Cybersecurity Careers: A Panorama of Roles

"I want to work in cybersecurity" is like saying "I want to work in medicine": it is true, and it hardly narrows anything down. The field contains dozens of jobs with very different daily lives, from breaking things on purpose to writing policies, from night-time incident response to talking with executives. This lesson gives you a map of the main roles so you can choose where to point your effort.

A field with many doors

Security work is usually grouped into a few broad families:

• Offensive security: testing systems the way an adversary would, with permission.
• Defensive security and operations: monitoring, detecting and responding.
• Engineering and architecture: building security into systems and applications.
• Governance, risk and compliance (GRC): organizing, measuring and proving security.
• Specialist and support roles: forensics, intelligence, awareness, privacy.

Job titles vary a lot between companies and countries. Read job descriptions for the tasks, not just the title. In France, ANSSI (cyber.gouv.fr) and other bodies publish overviews of cybersecurity professions; in the United States, NIST publishes a workforce framework (nist.gov) that describes work roles and skills. Both are good references to explore.

Offensive roles

Penetration tester (pentester)

Daily work: planning authorized tests, performing them, documenting findings and writing reports, then discussing fixes with the client. Much of the job is writing and communicating, not only technical work.

Skills: networks, systems, web and API security, Active Directory, scripting, report writing, and a lot of discipline.

Typical path: system or network administration, development or a defensive role, then a move into testing; or direct entry through a consulting firm for strong self-taught candidates with a portfolio.

Red team operator

A more advanced and specialized role: adversary simulation over a longer period, stealth, objectives and detection testing, as seen in chapter 3. Usually reached after significant pentest experience.

Application security engineer

Works with developers on secure design, code review, threat modeling and security tooling in the development pipeline, as in DevSecOps. Combines development skills and a security mindset.

Defensive and operations roles

SOC analyst

Daily work: monitoring alerts, triaging, investigating and escalating, following playbooks. Often the most accessible entry point, with levels from triage to senior investigation. Work may include shifts.

Skills: logs, networks, endpoint behavior, SIEM, careful reasoning, clear tickets.

Incident responder and digital forensics analyst

Handles confirmed incidents: containment, investigation of evidence, reconstruction of timelines, and recovery support. Requires calm, rigor and knowledge of operating systems, memory and disk analysis, and legal sensitivity about evidence.

Detection engineer

Designs, tests and maintains detection content, using techniques such as the use cases and ATT&CK mappings of chapter 4, and automation skills like those of chapter 2.

Threat intelligence analyst

Researches adversaries, campaigns and techniques, and turns the findings into useful information for defenders and decision makers. Combines technical knowledge, research skills and writing.

Vulnerability management analyst

Coordinates scanning, prioritization and remediation of vulnerabilities across the organization, working with system owners to get things fixed. Needs a mix of technical knowledge and persuasion.

Engineering and architecture roles

Security engineer

Builds and runs the security controls: identity systems, endpoint protection, network defenses, logging platforms. Strong systems and automation skills.

Cloud security engineer

Specializes in securing cloud environments: identities, configurations, workloads and pipelines, as in chapter 5. One of the high-demand specializations.

Security architect

Designs the security of systems and the overall approach, balancing risk, cost and usability. Usually an experienced profession that needs both breadth and depth.

Governance, risk and compliance (GRC)

GRC analyst or consultant

Helps organizations assess risk, define policies, prepare for audits and comply with laws and standards (for example data protection regulations and recognized security management standards). Less hands-on technically, but highly valued and often the best route for people who enjoy structure, writing and talking with many stakeholders.

Security officer (RSSI in France, CISO elsewhere)

Leads the security strategy of an organization: sets priorities, manages budgets and teams, reports to management and handles crises. It is a senior role that mixes technical credibility, leadership and communication. Very few people start there, but many aim for it.

Privacy and data protection roles

Related roles, such as the data protection officer, handle compliance with personal data laws. They collaborate closely with security teams.

Other useful roles

• Security awareness and training specialist: helps people adopt safe behavior; strong communication skills.
• Security researcher: investigates vulnerabilities and new techniques, often in a specialized field such as hardware, mobile or industrial systems.
• Security consultant: a broad advisory role in a consulting firm, mixing audits, advice and projects for different clients.
• Technical sales and customer success in security: bridges customers and product teams.

Comparing the main entry roles

Role	Day looks like	You will enjoy it if	Common entry route
SOC analyst	Alerts, investigations, tickets, teamwork	You like detective work and routine with surprises	IT support, helpdesk, junior security roles, training programs
Pentester	Technical tests, notes, long reports	You like puzzles and writing, and tolerate pressure of deadlines	Admin or developer background, strong labs and portfolio
Vulnerability analyst	Prioritizing and chasing fixes	You like organization and influencing people	System administration, IT operations
Cloud security engineer	Configurations, automation, reviews	You like building and automating	Cloud administration, DevOps
GRC analyst	Policies, audits, risk registers, meetings	You like structure, writing and working with people	Audit, project management, legal or compliance background

Skills common to every role

• Fundamentals: networks, operating systems, web, identity: what chapters 1 and 2, and the earlier courses, built.
• Communication: explaining risk to different audiences, in writing and speech.
• Ethics and discretion: you will handle sensitive information and powerful access.
• Curiosity and continuous learning: the field changes constantly.
• Teamwork and calm: incidents are stressful and team sports.
• Scripting and automation: useful everywhere.

Careers are not straight lines

Most professionals change roles several times. Many pentesters began in system administration; many analysts later become engineers or architects; some move from technical work to management. The first job rarely matters as much as the foundation it gives you. A defensive start gives a powerful understanding of what really gets detected, which makes you a better tester later; an offensive start gives you attacker intuition that helps in defense.

Reality check: work conditions

• Shift work and on-call exist in operations and incident response.
• Stress and responsibility are real; look for teams with healthy practices and support.
• Reports and meetings take much more time than movies suggest.
• Pay and conditions vary a lot by country, sector and employer; compare several sources and avoid relying on a single number.
• Diversity of backgrounds is welcome. People come from IT, law, teaching, audit, the military and elsewhere. A non-linear path is an asset.

Your turn: find your top two

Read the roles above and answer on paper: (1) Which two roles attract you most, and why? (2) Which tasks would you like least? (3) For your top choice, list three skills you already have and three you need to build.

See a solution

There is no single right answer. Here is a model reply from a fictional learner:

1. "I am drawn to detection engineer and pentester. I like understanding how things break and also enjoy writing scripts that find patterns."
2. "I would like routine ticket handling and heavy shift work less. I would also struggle with long compliance documents."
3. "For detection engineer: I already have Python basics, log parsing and a first use case. I need to build SIEM query skills, more Windows and Linux logging knowledge, and a deeper familiarity with ATT&CK."

A good answer is specific and honest, and leads to concrete actions for your plan.

Portfolio step

Create a folder 07-career-plan in your portfolio. Add role-exploration.md with your two target roles, the skills you have and the skills you will build, and a link to three real job descriptions you read (describe them without naming companies if you prefer). This document is the seed of your 90-day plan in the next lesson.

Now that you have a destination in mind, let us plan the road for the next 90 days.