Personal attributes

remaining calm in the face of a high-pressure environment
juggling multiple priorities in a fast-paced environment
quickly assessing the relative significance of lots of information
working in a structured way to identify anomalies or unusual activity
troubleshooting and problem resolution
being comfortable working across multiple functions
conveying complex or difficult technical concepts to audiences with varying levels of technical ability
establishing and maintaining strong, collaborative working relationships with internal and external teams
evaluating the probable social, commercial, cultural, ethical and environmental consequences of an action

Specialist skills

performing first line security monitoring and analysis, as part of a SOC or NOC team, utilising industry recognised SIEM technologies (e.g. Splunk, LogRhythm)
understanding of, and experience in, security technologies such as, SIEM, IDS/IPS, AV, web and email content filtering
using network management, monitoring and diagnostic tools
conventional network and/or host-based intrusion analysis
assessment of advanced persistent threat adversaries

For a senior professional:

experience in performing first and second line security monitoring and analysis, as part of a SOC or NOC team, utilising industry recognised SIEM technologies (e.g. Splunk, LogRhythm)
proven ability to connect disparate data elements in order to identify patterns of behaviour in support of intelligence reporting
contribute towards ensuring that the capacity, reliability and availability of network services meet the requirements of the organisation
experience in other aspects of cyber security such as malware analysis, incident response or forensic investigation, etc.

CIISec Skills Groups* (additional Skills Groups may also be relevant to particular jobs)

F1 – Intrusion Detection and Analysis

Principles:

monitors network and system activity to identify potential intrusion or other anomalous behaviour
analyses the information and initiates an appropriate response, escalating as necessary
uses security analytics, including the outputs from intelligence analysis, predictive research and root cause analysis in order to search for and detect potential breaches or identify recognised indicators and warnings
monitors, collates and filters external vulnerability. reports for organisational relevance, ensuring that relevant vulnerabilities are rectified through formal change processes
ensures that disclosure processes are put in place to restrict the knowledge of new vulnerabilities until appropriate remediation or mitigation is available
produces warning material in a manner that is both timely and intelligible to the target audience(s)

*Non-Commercial - No Derivatives (BY-NC-ND) license. 2021 Copyright © The Chartered Institute of Information Security. All rights reserved. Chartered Institute of Information Security®, CIISec. Chartered Institute of Information Security®, CIISec®, AfCIIS®, ACIIS®, MCIIS®, FCIIS® and the CIISec graphic logo are trademarks owned by The Chartered Institute of Information Security and may be used only with express permission of CIISec.

Experience

Any role which has developed an understanding the technology behind computer and communications networks, and an ability to work in complex and dynamic technological environments, could provide a foundation, with some additional specialist training, to move into Network Monitoring & Intrusion Detection.

Examples of such roles include:

telecommunications engineering
IT incident response
computer or network engineering

Network Monitoring & Intrusion Detection

More about a career in Network Monitoring & Intrusion Detection

An introduction to this specialismWorking life

An introduction to this specialism

What will your responsibilities include? What are your tasks likely to include?Responsibilities

What will your responsibilities include? What are your tasks likely to include?

What core, related and wider knowledge is important for working in this specialism?Knowledge

What core, related and wider knowledge is important for working in this specialism?

What personal attributes might you need? What specialist skills are important?Skills

What personal attributes might you need? What specialist skills are important?

What other cyber security or IT role might you progress to from this specialism?Moving on

What other cyber security or IT role might you progress to from this specialism?

Which certifications and qualifications are relevant to roles in this specialism?Qualifications

Which certifications and qualifications are relevant to roles in this specialism?