Roles and Careers in Cybersecurity

Roles and Careers in Cybersecurity

“Cybersecurity” is not one job

One of the most common misconceptions about security is that it is a single career — a hooded figure typing furiously in a dark room. In reality, cybersecurity is an enormous, interdisciplinary field with dozens of distinct roles demanding very different skills: some deeply technical, some investigative, some legal, some people-facing, some research. A talented social engineer, a reverse engineer staring at disassembly, a privacy lawyer, and a compliance auditor are all “in cybersecurity,” and they may never use the same tool twice.

This breadth is good news: there is a path for almost any aptitude, and the field has a persistent workforce shortage — hundreds of thousands of unfilled roles in the US alone. This page maps the landscape so you can see where your interests might fit, and how the rest of this course (and the other PSU security courses) connects to real jobs.

Two ways to map the field

The team colors (the informal map)

The industry borrows military exercise terminology to describe orientation:

🔴 Red team — offense. Find the weaknesses by attacking (with authorization): penetration testers, red teamers, exploit developers, bug-bounty hunters.
🔵 Blue team — defense. Detect, defend, and respond: SOC analysts, incident responders, threat hunters, security engineers.
🟣 Purple team — collaboration. Red and blue working together so that offensive findings directly improve defenses, rather than being thrown over a wall.
🟡 Yellow team — builders. The developers and architects whose code and systems security depends on; “DevSecOps” is yellow and blue working as one.

The NICE Framework (the formal map)

For a rigorous taxonomy, the US government’s NICE Framework (NIST SP 800-181) defines cybersecurity work in terms of work roles, competency areas, and the tasks/knowledge/skills behind them. Its 2024 revision organizes work into seven categories: Oversight & Governance, Design & Development, Implementation & Operation, Protection & Defense, Investigation, Cyberspace Intelligence, and Cyberspace Effects. It is the reference employers and curricula use to describe jobs consistently — worth knowing by name when you read job descriptions.

A tour of the roles

Defensive (blue team)

SOC Analyst — the front line of a Security Operations Center, triaging alerts from a SIEM. Usually tiered: Tier 1 triages, Tier 2 investigates, Tier 3 hunts and handles the hardest cases. A common entry point into the field.
Incident Responder (DFIR) — when something has happened, IR contains, eradicates, and recovers, while digital forensics reconstructs what occurred. (PSU’s Digital Forensics course feeds directly into this.) See incident response.
Threat Hunter — proactively searches for attackers who slipped past automated detection, using hypotheses drawn from ATT&CK.
Detection / Security Engineer — builds and tunes the defenses themselves: writing Suricata/SIEM rules, hardening hosts, engineering the logging pipeline.
Security Architect — designs systems to be secure from the start, applying security principles like defense in depth and least privilege at the blueprint stage.

Offensive (red team)

Penetration Tester — authorized to break into systems to find weaknesses before real attackers do, then report them. Heavy use of recon, network, and application skills.
Red Teamer — goes beyond a pentest to emulate a specific adversary end-to-end (including social engineering and physical access), testing detection and response, not just finding bugs.
Exploit Developer / Vulnerability Researcher — finds novel vulnerabilities and writes working exploits; the deep end of memory corruption, fuzzing, and reverse engineering.
Bug Bounty Hunter — independent researchers paid per valid vulnerability through programs like HackerOne; a flexible on-ramp that rewards demonstrated skill over credentials.

⚠️ Offensive work is legal only with explicit authorization (a contract, a scope, a bug-bounty policy). The exact same nmap scan is a paid engagement or a federal crime depending entirely on permission — see the privacy and law material. Ethics and scope are not optional add-ons to this career.

Building secure software

Application / Product Security Engineer — secures the software development lifecycle: SAST/DAST, secure code review, and threat modeling for products.
DevSecOps Engineer — bakes security into CI/CD pipelines — supply-chain controls, automated scanning, secrets management. PSU’s System Administration and DevOps course is the direct path here.

