The purpose of any architecture is to supply a plan for a construction. What are the constructive ("building") jobs a cyber security architecture does?

Three: designing something new, improving or adapting what already exists, and tearing something down in a controlled way — and in practice the middle one dominates.

1. New build. Supporting the design and construction of a green-field estate. This is the case everyone imagines and the one you will rarely get: it turns up at company foundations, spin-offs and start-ups, and almost nowhere else.
2. Improvement, modernisation, adaptation, repair of existing systems. The common case. You inherit legacy IT, OT installations and whatever else has grown over twenty years, and the job is to make that better rather than to draw the ideal from scratch.
3. Controlled replacement or decommissioning. Genuinely part of the discipline, and the part most often skipped. Systems that are switched off badly leave behind live accounts, forgotten firewall rules, forwarded DNS records and a database nobody owns any more — a decommissioning without a plan creates attack surface instead of removing it.

The mental image from building holds: architects design new houses, but most architectural work in an old city is conversion, extension and demolition. Expect brown-field, and value the ability to work with what is there.

Go deeper:

• Wikipedia — Legacy system — why the brown-field case dominates: the economics that keep old systems running long past their design life.