July 14, 2003 (Computerworld) --
Information security specialists have it a little better than other IT professionals in today's tight job market, but not by much. That's according to Jim Wade, senior vice president and chief information security officer at financial services firm KeyCorp in Cleveland.
The pay is slightly higher, Wade says -- maybe 10% more than for other IT positions at comparable levels -- and a high-quality candidate, especially in the senior-level ranks, should have no problem finding interested employers.
To become a top-ranked information security specialist, you have to make the right moves. Here are some tips to help you manage your information security career.
•Get the right certifications, says Wade. There are three types: vendor- and technology-specific, skills-based, and knowledge-based. You'll likely need all three at different places in your career.
When you're first starting, he says, knowledge of a specific technology, like firewalls, is good for operations jobs. The next step, demonstrating a skill such as intrusion-detection expertise, earns you entry into specific projects. When you want to move into management roles, a broad-based certification, like Certified Information Systems Security Professional (CISSP) or Certified Information Security Auditor, is the way to go. (Wade is also president of International Information Systems Security Certification Consortium Inc., a professional standards group for the security industry and the body that oversees the CISSP test.)
The better certifications account for the fact that information security is a continual learning process, says Kerry Anderson, vice president and information security officer at Boston-based FMR Corp., the parent company of Fidelity Investments. So look for ones that require continuing education credits to maintain your status. They indicate that you stay up to date in this changing field. Ones that require you to demonstrate on-the-job experience are also more valuable to employers, she says.
•Consider earning a graduate degree in information security, says Wade. Look for programs that combine technical training with business strategy courses; today's security professional has to be as savvy about corporate financial goals as he is about Unix security holes. Two places to check out: Purdue University and Idaho State University.
If you're looking for more academic programs, Anderson suggests researching the universities recognized by the National Security Agency as Centers of Academic Excellence in Information Assurance Education. That list is available at www.nsa.gov.
•Increase your disaster recovery and risk management skills, says Kenneth Davis, director of information security at Allstate Insurance Co. in Northbrook, Ill. People with disaster recovery skills are vital to businesses because they keep operations running in an emergency. A need for people with risk management expertise arises out of recent government regulations that require businesses such as financial services firms and health care providers to protect personal data.
•Build a home laboratory, says Tom Baltis, manager of risk management at Allstate. Readily available freeware or shareware versions of many commonly used technologies put such a lab within the means of most people, he says. This gives IT professionals the opportunity to acquire knowledge of the underlying theories and uses of security tools - skills that transfer regardless of the actual product used.
•Give something back to the information security community, says Wade. The best way to do that, he says, is to work with standards bodies and professional organizations to develop best practices and enhance the common body of knowledge.
•Get on a project working with strategic partners, such as vendors, service providers and customers, Wade says. This gives you valuable experience in an area of growing importance: providing adequate levels of security when the risks arise from connecting to systems outside your infrastructure.
•Consider an internship in IT security if you're still in school, says Wade. Not only will you get practical, real-world experience, but you'll also make valuable contacts for your postgraduation job search.
Information security jobs are everywhere -- from Fortune 500 companies to mom-and-pop businesses -- and in every state, says Davis. That means you have a good chance of being able to find work where you live. And if you're willing to relocate, the chances of finding your dream job increase.
•Take a second look at government jobs, says Wade. After losing many good people to higher salaries and better opportunities in industry, the U.S. government is adapting its traditionally rigid employment practices to recruit and retain more information security professionals. Johnson is a Computerworld contributing writer. You can reach her at amy-helen@pobox.com.
See results from our survey of more than 5,000 IT pros, and use our Smart Salary Tool to compare your pay with IT workers in similar jobs across the U.S.
See your link here
or
Other Security Stories
See results from our survey of more than 5,000 IT pros, and use our Smart Salary Tool to compare your pay with IT workers in similar jobs across the U.S.
After weathering layoffs or pay cuts, your IT staffers may need some help getting motivated. Try these strategies for employee renewal.
No Windows geek or PC support pro should be without these must-have utilities -- and they're all free.
Get the latest news, features, opinions and more on key technology issues.
Get the latest news, reviews and more about Microsoft's newest desktop operating system.
General Mills, Genentech, San Diego Gas & Electric, University of Pennsylvania and Monsanto top the list.
Computerworld
