Certification - December 2008 - (Page 46) Learning about the business aspect is important, Wolfe said, because the requirements of security are mapped to the regulatory requirements, such as SOX compliance generally, Gramm-Leach-Bliley Act compliance in the financial sector or HIPAA compliance in the health care industry. It’s important for security technicians to have an understanding of how businesses are organized so they know what is and isn’t appropriate data for people to be allowed access to. we can’t have them on a project by themselves, [so] it depends on the types of projects [they are assigned].” On smaller, one- to two-person projects, soft skills are a must. “On projects like that, having good communication skills [and] interpersonal skills is an absolute requirement because there’s nowhere to hide,” Wolfe said. Additionally, entry-level security employees looking to advance into management and take on more responsibility must have good communication skills — and that doesn’t just mean talking to colleagues. They should be able to interact with and present to both customers and executives. “As they progress, if they have [good] communication skills, they might start to do design work and get involved in the discovery sessions we do with customers in pre-sale,” Wolfe said. “Once they’ve got a couple of projects under their belt and they’ve demonstrated that they’ve mastered the work for certain types of projects, we might give them a chance to run a project.” Entry-level security technicians are required to do a lot of grunt work such as coding, but they do get opportunities to do some hands-on work — usually under the supervision of a senior colleague. “If you just have an applications development background, then there are roles we have that people can add a lot of value for us. But by having an understanding of the business side, people have a much better ability to go in and be more consultative,” Wolfe said. For instance, a security technician might work with customers to perform an IdM road map and assessment. To do this, it is imperative to understand how the business operates and to be well-versed in some of the processes associated with it, such as on- and off-boarding. At Laurus, the next step up would be a project leader position and then a practice lead, which is a person who oversees projects and performs the design and estimation with a handful of people reporting to him or her. The next role would be that of a practice manager, who would be in charge of a number of practice leads. Future Prospects On a bright note, the market seems to point to a need for more professionals in the IT security field, Wolfe said. “[Issues surrounding] security are only getting more complicated,” he said, noting that regulation was a significant talking point during the 2008 U.S. presidential race. “[It] always ends up boiling down to more things on audits [that] people are going to be looking for, and that will translate to more experts needed to go in and assess whether the security program or the way security is being implemented in an organization is in compliance with the regulation,” he said. Further, the fear of outsourcing is low in IT security, as it is difficult to outsource these jobs to Asia or anywhere else, Wolfe said. 8 – Deanna Hartley, dhartley@certmag.com Nontechnical Requirements Though nontechnical skills — specifically soft skills — always are an invaluable asset, Wolfe said they’re not a prerequisite for undertaking certain projects. For instance, typically, a team of five to seven people will work on larger projects. “If [a person’s] English communication skills aren’t really solid but they’re technically very sound, we can still have [that person] add value on those larger projects because our people will manage them and they’ll be the technology experts,” Wolfe said. “We’ve had people who are real superstars with the technology, but 6 CERTIFICATION MAGAZINE December 2008
For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.