In the modern digital world the demand for skilled security professionals is growing at an exponential rate. Every day there is a news story regarding the latest company who has fallen victim to a security breach, and companies are hiring across a wide variety of security positions to help protect themselves and their customers. To facilitate keeping businesses secure there are a plethora of different career paths for you to take, in this course we’ll look at some of the most common.

From the outside looking in Information Security might not seem like such a big industry, but to successfully secure the vast technology landscape embedded in modern society it takes an army of security professionals. As our appetite for technology continues to grow, so will the opportunities for a career in Information Security.
Let's take a high level view of some of the common roles you might find in businesses across the globe, and a representative hierarchy so you can get an idea of career progression paths.
<img src="https://media.chrisdunne.com/img/content/original/information-security-career-progression.webp" alt="A mind map depicting security roles and the hierarchy for career progression" />
In the proceeding lessons we will breakdown each role so you can understand what the responsibilities of each job are, and hopefully you will gain some insight into what you might be interested in pursuing.

Looking at the various roles that are available within Information Security, with a mind map to help visualise the available paths for career progression and provide a representative organisation structure.

Security Career Roadmap

The CISO is the most senior position within the Information Security department, and they are the direct route to the board of directors within a business. Traditionally a CISO would progress through the Governance, Risk, and Compliance route or through other areas of leadership within a business, however modern CISO’s are more technically capable and can often have a foundation in engineering or operations.
A key responsibility of the CISO is to establish a robust security programme for the business, which will feed into the board of directors to gather support, provide frequent feedback cycles, and to ensure it aligns with the overall business strategy.
The CISO will be a pragmatic leader and ensure the Information Security department has the necessary tooling, skills, and training required to achieve the required level of security posture across the business. In practice this may involve relaying evidence based requests from the security team to the board of directors to negotiate budget, request support for an initiative, or provide any necessary resources.
A CISO is not expected to know absolutely everything about Information Security, the field is too vast for that to be realistic. However, they should have solid foundational knowledge with extensive associated experience within security teams and across various businesses. They should be confident speaking to and selling ideas to the board of directors, evangelising the various facets of the security programme at all levels of business, and leading a cross-functional team of security professionals.
Often CISO’s will acquire and continue to renew a number of security related certifications, although not a requirement certifications can demonstrate a level of knowledge of security and provide credibility during the hiring process. It is also a sign of commitment to continuous learning which is a requirement for most roles within the field of Information Security, due to the ever evolving landscape of threats to businesses.
Common certifications that you might find CISO’s acquire are:
<ul>
 <li><a href="https://www.isc2.org/certifications/cissp" target="_blank" rel="nofollow">Certified Information Systems Security Professional (CISSP)</a></li>
 <li><a href="https://www.isc2.org/certifications/issmp" target="_blank" rel="nofollow">Information Systems Security Management Professional (ISSMP)</a></li>
 <li><a href="https://www.isc2.org/certifications/ccsp" target="_blank" rel="nofollow">Certified Cloud Security Professional (CCSP)</a></li>
 <li><a href="https://www.isaca.org/credentialing/cism" target="_blank" rel="nofollow">Certified Information Security Manager (CISM)</a></li>
 <li><a href="https://www.isaca.org/credentialing/crisc" target="_blank" rel="nofollow">Certified in Risk and Information Systems Control (CRISC)</a></li>
</ul>
It’s also common for a CISO to have a Master of Business Administration (MBA), as a large part of the role is business related.
The journey to becoming a CISO is often a long one, and it’s rare to find a CISO with under 15 years experience. The best approach for reaching the Mount Everest of Information Security roles is to focus on being the best security professional you can be, evolve into a leader and network with business professionals.

The responsibilities of the Chief Information Security Officer, as the most senior position within the Information Security department.

