Chapter 2: Which Career Field Is Best for You?

In the previous chapter, you experienced cybersecurity from a bird's-eye view. In this chapter, we are going to take a deep dive into cybersecurity and learn about its different fields. As we go further, we will also be looking at varied career opportunities, and how to determine which cybersecurity field is best for you.

By the end of this chapter, you will have an overview of definitions, job requirements, and the expectations of several well-known cybersecurity positions listed in the fields of Risk Assessment, Governance, Threat Intelligence, Security Operation, Security Architecture, and Cybersecurity Education.

In addition, I will be guiding you through how to determine a cybersecurity career choice that fits you. After completing this chapter, whether you have been able to choose your favorite cybersecurity occupation or not, the tips and tricks provided can be carried on to the next chapters, which will help you continue...

Introducing you to the cybersecurity roadmap

As you learned in the previous chapter, cybersecurity is a general term to describe an industry where professionals manage security risks secure and defend infrastructures, systems, and applications that may be internet-associated. That is, indeed, what cybersecurity professionals do in a nutshell. However, the definition can sound quite vague if you are trying to decide on the right cybersecurity vocation. How and what exactly do you defend? What does "defend" precisely mean in the context of cybersecurity? To have a clearer view, let's break all these questions down into pieces.

Cybersecurity is no myth; you can refer to it in the same way as you think of other fields and subfields. For example, take the hospitality industry as an example. "Hospitality" refers to the service industry, and under hospitality, there are subfields, such as hotel service, lodging service, dining service, and so on. Similarly, cybersecurity...

Understanding the top prominent cybersecurity domains

Despite the diverse number of subfields, in this book, we'll concentrate on the most in-demand areas of each domain shown in the preceding section, which are listed in the following table. Note that each domain has several areas that are equally in demand. However, since it is not practical to list all of them, only some have been chosen:

Table 2.1 – In-demand areas of domains

Let's simplify and focus our mind map view so that it mirrors this chapter's topic, like so:

Figure 2.2 – Cybersecurity domains

In this section, we learned that cybersecurity is a broad field that contains many sub-fields of different focuses. The sub-fields we are going to work on are Risk Assessment, Governance, Threat Intelligence, Security Operation, Security Architecture, and cybersecurity Education, respectively. In the upcoming sections, each of these domains will be closely...

Guiding you on how to choose a career

Before deciding on your favorite cybersecurity path, let's learn how to determine if any field is right for you. The following are some recommendations to help you identify your career path:

• Find your passion: Believe it or not, to be successful and satisfied with any career, you need to like it first. With that in mind, find things that interest you, keep you excited, and that you can do for a long time without feeling fed up.

  For example, people who like to explore and question things tend to go for science-related fields, since the nature of those fields is to scout for new findings and discover the root causes of things.

• Identify your strengths: Knowing what you are good at and leveraging them is also a good way to go about finding the best fit career for you. For example, if you are not good at arts and design but very good with math, why compete with people who are masters of design? Instead, take advantage of your mathematical...

Which cybersecurity field is the best for you?

Now, we are in the right direction to narrow down the professions that are the best fit for you. Let's summarize what we have learned about the different cybersecurity career options that were introduced in this chapter and find out which one is right for you.

Risk Assessment and Offensive Security

A good occupation under Offensive Security could be pentesting, where you can legally attack systems or software to find vulnerabilities, helping organizations prevent potential future attacks.

If you are a curious person who enjoys exploring and bringing improvements to things, and has always dreamed of being that cool ethical hacker from the movies, this could be a good career choice for you.

Governance and GRC

A GRC analyst ensures that organizations' GRC are aligned and effective. This work requires learning about certain cybersecurity laws and regulations.

As a result, if you find cybersecurity laws and regulations...

Summary

In this chapter, we briefly scanned the big picture of the cybersecurity field and its many different domains. After that, we investigated the leading areas and job titles in cybersecurity, including Risk Assessment, Governance, Threat Intelligence, Security Operation, Security Architecture, and Learning.

The areas we learned about were Offensive Security, GRC, External Threat Intelligence and Internal Threat Intelligence, Incident Response, Cloud Security, education, training, and awareness. Finally, the professions we learned about were Penetration Tester, GRC Analyst, Cyber Threat Intelligence Analyst, Incident Responder, Security Architect, Cloud Security Specialist, Cybersecurity Trainer, and Cybersecurity Instructor.

Thenceforth, summaries of each domain, area, and role were provided, together with guidance on how you can find your desired career. In the end, several tips and industry required skills were brought to your attention. 

By the end...

Questions

Take a few minutes to complete the following knowledge-check questions:

1. Which of the following is NOT a step in the Penetration Testing procedure?

   A. Report

   B. Exploit

   C. Remove the company's internet access

   D. Identify the system's weak points

2. During an Incident Response event, which order is correct for executing the following actions?

   A. Plan, Report, Evaluate, Document, Eradicate, Contain, Recover

   B. Prepare, Identify, Contain, Eradicate, Recover, Evaluate, Document

   C. Prepare, Identify, Eradicate, Contain, Recover, Evaluate, Document

   D. Contain, Identify, Eradicate, Recover, Evaluate, Document, Prepare

3. Cybersecurity specialists only need to perform individual tasks; thus, communication skills are not important.

   A. True

   B. False