Geekly Articles each Day
📜 ⬆️ ⬇️

Skills and requirements for information security professionals



Despite the high popularity of the profession, the abundance of information resources and materials in the open access market suffers from a shortage of qualified personnel, especially those associated with practical information security.

This article will cover the topic of demand for information security specialists, the specific requirements and skills.

')

Statistics


According to statistics from one of the HR agencies, information security specialists at the end of 2015 were offered an average of 21% more than in January 2015. This indicates that even in a crisis, qualified specialists are in demand, moreover, the market feels their shortage.

Indeed, the topic of information security has become more urgent than ever - it is the growing attacks (in terms of damage and frequency) of the banking sector attacks (SWIFT, correspondent accounts), the increasing number of targeted attacks (Advanced Persistent Threat, APT), etc.

Even those companies staffed by information security specialists need a qualified assessment of the maturity of protection systems, perimeter security, web applications and other infrastructure elements - an increasing number of initiators of BugBounty programs is indicative, with the amount of payments ranging from $ 100 to $ 20,000 for vulnerability.

Jobs


Based on the data presented on the websites for the placement of vacancies, the average salary of information security specialists with experience of 1-3 years is at the level of 40,000-70,000 rubles. This refers to the specialists of the initial group (junior ), with little experience, according to professional requirements and duties, this is clearly seen (hereinafter, the "average" indicators are presented):

Duties:

Requirements:

As can be seen from the description, this is more a system administrator with a bias in the information security than a “pure” security engineer. It is difficult to distinguish any specific specifics in skills. Who is looking for candidates - a company of any orientation, it is difficult to select an area.

Experts with experience of 3-6 years are already in the middle . More skills and experience are required, but the salary level is much higher. These specialists, as a rule, have a good technical background (system administration, search for vulnerabilities), are well aware of applications, techniques and methodology. These specialists can be divided into two directions - attack and defense. Universals at this level (Pentester + IS specialist) - practically does not exist in nature (or this is already senior level). The average plug is 70.000-100.000 rubles.

Information protection specialist:

Duties:

Requirements:

Pentester:

Duties:

Requirements

The requirements for such specialists are more specific, focused on the scope in a particular area, including methodologies and the type of software used. Representatives of e-commerce, financial sector, integrators, large / distributed retail companies, etc. are looking for such specialists.

Specialists with experience from 5-6 years - senior . As a rule, this is a leadership position - the head of the security analysis department; Head of Information Security Management; analyst; large sales of IB vendor; uz-specific pentester. The salary level is from 120,000 to 200,000 rubles.

There are very few people from this category, and, as a rule, they are “widely known” in the industry. These are experts who are well versed in the subject area, and, as a rule, have expert qualifications in a narrow specialization. Welcome to the experience of speaking at conferences or other public activity - it means the candidate monitors the trends and receives a timely assessment of the professional community.

Of the requirements here are the following:

Requirements are presented in the average version for the above specialists. Professional skills of the applicant, as a rule, are known and such people are “hunted” not for a specific task, but for a whole stage or level of the company's activity. This kind of specialists are in demand in the financial sector, IT integrators, information security vendors, large IT companies.

The top of the pyramid ( lead ) - experts with experience of 10 years. This category includes CTO, CISO, system architect, team lead. Salary level from 200.000. As a rule, these are famous people in the information security industry, with extensive experience and connections.

Requirements / skills: here they usually look at completed projects, line of action. Skills can request a complete list from previous positions (and it is usually extensive to this stage), or the necessary result of work will simply be indicated. In the case of these positions, people no longer look at knowledge, but at achievements.

Such specialists are required by large integrators, information security vendors, the largest technology companies, the financial sector, and the public sector.

Summing up


Information security for market participants is becoming a priority. To provide such protection only by automated means is almost impossible. The demand for specialists in the field of information security is growing at the same rate as the information technologies themselves are developing.

The problem of education and further employment lies in the perennial problem “there is no work, because there is no experience, because there is no work ...” and you can read this phrase endlessly in a circle. The generally accepted fact that a diploma in itself does not give priority. By the time of release most of the knowledge is no longer quoted.

The quickest and most successful way out is self-education.

Source: https://habr.com/ru/post/306336/

More articles:


All Articles