whats it like working in IT security?

moneymad

Is it interesting?

Blowfish

It's a difficult question to answer as InfoSec is broad and is involved not just in every aspect of IT, but in some areas outside of IT also. The jobs are incredibly varied, do you have any idea which aspects you find appealing?

On a personal level, I do find my own role interesting, though I know it's not for everyone and there are other parts of InfoSec that I wouldn't really be interested in working in.

Kinet1c

A company I worked for had several security teams, as follows:

1. Security review of code created internally (requires good coding skills)

2. IT process security along with release management (higher level view, cert like CISSP would suit)

3. Threat management including malware analysis etc. (more suited to OSCP type stuff or CEH )

industrialhorse

Kinet1c wrote: »

A company I worked for had several security teams, as follows:

1. Security review of code created internally (requires good coding skills)

2. IT process security along with release management (higher level view, cert like CISSP would suit)

3. Threat management including malware analysis etc. (more suited to OSCP type stuff or CEH )

Dont forget Business Continuity & Disaster Recovery and a hell of a lot of firefighting!!!

thomas anderson.

Its great.

I stand outside the Comms Room door with a bat and tell people to move along.

Keyzer

thomas anderson. wrote: »

Its great.

I stand outside the Comms Room door with a bat and tell people to move along.

You hear that Mr. Anderson?... That is the sound of inevitability...

syklops

I work with people who do risk and compliance which to me sounds as dull as dishwater but they love. I do Pen Testing and SIEM deployment, which means I always have my head in a shell, which they can't imagine anything worse which I love.

Pen testing has its dull days as well. Lots of paper work and lots of customer interaction. Plus most people around you dont really understand what it is you do(including your managers).

I'd say its on a par with almost any other IT job to be honest.

syklops

syklops wrote: »

Pen testing has its dull days as well. Lots of paper work and lots of customer interaction. Plus most people around you dont really understand what it is you do(including your managers).

It's funny to hear the conversations about pen testing, vulnerability scanning, incident handling and security auditing... apparently it's all the same

timmywex

Deleted User wrote: »

It's funny to hear the conversations about pen testing, vulnerability scanning, incident handling and security auditing... apparently it's all the same

Pen testing and VA are two terms that are used fairly interchangeably really :eek:

syklops

timmywex wrote: »

Pen testing and VA are two terms that are used fairly interchangeably really :eek:

Used interchangeably by them that don't know one end of a mule form the other.

trout

timmywex wrote: »

Pen testing and VA are two terms that are used fairly interchangeably really :eek:

not in my earshot ... and not for long

zweton

any of ye guys working within the grc field?

Blowfish

zweton wrote: »

any of ye guys working within the grc field?

I suppose technically my job (Information Security Analyst) is kind of in GRC, but it's a suprisingly difficult question to answer as InfoSec is just one small part of GRC as a whole and GRC is only one part of my job as a whole.

Armistice

Also remember there is another side to IT security which is Networking - Access lists, Firewalls ASA/PIX , intrusion detection, VPN's etc.