Sophos Certified Architect

AT15, AT80 · ● Active · Expert · Sophos

Expert-level Sophos certification validating advanced architecture, design, and multi-site deployment expertise in Sophos Central Endpoint (AT15) and Sophos Firewall XGS (AT80) platforms. Designed for channel partners, solutions architects, and senior security engineers responsible for enterprise and complex multi-site deployments.

Exam facts

Vendor source — Sophos Academy ↗ Official exam guide — Sophos Partner Certification Path ↗ Exam objectives — Sophos Learning Portal ↗

About

The Sophos Certified Architect certification validates expert-level skills in designing, deploying, and managing advanced Sophos endpoint and firewall architectures at enterprise and multi-site scale. Unlike the Professional-level Engineer cert, the Architect tier focuses on infrastructure design, high availability, complex network topology support, and strategic security orchestration across multiple sites and product families. Available through Sophos Academy with free or tiered partner training, this certification has become the gold standard for channel partners pursuing solutions architect roles, pre-sales engineering, and senior technical leadership in Sophos-centric organizations. The certification split into two tracks—AT15 (Central Endpoint) and AT80 (Firewall XGS)—reflects Sophos's modular product strategy; both are commonly held together by architects managing integrated endpoint-and-firewall deployments. Active since the Sophos XG generation and regularly updated for current product versions (SFOS 20.x+, Central v3.x+).

Domain context — Security

Expert-level security certification spanning advanced firewall architecture, enterprise endpoint deployment, zero-trust network design, high availability orchestration, and multi-site threat orchestration. Primary use case: Solutions architecture for complex Sophos deployments, enterprise migrations, managed security service provider (MSSP) design, and channel partner pre-sales/technical leadership roles.

Read full deep dive — Security →

Topics covered

AT80 (Sophos Firewall Architect / XGS)

• Advanced Firewall Architecture & Design — multi-site network topology, DMZ design, branch/hub-spoke models, failover planning
• High Availability (HA) Clustering — active-passive stateful, active-active, license management, state synchronization, failback strategies
• Advanced Routing Protocols — OSPF, BGP, VRF, redistribution, multi-site routing design
• Multi-Firewall Management — Sophos Central orchestration, Sophos Firewall Manager (SFM) deployment, policy distribution, reporting aggregation
• Zero Trust Network Access (ZTNA) Architecture — Sophos SecureConnect design, identity-centric access control, micro-segmentation patterns
• SD-WAN with SD-RED — integration with Sophos firewall, hybrid cloud routing, application prioritization
• Advanced WAF & Application Control — custom policy design, evasion technique handling, rule tuning at scale
• Sandstorm Cloud Sandboxing — integration, threat detonation workflows, containment orchestration
• Synchronized Security — endpoint-to-firewall threat correlation, response automation, Central ecosystem integration
• Enterprise Email Security — Sophos Email at scale, integration with Firewall and Central, advanced threat filtering
• Cloud Optix (CSPM) — cloud infrastructure security, compliance automation, Sophos Central integration
• Complex Network Migrations — legacy UTM9/SG migration, phased rollouts, coexistence strategies, data center consolidation
• Reporting & Analytics — advanced Central dashboards, compliance reporting, threat analytics, SLA/KPI design

AT15 (Sophos Central Endpoint Architect)

• Enterprise Endpoint Deployment Models — cloud-only, hybrid, on-premise, large-scale fleet management
• Intercept X Advanced EDR/XDR Architecture — behavioral analysis tuning, threat hunting workflows, response automation
• MDR Integration & Orchestration — Sophos Managed Detection and Response workflows, escalation, SLA design
• Policy Architecture at Scale — group design, inheritance models, exception handling, multi-tenant scenarios
• Live Response & Forensics — investigation workflows, threat artifact collection, evidence chain for incident response
• Central Admin Console at Enterprise Scale — multi-site admin delegation, reporting dashboards, API integrations
• Third-party Integrations — SIEM integration (Splunk, Azure Sentinel), automation platforms, threat intelligence feeds
• Compliance & Audit — reporting for regulatory frameworks, audit trail design, evidence collection
• Threat Response Orchestration — cross-product response (firewall + endpoint), containment strategies, eradication planning

Source: Sophos Academy Training Courses ↗ · Sophos Certified Architect Practice Test ↗

Common skills at Security · Expert

Shared content for the Security domain at Expert level — not specific to this cert.

