Why are Cybersecurity Roles Confusing

People coming into the cybersecurity field often expect that there are clearly defined roles and that they maintain some stable set of responsibilities. Well, wrong. Unfortunately, the world of cybersecurity is chaotic and a confusing mess. So that's what we're going to talk about today. And, you know, I'd like to actually thank one of the followers here, uh, Chris Sanchez. Now, uh, Chris is a follower of the Cybersecurity Insights channel, and he asked this seemingly simple but ultimately frustrating question. So let's dive into it. Um, we're going to talk about why it's frustrating. We're going to talk about some simplistic tools to be able to get at least a baseline understanding of the different roles and, and kind of what they do. And I'm also going to provide an opportunity to go deep, especially if there's an interest to truly understand behind some of these roles. What are the aptitudes and the knowledge and the tasks? And, you know, how are they kind of graded, um, you know, from a maturity perspective? And all sorts of other things, because there are some very deep resources to help with that, but it's going to take some work. So Depending on, you know, where you want to go, we're going to be able to satisfy it as we go down this journey here. So the first thing we kind of have to ask ourselves is, why does anybody really need to know what the roles and responsibilities? Well, normally somebody asks that because they're interested in going into the field, and they, you know, want to map it to their current skill sets or things that they like to do, all perfectly legitimate, great things, because you want to know that going in. So there is definitely a need to understand what those roles are, even just at a generic, um, level. But part of the problem is the industry has a lot of shifting terms, and the tools are always changing, and the roles, um, are often shifting. So it can be very misleading, especially when you go out and you look at the job descriptions. Oh, these have been a mess for years. In many cases, the job title is not truly reflective of what the role is. You actually have to look at the very specific accountable duties to kind of understand if that matches up or not. In many cases, it doesn't. The same thing goes with the requirements. You know, what kind of certifications or skills, experiences, things of that sort. And it all kind of started way back in the early days where people didn't know— HR departments didn't know how to write good job reqs, and they didn't know what skills or what the right certifications were. And even the certifications were kind of a little flexible, if you will. And so people started just writing whatever they could, and they weren't all that great. But the next HR person or the next hiring manager again didn't know what they would look, well, what's already published out there? Let's just copy that and use that. And so bad practices have been propagated, unfortunately. And there's only a few sites, and we'll get to one of them today, that has actually taken a step back and said, wait a second, this isn't right, this isn't helping anybody. You can't list something as a security engineer and really you're looking for a CISO, right, a chief information security officer. That's wrong, that's misleading, you're not gonna get what you want, and the people that come into the role are gonna be completely surprised. So there is unfortunately a lot of job descriptions out there that are not right. There's not good resources. If you went out and Googled it, you're not gonna get anything current. You're probably not going to get a whole lot of information that you can grab easily anyway. So when I talk with people going into the industry, and this has been true for many, many years, and it doesn't matter if they get hired in as an architect or an analyst or an operations person or whatever, I'll tell them and go, listen, whatever you're going to do on day one, whatever tools whatever objectives that they're giving you, whatever expectations people have, the people, and maybe even your title, that is fundamentally going to change somehow, probably within 18 months. If you look back after a year and a half, you're gonna say, oh yeah, what I started with, I'm doing something completely different. The expectations have changed, the tools have changed, whatever. And that is the norm we have in our industry. A high degree of ambiguity. Uh, the roles and the responsibilities shift all the time, and in most cases they simply expand. Very rarely do they actually contract. So it's always piling more and more and more on, and that isn't necessarily a bad thing because that forces all of us to become, well, much more dynamic and make sure that we have a much broader scale of our skill sets and really what we can accomplish. And that's a good thing, right? So, you know, if we take a look at— and again, we're taking a step back— if we take a look at a typical security organization, right, and we look at the org chart— and this is just kind of a high-level model— we've got some basic areas here that we have to understand before we dive into the more specific roles. We've got a leadership function, and sometimes it's a CISO, sometimes it's a director of security. Sometimes a CISO only has the information side or data side or infrastructure. Other times they're also the chief security officer, or maybe it's a chief security officer that's now inherited the digital side. It can be, but it's a leadership role. And typically in the leadership roles, you're defining goals, you're defining what those objectives are, you're working with budgets and managing people and driving to those objectives. You're justifying what you're doing, you're interpreting risks, and you're representing that to your peers, C-suite, and even board members to help support and build a sustainable capability that keeps you in that optimal zone of risk. Not an easy job, takes a lot of skill, and typically it's the more seasoned people that are successful at this given those specific skills. Now beneath them, you tend to have 3 general groups, and again, some organizations more, but in general, you've got 3. You've got