You’re building an information security team. What are the most important skills to look for?

Technical Proficiency: Strong understanding of networking, operating systems, and security tools. Security Fundamentals: Knowledge of cybersecurity principles, frameworks, and standards. Risk Management: Ability to assess and prioritise security risks. Incident Response: Proficiency in detecting, analysing, and responding to security incidents. Communication: Strong communication skills. Analytical/Problem-Solving Skills: Critical thinking and troubleshooting abilities. Continuous Learning and Adaptability: Willingness to stay updated and adapt to new challenges. Ethical Mindset: Commitment to ethical mindset and privacy principles. Leadership and Management Skills: Experience in leading and managing security teams (for leadership roles).

For an entry level role technical training with proven internship would be acceptable especially when the individual involved demonstrate passion and commitment to continuous learning and improvement.

Technical skills can be showcased with certifications like OSCP, GCIH, cloud security certs (AWS, Azure), and vendor certs (Cisco, Palo Alto). Baseline knowledge would be CISSP. Hands-on training from SANS or offensive security courses are great. YouTube is great. Vendor sites sometimes have free training (e.g. Palo Alto). Stay abreast of emerging areas of expertise: CSPM, CWPP, DevSecOps (code analysis, container scanning), AI/ML for threat detection, Zero Trust architecture, SASE, Endpoint Detection and Response, deception tech. Teams need [1] depth in specific domains (cloud, app, network etc.) and expertise in latest tools/methods. A track record of continuous learning is crucial. This is what I want to see on my team.

Like any other succesful team it is beneficial to have different qualifications, experiences and levels of seniority in a team. This way you can learn from each other and raise the level for the team as a whole.

é essencial procurar por uma combinação de habilidades técnicas e comportamentais. Algumas das habilidades mais importantes incluem: Conhecimento técnico em segurança cibernética: compreensão profunda de conceitos de segurança, como criptografia, redes, sistemas operacionais, detecção e prevenção de ameaças, entre outros. Pensamento analítico e habilidades de resolução de problemas: capacidade de analisar cenários complexos de segurança e desenvolver soluções eficazes para mitigar riscos. Fortes habilidades de comunicação: capacidade de comunicar conceitos de segurança de forma clara e eficaz, tanto para especialistas técnicos quanto para partes interessadas não técnicas.

Candidates with a potent blend of technical prowess and problem-solving abilities, particularly those willing to roll up their sleeves and delve into the nitty-gritty details of security challenges. Integrity and ethical behaviour are non-negotiable, ensuring candidates adhere to ethical standards and prioritize protecting sensitive information at all times.

Entre outras capacidades de uma equipe, gostaria de destacar as competências relacionadas a inteligência de ameaças, pois além de gerar IoCs e TTPs de ameaças emergentes, favorece a colaboração e o compartilhamento de informações entre organizações, setores e países. Ao trabalhar em conjunto, as comunidades de segurança cibernética podem identificar e responder a ameaças de forma mais eficaz, protegendo assim a infraestrutura crítica e os ativos digitais de todos os envolvidos.

Ter uma equipe de Segurança da Informação agrega muito valor nos resultados da companhia, e da mesma forma é necessário identifica-la como um investimento. Ter uma equipe multidisciplinar com prática e com multi senioridade é muito bacana inclusive para traçar um plano de carreira e manter a vontade de ser e fazer o melhor do colaborador. Trabalhar com segurança requer gostar realmente do que se faz, muita dedicação e se manter atualizado. Comunicação mais do que nunca é importante para poder interagir com pessoas de outras equipes ou até mesmo com pessoas do setor, e se puder ter pessoas que tenham conhecimento na lingua inglesa é de grande valor, visto que uma parcela grande de materiais estão em ingles.

When forming an information security team, it's crucial to look for professionals with solid technical skills, analytical thinking, understanding of security regulations, effective communication skills, incident management experience, creative problem-solving abilities, ethics, and integrity. These skills are essential for addressing the complex and ever-evolving challenges of the cybersecurity landscape, ensuring effective protection of the organization's data and systems.

Reflecting on my journey through the world of information security, I've realized how much technical skills truly are the bedrock of any successful team. Whether it was diving deep into network security, unraveling the complexities of cryptography, or navigating the murky waters of malware analysis, the ability to wield various tools and methodologies has been indispensable. I've faced decisions about whether to bring on board specialists with laser-focused expertise or versatile generalists who could juggle multiple tasks. It's this blend of hard and soft skills that has made the most significant difference in our achievements and our resilience in the face of ever-evolving cyber threats.

Security is hard. It's about safely or gracefully handling the unexpected. In order to do that, you need to discuss what actually is expected and then discuss scenarios when something odd happens. The ability to do so requires communication skills to different stakeholders who have different lenses of focus and understanding. Strong communication skills are needed to adapt your messaging to the right audience; otherwise, they're going to ignore your warnings and your recommendations.

Combining technical chops with communication proficiency transforms your career. Effectiveness requires influencing and working with others. Spend more time here than you think you need. Examples... Explaining complex topics simply to non-technical audiences. Creating clear documentation, reports, presentations. Strong interpersonal skills for training, delivering bad news, influencing. Excellent writing for policies, procedures, advisories. Public speaking abilities. Communication enables buy-in, security culture, positioning security as the business-enabler. Emotional intelligence helps to understand perspectives. Emotional regulation helps to remain composed in stressful incidents. Again, spend more time here than you think you need.

