Cybercrime can’t simply hurt businesses. It can destroy them.
After a ransomware attack struck a medical office in Battle Creek, Michigan in April 2019, Dr. Willam Scalf, one of the two doctors at the facility, said “I was suddenly retired and didn’t want to be.” The New York Times reports that the criminals demanded $6,500 to release the medical files they had frozen as a result of the attack. Rather than capitulate to the criminals, the center chose to shut down for good, leaving its 10 employees without jobs.
The same fate struck a printing company in Colorado, forcing it to permanently furlough several hundred employees in the wake of a ransomware attack. The city of New Orleans is still reeling from ransomware that infiltrated its computers in 2019, requiring much of its work be done on paper, including police reports that officers now have to complete by hand.
Cybercrime rates are skyrocketing, costing businesses and individuals $3.5 billion in 2019. This is according to the 2019 Internet Crime Report issued by the Federal Bureau of Investigation’s Internet Crime Complaint Center (IC3). The business losses inflicted by cybercriminals has more than tripled from their 2015 level of $1.1 billion. Additionally, the number of incidents reported to the IC3 has increased by more than 60%, reaching 467,361 in 2019 from 288,012 incidents in 2015.
Businesses are increasingly challenged in their efforts to prevent and recover from cyberattacks. One major reason for this is the growing shortage of cybersecurity professionals who possess the training and experience to lock down the data networks that companies rely on. The IC3’s 2019 cybersecurity workforce study — entitled Strategies for Building and Growing Strong Security Teams — reports the global cybersecurity workforce will need to grow by 145% to meet current demand, and by 62% to fill the 500,000 cybersecurity positions currently open in the U.S.
The resources in this guide explain how to get into cybersecurity and the steps required to qualify for top jobs in this growing field, which becomes more vital to businesses with each passing year. It describes dozens of specific cybersecurity roles, as well as the education and skills required to build a rewarding career.
The State of Cybersecurity: Job Outlook
Few jobs are in greater demand than those related to cybersecurity. These statistics highlight the robust cybersecurity job outlook:
- The U.S. Bureau of Labor Statistics (BLS) Occupational Outlook Handbook reports that employment for information security analysts will grow by 32% between 2018 and 2028, which is a much faster than the 5.2% growth forecast for all occupations in the same period. The demand for cybersecurity professionals is expected to be highest in the financial and health care industries. In computer system design and related services, the demand is forecast to increase by 55% between 2018 and 2028.
- Cybercrime and data breaches are on the rise, creating increased demand for knowledgeable and skilled cybersecurity professionals. Figures compiled by the IC3 found that businesses lost $1.7 billion in 2019 due to business email compromise (BEC) and email account compromise (EAC), which infiltrates business and individual email accounts to implement unauthorized funds transfers.
- Hackers and cybercriminals continue to pursue new ways to breach computer and data systems, requiring cybersecurity professionals to gain the skills to effectively counter ever-evolving new threats. For example, attacks on email accounts have grown more sophisticated. Criminals are now able to target specific high-ranking individuals in organizations, a practice referred to as “spear phishing.” Such attacks have succeeded in spoofing the email accounts of law practices and in tricking human resources departments into diverting direct deposits of paychecks to bank accounts controlled by criminals.
- There continues to be a shortfall between available cybersecurity jobs and the number of people entering the cybersecurity field. The Center for Strategic & International Studies (CSIS) reports that more than 314,000 cybersecurity positions were unfilled in the U.S. as of January 2019, and it forecasts as many as 1.8 million open cybersecurity jobs worldwide by 2022. The number of unfilled cybersecurity positions in the U.S. has increased by more than 50% since 2013, according to CSIS.
Top 25 Cybersecurity Careers
The range of cybersecurity careers available to computer professionals is as diverse as the formidable data-security challenges facing organizations. Listed here are some of the cybersecurity positions that companies are struggling to fill today, and that are expected to be in great demand well into the future.
- Cybersecurity Engineer: CompTIA, the world tech association, describes the primary responsibility of cybersecurity engineers as working with a company’s IT staff to patch and protect information systems. This requires staying up-to-date on new technologies and new threats, and devising emergency plans to return systems to operation following a disaster. CyberSeek, the interactive data and career tool, estimates there are currently 53,175 openings for cybersecurity engineers in the U.S. and their average annual salary is $106,000.