engineering and architecture. These are the technical wizards out there, and it applies both internally to the infrastructure, if you can imagine that, right? The day-to-day keeping the business up and running, but it can also apply to whatever products or devices or services that the organization provides, because again, you don't wanna be providing, you know, hacked or vulnerable services or products or devices out to your customers or supply whatnot. So there's engineering and architecture technical aspects in both of those, um, the infrastructure side and the products and services side. The next area is about operations and support, and this is the day-to-day keep everything up and running. Many times you've got analysts or you've got people in the security operations center, they're responding to alerts They're closing vulnerabilities, they're evaluating and looking for attacks, all those kinds of things, right? The day-to-day care and feeding. And you don't want to get behind on that. You tend to have a firefight every day or a fire you're putting out every day, and it just never stops. The third area is the GRC, the governance, risk, and compliance aspect of it. And this is a mishmash of a whole bunch of different things. But if you can imagine an organization needs to make sure that they're in alignment and remain in alignment with all the different regulations out there, privacy being one of them, but there's others, right? Gathering the information for the metrics. So looking at the measures to gather and roll up into the metrics to help leadership interpret that as it applies to what is the acceptable risk, right? What is the risk appetite? Do they need to move left or right or up or down to, you know, get back into the correct zone? You've got auditing capabilities, you've got training. When you look at not only the technology, but, and the processes around that, but you've got to look at the behaviors. So, you know, processes, behaviors, technology, and everything around that. This group also maintains the corporate security policy and the guidelines and potentially procedures, right? They manage all that, and non-compliance and auditability, all sorts of different things. So in one, in one, you know, way you can think about it, it could be kind of a catch-all of everything else, but there's a lot of distinct roles even within this space that you could break out. But in general, this is the kind of thing that organizations are kind of set up for. And if you're thinking about getting in the industry or you're trying to figure out where somebody is, kind of use this as a mental map to to drop them in one of these buckets. And more than likely, you'll, you know, you'll start to understand who they're communicating with and some of the different roles. Okay, so with that, let's kind of dive into some resources. And if you're looking to get in the industry and you wanna kind of map it to your, you know, your skills and talents, or just figure out what your career path is, because like any field, You don't get to go into it, you know, from college or from getting a certification and get your dream job, right? It's a story arc and it's stepping stones. So you might get an entry level and you're gonna move from job to job to job. And there's a good site out there and it's run by the government. It's called cyberseek.org. And this is kind of what it looks like. And one of the things in there is actually a career pathway. I'm gonna put all the links for everything that I'm gonna show you here in the description so you'll be able to go out. And this is an interactive site, so you can kind of take a look at different skill areas and go, okay, entry-level, where does that lead me? Great, you know, maybe analyst, and maybe eventually I want to be an engineer. And for each one of these areas, you can scroll down and you can see what they make, and you can see, you know, some of the overviews and some of the skills, top skills, and some of the certifications. So it's a good starting point. Now, it's not— it doesn't give every single job description out there, but again, it's that first pass. It's really kind of a nice step. So I tend to push people over to that place first to get a feel and an understanding. Again, that's cyberseek.org. It's actually run by the, by the US government, and you can even see for the different states where the job openings are. Kind of nice. The second place I want you to go to is that I want you to go to CyberSN. And this is a site by Dedri Diamond, and she's one of my favorite people in the industry. She is just totally awesome. She created this and it pairs up workers with hiring agencies and companies that need cybersecurity resources. And she's fantastic. So if you ever bump into her, please shake her hand and tell her, you know, You know me, and, and definitely harass her a little bit. She's fantastic. So if you go out to CyberSN, they do have a job categories list, and they've got about 35 different roles there. And one of the benefits here is, compared to CyberSeek, is it goes down a layer and it helps understand. So for example, if I click on the security engineering role, it's got a whole bunch of other subcategories. Now again, there isn't a whole lot of detail behind this, but you can start to understand where some of these may be, whether it be, you know, SecOps versus embedded security, cloud security engineer, right? And then you can start doing more research on that. Or even better, because your step after this is to look at the sites like CyberSN who do have good job recs out there, and look at the job recs for the ones that you're interested in and see if that aligns with where you want to go or your skill set, or if it fits in your career path that you're moving forward. But I want to caution you Again, a lot of sites, the job reqs aren't reflective, and so you really have to look into the details. Don't take at face value whatever they're calling the job, right? Security engineer where they really want an architect, or they're really looking for somebody that does 3 of those roles, right? You have to really look at the details, and in many cases when they put down the requirements or the certification If you don't fit