Insight into the world of an IT security analyst
Cyber security, can you hack it?
Cybercrime is one of the biggest threats to businesses all over the world, New Zealand included. As we are living in an increasing connected world the need for IT security specialists is on the rise. One prominent New Zealand business owner recently stated, 'If I can get 30 IT security specialists to walk through our doors today, I will employ them all.
A survey in 2014 found that 83% of New Zealanders had experienced some kind of cybersecurity breach. But this is only the tip of the iceberg. As we still do not have a central organisation for reporting cybercrime, breach disclosure isn't accurate. Often, victims of cybercrime don't know how to report it.
"As a result, we don't have a consolidated picture of cybercrime in New Zealand, however, we do know that IT security jobs are becoming the hotspot for IT professionals," says Grant Burley, Director at Absolute IT.
"Our latest data shows that the median base salary package for IT Security Analyst is $99,000 with the upper quartile receiving more than $143,500 per year. The median base rate per hour for contractors is $130/hour, with the upper quartile receiving more than $150/hour.
So what are the skills that you need to be an IT security analyst?
According to Shane Hanson an IT Security Analyst, the top three skills are:
1. Attention to detail: IT security professionals work methodically and very detail oriented.
2. The ability to continuously learn: IT security professionals have an eagerness to dig into technical questions and examine solutions and problems from all sides. They are also big believers of continuing education and take the opportunity to upskill as they understand how quickly technology changes and advances.
3. The ability to see what motivates others. You have to be able to put yourself in someone else's shoes and understand the 'why' to be able to anticipate and front foot the 'how'.
As with all technical fields, Hanson believes that the devil is in the detail in cyber security. Even a minuscule thing can determine whether a packet is valid or harbouring a vulnerability. Because of this, a dedication to continuing education is vital in order for IT security professionals to keep up to date with the latest vulnerabilities and defences.
In addition to these skills, Hanson rates the following attributes:
· Enthusiastic and highly adaptable
· Strong analytical and diagnostic skills
· Demonstrated skills in innovation and collaboration
· Keep a current understanding of vulnerabilities from the Internet
· Maintaining awareness and knowledge of contemporary standards, practices, procedures and methods
· Ability to get the job done
What the Job is Really Like
Hanson is no stranger to justifying the cost and impact of security decisions, which he believes is the hardest part of the job. "I remember once finishing up a quick design project, when an email came across my desk which essentially said 'we'll put these changes in place until the security guy leaves, and then we can roll them back to make our lives easier!'
But he has solid reasons for loving this line of work too. "For me as a contractor the best part of the job as an IT security specialist is the variety of things I get to do in a day, and seeing the myriad of different ways used to achieve the desired outcomes along the way when tackling a problem.
And the job really is varied. Information security specialists may have expertise in working with different types of computer networks associated with the government and NGOs, defence industries, and the banking and commerce sector, to name just a few.
There are a variety of roles available within the field of information- and cybersecurity. Some of these roles do not, and cannot, exist in isolation of each other, so is it very common that an IT specialist working in one area will develop a strong understanding of the work in other areas. This is exactly what keeps the career interesting.
As employers use slightly different job titles for the same role, overlaps between roles can occur. Therefore, when exploring careers in information and cyber security, read job descriptions thoroughly to get an understanding of what's involved with a particular role.
From analysing and assessing potential security risks, developing plans to deal with such incidents by putting measures in place such as firewalls and encryption, to monitoring and auditing systems for abnormal activity, to executing corrective actions, IT security specialists never have a boring day.
And it's exciting too: IT security specialists can essentially do everything a hacker can, only they use these skills for good not evil! Say hello to the modern superhero.
What to expect
Much of IT security work is office-based, but specialists can also work as consultants, either for an employer or as self-employed, travelling out to visit clients, sometimes even across the world for global clients. The industry is male dominated, but there are schemes in place to entice women to enter this line of work.
Although it is possible to enter the IT security without a degree via entry level positions in IT (such as help desk support), statistics show that it is becoming more challenging to enter the field from a more general IT role. More recent entrants are graduates, which is a good indication of the growth of information security as a sector.
Currently, half of IT security specialists have an undergraduate degree, with the most common degree subject being IT. There are other useful degree subjects that have desirable transferable skills, such as:
- cyber security
- network engineering
- networks and security
- computer science
- forensic computing
- mathematics
- physics
While those subjects don't sound like the most exciting subjects, Hanson notes that as someone who "gets to poke around in a lot of other people's environments" he often comes across some very interesting things. "I've seen people running secret cloud services inside corporate networks along with everything from unsecure wireless APs to printers on public addressing.
