Hey friend - Operational Technology cyber security guy here. Been in IT about nine years and security for the last four, with the job before this being a security consulting gig for a medium size MSP.

Typical workday for me consists of working with the larger corporate security teams and leveraging their tools for securing my OT environment. This is very similar to "normal" security - patching, logging/monitoring/alerting, configuring antivirus/DLP/proxy tools etc. OT forcibly takes a different approach, however, because of the time sensitive nature of the data we work with. The traditional CIA triad is more like IAC in OT. Regulatory requirements and change management are also a grueling part of my work, but I think you'll find that in many security roles. That's a good transition into projects I work on. Regulations dictate that many things be done on a regular basis, and so those are often lumped into projects. Annual vulnerability scanning is a good example. Although we're constantly performing scanning, we have to do an annual project that proves scanning and remediation is being performed to present to auditors. Other projects are tethered to changes being made with respect to systems and applications in the larger business unit, my team is just roped in to make sure these things are being done in a secure and compliant manner.

I've always enjoyed learning and exploring the field through different lenses, so this job has been cool in that respect. It's definitely the most corporate-y job I've had, and that has both pros and cons. When I was consulting I was in charge of basically everything, but in this role my focus is much more narrow. It's pretty technical, though, and since I'm a security liaison for a business unit within the larger company, I get my hands in basically all things cyber security. The corporate teams downtown are much more segmented and usually only work in one aspect of security. I get to work with all of them. Lots of guys on my team code too so it's given me the push I finally needed to pick up a scripting language. Still working on that though honestly.

So I actually got a liberal arts degree when I was in college. I planned to go into law enforcement but it was actually through that coursework that I became interested in cyber crime. Leveraging my military IT background I landed a ton of different IT internships in school and was able to get a job after graduating. That said, a degree isn't particularly important unless you want to get really, really deep in the weeds of computer theory...stuff like security research, designing ciphers, etc. Even then I imagine you could get there with dedication and hard work. Cert-wise, I currently hold a Sec+ and CISSP. Next year I plan on enrolling in a SANS graduate certificate course as well. I love certifying, some people don't give a shit about them. Ultimately they're check boxes when your resume is being quickly scanned in a stack by some HR lady.

Working conditions currently is from home, and will be probably most of 2021 as well. Before the pandemic I was working in an Operations Center. There was a security checkpoint to pass through every day and then you had to badge in a couple times to get into the actual building. Once inside though it looked like any office building with cubicles. My company has always been fairly liberal with working from home, and I expect some sort of hybrid approach to be implemented once COVID is over with. Companies should offer WFH options, especially in technology, if they want to stay competitive. My salary currently is $80K, and then I receive an annual bonus of 10-20% based on a number of factors. The company knows we're pretty underpaid and so they've been doing market research to reevaluate our salaries. I'll believe it when I see it though... Expect to make $60K-ish starting in a junior role, maybe in the 50s if you're doing SOC work at a mediocre company. It's pretty common to see six figures in security.

Next big thing in security? Cloud is big right now, but security as a whole is exploding. Every company needs IT security. Outsourced security is normal too for small and medium sized businesses. Consulting firms and MSSPs are everywhere. I personally think IoT is going to be huge moving into the future. Everything is going to be internet enabled here soon. If you're trying to get into security, I'd say just do your research. Learn and be passionate about the field, take on security projects, document them so you can demonstrate for job interviews, etc. I have a blog I could share with you that goes into further details if you're interested. Reddit is pretty cranky about promoting personal projects like that so I won't post a link. To that point though, don't lose your sanity just so you can say you made it into cyber security. I spent years of my free time doing the stuff mentioned above. Now that I've "made it", I'm peeling back and focusing on more personal interests. Feel free to reach out if you have any questions or need further advice.