This feature first appeared in the Spring 2019 issue of Certification Magazine. Click here to get your own print or digital copy.

In a recent survey of Chief Information Officers, 88 percent reported that cybersecurity initiatives were on their shortlist of priorities for 2019. That's an astounding figure that cuts across industries and geographies as organizations struggle to protect their systems and data in an increasingly dangerous threat environment.

Implementing cybersecurity initiatives requires talented and skilled staff, and surveys consistently reveal that filling cybersecurity positions continues to challenge organizations. In a 2018 CSO survey, 53 percent of organizations reported that they suffered from a problematic shortage of cybersecurity skills. This news might keep senior technology leaders awake at night, but it also presents an opportunity for individuals seeking to find employment in a high-demand, lucrative field.

Data security administrators serve on the front lines of the cybersecurity battle. They're responsible for operating and monitoring a wide variety of cybersecurity controls that are designed to protect the confidentiality, integrity, and availability of an organization's information and technology assets.

The shortage of technology professionals with the skills to fill these positions presents an unprecedented opportunity for people to enter the field. Let's take a closer look at the responsibilities of data security administrators and discuss how newcomers can land their first position.

Job responsibilities

Many roles in an IT organization are fairly narrowly defined. Database administrators are responsible for monitoring and managing the performance of their database platforms. Application developers specialize in specific types of applications and languages. Network technicians manages switches and routers.

Data security administrators, on the other hand, generally don't have such narrowly defined responsibilities. This breadth of scope is one of the major reasons that the field is so exciting to enter — and why it is difficult to find qualified candidates. The reality is that the world of cybersecurity professionals crosses many different disciplines of information technology.

Some data security administrators focus on network security. They're responsible for the operation and monitoring of firewalls, intrusion prevention systems (IPS), and other network security controls. They build defensive perimeters around networks that are designed to create boundaries between networks and restrict traffic.

Network security technicians also help protect internal networks from unauthorized access by maintaining network access control (NAC) systems that verify device authorization before permitting network access.

Once devices connect to the network, data security administrators continue to monitor them to ensure that they comply with the organization's security policies and don't pose an undue risk to the organization. One of the main ways that they do this is by performing network vulnerability scanning.

These scans probe systems connected to the network and seek to determine whether they contain known vulnerabilities, such as the use of default passwords, missing security patches, or application flaws that would permit SQL injection attacks.

They then work with other IT professionals to remediate the vulnerabilities and verify that the remediation was effective. These duties are an essential part of cybersecurity hygiene and seek to identify issues before they cause a data compromise.

Other data security administrators focus on the field of identity and access management (IAM), where they implement controls designed to perform the core tasks of IAM: identification, authentication, and authorization.

Identification and authentication systems allow users to make claims of identity and then prove those claims through the use of passwords, biometrics, and other authentication technologies. Authorization systems maintain the permissions granted to each individual user and ensure that no user is able to exceed his or her authority on the network.

Unfortunately, sometimes things do go wrong in the world of cybersecurity and the organization looks to data security administrators to investigate security issues and help guide appropriate responses. Incident response is another of the crucial tasks facing cybersecurity professionals and, in many organizations, is a 24/7/365 responsibility, requiring prompt reaction at the earliest signs of a cybersecurity incident.

Data security administrators responding to an attack must first identify the scope of an incident, contain the damage to the organization, eradicate the cause of the breach, and then recover normal operations.

Finally, not all roles filled by data security specialists are nose-down technical jobs. Cybersecurity professionals who enjoy spending their days interacting with colleagues around the IT organization can certainly find roles that allow them to put these skills to work.

Some data security administrators find themselves leading security awareness training efforts where they provide other technologists and end users with the knowledge they need to protect themselves and the organization from cybersecurity threats. Other security team members provide consulting services to the organization, helping ensure that new and ongoing technology initiatives benefit from competent cybersecurity advice.

The responsibilities of a data security administrator are indeed varied, but this variety makes the profession both challenging and exciting. Technologists seeking a position that is in high demand, and that presents new challenges every day, will find that cybersecurity positions hit the mark.

Becoming a data security administrator

There's no single path to becoming a data security administrator and you'll find that people currently working in the cybersecurity field often come from many different backgrounds. In fact, cybersecurity teams benefit from bringing in technologists from other areas of the IT organization, because they can often put their subject matter expertise to work in the field of security.

Database administrators can become database security experts. Network technicians can become network security consultants. Application developers can become application security specialists. Diverse technical backgrounds provide security professionals with the credibility they need to provide advice to diverse technical teams.

Individuals seeking to break into the cybersecurity field from other disciplines in IT or as their first foray into the world of technology will benefit from earning one or more professional certifications. The CompTIA Security+ certification is the most common first stop on many cybersecurity career paths, as it provides a broad overview of the cybersecurity field.

Security+ is designed as an entry-level certification and, as such, has no work experience requirement. After studying for the exam, individuals can immediately sit for the multiple-choice test and earn their certification.

Continuing the career journey

Landing your first job in cybersecurity is only the starting point of a wonderful journey. Data security administrators seeking to advance in their careers should seek out new responsibilities and find ways to broaden their base of security knowledge.

The cybersecurity skills gap doesn't only exist at the entry level — organizations need both deeply skilled technical specialists and cybersecurity leaders who understand the business. In either case, building a solid technical base provides the foundation for a long career in cybersecurity.

Certifications can also play an important role in cybersecurity pro - fessional development. Most cybersecurity professionals consider (ISC)²'s Certified Information Systems Security Professional (CISSP) certification to be the gold standard cybersecurity certification. The CISSP does have a five-year experience requirement, so most cybersecurity professionals earn it during their second or third position in the field.

Individuals seeking to go down the technical track may also wish to consider advanced technical certifications, such as CompTIA's Cybersecurity Analyst+ (CySA+) and Penetration Tester+ (PenTest+) certifications. Those with sights set on the corner office might wish to consider the Certified Information Security Manager (CISM) credential offered by ISACA.

Anyone considering a career as a data security administrator should act now, as the timing is perfect. Educational opportunities abound to develop skills in this field and the demand for trained cybersecurity professionals is at an all-time high.