Once the City had a Chief Security Officer, this was the architecture counterpart to that post: a standing working relationship rather than a series of referrals, across security posture, governance initiatives, and the incidents themselves — attacks and breaches, as they happened.
Where an incident reached the level that federal agencies became involved, that meant working alongside the Department of Homeland Security and the Federal Bureau of Investigation.
Why the pairing matters
Security and architecture fail in opposite directions when they are separated. A security function without architecture in the room produces controls the estate cannot carry, which get exceptions written for them within a year. An architecture function without security in the room produces designs that are elegant and indefensible.
The other half of the answer is that incident response is where a design finds out what it actually is. Segmentation either holds or it does not; the packet capture platform either answers the question or it does not; the criminal justice boundary either survives contact or becomes a disclosure. Sitting in that work, rather than reading the report afterwards, is what makes the next design different.
Specific incidents are not described here, and will not be.
Outcome
One architecture voice in the room for posture, governance and incident response, rather than a security function and an architecture function arriving at different answers.