Governance, risk, and the human side

GRC (Governance, Risk & Compliance) — manages risk frameworks, audits, and standards (SOC 2, ISO 27001, NIST). Less hands-on-keyboard, heavy on risk reasoning; a strong fit for people who like policy and organization.
Security Awareness / Training — builds the human firewall against phishing and social engineering.
Privacy & Legal — data-protection law (GDPR, HIPAA), the intersection of privacy and technology.

Specialized and research tracks

Malware Analyst / Reverse Engineer — dissects malicious code (PSU’s malware analysis material).
Threat Intelligence Analyst — tracks adversaries, campaigns, and TTPs to inform defenders.
Cloud Security, IAM Engineer, Cryptographer/Cryptography Engineer, and OT/ICS & IoT Security — each a deep specialty in its own right.
CISO / Security Management — sets strategy and owns risk at the organizational level; the leadership track.

How this maps to the PSU security courses

This course is the broad foundation; the others go deep in a direction that aligns with the roles above:

If you’re drawn to…	Explore…
Defense, detection, network monitoring	CS496/596 Network Security
Investigation, IR, evidence	CS493/593 Digital Forensics
Building & operating secure systems	CS410/510 System Administration & DevOps
Embedded / OT / device security	CS410/510 IoT Security
Reversing & malicious code	CS492/592 Malware Reverse Engineering

The local CyberPDX community and PSU’s Code Party are good ways to meet people working in these roles.

Getting in: building a path

You do not need to pick a specialty on day one — breadth first, then depth. What consistently works:

Hands-on practice beats passive study. Build a home lab, run vulnerable VMs, and play Capture-the-Flag (CTF) competitions and platforms like TryHackMe and Hack The Box. The binary bomb in this course is exactly this kind of practice. Demonstrated skill is the strongest credential in security.
Learn the foundations. Networking, operating systems, a scripting language (the Linux skills in this course), and how systems actually work — you cannot secure what you do not understand.
Certifications signal baseline knowledge and matter for some roles (especially defense/GRC and government): CompTIA Security+ (entry), OSCP (hands-on offensive), CISSP (experienced/management), and the GIAC/SANS family. Useful, but no substitute for ability.
Build a public footprint. A GitHub of projects, a write-up blog, CTF results, or open-source contributions all show, rather than claim, competence.
Soft skills are not soft. Clear technical writing, communication, and curiosity separate good analysts from great ones — security work is ultimately about explaining risk to people who must act on it.

Key takeaways

Cybersecurity is many careers, not one — offensive, defensive, building, governing, investigating, researching — with a persistent talent shortage and a path for most aptitudes.
Two maps help: the informal red/blue/purple/yellow team colors, and the formal NICE Framework (NIST SP 800-181) with its seven categories.
Blue (SOC, IR, hunting, engineering), red (pentest, red team, exploit dev, bounties), builders (AppSec, DevSecOps), and GRC/specialized tracks each demand different strengths.
Offensive work is legal only with authorization — ethics and scope are core to the job.
Break in through hands-on practice (CTFs, home labs, this course’s exercises), solid foundations, selective certifications, a public portfolio, and real communication skills.

References

NIST SP 800-181 Rev. 1 — Workforce Framework for Cybersecurity (NICE Framework). https://csrc.nist.gov/pubs/sp/800/181/r1/final
NICE Framework Resource Center (NIST). https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center
CyberSeek — US cybersecurity career pathway and job-gap data. https://www.cyberseek.org/
CISA — Cyber Career Pathways Tool. https://www.cisa.gov/cyber-career-pathways-tool
SANS — Cybersecurity Skills Roadmap. https://www.sans.org/cyber-security-skills-roadmap/
CyberPDX — Portland State cybersecurity community. https://cyberpdx.org/

🛠️ Maintenance note: role titles, certification names, and workforce-gap figures shift yearly — re-verify the NICE category list (last revised 2024), certification relevance, and CyberSeek numbers before each term. The PSU course-mapping table should be updated if course numbers or offerings change.