• Advanced threat modeling — ATT&CK framework, threat actor behavior prediction, campaign analysis, kill-chain mapping
• Security architecture design patterns — defense-in-depth layers, zero-trust principles, assume-breach models, network segmentation theory
• Enterprise incident response orchestration — playbook design, cross-team coordination, forensics methodology, evidence handling, post-incident review
• Compliance architecture — regulatory mapping (PCI-DSS, HIPAA, SOC 2, ISO 27001), audit design, continuous monitoring, exception management
• Identity & access management (IAM) integration — directory services, LDAP/Active Directory sync, SSO/SAML, privilege escalation prevention
• SIEM and log correlation — detection engineering, false-positive tuning, correlation rules, alert fatigue management
• Third-party ecosystem integration — vendor API documentation, integration testing, secure credential handling, SLA enforcement

Recommended courses at Security · Expert

Practice exams

Books

Note: Sophos Architect certifications rely heavily on vendor documentation, technical briefs, and hands-on labs rather than traditional published books. Official Sophos training materials and product architecture guides are the primary study sources.

Typical job titles at Security · Expert

Sophos Solutions Architect · Senior Security Architect (Sophos focus) · Network Security Architect · Channel Partner Architect · Pre-Sales Security Architect · Enterprise Security Architect

(Job titles drawn from current job-board postings, MSP/channel partner career paths, and solutions engineering roles.)

Salary

Salary context: Ranges reflect Solutions Architect and Senior Security Engineer roles that list Sophos certification as required or strongly preferred. Sophos-certified architects command premium salaries in MSSP/channel partner environments and enterprise pre-sales. Salary varies significantly by region, vertical (finance/healthcare/enterprise), and organization size. For current architect postings, check LinkedIn, Seek (ANZ), IT Jobs Watch (UK), or regional job boards filtering for "Sophos" + "architect."

Skills validated

Cert-specific — what this exam actually tests, distinct from shared "Common skills" above.

• Advanced Sophos Firewall XGS architecture (zones, policies, implicit-deny, multi-site design)
• High availability (HA) clustering (active-passive, active-active, license mgmt, state sync)
• Multi-firewall orchestration via Sophos Central (policy distribution, reporting, compliance rollup)
• BGP/OSPF routing integration with Sophos firewalls (VRF, redistribution, failover routing)
• Zero Trust Network Access (ZTNA) design (Sophos SecureConnect, identity-centric segmentation)
• SD-WAN integration (SD-RED, Sophos Central orchestration, hybrid cloud routing)
• Web Application Firewall (WAF) tuning (custom policies, evasion techniques, performance)
• Sandstorm cloud sandboxing (threat detonation, threat intelligence, containment workflows)
• Synchronized Security (endpoint-to-firewall threat correlation, response automation)
• Enterprise email security architecture (Sophos Email at scale, integration, advanced filtering)
• Cloud security posture management (Sophos Cloud Optix, compliance, Sophos Central integration)
• Complex network migrations (legacy UTM/SG migration, phased rollouts, coexistence)
• Advanced Sophos Central Endpoint deployment (EDR/XDR, live response, threat hunting, MDR integration)
• Enterprise policy architecture (group design, inheritance, multi-tenant management)
• Compliance reporting and audit (regulatory frameworks, evidence collection, SLA design)
• Third-party ecosystem integration (SIEM, automation platforms, threat intelligence)

Related certifications

• Prerequisite for: Sophos Certified Expert (if offered); advanced channel partner tier status; enterprise solutions architect leadership roles
• Stacks with: Sophos Certified Engineer (ET15 / ET80) ↗ — foundational tier required before Architect
• Replaces: N/A — no predecessor cert; Sophos XG generation is current (no major sunset announced)
• Equivalents at this level: Palo Alto Networks PCNSE+ (expert-level) ↗ (networking-focused), Cisco Certified Network Associate Security (CCNA Sec) ↗ (networking-focused), CompTIA CASP+ ↗ (vendor-neutral expert-level)
• Vendor overview: Sophos ↗

Sources

• Sophos Academy ↗
• Sophos Partner Certification Training EMEA ↗
• Sophos Partner Certification Points System & Dashboard ↗
• Sophos Firewall Architect Practice Test ↗
• Sophos XGS Firewall Certified Architect Training (CDW) ↗
• Fast Lane Sophos SCAX Course ↗
• Glassdoor Sophos Architect Salaries ↗
• IT Jobs Watch ↗
• Zippia Sophos Salaries ↗
• SalaryList Technical Architect ↗

Last verified: 2026-05-02 Parent ecosystem: Sophos Endpoint & Firewall Parent domain: Security Vendor overview: Sophos