SOC Analyst, Hacker, or GRC? Finding Your Place in Cybersecurity

Episode transcript

Transcript provided for accessibility and search. Minor transcription errors may remain.

SPEAKER_00 0:02

Welcome to Hacking Your Cyber Career. Episode 8. SOC Analyst, Hacker, or GRC. Finding your place in cybersecurity. There's a lot more to cybersecurity than stopping hackers. So where do you fit in? Here's Steve.

SPEAKER_01 0:24

Whenever I get into an Uber, there's always the possibility the driver will ask what I do for a living. And when I tell them I work in cybersecurity, I usually get a rather interesting reaction. Oh, cybersecurity! You must see some really weird things. Well, yes, actually I have. Over the years I've encountered extraordinary incidents, including activity associated with nation-state threats. But the vast majority of cybersecurity work isn't sitting in a dark room surrounded by flashing monitors desperately stopping hackers. It's often about stopping people inside the organization from accidentally creating the vulnerabilities hackers would love to exploit, which, admittedly, doesn't sound quite as exciting. Today I attended a meeting about access permissions and explained why we shouldn't connect an unsupported application directly to the internet. Not exactly the next Netflix thriller, is it? But it's important work. And it highlights something people trying to enter cybersecurity often misunderstand. Cybersecurity isn't one job. It's a collection of different disciplines requiring very different skills, interests, and personalities. Some people investigate suspicious activity. Others design security architecture. Some manage technical controls. Others work with business leaders to understand risk. Some train employees, improve processes, review compliance requirements, or help organizations make better decisions. And here's the interesting part. You don't have to be a brilliant hacker to be successful in cybersecurity. You don't even have to spend your entire career in a deeply technical role. I've spent decades building and leading technology and cybersecurity teams. I've seen people with very different backgrounds become outstanding professionals. So today we're exploring different career paths, what the jobs involve, what sorts of people enjoy them, and how to figure out where you belong. Because before you spend two years preparing for a cybersecurity career, it's worth checking you're preparing for one you'd actually enjoy. I'm Steve, and this is Hacking Your Cyber Career. Let's begin with one of the better-known paths, the Security Operations Centre, or SOC. The SOC monitors security events, investigates suspicious activity, and helps the organization respond to threats. An analyst might review alerts, examine logs, investigate unusual authentication activity, analyze endpoint events, or determine whether something is genuinely malicious. And sometimes they uncover a serious attack. But much of the work involves things that turn out to be entirely legitimate. An employee logging in from an unfamiliar location, an application generating unexpected traffic, a tool reporting suspicious behavior with an innocent explanation. The job is separating concerning activity from the enormous amount of normal activity across an organization. That takes curiosity, attention to detail, patience, and perseverance. An investigation doesn't always give you an answer immediately. Sometimes you'll spend hours examining evidence, following leads, and trying to understand what happened. Only to discover somebody installed an approved software update. Brilliant. Three hours of your life you'll never get back. But it wasn't wasted. You've learned about the environment, validated what happened, and improved your ability to recognize similar activity. If you enjoy puzzles, understanding systems, and digging into technical details, operations may appeal to you. You also need to tolerate uncertainty. Not every alert comes with a convenient explanation. And communication matters. You may explain findings, escalate an incident, or document evidence for another team. The SOC isn't just staring at screens, it's investigation, judgment, and teamwork. Also, some SOC environments operate shifts, including nights and weekends. Worth knowing before deciding it's your dream job. Cybercriminals, rather inconsiderately, don't limit their activities to business hours. Now let's talk about the career path that probably attracts the most attention. Ethical hacking, penetration testing, red teaming, and apparently wearing a hoodie while typing at extraordinary speed. There's nothing wrong with offensive security. It's fascinating, but the reality is rather different from the films. Penetration testers are authorized to evaluate systems, applications, and environments to identify weaknesses attackers might exploit. They may examine web applications, test networks, evaluate configurations, assess authentication, or demonstrate how vulnerabilities could be exploited. But remember the word authorized. Professional testing happens within an agreed scope, with defined rules and appropriate permission. You don't simply decide a company's website looks interesting and start attacking it. That's not career development, that's potentially a criminal investigation. A good penetration tester needs technical knowledge, creativity, and persistence, but also discipline and communication. Finding a vulnerability is only part of the job. You must explain what you found, why it matters, how it could affect the organization, and what should be done. If you can't communicate the result, the technical achievement may have little business value. And not every test produces spectacular discoveries. There's plenty of routine assessment, documentation, retesting, and report writing. So ask whether you enjoy methodical investigation and technical problem solving rather than just imagining yourself as a hacker. The actual work is considerably more disciplined than Hollywood would have you believe. Next, security engineering and architecture. These roles matter because much of cybersecurity is making systems secure before something goes wrong. Engineers implement and maintain firewalls, endpoint protection, intrusion prevention, identity controls, data loss prevention, and cloud security capabilities. This can be deeply technical. You need to understand