Skip to main content
qorionix
ZQ-400partner
  • MSP or MSSP technician
  • Compliance and audit

Qorionix Certified Delivery Architect

The top of the programme. For the consultant or partner architect who designs the deployment, sequences the rollout and defends it in procurement.

What this certifies

Written so it could be disproved by watching the holder work. If you cannot imagine the task you would set to test a line of this, it does not belong here.

Can produce a deployment design for a regulated 500–1,000 identity organisation covering home-region binding, the sequencing of a privileged-access rollout, an autonomy envelope justified per action class, and an explicit written statement of what the platform will not detect. Can defend that design's residency and AI-processing claims against a procurement questionnaire without overstating either. Can size, stage and price a migration from an incumbent identity, endpoint or log stack, including the dual-send period and what breaks during it.

What it does not certify

A credential that appears to certify more than it tested is worse than no credential, because a buyer relies on it. This list is never empty on any credential in the programme.

  • Does not certify the ability to build the platform, extend it, or make product commitments on our behalf.
  • Does not certify security architecture generally. It is a product-delivery credential, not a CISSP.
  • Does not certify that the holder's designs are correct. It certifies that they are defensible and that the holder knows where the limits are.
  • Does not include any authority to represent Qorionix commercially.

The job tasks it maps to

Phrased as the person holding the job would phrase it, with where in the product it happens — so the mapping is checkable rather than aspirational.

“Design the deployment before touching anything, and write down what it will not do”
The design document, the hard-limits statement, and the residency position
“Answer a 200-question procurement security questionnaire without lying”
The trust surface, the AI Act system card, and the unverified-inference position
“Sequence a privileged-access rollout so the customer is never locked out of their own systems”
PAM staging: vault, proxy, rotation, and the credentials that are never rotated automatically
“Justify, per action class, what the platform may do unattended — to a risk committee”
The autonomy ladder, the capability ceiling, and the reversibility argument
“Migrate off an incumbent without a coverage gap in the middle”
Dual-send, staged cutover, and detection-coverage comparison
“Decide when the answer is that this product is the wrong choice”
The published hard limits, and the cases where we say buy it elsewhere

Getting here

Prerequisites

Full sequence: ZQ-100 → ZQ-200 → ZQ-300 → ZQ-400

Recommended experience

Has personally delivered at least two security or identity deployments end to end, and has sat in front of a procurement or risk committee. Holding the Evidence and Audit Analyst credential as well is strongly recommended and not required — roughly a third of this exam's Domain 4 overlaps with it.

Recertification

Valid for 24 months

Twenty-four months, by submitting a real deployment design — customer details redacted — for review against the same rubric the exam uses, plus a short renewal assessment. Longer than the operational credentials because this material is about trade-offs and constraints rather than about screens, and trade-offs decay more slowly than a console does.

Price

€350, including the design review

The design review is the expensive part and it is a human reading a document, so the price reflects real cost rather than positioning. Purchased in the console; the design submission is reviewed by hand.

How you would prepare, and how you would be assessed

What the labs assume

  • No lab tenant is required for Modules 1, 3 and 4 — they produce documents. Module 2 needs a privileged-access environment you can break.
  • For Module 2: at least one Linux host reachable over SSH, one Windows host, and one database you are allowed to lock yourself out of. All three should be disposable.
  • A real procurement questionnaire, ideally one you have been sent. The generic ones circulating online are easier than the real thing.
  • Somebody willing to play a hostile risk committee for ninety minutes. This is the highest-value hour in the course and it cannot be simulated by reading.