\u002Fnhimg.org\u002Fcommunity\u002Fcybersecurity-beyond-identity\u002Fsecurity-tool-sprawl-and-context-loss-what-practitioners-need-to-fix\u002F",[476],"[2]",". In 2025, almost half of SaaS licenses paid for were never used (more than $20bn wasted spend)",[531,552,553],{},[472,554,557],{"href":555,"rel":556},"https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F02\u002F11\u002Fsecurity-teams-ai-driven-it-spend\u002F",[476],"[3]",".",[487,560,561,562,565,566,569,570,577],{},"Tribal knowledge is scattered across people, not systems. APQC found only around ",[413,563,564],{},"8%"," of organizations consistently capture knowledge from departing employees, and ",[413,567,568],{},"16%"," make no attempt at all",[531,571,572],{},[472,573,576],{"href":574,"rel":575},"https:\u002F\u002Farguslabs.ai\u002Ftribal-knowledge-problem-when-best-people-leave\u002F",[476],"[4]"," — meaning the people with the answer may have left, be on leave, or simply not remember.",[487,579,580],{},"Discovery is incomplete by design — tools bought outside \"the security budget line\" by other departments don't show up in any inventory she controls.",[487,582,583],{},"Her evidence is only as credible as her ability to document and defend it — informal \"I checked, it's fine\" doesn't survive an audit, and undocumented tribal knowledge is increasingly treated as a liability in due diligence, insurance, and regulatory contexts, not just an inefficiency.",[375,585,587],{"id":586},"relationships","Relationships",[484,589,590,596,602],{},[487,591,592,595],{},[413,593,594],{},"Harry the Head of Cyber:"," reports up, is the primary source of the evidence base for every renewal\u002Fconsolidation decision. Often feels her work is under-visible until something goes wrong.",[487,597,598,601],{},[413,599,600],{},"Simon the CISO:"," essentially no direct relationship; occasionally visible via incident write-ups or big consolidation wins.",[487,603,604,607],{},[413,605,606],{},"Paige the Procurement Officer:"," ad hoc, usually reactive — Paige asks \"is this still needed\" close to a renewal date, and Sasha has to drop something else to answer under time pressure.",[375,609,611],{"id":610},"empathy-mapping","Empathy Mapping",[613,614,616],"h3",{"id":615},"says","Says",[391,618,619,625],{},[394,620,621],{},[397,622,623],{},[400,624],{},[405,626,627,631,636,641],{},[397,628,629],{},[410,630,385],{},[397,632,633],{},[410,634,635],{},"\"I need the product owner in this conversation before we can treat that control as in place.\"",[397,637,638],{},[410,639,640],{},"\"That capability is already in the stack — show me what this vendor does that we don't already own.\"",[397,642,643],{},[410,644,645],{},"\"I'm not signing this off at the review board until the product owner and the vendor can both explain the residual risk.\"",[613,647,649],{"id":648},"does","Does",[391,651,652,658],{},[394,653,654],{},[397,655,656],{},[400,657],{},[405,659,660,665,670,675],{},[397,661,662],{},[410,663,664],{},"Designs security into business processes and project plans",[397,666,667],{},[410,668,669],{},"Holds conversations with vendors and product owners — not consoles",[397,671,672],{},[410,673,674],{},"Sits on review boards for new technology and projects",[397,676,677],{},[410,678,679],{},"Owns a domain (EDR\u002FIAM\u002FSIEM\u002Fetc.), not the whole stack",[613,681,683],{"id":682},"thinks","Thinks",[391,685,686,692],{},[394,687,688],{},[397,689,690],{},[400,691],{},[405,693,694,699,704,709],{},[397,695,696],{},[410,697,698],{},"\"I know things nobody else does, and half of it isn't written down anywhere.\"",[397,700,701],{},[410,702,703],{},"\"If I don't document this properly, it'll get overruled by whatever the invoice says.\"",[397,705,706],{},[410,707,708],{},"\"This should not take me three weeks per category, every time.\"",[397,710,711],{},[410,712,713],{},"\"I'll be the one blamed if this surfaces in an incident review instead of before it.\"",[613,715,717],{"id":716},"feels","Feels",[391,719,720,726],{},[394,721,722],{},[397,723,724],{},[400,725],{},[405,727,728,733,738,743],{},[397,729,730],{},[410,731,732],{},"Overworked, under-resourced relative to the size of the estate",[397,734,735],{},[410,736,737],{},"Frustrated that ground truth is treated as anecdote until proven",[397,739,740],{},[410,741,742],{},"Quiet pride in being the one who actually knows",[397,744,745],{},[410,746,747],{},"Undervalued — highest-friction work, least visibility upward",[375,749,751],{"id":750},"design-marketing-angle","Design & marketing angle",[383,753,754],{},"Not the buyer, but the credibility engine — if ESProfiler's evidence doesn't hold up to Sasha's scrutiny, Harry won't trust it either. She is the person most likely to be working in ESProfiler every day: running the investigation, maintaining the evidence, and keeping the estate picture current.",[383,756,757],{},"Product marketing\u002FUX aimed here should emphasize speed (minutes, not weeks), rigor (structured evidence, not hallway knowledge), and making her existing tacit expertise visible and defensible upward, rather than replacing her.",[383,759,760,761,764],{},"The key play for ESProfiler at this level is ",[413,762,763],{},"force-multiplier"," not a replacement for her.",[375,766,768],{"id":767},"sources","Sources",[484,770,771,777,783,789],{},[487,772,773,776],{},[472,774,537],{"href":535,"rel":775},[476]," Secure.com, security tool sprawl — 45 tools; analysts use fewer than half on a given day",[487,778,779,782],{},[472,780,549],{"href":547,"rel":781},[476]," NHIMG \u002F Securiti, tool sprawl and context loss — 61 security tools",[487,784,785,788],{},[472,786,557],{"href":555,"rel":787},[476]," Help Net Security — almost half of paid SaaS licenses unused",[487,790,791,794,795,799],{},[472,792,576],{"href":574,"rel":793},[476]," APQC via Argus Labs, ",[796,797,798],"em",{},"The Tribal Knowledge Problem"," — 8% capture departing knowledge; 16% make no attempt",{"title":801,"searchDepth":802,"depth":802,"links":803},"",2,[804,805,806,807,808,809,810,811,818,819],{"id":377,"depth":802,"text":378},{"id":388,"depth":802,"text":389},{"id":466,"depth":802,"text":467},{"id":481,"depth":802,"text":482},{"id":501,"depth":802,"text":502},{"id":519,"depth":802,"text":520},{"id":586,"depth":802,"text":587},{"id":610,"depth":802,"text":611,"children":812},[813,815,816,817],{"id":615,"depth":814,"text":616},3,{"id":648,"depth":814,"text":649},{"id":682,"depth":814,"text":683},{"id":716,"depth":814,"text":717},{"id":750,"depth":802,"text":751},{"id":767,"depth":802,"text":768},"The security architect is the boots on the ground of the security estate.","md",null,{},true,{"title":240,"description":820},"PW-ZLCBqg1c21YHW8KsCtY3UW2zJIeElQ8xJ9zVoUtA",[828,830],{"title":236,"path":237,"stem":238,"description":829,"children":-1},"The head of cyber, or Chief Security Architect, is the head of the security team and the security architects. They are responsible for the security tooling portfolio and often the key decision maker for security investments.",{"title":244,"path":245,"stem":246,"description":831,"children":-1},"The procurement officer is the gatekeeper of the contract calendar and negotiation process.",1790076745614]