CH2: Cyber Job Roles and Responsibilities

1.0 Introduction: The Paradox of Choice

One of the most daunting challenges for a student nearing graduation is not the lack of opportunity, but the overwhelming volume of it. "Cybersecurity" is not a single job; it is an umbrella term covering dozens of distinct disciplines. A Digital Forensic Examiner has a completely different daily routine, toolset, and stress level than a Governance, Risk, and Compliance (GRC) Analyst.

In this chapter, we will deconstruct the industry. We will move beyond generic titles and explore the specific "Day-in-the-Life" realities of the roles you are likely to encounter. More importantly, we will introduce the concept of the "Resume Gap Analysis"—a critical strategic tool you will use to identify exactly what skills you are missing and how to acquire them before you sit for your first interview.

Learning Objectives

By the end of this chapter, you will be able to:

Differentiate between core functional areas: Security Operations, Digital Forensics, GRC, and Offensive Security.
Analyze entry-level and mid-level job descriptions to identify required technical competencies and certifications.
Evaluate your current skillset against real-world market demands.
Construct a personal "Gap Analysis" to direct your self-study and lab time for the remainder of this practicum.

2.0 The Foundation: Entry-Level Gateways

Most cybersecurity careers do not start with "hacking" a mainframe. They start with monitoring, ticket handling, and system administration. These roles form the bedrock of your experience.

2.1 The Security Operations Center (SOC) Analyst

Often referred to as the "Blue Team," the SOC Analyst is the frontline defender.

The Reality: You are the digital sentry. You work in a 24/7 environment, often in shifts, monitoring screens for anomalies.
Core Responsibilities: Your primary task is Triage. You monitor alerts from a Security Information and Event Management (SIEM) system like Splunk, ELK, or QRadar. You must quickly distinguish between a "False Positive" (a user typing their password wrong) and a "True Positive" (a brute-force attack).

Common Job Description Tasks

When looking for this role, expect to see requirements like:

"Monitor security alerts in SIEM systems (Splunk, ELK, QRadar) and perform initial triage."
"Analyze logs (firewall, proxy, endpoint) to identify suspicious network activity."
"Distinguish between false positives and true security threats to reduce alert fatigue."
"Document findings in the ticketing system and follow established incident response procedures."
"Collaborate with incident response teams to escalate critical alerts."

2.2 IT Support & System Administration (Security-Aligned)

Do not underestimate the value of a Help Desk or SysAdmin role.

Why it matters: Help desk specialists with security awareness identify phishing attempts and social engineering tactics that automated filters miss. A Network Administrator learns how to segment networks and configure firewalls—skills that are prerequisites for any security architect role.
Transition Power: Many of the best security engineers started here because they understand how the infrastructure actually works.

Common Job Description Tasks

"Identify and escalate potential security incidents to the security team."
"Perform secure password resets and strictly follow identity verification protocols."
"Reinforce security awareness (e.g., anti-phishing) with end users during support calls."
"Implement and maintain firewalls, VPNs, and routing policies."
"Develop and implement patch management procedures for servers and endpoints."

3.0 The Investigators: DFIR & Threat Hunting

If the SOC is the police patrol, these roles are the detectives.

3.1 Incident Responder & Digital Forensics (DFIR) Specialist

When the defenses fail and a breach occurs, the DFIR team is activated.

The "Digital Detective": This role involves deep-dive investigations to reconstruct events. You answer the questions: How did they get in? What did they take? Are they still here?.
Forensics vs. Response:
- Forensics: Focuses on acquiring forensically sound copies of evidence using write blockers and maintaining Chain of Custody.
- Response: Focuses on containment, eradication of threats, and recovery of systems.

Common Job Description Tasks

"Collect and analyze forensic evidence from systems using write blockers and specialized acquisition tools."
"Conduct memory forensics (using Volatility) and disk analysis (using FTK/Autopsy) to identify artifacts."
"Create comprehensive incident reports documenting procedures, findings, and conclusions for legal scrutiny."
"Develop remediation strategies and 'lessons learned' reports post-incident."
"Maintain a proper chain of custody for all digital evidence."

3.2 The Threat Hunter

This is a proactive evolution of the analyst role.

Hypothesis-Driven: Instead of waiting for an alert, the Threat Hunter develops hypothesis-driven searches to proactively identify threats that evaded automated detection.
The Framework: They rely heavily on the MITRE ATT&CK framework to understand adversary tactics and map them to specific logs.

Common Job Description Tasks

"Develop and implement hypothesis-driven searches to identify hidden threats."
"Use the MITRE ATT&CK framework to map adversary tactics to internal log sources."
"Create custom detection queries and scripts (Python/PowerShell) for SIEM tools."
"Analyze patterns of behavior to uncover sophisticated Advanced Persistent Threats (APTs)."

4.0 The Overseers: Governance, Risk, & Compliance (GRC)

Not all cyber roles are technical. The GRC Analyst is the bridge between the server room and the boardroom, ensuring the organization follows laws and standards.