- Cybersecurity Analyst: This role focuses on detecting cyberthreats to an organization, preventing as many as possible and mitigating the impact of the attacks that can’t be prevented. CompTIA explains that in small companies, the duties of a cybersecurity analyst may be given to someone with a broader IT role, while in medium and large firms the position may be part of a security team. The position is responsible for intrusion detection, firewalls and antivirus protection. According to figures compiled by CyberSeek, there are currently 29,792 open positions for cybersecurity analysts and their average annual salary is $95,000.
- Network Engineer/Architect: The duties of this position include designing, implementing and troubleshooting LANs, WANs, intranets and other communication networks. CompTIA points out that network engineers must understand the cyberthreats to the networks they maintain and assist their organization in adopting technologies that thwart such attacks. PayScale estimates the average annual salary for network engineers is $73,204. The BLS forecasts the number of network administrator jobs will increase by 24% between 2018 and 2028, which is much faster than the 5.2% average growth for all jobs in the same period.
- Cybersecurity Consultant: The website Coder Academy describes this position as a “catch-all cybersecurity expert” who contracts with organizations to evaluate their computer systems and identify security risks and other problems. They routinely conduct threat analyses and security checks of data and communication networks. They then write reports explaining the results of these checks to IT managers and others at the organizations they serve. Freelancemap estimates the average annual salary of cybersecurity consultants is $84,000; the average pay rate for cybersecurity consultants is $168 per hour.
- Cybersecurity Manager/Administrator: A cybersecurity administrator is the “point person for a cybersecurity team,” according to CompTIA. The position is responsible for protecting data systems from unauthorized access and modification or destruction of a company’s information. They identify vulnerabilities in networks, monitor them for suspicious activity, configure firewalls and other security software, set and implement network security policies, and train employees in security policies and procedures. PayScale estimates the average annual salary of security administrators is $65,953.
- Systems Engineer: The work of systems engineers touches all parts of an organization, including IT and business units. The duties of the position encompass understanding user requirements, planning and implementing all hardware and software components, and monitoring and controlling access to the company’s data. CompTIA explains that system engineers support managers in estimating data project costs, setting system design parameters and troubleshooting problems. The BLS estimates the average annual salary of computer systems analysts was $88,740 as of May 2018.
- Vulnerability Analyst/Penetration Tester: Also called “pen testers,” this position is a form of “white hat or good hacker,” according to CompTIA. Pen testers use the same tools hackers rely on to assess and break into a company’s data network. They also conduct social engineering tests to thwart spear phishing and may evaluate an organization’s physical security. CyberSeek estimates there are currently 13,573 openings for vulnerability and penetration testers, and it estimates the position’s average annual salary at $103,000.
- Software Developer/Engineer: The skills required to succeed as a software developer also serve as the basis for a career in cybersecurity, as CompTIA explains. Among the abilities that overlap both software development/engineering and cybersecurity are cryptography, information assurance, security policy, risk assessment, routers and disaster recovery planning. The BLS estimates that software developers earned an average annual salary of $103,620 as of May 2018.
- Cybersecurity Specialist/Technician: This position is on the front line in the battle to protect computer networks, taking primary responsibility for detecting cyberthreats and implementing the corrections required to protect against them. According to CompTIA, a cybersecurity specialist’s duties include configuring and managing network monitors, analyzing network logs to identify suspicious activity, spotting and plugging potential network vulnerabilities and applying all required network security patches. BLS figures indicate the average annual salary of information security analysts was $98,350 as of May 2018.
- Chief Security Officer (CSO): Investopedia describes the CSO as the executive responsible for the security of an organization’s personnel, physical assets, and information in digital and physical forms. The position is often synonymous with a chief information security officer (CISO) but has been broadened in recent years to encompass security for all of a company’s assets. CSOs develop and oversee the policies and programs that prevent and respond to security breaches, ensure compliance with security regulations and assess financial security risk strategies. The salary website PayScale estimates the average annual salary of CSOs is $146,337.
- Chief Information Security Officer (CISO): According to Code Academy, CISOs are mid-level executives who oversee an organization’s IT security operations. The position is responsible for planning and managing the computer, data and network security needs of all of a company’s employees. They also assist business managers in meeting the security requirements of their departments. According to PayScale, the average annual salary for CISOs is $160,925.
- Information Security Analyst: This position is charged with ensuring that an organization’s firewalls, antivirus protection, encryption and other security measures are in place and functioning correctly on a day-to-day basis. The BLS describes the duties of information security analysts, which include monitoring networks for data breaches, investigating the source of breaches, documenting the damage that results from security breaches, conducting penetration tests and other vulnerability testing, and consulting with managers and senior IT officials on required security enhancements. The average annual salary of information security analysts as of May 2018 was $98,350, according to BLS estimates.