that, don't worry about it, because in many cases they don't even know why they're putting that down there anyway. So, you know, apply, be able to give relevant experience and knowledge and background. It's better to give it a shot and try and apply for a job regardless of what they're saying. You know, you have to have a GCIA or GSEC. If you think you've got the skills, apply for it, okay? So don't be held back. It's okay to be rejected 20 times. It is. A lot of these job reqs that I see are not reflective. They aren't what they need to be. So keep that in mind. Okay, so that should help you if you're trying to get into the industry and you kind of want those next few steps to begin exploring. If this doesn't satisfy you, If you actually wanna go down that rabbit hole and understand, well, what aptitude, what knowledge, what task, what skills, what specific certifications and kind of work, and how does somebody grade a novice to an expert and in between, you really wanna know that? Okay, we can go there. The first place that you need to go and start doing your research is NIST, right, the National Institute of Standards and Technology. And on there specifically is the NICE, N-I-C-E, site, and that's the National Initiative for Cybersecurity Education. This— and I've worked with this organization before in helping drafting standards— really what it's doing is it's helping the academia community figure out how do they develop programs for cybersecurity so that that next generation of people can be trained with the right skill sets., right? And then can be communicated out. So when you do get a degree, it means something, right? And it's fairly consistent. Those are very important things as we're getting, you know, and trying to fill the several million open positions right now out in the industry. So there's lots of different resources out here, right? Including CyberSeek, the link for CyberSeek that we saw originally. But one of the things that you're going to want to go to is you're going to want to look at a particular publication. And it's SP, it stands for Special Publication, SP 800-181. It's the government, they love their numbers. And to be honest, there's actually two versions of this. The first version that came out, I wanna say in 1997, is very lengthy and it's about 135 pages long. And within this, they actually talk about the different education models and the types of skills and knowledge and everything else that's necessary for some of these roles and to satisfy some of the needs. So you can see some of the categories here, you can see some of, we'll get down further, you can see some of the work roles and everything else. And again, these are the tasks and it goes on, right? The knowledge and every tremendous amount of data. And if you'd like to have a resource that you can print out and kind of page through and highlight, this is a great one to have it because if you choose the most current version of SP 800-181, you won't get that. This is the current version of it. It's only like 15 or 18 pages long, and they've taken out all those resources. They've actually put the resources on the web. You still get an overview of the methodology, which may or may not apply to you unless you're in academia, that you can understand kind of, you know, how programs should be developed. But they do have some online resources. But if you're going to do that, I'm going to show you the last link, and again, these are going to be in the description. You need to go out to NICCS, the National Initiative for Cybersecurity Careers and Studies, and out there they basically take that— everything that's in, um, SP 800-181, all the different tables, and put it online. So you can go out and you can look and look up any of these roles. And when you do, well, guess what? It's showing you the abilities. It gives you a listing of those. It shows you the knowledge. This is the type of knowledge this role needs. These are the skills. These are the tools. And here are the capability indicators for entry, intermediate, and advanced in this skill set. So this provides a tremendous amount of information and resources if you really want to dive in. So If you want to go down that rabbit hole, by all means, you are welcome to do that. The thing is, again, realize that these documents are a couple of years old and the industry is truly dynamic. So things change. So keep your wits about you. Again, take a look at the resumes, take them with a grain of salt, right? Assume that there's going to be some flaws in there, either with requirements or duties or But see what an organization is asking the candidate, asking you, what to accomplish, okay? And, you know, see if you can fit that to 80% to 90%, great. And rarely does somebody come in and can satisfy that to 100%. And don't be too caught up in the requirements for certifications, right? Work with that potential employer and, you know, give your best case and show where you're at in that skill set. And you may be surprised, there is a great need for talented people, and many organizations, especially larger ones, are willing to bring people in, groom them, help them get that extra set of skills to be able to fulfill the job, right? And when you do get that job, always remember, 18 months, chances are you're going to be using entirely different tools or languages or different expectations, different goals. Right? You may even have a different title reporting to different people. Expect an ambiguous and chaotic environment. That is the norm. And if you don't like ambiguity, you may wanna reconsider cybersecurity as a profession because that is one of the big things that we all have to deal with in this field. So again, thank you, Chris Sanchez, for the question. Hopefully I did it justice. And for everybody out there, please let me know, give me a comment, let me know what your thoughts, your experiences are. I read all the comments, I absolutely love them because we all have to communicate. And if you have another topic you want me to dive into or rant about, please also put it in there and I will do my best. As always, if you like this video, please hit the like, and you're welcome to join and follow the Cybersecurity Insights channel.