The job of ethical hacker has only recently become a recognised job title. Broadly speaking, cybersecurity jobs are associated with what is known as ethical hacking, in the sense that they aim to protect users from cyberattacks and cyber threats. 

The best-known cybersecurity jobs are therefore the following:

The Pentester

As a cybersecurity professional, the pentester checks the security of computer networks by carrying out intrusion tests, or “penetration tests”, which gave rise to the abbreviations “Pentest” and “Pentester”. 

The pentester can carry out two quite distinct types of penetration test: internal penetration tests and external penetration tests.

This dual test makes it possible to check the vulnerability of an organisation’s network from the internal network, and also from a connection outside that network. At the same time, these tests show whether or not the antivirus software and firewalls are robust enough to repel intrusion attempts.

Thanks to the various penetration tests, the pentester can assess the severity of each vulnerability and how complex it is to fix, as well as the order of priority to be given to these fixes.

Following these tests, the pentester identifies the vulnerabilities and proposes actions to correct them, then erases all traces of the vulnerability tests to prevent malicious exploitation of the flaws previously identified. 

They are also responsible for security audits of the company’s information system, such as code audits, configuration audits, architecture audits and even organisational audits. These audits also enable them to report back to the organisation on the security gaps in its information system, from multiple angles.

The pentester and the ethical hacker are closely linked by their missions. The two terms and the two roles are frequently confused. They share the history of two recent professions for which there was originally no training and only self-taught profiles. As with a White Hat Hacker, when this type of profile came to light, it was possible to switch from the malicious side to the ethical side.

The cybersecurity engineer

The cybersecurity engineer, also called an Information Systems Security (ISS) expert, is responsible for analysing and dealing with intrusion threats targeting the IT system of the company that hired them or the company they work for. They define action plans to anticipate IT threats.

Like the pentester, they track down possible flaws in internal and external networks to prevent intrusions and stop malicious hackers from exploiting a weakness in the network architecture of the company they protect.

They also audit the security level of IT systems, and do so on an ongoing basis. They monitor all network access points that could lead to an attack. If they identify sources that could pose a threat to the interests of the company that hired them, they can work to block these external sources preventively. 

They also write security procedures for company staff to follow and can play a role in raising employees’ awareness of IT security issues. They can create training materials tailored to each department of the company and the level of knowledge each one needs.

They may lead the technical (IT) teams to secure the company’s network and IT systems. They also monitor threats circulating on the internet and may work confidentially with other cybersecurity services such as the Security Operations Center (SOC).

The SOC analyst 

The SOC (Security Operations Center) is the team responsible for information security within a company. This team, often described as a platform, supervises and manages information system security using various collection tools that make it possible to link different events such as intrusion attempts or confirmed hacks.
The SOC ensures that security flaws and incidents are identified, analysed, understood and controlled. 

The various members of the SOC team monitor and analyse activity on the company’s networks, servers, endpoints, databases, applications, websites and other systems, looking for abnormal behaviour that could signal or explain a security incident.
Because the SOC has to fulfil several missions, it is generally organised into 3 levels:

• Level 1 – the operator : picks up alerts and makes an initial diagnosis. They may resolve incidents they have identified if it is within their remit.
  
• Level 2 – the security analyst : analyses in detail the alerts escalated because they could not be handled by the level 1 operator, for more in-depth study and, where possible, resolution of the incidents. To do this, they communicate with the teams concerned by these types of incident and support them in handling them. Where possible, the analyst puts remediations in place.
  
• Level 3 – the security expert : the final tier after level 2 when incidents are not resolved by the security analyst. The expert therefore steps in for in-depth analyses or those requiring specific or more advanced skills. Based on risk analysis, the SOC manager will propose and implement use cases covering numerous threats. If a use case is not already in the catalogue, they are responsible for developing it to meet that specific need.

The cybersecurity architect

The information systems cybersecurity architect oversees the technical and technological choices of IT and business projects to ensure they comply with the organisation’s security requirements. They are the technical authority on security architectures. 

They produce documentation of the cybersecurity architecture they have defined and are responsible for its evolution.

They also produce the specifications needed for it to work properly and to be well understood by the other people who need to read up on it, learn about it or be trained on it.

They create and update the security policies and standards that apply across the company, and also write the security testing & security audit strategies, as well as all the security documentation required for certifications and accreditations. 

They carry out and update risk analyses, which among other things extends the company’s cybersecurity requirements to its various suppliers.

They are a true conductor of cybersecurity. Every day, they check the level of security achieved through compliance and penetration testing campaigns. They take into account and analyse the incidents and problems identified by the various resources assigned to information system security, and propose action plans to fight these threats more effectively. 

The cybersecurity architect also coordinates the technical team’s IT security work, as well as raising awareness and providing ongoing training for staff on the subject, and manages everything related to knowledge transfer and supporting employees in order to maintain the level of knowledge acquired.