Rewarding cyber security careers: a day in the life of our cyber investigation team
26 Oct 23
Cyber Security
BY Jim O'Connell
As the US Cybersecurity Awareness Month draws to a close, we've enjoyed the discussions it's sparked worldwide on the topic.
With a whole team of cyber and cyber security experts within our ranks, we support a number of clients with cyber training, consultancy, and niche services such as vulnerability investigations.
One such expert is Jim O'Connell, who's had a long and varied career but now works as a cyber investigation product manager in our Cyber Division. He's here to share some insights into what his day-to-day life looks like, and how he supports our customers worldwide.
Take it away, Jim!
Entering the world of cyber
While enjoying a full career in the RAF, the latter part of my time threw me headfirst into the world of ‘cyber’ with a role that included coordinating cyber vulnerability assessors and contributing to information assurance across the business. Previously my background had mostly been in engineering, so I was trepid at first as I thought cyber was for people much more technical than me….
My epiphany in cyber security, however, came with my last job in the service when I became the information system security manager for a high-profile programme located in West Norfolk. My responsibility was to maintain certification for sensitive information systems. The certification was granted by the programme lead nation who mandated all information system assurance had to be undertaken within the National Institute of Standards and Technology (NIST) Risk Management Framework (RMF). As I embarked on this new role, I soon discovered that there was no requirement for the traditional security operating procedures (SyOPs) and risk management accreditation document sets (RMADS) I had become accustomed to, and suddenly realised I had truly ended up in the cyber security ‘deep end’.
Training in a previously unknown way of working helped me quickly realise that digital security was not just about complex codes but also had to include an understanding of the human element. I could not only recognise the importance of sound policy and accurate standard operating procedures, that still included the use of strong passwords etc, but now understood the essential inclusion of supply chain risk management, privacy, environmental and personal protection, to name but a few.
This moment of clarity, concerning the interconnectedness of technology and human behaviour in maintaining a secure digital environment, was a pivotal motivator in my obsession to encourage personnel and organisations to work within any given cyber security framework, but predominantly those provided by NIST!
There's an undeniable connection between technology and human behaviour in maintaining a secure digital environment
Life at Inzpire
As a member of Inzpire’s Cyber Division, I spend most of my working day as a cyber investigation product manager, where I am accountable for the quality of cyber investigations undertaken by two specialist investigation teams. In my role, I actively apply NIST cyber security language to standardise investigation reporting, fostering a clearer understanding for both investigation team members and customers. By leveraging this common language, I aim to enhance transparency and coherence in our investigative products. I help prioritise tasks delivering priority features and define, own, and solve problems. I use knowledge of customer needs and business goals to frame problems and set priorities for the investigation teams. I work closely with team leaders to ensure effective product delivery by simplifying complex language. And using AGILE as a workflow management tool, we consistently deliver high-quality cyber security products to our valued customers.
When I’m not product managing, I develop my own tools and doctrine that could be used by any organisation wanting to strengthen their own cyber security posture. One such tool is the Cyber Security Framework ‘CSF in a Box’, which, one day, we will hopefully be able to deliver to any organisation wanting to work within the framework.
The tool's functionality is focussed on gap analysis, revealing the CSF core functions, categories, and sub-categories, complemented by an informative reference, such as the NIST SP 800-53 control set. The tool enables organisations to qualitatively assess the maturity of their progress in meeting their framework target tier by modifying the status of each control.
The outcomes of the core work become apparent in another section of the tool, by indicating an organisation's progress and cyber resilience. This feature is essential as it automatically classifies risk as acceptable, minor, moderate, or unacceptable, encouraging users to pinpoint areas where their efforts should be concentrated.
So, what are the most rewarding elements of my work? Managing cyber security products that have a tangible impact on protecting digital assets and sensitive information is number one but being given the opportunity to engage in ongoing learning to remain up to date on the latest cyber security trends, technologies, and best practices is a close second. Finally, knowing that my work directly contributes to securing customer data and providing a sense of safety in the digital landscape is up there in third.
I know that my work directly contributes to securing customer data - a great feeling to have
My tips for pursuing a cyber security career
- Stay curious and commit to ongoing learning. The cyber security landscape evolves rapidly, so staying informed is crucial.
- Gain practical experience through projects, or personal initiatives; hands-on skills are highly valued in cyber security, get some!
- Consider obtaining relevant certification to enhance your credibility, such as CISSP (the ISC2 have a great route to this via Certified in Cybersecurity (CC)) or CompTIA Security.
- Follow industry news, security blogs, and subscribe to cyber security newsletters to stay abreast of the latest threats and technologies.
- Explore ethical hacking and penetration testing; understanding how attackers think is essential for effective defence.
There are many pathways into the industry and the UK Cyber Security Council’s website lays these out really well. Remember that cyber security is a diverse field, and different roles may require different combinations of skills, so tailor your approach based on your interests and goals.
To hear more about our work within the NIST CSF or wider cyberspace domain – or to find out more about cyber careers at Inzpire – please don’t hesitate to get in touch.
Latest News
Welcome to our cyber team Steve
23.04.24
New Joiners
Stephen Atkinson joins us as a junior cyber security consultant, a career change following over 15 years in the Royal Air Force.
Need Help?
Our team are here to help. If you have any questions, no matter how big or small, please get in touch.
+44 (0)1522 688231
.(JavaScript must be enabled to view this email address)