It is important to have a) facts right b) speak the language of the target group. The senior management is not interested in the technical details but in the risks for the organization. Admins need to know the tech stuff. Communicating the right things in the right language will help to get the message across.

I think the contributions in this thread identify the value of communication skills. Being able to translate technical risks into business risks, enabling an executive audience to make a business decision, is a skillset highly valued, and often overlooked. Additional focus on this one set of skills can elevate your team, and yourself, to a different level of acceptance across your organization. Audiences value a message tailored to their needs. Being able to develop and deliver that message is what sets security teams apart. I've been honoured to work with teams over during my career that achieved this position within organizations, and our work was so much easier!

Pensamento crítico e habilidades de tomada de decisão: capacidade de avaliar criticamente situações de segurança e tomar decisões rápidas e informadas para proteger os ativos da organização. Conhecimento de conformidade e regulamentações: compreensão das leis, regulamentos e padrões de segurança relevantes para o setor da organização e capacidade de garantir conformidade.

Throughout my career, I've observed that the most effective information security teams excel in communication. It's not just about being able to report incidents or provide guidance; it's about fostering an environment where communication flows seamlessly across all levels of the organization. This ensures that security is not siloed but integrated into every aspect of the business. In my teams, I prioritize hiring individuals who can articulate complex security concepts to non-technical stakeholders as efficiently as they discuss technical details with their peers. This skill is indispensable for building a culture of security awareness and for aligning security objectives with business goals.

Analytical skills are paramount for cybersecurity teams to effectively identify, investigate, and mitigate cyber threats. These skills are important for professionals to analyze vast amounts of data, recognize patterns, and detect anomalies indicative of potential breaches. In an event of breach, analytical abilities facilitate quick situation assessment and informed decision-making. Being abreast with above stated skills, staying current with the evolving threat landscape requires analytical thinking to extract insights from threat intelligence. IMHO when designing security architectures, maturing skills for an organizations the Leadership need to invest in programs focusing on critical thinking, problem-solving, and data analytics.

Habilidades de trabalho em equipe: capacidade de colaborar efetivamente com colegas de equipe, líderes e outras partes interessadas para alcançar objetivos comuns de segurança. Curiosidade e disposição para aprendizado contínuo: interesse em permanecer atualizado sobre as últimas tendências, tecnologias e ameaças em segurança da informação e disposição para buscar oportunidades de aprendizado e desenvolvimento profissional.

Analytical skills are the cornerstone of effective problem-solving in cybersecurity. In my tenure, I've valued team members who can sift through data to identify trends and anomalies that may indicate a security threat. However, beyond mere data analysis, what sets a great security professional apart is the ability to think critically about the information at hand and creatively develop solutions that are both innovative and practical. This involves a constant curiosity and a commitment to lifelong learning, as the threat landscape and technology ecosystem are in perpetual flux. Encouraging a culture where questioning and innovation are welcomed has been key to staying ahead of potential security threats.

In information security, teamwork skills are important. Being able to collaborate, coordinate, cooperate, and resolve conflicts effectively has been crucial. These skills have allowed us to combine our diverse backgrounds, perspectives, and expertise to achieve superior results, share knowledge, and support one another. Beyond just improving our performance, teamwork has also created a sense of belonging and engagement within the team, boosting morale and motivation. Additionally, being adept at teamwork has been essential for building strong relationships with other teams and departments in the organization, as well as with external partners and vendors.

Leadership within information security extends beyond hierarchical roles. It's about cultivating a sense of ownership and responsibility across all team members. In my journey, I've found that empowering team members to take initiative not only fosters innovation but also builds resilience within the team. A leader's role is to guide this process, ensuring that the team's efforts are aligned with the organization's strategic objectives while also encouraging professional growth and development. This approach has proven to be effective in creating teams that are proactive, motivated, and deeply invested in their mission to protect the organization.

Adaptability skills are essential in information security, given the field's dynamic nature. Key aspects include flexibility to adopt new technologies, resilience in recovering from setbacks, agility in applying new knowledge, and the ability to anticipate and prepare for future trends. Professionals who embrace change, learn from mistakes, and #stayCurious and #stayAhead of emerging threats ensure an organization's security posture remains robust and responsive. Adaptability not only aids in overcoming current challenges but also in seizing opportunities for innovation and improvement.

For entry level, I look for someone that has initiative and drive, I.E. the ability listen and willingness to work. Many things can be taught or they take time to build the intuition and experience. What can't be taught is character.

Work out what you can teach, and what you can’t (or is harder to). Recruit people with the skills you can’t teach, like investigative mentality or problem solving. Then teach them the things you can.

Building a successful information security team goes beyond assembling a group with the right skills; it's about creating a culture that values security as a shared responsibility. This culture is fostered by leadership that exemplifies and rewards collaboration, innovation, and a proactive approach to problem-solving. In my experience, teams that operate within such a culture are not only more effective in defending against threats but also in influencing positive change within the organization. It's this blend of skills, mindset, and culture that forms the bedrock of a truly exceptional information security team.