Well here's my thoughts on how architects and security people responsible for security architecture should work together. Keen for feedback as always :). Note - I updated this post further to comments to highlight how security testing should work.
Application Owners - These are business people who own a business process and hence the business applications that support the business process.
Business Analysts - These are people who identify requirements from business stakeholders and ratify them with the Application Owner.
Solution Designers - These are the people who often write the use cases for the applications and have responsibility for the design of the applications.
Enterprise Architects - Along with producing the "enterprise architecture" these fellows liaise with the solution designers to determine requirements so that applications can be interconnected. For example network and middleware designs. Enterprise Architects produce solution blueprints for solution designers to follow for applications.
Enterprise Security Architect - Along with developing the "enterprise security architecture" which is a subset of the "enterprise architecture" and contains the "zone model" this person develops "security patterns" that can be overlaid over solution blueprints that provide standard sets of security controls. This person also is responsible for securing middleware and other shared infrastructure. It should be noted that the "security patterns" produced are vendor independent and are performance specification related. This enables the organisation to have a long term view of what they want and what direction they are heading in allowing them to drive vendors to deliver to meet their needs, rather than be driven by the offering of vendors.
Security Solution Designers - These people take the "solution design" from the solution designers and apply the "security patterns" from the enterprise security architect to develop the "high level design" for the solution. They also go to the next level of detail called the "security detailed designs". They select the vendors of the hardware and software to meet the requirements of the pattern and use their experience of "what works in the real world" to ensure that the planned application architecture and planned security architecture meshes together. Most importantly they perform the risk assessment, collate the requirements, select and document the security controls.
Security Engineers - These unsung heroes using their in depth training with the security products in use configure the security product hardware and software in accordance with the "security detailed designs".
Application Developers - These guys develop the application in line with the solution design and use cases written and updated by the business analysts. Hopefully they are well educated and policed so that they write secure code in line with the requirements in the "high level design" and "security detailed designs"
Functional Testers - These people test the application to make sure it meets the requirements in the "use cases" mostly put together by the Business Analysts and refined by the Solution Designers.
Non Functional Testers - these people test all the things that need to be tested that don't fit in a use case. For example conducting performance and volume testing, making sure high availability functions work as advertised by turning devices off etc.
Security Testers - These security people check that the security controls designed by the security solution designers and documented in the detailed design documents operate as intended. For example password strength is enforced, sessions are terminated when a logout function is activated etc. Its a good idea for these guys to also check that security requirements and security controls match up.
Penetration Testers - These wonderful people look for common application vulnerabilities, misconfiguration of operating systems, databases and application server software. Their job is to identify missing commonly expected security controls, see if they can bypass the existing security controls or find weaknesses in their implementation. It should be noted that the penetration testers job is not to perform the more rudimentary functional or non-functional testing of security controls but to be the "icing on the cake" to sanity check the design and put the security controls through their paces.