Chief Information Security Officer (CISO)

The Head of Security Engineering manages and runs the security engineering function within a business, they’re often more embedded in the product and engineering departments in comparison to the other pillars of Information Security. A Head of Security Engineering usually has a background in hardware or software, and has extensive experience working as a Security Engineer.
A key responsibility of the Head of Security Engineering is to help devise the security engineering strategy, in collaboration with the security engineering team and any stakeholders. The strategy will align with the needs of the business, and take into account any regulatory requirements associated with the industry in which the business operates. They can then create objectives for the team, which are derived from the security engineering strategy.
The Head of Security Engineering will help mentor the members of their team, and encourage continuous learning and knowledge sharing. In a fast changing threat landscape it is integral to have a high performing team with access to the latest training. The team can then evolve their skills and understanding, which can enable more proactive evaluation of security tools, best practices, and techniques.
They will help to establish a security first culture by embedding security engineering within the product and technology departments. That way security can be a first class citizen, and it can be embedded in team processes, the software development lifecycle, and while services are running in production. By establishing robust processes and supplying tools with the best developer experience, teams will be empowered to take ownership of the security posture of the products they are building.
To ensure the business maximises the return on their investment in security tooling, the Head of Security Engineering will evaluate and experiment with the latest technologies and platforms, along with their team. They will ensure access to the best security tools, to satisfy the security requirements of the business. This will involve bringing in and evaluating new vendors, and managing those business relationships.
The Head of Security Engineering will report to the CISO in large businesses, and the CTO in smaller companies. This will involve regular transparent communication with senior management and executives on how the security engineering strategy feeds into the bigger strategy for the security department and the wider business. It will also include insights into the security posture of any products deployed in production, along with updates on current objectives and any associated metrics.
A Head of Security Engineering will have the technical capabilities to drive improvements to the security culture within the technology department, and also the communication skills to sell ideas to engineers and non-technical stakeholders. They should be confident communicators and able to manage business relationships, and they should be capable of selling the benefits when security may be a competing priority with product development.
A Head of Security Engineering will often have certifications acquired as a Security Engineer, which are usually vendor specific, they may have more managerial focused certifications, but often they are acquired once in the position. Here are some common certifications you might find a Head of Security Engineering has acquired:
<ul>
 <li><a href="https://aws.amazon.com/certification/certified-security-specialty/" target="_blank" rel="nofollow">AWS Certified Security - Specialty</a></li>
 <li><a href="https://learn.microsoft.com/en-us/credentials/certifications/cybersecurity-architect-expert/" target="_blank" rel="nofollow">Microsoft Certified: Cybersecurity Architect Expert</a></li>
 <li><a href="https://cloud.google.com/learn/certification/cloud-security-engineer" target="_blank" rel="nofollow">Professional Cloud Security Engineer</a></li>
 <li><a href="https://www.isc2.org/certifications/cissp" target="_blank" rel="nofollow">Certified Information Systems Security Professional (CISSP)</a></li>
</ul>
This is not an exhaustive list, and the path to becoming a Head of Security Engineering is too diverse to cover all qualifications that may have been obtained along the way. It is not even a requirement to have formal education, although it may help, the experience of working within technology, being able to communicate with engineers, having a modern attitude to security in practice, and having extensive experience working as a security engineer or in a related role is what will give you the foundation to be a successful Head of Security Engineering.

The responsibilities of the Head of Security Engineering, as the most senior engineering position within the Information Security department.