- Security Architect: The secjuice blog defines a security architect as being above a security engineer but below a chief technology officer (CTO) or CISO. The primary duty of security architects is to craft security policies that allow processes such as DevOps to operate securely without any unnecessary impediments. These policies are then implemented by security engineers using a variety of tools, services and automated processes. PayScale reports the average annual salary for security architects is $122,488.
- Cloud Security Architect: The security policies that are effective inside of IT departments don’t transfer directly to protecting an organization’s data assets that reside in the cloud. Cloud security architects are responsible for designing policies and procedures that ensure the trusted and efficient access to cloud resources in proprietary and open environments, as the SANS Institute explains. The resulting cloud security architecture must function in multi-tenant and multi-landlord settings and at the network, operating system and application levels. According to the salary site Glassdoor, the average annual salary for cloud security architects is $106,362.
- Counterespionage Analyst: Also called a counterintelligence analyst, this position typically supports military and intelligence operations of various government agencies. For example, The Balance Careers describes the role of counterintelligence special agents for the U.S. Army as assessing and counteracting foreign threats, including sabotage, terrorism, espionage, treason and sedition. Starting salaries for counterintelligence threat analysts at the U.S. Central Intelligence Agency range from $55,539 to $82,326 annually, depending on experience level.
- Digital Forensics Analyst: This position is synonymous with computer forensics analysts, as Forensicanalyst.org explains. Digital forensics analysts are responsible for handling digital media involved in criminal cases in support of federal, state and local law enforcement. They are also hired by private businesses to protect financial, market intelligence and other sensitive company data. PayScale estimates the average annual salary for forensic computer analysts is $72,869.
- Cyber Intelligence Specialist: Among the duties of this position, according to The Balance Careers, are investigating malware-related criminal activities and predicting when and where cybercriminals may strike in the future. Cyber intelligence specialists are also called cyber threat analysts. Their work supports decision-makers in government agencies, private security services and the highest levels of corporations. According to PayScale, the average annual salary of threat intelligence analysts is $75,000.
- Information Systems Security Engineer: The U.S. National Institute of Standards and Technology defines the responsibilities of this position as encompassing all activities related to securing an organization’s information systems. The position defines information security requirements and integrates security policies in all hardware and software components. PayScale estimates the average annual salary of information systems security engineers is $96,685.
- Security Director: According to BizManualz, the duties of a security director include overseeing the physical security of an organization’s facilities and employees, and leading the company’s security staff to ensure they are adequately trained and equipped to fulfill their responsibilities. Security directors report all incidents and threats to top management. They also maintain all security records to confirm that the company complies with all regulations. PayScale lists the annual average salary of security directors at $82,341.
- Forensic Engineer: Similar to the position of digital forensics analysts, forensic engineers generally have broader responsibilities that include investigating system failures and other performance problems using engineering principles, as the American Society of Civil Engineers explains. From a cybersecurity perspective, the work of forensic engineers focuses on determining the source of information system failures, whether due to mechanical faults, human error or criminal activity. PayScale estimates the average annual salary of forensic engineers is $82,362.
- Malware Expert: This position is sometimes referred to as a malware analyst. It entails analyzing software code to identify attempts to infiltrate an organization’s data networks via malicious programs. CSO Online points out the role doesn’t require a background in security, but rather programming and software design skills to identify threats and intrusion attempts embedded in software. According to PayScale, the average annual salary of malware analysts is $94,880.
- Cybersecurity Architect: In many organizations, this position is synonymous with the title of security architect. The job duties of a cybersecurity architect include assisting senior executives in crafting and implementing the organization’s cybersecurity policies, and collaborating with business managers, developers and engineers to determine their security needs and ensure all security policies are being followed, as CompTIA explains. Salary.com lists the average annual salary of cybersecurity architects at $123,902.
- IT Security Specialist: Also referred to as a computer security specialist or cybersecurity specialist, this position is charged with protecting an organization’s information systems, including hardware and software components, and all data stored in the systems. CompTIA explains the primary challenge of IT security specialists is to stay at least one step ahead of cybercriminals by anticipating and thwarting their methods of attack. PayScale estimates the average annual salary of IT security specialists is $75,961.
