A great responder is hard to find

Yet, these organization are finding it exceedingly difficult to find such experts and to assure that they can prevent, contain, and resolve incidents quickly, efficiently, and effectively.

This fact is reflected in the fact that the number of unfilled cybersecurity jobs worldwide has increased 350% from one million to 3.5 million between 2013 and 2021.

What about earning potential?

As we can see, when it comes to the field of incident response – it’s a job seeker’s market, and the hiring organization is prepared to pay. According to one source, the majority of cyber incident responder salaries in the US currently range between $95K (25th percentile) to $131,000 (75th percentile), with top earners (90th percentile) earning $155K annually.

Another source presents an even rosier picture with the average salary coming in at as high as $130K, with the top echelon taking home $170K every year.

About the role

Responsibilities

Other than the obvious – ‘responding to a cyber incident’ – the individual fulfilling this role is essentially charged with being the cyber protector of the organization, responsible for preventing, mitigating, and resolving cyber incidents, by:

• Identifying network and system vulnerabilities
• Collecting intrusion artifacts, including source code, malware, and others
• Developing the incident preparedness and handling plans
• Running penetration tests, risk analysis, and security audits
• Coordinating the incident response team
• Crafting processes and best practices for efficient, clear, and timely communications and updates
• Creating and sharing post-mortem reviews and reports with lessons learned

And more.

The career path

At the entry level, responders typically fill the role of security, system, or network administrator, as well as incident response engineer, cyber incident responder, CSIRT (Computer Security Incident Response Team) engineer, and CND (computer network defense) incident responder.

Management level positions can include director of incident response, CSIRT manager (Computer Security Incident Response Team), and more.

Education 

While a specific bachelor’s degree is not mandatory, a technical degree in computer science or similar field will not only boost the resume it will also help increase the chances of successfully capturing career opportunities that may not otherwise be available.

Moreover, if the goal is to accelerate on a management trajectory, a specialized master's degree in information security or information assurance will certainly work to one’s advantage.

Professional certifications

In addition to a formal education, there are also a number of important professional certifications that are often required for coveted positions in incident response, including:

• Certified Information Systems Security Professional (CISSP)
• Certified Ethical Hacker (CEH)
• Cisco Certified Network Associate (CCNA)
• Certified Computer Examiner (CCE)
• GIAC Certified Forensic Examiner (GCFE)
• GIAC Certified Forensic Analyst (GCFA)
• GIAC Certified Incident Handler (GCIH)
• GIAC Certified Intrusion Analyst (GCIA)
• Certified Computer Forensics Examiner (CCFE)
• Certified Penetration Tester (CPT)
• Certified Reverse Engineering Analyst (CREA)
  
  

What top-notch cyber incident responders bring to the table

Being a world-class cyber incident responder is not just about having the right education or certification. It’s also about bringing the right skill set.

Incidents can be chaotic and messy. And that’s why the best of the best come well-equipped with the know-how and expertise in processes and tools that assure speedy, efficient, and effective resolutions.

Among the most important capabilities are:

• Informing, onboarding, and aligning the incident response team within minutes (time lost is money and reputation wasted)
• Assigning roles and tasks quickly and clearly
• Assuring that communication and collaboration tools are easily accessible to all
• Sending accurate and intuitive status updates to team members, stakeholders, and management in a timely manner
• Knowing how to access all relevant incident data regardless of the number of sources
• Extracting actionable insights from data, for understanding the root cause and sharing lessons learned
• Securing communications and restricting access to incident data to minimize the potential for legal exposure
• Engaging with incident stakeholders, breach counsel, and others in a secure, clear, and timely manner

How Exigence can help

 Incident responders and security executives all over the world are leveraging the Exigence platform to assure that theirs is a world-class cyber incident response organization with:

• Process-driven, structured, and automated workflows
• Data centralization, consolidated updates, and reports that are generated and the click of a button
• Efficient and secured communications
• Unprecedented collaboration with all communication and updates in a single pane of glass

To see the solution in action and learn how Exigence can help your organization execute world-class incident response, we invite you to reach out to us at info@exigence.io.