A few of my clients are now looking to staff their first inroads into SOA, their first project where something actually happens beyond the investigation. So...how many people are needed on the project? Who are they? What are their roles? Here are some rough guidelines based upon my experience thus far.

The Who (Not the Band)
You're going to need an eclectic array of skills to do SOA right, including:

• Project leader/architect
• Data specialist
• Security specialist
• Native systems specialist
• Service development specialist
• BPM/orchestration specialist
• Governance specialists
• Testing and deployment specialist
• Project archivists
• External services specialists

The What
While many of the above titles are self-explanatory, it does help to define them in a bit more detail. Indeed, roles within the creation of a SOA could be a bit confusing, and the dynamics of a SOA team still need some understanding.

The project leader/architect is the person responsible for the delivery of SOA, on time, on budget, and meeting the objectives outlined when the investment was made. Typically, this is an IT project manager with an understanding of SOA, but in smaller organizations this could be the enterprise architect or even the CIO.

Data specialists are responsible for all data-related analysis, design, and deployment. Typically they have an understanding of all native data layers within the problem domain, as well as metadata and data design (logical and physical), including middleware and data abstraction layers. They also have knowledge of how data is bound to services, and work closely with the service developers.

Security specialists make sure the security that goes into the SOA is thought about at each stage of the process. SOA security (typically, identity management) needs to be systemic. This cannot be an afterthought, and a plan must be created and implemented during the project.

Native systems specialists are experts in the native systems that exist in the problem domain. In other words, they understand the operating systems and hardware, as well as application and networking interfaces. They can do performance tuning and some light development.

Service development specialists build services using service development tools, and have an understanding of how these services link back to the data layer(s) and link forward to the orchestrations or processes. They are high-end developers, really, who understand how to design, build, test, and deploy services.

BPM/orchestration specialists are those who both understand the processes as well as automate them within an orchestration layer, such as a BPEL tool or process integration engine. These people need to understand both logical process designs, as well as how to deal with processes yet to be automated, workflow and implementation, or the solution to the process problem.

Governance specialists are just that. They figure out the role governance plays within a SOA, the right technology for the job, and how to implement it in the course of the project. In some instances the use of governance is contraindicated, so you have to be careful here.

Testing and deployment specialists are the people responsible for the development of a formal test plan for the SOA, and they test each layer/component to make sure that it's rock solid and ready for production.

The project archivist is responsible for keeping track of the various design artifacts that pop out of these projects, including business requirements, application semantic documentation (metadata), services analysis and design documentation, process analysis and design documentation, test planning, etc. This makes it easy for others on SOA projects in the future to learn from the successes and mistakes of others.

External services specialists are people who look outside of the firewall to meet the services needs of the SOA. This means looking at SaaS providers, and other services you don't own, as potential solutions/components within the SOA.

How Many?
Your mileage may vary - a lot. My numbers are for a typical project, but here are some initial findings. My assumptions are: A dozen systems in the problem domain, each having separate data layers that are physically collocated. In addition, I'm assuming medium complexity for the SOA, a reasonable budget, and the availability of training and outside consultants.

• Project leader/architect: Typically one for the project.
• Data specialist: .5 per data layer. Meaning, if you have 12 different databases or applications, you need six.
• Security specialist: Two per project - one who understands the existing security, and one who understands the special security requirements of SOA.
• Native systems specialist: One for each type of system, i.e., if you have a mainframe, Unix, and Windows NT, you'll need at least three.
• Service development specialist: One for every 100 services to be deployed. Typically you're going to do approximately 1,000 in a project that big, thus figure on 10 service development specialists.
• BPM/orchestration specialist: Four per project - one who understands and documents existing services, one to document new services, and two to build the services into the orchestration layer.
• Governance specialist: One per project.
• Testing and deployment specialist: Three per project - one to write the plan, and two to execute the plan.
• Project archivist: One per project.
• External services specialist: One per project.