Head of Security Engineering

An Application Security Engineer is responsible for helping Software Engineers secure the Software Development Lifecycle (SDLC). They will report to the Head of Security Engineering in most organisations, and will embed themselves within the engineering department. It is important for an Application Security Engineer to have a background in Software Engineering and knowledge of DevSecOps practices.
The responsibilities of an Application Security Engineer will vary depending on the size of the technology department, often they will take on Cloud Security, Network Security, DevSecOps, and Automation responsibilities, plus much more, on top of their own core competencies. This may sound like a lot to take on, but it can be a varied and exciting career path for a software engineer who is interested in security.
We’ll break down the core competencies alongside the SDLC to highlight where each responsibility fits in.
<h2>Planning &amp; Requirements</h2>
The Application Security Engineer will be involved in defining suitable security requirements, which might be influenced by regulatory requirements. These security requirements can form part of a service readiness document and act as a checklist of items that teams can plan in as part of their definition of done for project and feature work.
It’s also important for teams to have the security metrics they require to make informed decisions on patch and remediation work so that it doesn’t simply sit as security tech debt as systems degrade over time. This is a key component when deciding what tools to adopt, as it provides the opportunity for continuous improvement and allows teams to make informed decisions regarding risk.
<h2>Design &amp; Architecture</h2>
As an Application Security Engineer, you want teams to ensure their software designs and architecture are secure, and a great way to discover potential vulnerabilities early in the SDLC is through threat modelling. The Application Security Engineer will influence the security culture in teams so that they lead their own threat modelling exercises. As the team building the software has the domain specific knowledge, and are the subject matter experts on the systems they are building, it doesn’t make sense for a security professional to carry out the threat modelling exercise, rather they should lay the foundations and be there to support and guide where required.
A popular framework for threat modelling exercises is <a href="https://chrisdunne.com/post/what-is-stride" target="_blank">STRIDE</a>, which guides you on the type of threats to look for in relation to specific aspects of the design. It’s common to follow Shostack's 4 questions as a guide during threat modelling exercises.
<h2>Implementation &amp; Development</h2>
This is where it is important to shift security tooling left, so that developers have fast feedback loops where they are writing their code. This usually comes in the form of Static Application Security Testing (SAST), Software Composition Analysis (SCA), and secret scanning tools. Some of the most popular options, which come with a level of free access for you to try them out, are CodeQL, Snyk, and Semgrep.
A key focus of the Application Security Engineer is to provide a great developer experience, it’s essential to not increase the overhead on teams or introduce bottlenecks through the tools that are adopted. Bring the developers along on the journey when deciding what tools to use and how they will integrate into the existing ways of working.
<h2>Testing &amp; Quality Assurance (QA)</h2>
In modern technology departments everything will be deployed through a pipeline, but this is not always the case.
This is where security gates can be introduced, within the deployment pipeline or as a manual step in legacy systems, to ensure as many vulnerabilities as possible are prevented from reaching production. The most common security gates come in the form of the SAST, SCA, and secret scanning tools, which were mentioned previously, but also between pre-production and production Dynamic Application Security Testing (DAST) can be leveraged.
Once software has been deployed to a pre-production environment, DAST facilitates security testing at runtime against that environment to ensure it’s secure before pushing out to production. You can think of a DAST scan as a simulated penetration test.
<h2>Deployment</h2>
An Application Security Engineer will help to ensure the platforms which facilitate deployments are secure. This will include configuration settings in version control and deployment pipeline platforms, which are often the same platform, to include code review, enforce the four eyes principle, and include any security gates as required.
It’s also important to make sure the way in which code is deployed to a company owned datacentre or a cloud vendor is secure; in AWS for example you would look at using OpenID Connect (OIDC) and IAM Roles with short-lived credentials that are scoped to specific repositories within your version control.
<h2>Production &amp; Maintenance</h2>
Through the existing steps a lot of point-in-time vulnerabilities and misconfigurations would have been captured, but naturally new vulnerabilities are discovered every day and so a previously unknown vulnerability may exist within your software in production, as a result it’s important to continue to test in production, and this can be achieve with DAST through continuous scans or on a suitable schedule.
The role of the Application Security Engineer is centred around the SDLC, however it’s just as much about people, and building a security culture which makes security accessible and encourages everyone to be responsible for security. This culture can be nurtured through providing suitable modern education, a community to share and discuss security related topics, and through empowerment to take ownership of security posture across the business. You will need to collaborate across teams and departments, so having good communication skills is essential.
It’s common for Application Security Engineers to have no certifications, it’s not a requirement for the role in most organisations, but you may find they have vendor specific certifications that align with the tech stack of the companies they have worked for. The following list provides some example certifications, but it’s not exhaustive:
<ul>
 <li><a href="https://aws.amazon.com/certification/certified-security-specialty/" target="_blank" rel="nofollow">AWS Certified Security Specialty</a></li>
 <li><a href="https://cloud.google.com/learn/certification/cloud-security-engineer" target="_blank" rel="nofollow">GCP Professional Cloud Security Engineer</a></li>
 <li><a href="https://learn.microsoft.com/en-us/credentials/certifications/azure-security-engineer/?practice-assessment-type=certification" target="_blank" rel="nofollow">Microsoft Certified: Azure Security Engineer Associate</a></li>
</ul>
The Application Security Engineer role is varied, so you need to be adaptable, but because of that it can provide you with many options for personal development and career progression. You’ll remain technically hands-on, but also become a teacher and a leader within the business.

The responsibilities of the Application Security Engineer, operating under the Head of Security Engineering.

chrisdunne.com

The Security Careers Guide

Lessons

Security Career Roadmap

Chief Information Security Officer (CISO)

Head of Security Engineering

Application Security Engineer