Secure by Design
Redesigning a fragmented security assessment service into a single platform shared by five specialist teams.
Secure by Design is BT’s internal service for reviewing and assessing security risk across projects. I own the end-to-end product design of the platform that now supports it, from discovery workshops through to high-fidelity designs and delivery roadmaps.
A fragmented and inefficient security assessment process
The Secure by Design team was responsible for reviewing and assessing security risks across a wide range of projects, but the process supporting this work had become increasingly difficult to manage. Requests arrived through a legacy platform and supporting channels, critical information was often scattered across documents, emails, Teams conversations and shared repositories, and specialists relied heavily on manual effort to move requests through the assessment lifecycle.
The challenge extended beyond tooling. Five specialist teams contributed to the Secure by Design process, each with distinct responsibilities, workflows and reporting needs. Without a shared operational platform, visibility was limited, collaboration was difficult, and highly skilled security professionals were spending significant time administering work rather than assessing risk and protecting the business.
The opportunity was to create a unified platform that could support the end-to-end Secure by Design service, streamline collaboration across teams, and reduce the operational burden associated with security assessments.
The real barrier wasn’t assessment, it was information quality
While the initial assumption was that the Secure by Design team needed better workflow tooling, the research uncovered a deeper issue. The biggest source of friction wasn’t the assessment process itself, it was the effort required to gather, validate and structure information before meaningful assessment could begin.
Requesters submitted information with widely varying levels of quality and completeness, forcing specialists to spend time chasing context, interpreting conflicting information, and piecing together project details across multiple sources. This created delays throughout the lifecycle and introduced inconsistencies between assessments.
This reframed the design challenge entirely. Rather than simply replacing an existing system, the opportunity became creating a platform that improved information quality at the source, increased visibility across teams, and allowed specialists to focus on applying security expertise rather than managing administrative complexity.
From research insights to a shared future vision
With the discovery research complete, I took ownership of the end-to-end product design for a new Secure by Design platform. While a researcher led the initial discovery phase, my role was to translate a complex and largely undocumented security process into a scalable product that could support five separate teams working across the Secure by Design lifecycle. Rather than moving straight into detailed designs, I began by creating low-to-mid fidelity concept designs that visualised the future-state experience, a catalyst for discussion that helped stakeholders align around a shared vision and identify gaps in their existing processes.
To build a deeper understanding of the service, I facilitated a series of collaborative workshops in Mural. Depending on the problem being solved, these sessions focused on journey mapping, service design, information architecture, feature definition and dashboard requirements. Together, we explored how teams currently worked, identified missing parts of the journey, and defined how they could collaborate more effectively. These workshops ultimately informed the platform sitemap, service blueprint and future-state workflows, transforming fragmented operational knowledge into a shared understanding of how the service should operate.
Simplifying complex security workflows at scale
The biggest challenge was not designing screens, it was designing a service. The platform needed to support five different teams, each with distinct responsibilities, workflows and priorities, while maintaining a single source of truth throughout the assessment process. One of the most challenging areas was the dashboards used by engagement, consultancy, supplier background checking, handover and assurance teams. Stakeholders initially wanted to surface large amounts of project information in dashboard tables; through collaborative workshops I refocused discussions around user goals rather than data availability. Consultants needed to quickly understand the health and progress of their workload so they could prioritise actions, not review every detail of a project.
Alongside the dashboard work, I navigated the complexity of translating security assessment frameworks into intuitive user experiences. Existing documentation described processes at a high level, but many operational details were undefined or varied between teams. Through continuous collaboration I identified gaps, challenged inconsistencies, and mapped new workflows balancing security requirements with usability. Once the direction was established, I produced high-fidelity designs across requester, engagement, consultancy, supplier background check, handover and contract assurance workflows, alongside assignment management, messaging, activity logs, advanced search, reporting and security decision tracking.
Threats sit in a reusable library with their controls attached, consultants build on established patterns instead of writing every assessment from scratch.
A structured form replaces free-text documents, setting the standard quality bar the old process never had.
Escalation and pattern flags feed security decision tracking and reporting downstream, captured once, at the point of assessment.
Beyond design execution, I worked closely with architects and engineers to prioritise features, define delivery roadmaps, estimate design effort and shape future releases, turning a fragmented set of undocumented processes into a unified platform vision capable of supporting Secure by Design at scale.
Aligned around a single Secure by Design platform vision and future-state service model.
Mapped and redesigned fragmented workflows spanning intake, engagement, consultancy, supplier checks, handover, assurance and reporting.
Delivered across requester, engagement, consultancy, supplier check, handover and contract assurance experiences.
Prioritised features and delivery phases with stakeholders, architects and engineers.
Although the platform is still in development, the project has already delivered significant organisational value. Working closely with Secure by Design leadership, I transformed a collection of undocumented and fragmented processes into a shared future-state platform vision spanning five operational teams, established through concept validation, service blueprinting, journey mapping, stakeholder workshops and iterative design development.
A particularly important outcome was helping stakeholders shift from discussing individual tools and team-specific processes to viewing Secure by Design as a connected end-to-end service. This created a foundation for reducing administrative burden, improving visibility across teams, and allowing security specialists to focus more of their time on protecting the business.
Filters mirror the team’s real triage stages, workload health is readable at a glance, without opening a single project.
Strike and SLA columns surface only what needs action, the outcome of refocusing stakeholders from data availability to user goals.
The last comment and action live on the request itself, context stays in the platform instead of scattered emails and Teams threads.
