Jumping the Pond: Making the sideways move into CyberSec

So far, a large portion of this blog has been dedicated to helping people begin their careers within the Cyber Security sector from the beginning, i.e. straight from college or university. This week, I’d like to explore the options for those looking to make the move from other career paths, specifically with an eye to those looking at managerial positions. If you are already coming from an IT background, this post might have one or two things you might find useful, but you’ll probably have access to other resources that might be better suited to your needs.

I want to note here that while this will guide you through some of the options and a few certifications that will help move into CyberSec, some technical competency is a must. A good level of understanding of the technologies and principles underlying those technologies is unavoidable in this field, as you’ll see below. My suggestion would be to look at my earlier blogs and some looking around, as I won’t go into depth about technical knowledge here, as the same technical certifications and knowledge from those blogs apply.

N.B., You will notice that I use the terms ‘Cyber Security’ and ‘Information Security’ interchangeably. While these two terms have different definitions, in this context both do apply. See here for a good definition of both terms, and their differences.

This week, I’d like to give you a general overview of what is expected of a manager in the CyberSec, on top of leading a team to its fullest potential. This is to give you an idea of what to expect, to give you a better idea of what is involved and if it is for you. Next week, I’ll go through a few of the certifications that will boost your CV and your chances of moving into the field.

Roles and Responsibilities

As a Cyber Security manager, your title will cover various, diverse duties, all of which are crucial to aiding the company avoid risk and exposure. This position isn’t just about managing staff, evaluating their performance and justifying your department’s budget and existence: it requires full engagement with the organisation on different levels. The following are amongst the most important responsibilities that come with the role:

Monitor all operations and infrastructure – This will be the bulk of your team’s daily duties, and it is important you understand the role of your analysts and operations staff. Going through the security and event logs can be a tedious task, but it’s also the point at which breaches, risks and vulnerabilities are likely to be found.

Maintain security tools and technology – Almost certainly a joint effort with your organisation’s security office, it is important to keep these up-to-date and in compliance with your policies.

Monitor internal and external policy compliance – Writing and enforcing security policy, as well as auditing and renewing it periodically, is an important aspect of the role – making sure that both your company and its external vendors are complying to your security policies.

Monitor regulation compliance – This might be an aspect of your role you may want to delegate, particularly if you handle lots of personal identifiable data, particularly considering GDPR. With the large fines involved in failing to comply with legislation and regulation, this is one area that requires extra care.

Work to reduce risk – Designing training and writing reminder memos and emails are just some of the measures you can take to help bring everyone in your organisation up to speed with security practices.

Implement new technology – Investigation new technologies and evaluating their risk factors and the mitigation techniques you need to take to roll that technology out.

Ensure cybersecurity stays on the organisational radar – This one speaks for itself. You will be required to ensure that everyone knows that security is everyone’s responsibility, and it needs to be pro-actively kept on top of.

Detail a security incident response program - Every organization should have a well-defined, well-documented response plan to be executed if a security incident does occur. The plan should detail each team member’s roles and responsibilities in such an event, as well as the guide to how to proceed in the aftermath of an incident, i.e. gathering evidence, reporting to the correct authorities, what the priorities are in terms of business continuity. It would also be advisable to have those involved run through some simulated incidents, so the plan is smoothly executed if needed.