- Application Security Engineer: This position is much in demand as companies focus on ensuring the applications they release are as secure as possible. However, TechBeacon notes that landing a position as an application security engineer requires a unique combination of skills and experience. Professionals must be adept at hunting down and fixing bugs in code that may leave users of the software vulnerable to a malware attack. According to PayScale, the average annual salary for application security engineers is $97,684.
- IIoT (Industrial Internet of Things) Security Specialist: The Internet of Things is having a tremendous impact on industries of all types, yet the field is so new it is rife with security challenges, as IoT for All explains. The role of an IIoT security specialist entails ensuring that all automated frameworks that are being put in place are protected against attacks from both within and outside the organization. They do so by providing IT and business managers with visibility, access and control over these far-flung data networks. PayScale estimates the average annual salary for workers with IoT skills is $101,000.
Cybersecurity Education Requirements
Considering the range of technical and management skills represented in the cybersecurity landscape, no single, one-size-fits-all approach exists that will prepare students for specific positions. These are among the cybersecurity education requirements that apply to the majority of specialties in the field.
- A bachelor’s degree with a focus on IT or cybersecurity is often the minimum requirement for entry-level and mid-level cybersecurity roles.
- A master’s degree with an emphasis in cybersecurity is a standard requirement for higher-level managerial and executive cybersecurity positions.
- Among the topics covered in graduate-level cybersecurity programs are the following:
- Cybersecurity law and ethics
- Internet security
- Mobile computing
- Security and privacy
- Digital forensics
- Blockchain
- Cryptography
- Cybersecurity law and ethics
- Professional credentials for cybersecurity professionals include the GIAC Security Expert (GSE), GIAC Security Leadership Certification (GSLC), (ISC)²’s Certified Information Systems Security Professional (CISSP) and CompTIA’s Security+. These and other certifications can bolster the career success of cybersecurity professionals who are seeking to take on leadership roles.
- Security clearance is often required for federal government jobs, including entry-level roles.
Cybersecurity Skills in High Demand
The ever-changing nature of technology means that for cybersecurity professionals, the learning never stops. In addition to a knowledge of basic security policies and principles, careers in cybersecurity require hands-on experience with a range of hardware and software tools, as well as an understanding of organizational behavior and management approaches.
First and foremost, cybersecurity is a technology role — so, technical aptitude, knowledge of security across different platforms and an understanding of hacking are fundamental. Hacker Noon lists the cybersecurity skills that professionals rely on in their day-to-day work:
- Intrusion detection system engineering
- Secure software development (detect and close any “back doors” in the code
- Risk mitigation in the event of breaches
- Cloud security
- Future-proof encryption
- Regulatory compliance and governance
- SecOps, or the integration of security with all business and technical processes
However, soft skills are equally important to a successful career in cybersecurity. These abilities include:
- Problem solving
- Attention to detail
- Communication skills
- An analytical, inquisitive and insightful nature
- Persistence
- Critical thinking
Finally, nearly all cybersecurity positions require the ability to manage complex projects and a willingness to learn new skills in support of an organization’s security efforts.
Essential Cybersecurity Tools of the Trade
The responsibilities of a cybersecurity professional cover the gamut of potential attack scenarios and hacker techniques. Among the tools they rely on to keep their organization’s information systems safe are the following:
- Network firewalls and other network monitoring tools
- Antivirus software
- User authentication software and other access controls
- Packet sniffers
- Public key infrastructure services (PKI)
- Endpoint detection and response software (EDR)
- Anti-phishing tools
- Encryption tools
- Penetration testing software
- Web vulnerability scanning tools
- Risk assessment tools
Software Testing Help explains the use of these and other cybersecurity tools is on the rise in organizations of all sizes as they protect against the increase in cyberattacks. A recent study by Mimecast found that ransomware attacks increased by 28% in 2019, email spoofing struck 88% of all companies and 67% of firms reported an increase in impersonation fraud.
Recommended Reading:
What Can Cybersecurity Professionals Earn in Salary with a Master’s Degree?
Should You Become a Cybersecurity Analyst?
Sources:
Built In, “17 Must-Know Cybersecurity Tools”
CompTIA, “The Top 9 Cybersecurity Jobs and What You Need to Get One”
Forbes, “How to Start a Lucrative Career in Cybersecurity”
Forbes, “The FBI Issues a Powerful $3.5 Billion Cybercrime Warning”
(ISC)², “Strategies for Building and Growing Strong Cybersecurity Teams”
New America, “Cybersecurity Workforce Development: A Primer”
World Economic Forum, “This Is the Crippling Cost of Cybercrime on Corporations”