Charles Varga, CISSP shares the story of his progression from community college student to information security analyst, along with his insights on how cybersecurity education differs from duties on the job.
Disclaimer: The views and opinions expressed in this article belong solely to the author and do not necessarily reflect those of ISC2.
Before I started studying cybersecurity, I’d developed a specific idea of what my career would be like. I imagined using the latest hacking tools to break into systems and constantly discovering new vulnerabilities for a living. Reality painted a different picture.
In 2018 I began an internship with a local government agency and began taking cybersecurity classes that same year. I noticed almost immediately that what I was doing in my internship differed from the material I was learning in class. Most of my internship work involved defensive security, primarily incident response, learning to use tools which facilitated or supported me based on the type of action that was necessary. While I was there, I used my coding skills to build a tool that automated a significant chunk of the incident response procedure.
The Difference from the Classroom to the Enterprise
However, in my classes, most of what I was learning was the use of pen testing tools; we engaged in hacking exercises and capture the flag competitions. There was some defensive security involved as well in some of the exercises, but – in hindsight – this largely involved basic level exercises compared to the actual defensive security work undertaken by the cybersecurity workforce I’d go on to join.
I also noticed that, in the educational environment, we were rarely exposed to enterprise-level tools. But, in both my internship and first full-time job, enterprise software was our bread and butter.
When I entered the workforce full-time, my first role in IT involved less cybersecurity work than I expected. Yes, I was helping the security team a lot, but primarily as a systems administrator: I was responsible for ensuring that the organization's servers were up and running at all times while also fulfilling change requests that involved server upgrades, load-balancing of new services, remediations of detected vulnerabilities and modification of critical file transfer procedures. I was often “on call” 24/7.
Even as a sysadmin I made sure to soak up as much on-the-job cybersecurity training as I could, in the knowledge it could eventually lead to a role in which cybersecurity would be my primary responsibility.
Modern Incident Response
A few years into my first full-time role, I was indeed promoted to an information security analyst role, where my duties changed significantly. While cybersecurity work had been mostly a secondary responsibility in my first role, it was now front and center among my duties. I learned to navigate the organization's incident response procedures, which seemed to be an evolution of the procedures that I’d followed in my internship a few years previously.
During my first internship, the information security office had been responsible for handling all potential incidents, opening help desk tickets for remediation purposes and escalating as appropriate. I’d also had a taste of what it was like to respond to incidents in one of my cybersecurity classes at the university. In my current role, the information security team provides a supporting role for the enterprise's business objectives and core services – but information security itself isn't a core service. As such, most of the incidents that occur are handled by our third party MxDR provider, only a small fraction of those incidents is escalated to our team.
This is where I see another major difference between what I was taught and what I’ve experienced. Many of the incidents which were escalated to us required interaction with the end users (or their supervisors), to understand the nature of the anomalous activity that was identified. This soft skill is impossible to learn from a basic CTF exercise.
The lessons I’ve learned from almost ten years of experience are:
- Education in cybersecurity may differ, sharply, from on-the-job experience. My cybersecurity education focused on offensive security, but both my internship and my first cybersecurity role were primarily defensive roles.
- Regardless of how much education you attain in the field, your first IT role might not involve cybersecurity-related responsibilities. But this is okay: many cybersecurity professionals start off their career in lower-level IT roles, where you may need to develop and exercise soft skills which you may not have learned much about in a purely educational environment.
In a nutshell: the next generation of the cybersecurity workforce may come from unexpected places. I am evidence of this, from the current generation.
Charles Varga, CISSP, has eight years of experience in cybersecurity. He has held primarily technical roles, with responsibility for incident response, cloud security, identity and access management, and enterprise infrastructure, among others. His cybersecurity work spans several enterprise-wide projects and multiple publications in academia.
