Security Engineer: Job Role at a Glance

This is the onset of a new blog series- “Job Role at a Glance”. In this series, I will describe a security job role in a question-answer format. Apart from my research, I will be getting in touch with industry professionals with experience in that particular job role to get a better view of the current specifications of the role.

In the year 2020, the security engineer workforce reached a whopping 29,108 in the USA. As security becomes a major concern for both large and small scale firms, security engineers are quite essential to maintain security in different domains. A security engineer may specialize in a specific domain like- Data security, IT security, Network security, Application security engineer to name some.

I got in touch with three security engineers for this blog- Sumukh Venugopal, Information security engineer at Cisco, Lalit Mohan Sharma, Security Engineer at Paytm and Ronak Shah, Information Security Engineer at Sony India Software Centre.

Here are the questions and answers that give a glance at the role of a security engineer

Describe how a security engineer contributes to the organization’s security as a whole.

Security engineers develop and supervise data, combine systems, operations, and internal controls to ensure integrity and confidentiality of data and operation procedures in an organization to prevent breaches and leaks. They help protect data owned by an organization from threats or risk ruling out all possible anomalies.

The risk assessment that is derived out of compliance defines the gap between the ideal security posture that the firm should follow and the security posture it is following right now. A security engineer bridges the gap between the two of them. She/He also integrates the operations and security team.

Hence a security engineer plays an important role in the security of the product and the company.

What tools and coding languages a security engineer has to be proficient with?

The skillset and tools differ from domain to domain. There is nothing like a particular set of tools and programming languages to be proficient with, as the domain of security is very vast, you must be updated every day, every hour.

For an instance, an application security engineer and a network security engineer have different operations to perform and hence they must be proficient with the basic skills of their domain. However, the knowledge of computer networks and basic coding skills are common to all domains.

Command over tools like Wireshark, burp suite, Nessus, Nmap, etc can have an added advantage. Talking about the programming languages, one must be well versed with logic and how programming works. Googling syntax is totally fine. JavaScript, HTML, Python, C, Java, PHP, JAVA are a few common languages that can help in building a strong skill set.

What interpersonal skills are must-haves for a security engineer?

Communication is the key skill a security engineer must possess. He/She should know how to explain security reports to a person with the intellect of a high school student in the terms of cybersecurity.

Problem Solving skills are the fundamental skill required in the role. Cybersecurity revolves around solving real-world problems and communicating them to the relevant teams or management. Inquisitiveness, networking with people, and teamwork also play a major role.

Documenting and presenting their work is part of the job. Hence security engineers must be good at presenting their work because a good idea not showcased well to the audience is not as effective as expected.

How can students develop the technical skills and prerequisites required for pursuing their career as a security engineer?

Gaining experience through internships and real-world projects helps in creating a unique resume and that can prove quite helpful when looking for a job.

Building skills in the domain they are interested in is essential. Problem-solving skills are common to all domains- learning about both the processes and their compliance as well as the tools required to implement them can make them stand out from the crowd. Building a network at an early age can help students gain insights about the roles they are interested in at an early stage.

Starting with the basics of networks and programming in Python and C and basic tools required in security can help in the long run.

How significant are certifications for the job role of a security engineer?

This is a sensitive and disputed topic and everyone has different takes on it. Certifications are role-specific, so if an individual has an interest in let’s say offensive security then having an OSCP certification can prove to be quite helpful. Otherwise, collecting certifications just for the sake of it and in the hope of getting a job from it, will not be fruitful in the long run.

The requirement of certifications for a specific job role varies from firm to firm, some don’t require them others may mandate it. For any job role, skills are what matter at the end of the day. Learning should be the main objective of taking up a course or certification.

Certifications evaluate how good you are at a particular skill. If one already has the required skills, certifications don’t matter. She/He can bring that job to the table by showcasing those unique skills.

Certifications make one stand out of the crowd with no certifications. If an employer has to hire a person among two with almost similar skills, the bar for the person with a certification rises up. Certifications tend to make an individual more marketable.

Should absolute beginners take up their first job as a security engineer in an established and developed firm or a startup/developing firm?

In a matured or developed firm, the security engineer deals with the compliance, processes, the intricacies of why a process is being done, and how that process affects the resilience and security of the organization in a bigger picture.

In an immature firm or a startup, there is a lot of scope for learning things and making them work from scratch to the final result. The security engineer can get involved in the implementation of tools and processes. But this work requires a lot of time and devotion.

Startups help one learn a lot as you they involved a lot more. In developed firms the exposure is good, but there is a dedicated team for a specific task that a single person may be doing in a startup.

How does a security engineer get in pace with highly evolving and sophisticated threats and update the organization’s security infrastructure?

Security bulletins, IRC channels, and threat feeds are quite useful for getting updated with the latest threat feeds. Platforms like Twitter also help in delivering recent information and bugs and security patches.

How different are the roles of a security analyst and security engineer?

Security engineers build and develop the solution for a specific security problem. They are involved in the planning, designing, and implementing of products and security frameworks.

Security Analysts are concerned with the managing and monitoring of products and security frameworks. They analyse the problem and communicate it to the engineer.

How does a security engineer contribute to the security team of an organization after a significant cyber attack/data breach that affects the usual functioning of the organization?

An intrusion by an external actor is the consequence of some gaps and vulnerabilities existing in the security infrastructure. The security engineer identifies these gaps, addresses and closes them, thereby safeguarding the framework from further compromise.

Here, the application of critical thinking and problem-solving skills comes into play and the engineer implements them to gain more insights about the attack and come with a possible solution. Hence, the security engineer examines the damage, limits additional damage, records the details, notifying the affected areas.

How do companies lay their trust in an entry-level security engineer candidate to access critical and confidential information about their systems and networks?

In short-restricted access and paperwork. A novice security engineer is given limited access and mostly understands the networks and topological placement of assets. She/He may help in strengthening the security of the firm with the provided assets. The organization lays its trust in the employee and grants them some assets.

Disclaimer: The blog is based on certain perspectives and not everyone may agree with the points outlined here. The roles and responsibilities are not ideal, they change from organization to organization.

This brings up to the end of the blog. I will go on with these role-specific blogs for different roles in security. Ciao!