systems, connections, and how security controls affect them. Often the hardest part isn't configuring the technology, it's making it work in an existing environment. Organizations have old systems, new systems, cloud platforms, legacy applications, complex networks, and occasionally something nobody dares touch because the last person who understood it retired in 2019. Engineers need troubleshooting skills and an appetite for detail. Architecture takes a broader perspective. How do technologies, processes, and security requirements fit together? How should an application authenticate users? How should information move? What protects sensitive data? How do you balance security, cost, performance, and operations? Architecture needs technical understanding, certainly, but also communication. In my experience, successful architects are inquisitive, persistent, and able to explain complicated ideas clearly. An architecture diagram nobody understands isn't terribly useful, and a security design the business cannot implement isn't much better. The best architects understand the technology and the business problem. They work with engineers, project teams, and leaders to find practical solutions. If you enjoy seeing how things fit together, solving complex problems, and explaining your thinking, consider architecture. You probably won't walk straight into a senior architect role from your first training course. It's often something you grow into through engineering, operations, and experience, but it's a direction worth exploring. Now we come to an area I think is consistently underestimated. Governance, risk, and compliance. GRC. Before you switch off because you expect 10 minutes about spreadsheets and policies, hear me out. I consider GRC one of cybersecurity's most important disciplines. Organizations need to understand risks, evaluate them, prioritize them, communicate them, and decide how to manage them. That's not paperwork. That's fundamental to an effective security program. An organization may have hundreds or thousands of vulnerabilities, weaknesses, control gaps, and threats. It cannot fix everything immediately. How does it decide what matters? Understand business impact? Determine where to invest? Know whether its controls actually work? GRC professionals help answer those questions. They work with risk assessments, control frameworks, audit findings, privacy, regulatory obligations, and policies. They examine whether processes are followed, access is managed, changes are controlled, risks are addressed, and the organization can demonstrate its security program works. But GRC isn't just identifying problems. It's working with people to get those problems addressed. That requires communication, persuasion, negotiation, and business understanding. You might identify a significant risk. Wonderful. Now convince the people responsible to do something about it. They have other priorities, limited budgets and operational constraints. They might not agree with your assessment. You need to explain risk in terms they understand and work toward an appropriate response. That's different from configuring a firewall, but no less valuable. I've seen people from internal audit, finance, corporate controls, and other disciplines move into cybersecurity. Those backgrounds bring knowledge of processes, accountability, business operations, and risk. If you enjoy structured thinking, business problem solving, and working with people, don't overlook GRC. It may not be glamorous, but it helps keep the whole thing functioning. Frankly, I'd rather have effective risk management than an impressive collection of tools and absolutely no idea which risks matter most. Cybersecurity doesn't stop there. There are many specializations. Cloud security. As organizations move applications and information into cloud environments, they need people who understand cloud architecture, configuration, identity, monitoring, and data protection. Identity security. Who should have access to what? How do we verify people are who they claim to be? Manage privileged access? Remove access when no longer needed? Identity might not sound as exciting as threat hunting, but controlling access is central to cybersecurity. Then application security, helping development teams build software securely and identify weaknesses. Data security, understanding where sensitive information lives, how it's used, and how it's protected. Incident response, coordinating the technical and organizational response when something goes wrong. And security awareness, which requires a different combination of skills. If you're good at communication, education, and influencing behavior, awareness can be an excellent direction. Security isn't achieved by installing technology alone. People must understand their responsibilities and make sensible decisions. Then there are roles between disciplines. Project management, security program management, vendor management, business analysis, consulting, and eventually leadership. Cybersecurity needs a broad spectrum of capabilities. Some deeply technical, some focused on processes and risk, some centered on communication and people, and many combining all three. There's no hierarchy in which the most technical person automatically has the most valuable job. Organizations need all of these capabilities. The challenge is finding where your strengths and interests fit. Over the years, I've hired people into many technology and cybersecurity roles. One lesson is that technical knowledge is only part of the equation. Technical skills can often be taught. Certain roles do require a foundation before you can contribute safely. I'm not suggesting you walk into senior security engineering knowing absolutely nothing about computers. Interesting experiment, not one I'd recommend. But I look for qualities that are harder to develop through a training course. Curiosity, enthusiasm, initiative, willingness to learn, ability to work independently when appropriate, and ability to work with others. Personality and team fit matter enormously. That doesn't mean everyone should have the same personality. I've worked with the entire spectrum, from quiet introverts to extremely outgoing people. Teams need different personalities and perspectives. What matters is contributing effectively. An excellent technical specialist may be quiet and prefer focused problem solving. Fine. A