4.1 The GRC Analyst

The "Paper Shield": This role ensures the organization follows laws (HIPAA, GDPR) and voluntary standards (NIST CSF, ISO 27001).
The Day-to-Day: You aren't configuring firewalls; you are auditing them. You interview system owners, review evidence, and draft policies.

Common Job Description Tasks

"Conduct methodical risk assessments to identify and prioritize security vulnerabilities."
"Create, review, and maintain security policies (e.g., Acceptable Use, Incident Response) aligned with business objectives."
"Implement and map security frameworks like NIST CSF, ISO 27001, or PCI-DSS."
"Prepare for and respond to internal and external security audits, ensuring evidence collection."
"Perform Third-Party Risk Assessments (TPRM) on vendors and suppliers."

5.0 The Builders & Breakers: Engineering & Offensive

These roles usually require mid-level experience or specialized coding backgrounds.

5.1 The Penetration Tester (Red Team)

The "Ethical Hacker": You are paid to break in. You conduct vulnerability assessments and exploit flaws to demonstrate risk.
The Misconception: It's not just "pwn and leave." The most important part of this job is the Report. If you cannot explain to a developer how to fix the hole you found, you haven't done your job.

Common Job Description Tasks

"Conduct vulnerability assessments and penetration tests against networks and applications."
"Exploit discovered vulnerabilities to demonstrate real-world impact to the business."
"Perform social engineering campaigns (phishing, vishing) to test user awareness."
"Document findings and provide actionable remediation recommendations to technical teams."
"Utilize tools like Metasploit, Burp Suite, and Cobalt Strike for exploitation."

5.2 Cloud & Application Security Engineer

Cloud Security: As companies move to AWS and Azure, they need engineers who understand the "Shared Responsibility Model" and can secure distributed environments.
AppSec: You work with developers to integrate security into the CI/CD pipeline. You ensure security is built in from the first line of code.

Common Job Description Tasks

"Implement least privilege access control for Cloud IAM and service accounts."
"Configure cloud-native security tools (AWS GuardDuty, Azure Sentinel)."
"Perform Static Application Security Testing (SAST) and Dynamic Analysis (DAST) on code."
"Conduct code reviews and train developers on secure coding standards."
"Integrate security testing into automated CI/CD pipelines."

6.0 The Executive Track: Leadership

Eventually, the career path leads to management.

6.1 The CISO (Chief Information Security Officer)

The Strategist: The CISO aligns security with business goals. They manage the budget, handle the "politics" of the C-Suite, and take the heat during a breach.
The Shift: Success here requires business acumen. You must translate technical security concepts for the Board of Directors.

Common Job Description Tasks

"Develop enterprise security strategy aligned with business objectives."
"Translate technical security risks into business language for executive stakeholders."
"Manage the security budget and allocate resources for tools and personnel."
"Establish security governance frameworks and define the organization's risk appetite."

7.0 The Gap Analysis Strategy

Now that you have surveyed the landscape, how do you get there? You cannot learn "everything." You must target your efforts. This introduces the core assignment for this week: The Resume Gap Analysis.

7.1 How to Analyze a Job Description

A Job Description is a wish list, but it is also a roadmap.

Find the Data: Locate 3 distinct job postings for a role you actually want (e.g., "Junior SOC Analyst").
The Extraction: Copy the "Requirements" or "Responsibilities" section (like the examples provided in this chapter) into a document.
The Highlight: Mark every single tool, concept, or certification you do not currently possess.
- Example: The JD asks for "Experience with Wireshark and Splunk." You know Wireshark, but have never touched Splunk. Splunk is your Gap.

7.2 Bridging the Gap

Once you have identified your Gaps (e.g., Splunk, Linux CLI, Ticket documentation), this defines special projects that you can focus on.

Lab it Up: Don't have Splunk experience? Download the free trial, ingest some sample data, and learn the query language.
Document It: Write a blog post or a lab report about what you learned.
The Interview Pivot: When an interviewer asks, "Do you know Splunk?" you don't say "No." You say, "I noticed it was a requirement, so I set up a home lab instance, ingested 5GB of logs, and built a dashboard to track SSH failures."

8.0 Chapter Summary

The cybersecurity industry offers a role for every mindset—the investigator (DFIR), the builder (Cloud/AppSec), the defender (SOC), and the regulator (GRC). Your goal in this practicum is not to master all of them, but to identify one path, analyze the market requirements for it, and ruthlessly close the skills gap before you graduate.

Key Takeaways:

Entry-Level starts at the bottom: SOC and IT Support are the training grounds for almost all advanced roles.
Specialization is key: A Threat Hunter and a GRC Analyst have almost no overlapping daily tasks. Choose your lane.
The Gap Analysis is your compass: Be honest about what you don't know, then use the "Simulated Work Experience" to learn it.