It has only recently been that the position of ethical hacker has become a recognized job title. In the broad sense, cybersecurity-related professions are affiliated with what is called hacking or even ethical hacking, in the sense that they aim to protect users from cyberattacks and cyber threats. 

The best-known cybersecurity professions are therefore the following:

The Pentester

As a cybersecurity professional, the pentester checks the security of computer networks by carrying out intrusion tests, or “penetration tests” in English, which gave rise to the abbreviation “Pentest” and “Pentester”. 

Among these intrusion tests, the Pentester can carry out two quite distinct types: internal intrusion tests and external intrusion tests.

This double test will make it possible to check the vulnerability of an organization’s network from the internal network, and also from a connection outside this network. These tests will at the same time make it possible to test whether the antiviruses and firewalls are robust enough to repel its intrusion attempts or not.

Thanks to the various intrusion tests, the pentester will be able to assess the degree of vulnerability and the complexity of fixing it, as well as the order of priority to give to these fixes.

Following these tests, the Pentester identifies vulnerabilities and proposes actions to fix them, then erases behind him all traces of the vulnerability tests to avoid malicious exploitation of the previously identified flaws. 

He will also be in charge of security audits of the company’s information system such as code audits, configuration audits, architecture audits, and even organizational audits. These audits will also allow him to report to the organization what the breaches in IS security are, in multiple respects.

The pentester and the ethical hacker are closely linked by their missions. Confusion between these two terms and these two functions is commonplace. They share the history of two recent professions, for which there was originally no training and only self-taught profiles. As for a White Hat Hacker, when this type of profile came to light, it was possible to move from the malicious side to the ethical side.

The cybersecurity engineer

The cybersecurity engineer, also called Information Systems Security (ISS) expert, is in charge of analyzing and handling intrusion threats that target the computer system of the company that hired him or the company for which he works. He defines action plans to anticipate IT threats.

Like the Pentester, he hunts for possible flaws in internal and external networks, to prevent intrusions and to prevent malicious hackers from exploiting a flaw in the network architecture of the company he defends.

He also audits the level of security of IT systems, and does so permanently. He monitors all the network access points that could cause an attack. If he identifies sources that could represent a threat to the interests of the company that hired him, he can work on preventive blocking of these sources external to the network. 

He also writes security procedures to be followed by the company’s staff and can play a role in raising awareness of IT security issues among the company’s employees. He can create training materials according to the company’s departments and the level of knowledge needed by each.

He may be required to lead the technical (IT) teams to secure the company’s network and IT systems. He is also required to monitor the threats circulating on the net, and may work confidentially with other cybersecurity departments such as the Security Operating Center (SOC).

The SOC analyst 

The SOC (Security Operation Center) is the team in charge of ensuring information security in a company. This team, often described as a platform, makes it possible to supervise and manage IS security with various collection tools, making it possible to establish links between various events such as intrusion attempts or proven hacks.
The SOC ensures that flaws and security incidents are identified and analyzed, understood and controlled. 

The different members of the SOC team monitor and analyze activity on the company’s various networks, on servers, endpoints, databases, applications, websites and other systems, looking for abnormal behavior that could announce or explain a security incident.
As the SOC must make it possible to respond to different missions, it is generally organized in 3 levels:

• Level 1 – the operator : he picks up alerts and makes a first diagnosis. He can possibly resolve incidents he has identified if it is within his capabilities.
  
• Level 2 – the security analyst: he analyzes in detail the alerts raised that could not be handled by the level 1 operator for a more in-depth study, and if possible a resolution of incidents. To do this, he communicates with the teams concerned by these types of incidents and supports them in handling them. If he can, the analyst puts remediations in place.
  
• Level 3 – the security expert: this is the last tier after level 2 if incidents are not resolved by the security analyst. The expert therefore intervenes for in-depth analyses or those requiring a particular or more advanced skill. Relying on risk analysis, the head of the SOC will propose and implement use cases covering many threats. If the use case is not already in the catalog, he is responsible for developing it to meet this specific need.

The cybersecurity architect

The IS cybersecurity architect ensures the technical and technological choices of IT and business projects so that they comply with the organization’s security requirements. He represents the technical authority on security architectures. 

He is required to produce documentation of this cybersecurity architecture that he himself defined, and is in charge of its evolution.

He also produces the specifications necessary for its proper functioning, and for its proper understanding by the other resources who need to document themselves, inform themselves or train on this subject.

He creates and updates the security policies and standards applicable to the entire company, and also writes the security testing & security audit strategies, as well as all the security documentation needed for certifications and accreditations. 

He creates and updates risk analyses, which makes it possible, among other things, to extend the company’s cybersecurity requirements to its various suppliers.

He is a true conductor of cybersecurity. He checks daily the level of security achieved through compliance and intrusion testing campaigns. He takes into account and analyzes the incidents and problems identified by the various resources assigned to information system security, and proposes action plans to fight these threats more effectively. 

The cybersecurity architect also coordinates the technical team’s work on IT security, as well as the awareness-raising and continuing training of staff on this subject, and also manages everything related to knowledge transfer and support for employees in order to maintain the level of knowledge acquired.