GRC professional may spend the day engaging across the organization. An architect may explain complex decisions to business leaders. Different roles draw on different strengths. Someone who struggles in one environment might excel in another. There's no single ideal cybersecurity personality. Another thing I've noticed. People don't always move around within cybersecurity as much as you'd expect. Once they find a niche, they often stay. What I've seen more frequently is people entering cybersecurity from IT infrastructure, internal audit, finance, corporate controls, and other disciplines. That works well because they bring valuable experience. They understand operations, processes, technology, or business risk and apply that in a security context. So, if you're entering from another profession, don't assume you're starting from zero. You may already have useful skills. The important thing is understanding where they fit. How do you decide which part of cybersecurity suits you? Start with a simple question. What work do you actually enjoy? Not what sounds impressive, pays the most according to social media, or looks exciting in a film. What do you enjoy? If you like investigating technical problems, following evidence and uncertainty, perhaps operations or incident response. If you enjoy experimenting and finding weaknesses, consider penetration testing. If you like building systems and solving implementation problems, engineering. If you enjoy understanding how technologies fit together and explaining complex ideas, architecture. If you're organized, interested in business risk, and enjoy working with people to improve processes, GRC. If communication, education, and influencing behavior are strengths, security awareness. And if you're interested in leadership, understand the path may involve several areas. A good cybersecurity leader needs broad understanding. They don't have to be the world's leading expert in every speciality. Frankly, that person probably doesn't exist. But they need to ask sensible questions, evaluate priorities, and make informed decisions. Don't assume your first role determines your whole career. You may discover something else that interests you. You may move in from another discipline. Or you may find a specialization you love and develop deep expertise. All legitimate paths. There isn't one correct route. The important thing is making a conscious decision about what you're working toward, rather than collecting qualifications and hoping a career eventually emerges. I want to share something about my own career. If you imagine I sat down early in life and carefully planned to become a cybersecurity leader, I'm afraid the reality is less impressive. I didn't deliberately set out to become a CISO. I started in technology when cybersecurity was beginning to emerge as a distinct discipline. Many responsibilities we now associate with security sat within infrastructure and other IT teams. That's how it developed for me. As security became a larger concern, those responsibilities grew. What had been part of a broader technology function gradually needed its own focus. A small team developed, responsibilities expanded, more people joined, we added capabilities. Security operations became established, and cybersecurity needs kept growing. Eventually, what began within infrastructure became a substantial cybersecurity function, and my career evolved alongside it. It wasn't a brilliantly executed master plan. It was opportunity, experience, learning, and willingness to take on responsibility. Here's the lesson. You don't need to know exactly where you'll be in 20 years. Understand what interests you now, develop useful skills, and stay open to opportunities. Today's roles may look different in 10 years. Don't get so attached to a title that you miss chances to grow. Build a foundation. Understand disciplines. Develop relationships. Keep learning. If you want to lead a cybersecurity organization, understand more than one part of it. You don't have to be an expert in everything, but appreciate the contribution each discipline makes. Leadership isn't about being the most technical person in the room. It's bringing people, processes, technology, and business priorities together. That's a very different challenge. Enjoy building things? Good at explaining complicated ideas? Prefer structured processes? Enjoy working with people? There's no right answer. Understand yourself. Second, choose two disciplines that interest you. Not 10, but two. Perhaps operations and engineering. Perhaps GRC and awareness. Perhaps cloud and identity. Read job descriptions. Look at responsibilities. Find out which skills employers expect. Where possible, talk to people doing the work. Third, try something practical. Interested in operations? Use a safe training environment to investigate logs and alerts. Engineering? Build an authorized lab. GRC? Study a recognized control framework and practice identifying, evaluating, and managing risks. Awareness? Explain a common security risk to somebody who doesn't work in technology. See what you enjoy and what you don't. Discovering you dislike something before spending two years pursuing it is useful. Finally, remember, your existing experience has value. If you're coming from IT, audit, finance, project management, or elsewhere, don't throw that experience away. Apply it. Cybersecurity needs people who understand business as well as technology. One final thought. When people hear cybersecurity, they imagine stopping hackers. And yes, that's part of it. But much of the profession is helping organizations make better decisions, helping people understand risks, designing systems properly, putting controls in place, and preventing problems before they happen. There are many ways to contribute. Don't worry if you don't see yourself as a hacker. You might be an outstanding risk professional, a brilliant architect, a talented engineer, an excellent communicator, or a future cybersecurity leader. You just haven't discovered it yet. I'm Steve, and this has been Hacking Your Cyber Career. Thanks for listening. Keep learning, keep exploring, and don't let somebody else's idea of cybersecurity determine your career. The best cybersecurity career isn't necessarily the one that sounds most exciting. It's the one where your strengths, interests, and contribution come together. See you next time.