ตำแหน่งหลักใน Cybersecurity/Network Security (Core Roles)
| Role | Focus | Key Skills | Certifications |
|---|---|---|---|
| Network Security Engineer | Firewall, VPN, NAC, Segmentation, Hardening, Monitoring | Palo Alto, Fortinet, Check Point, Cisco, Routing/Switching, Scripting | PCNSE, NSE 4-7, CCNP/CCIE Security |
| SOC Analyst (Tier 1/2/3) | Monitor, Triage, Investigate, Respond Alerts (SIEM/EDR/NDR) | Splunk/Elastic/Sentinel, MITRE ATT&CK, Log Analysis, Threat Intel | CySA+, Security+, GCFA, GCIA |
| Security Architect | Design Security Architecture, Zero Trust, SASE, Cloud Security, Standards | Architecture Frameworks (SABSA, TOGAF), Cloud, Zero Trust, Crypto | CISSP, CCSP, SABSA, TOGAF, Vendor Expert |
| Penetration Tester / Red Teamer | Simulate Attacks (External, Internal, Web, Mobile, Cloud, Physical, Social) | OSCP, OSEP, CRTO, Exploit Dev, AD/Azure/AWS Attacks, C2 Frameworks | OSCP, OSEP, OSWE, CRTO, PNPT |
| Incident Responder / DFIR | Contain, Eradicate, Recover, Forensics (Memory, Disk, Network, Cloud) | Volatility, KAPE, Velociraptor, Timeline, Malware Analysis, Reporting | GCFA, GNFA, GCFR, OSCP |
| Threat Hunter | Proactive Hunt (Hypothesis-driven), TTP Detection, Tool Development | MITRE ATT&CK, Sigma, KQL/SPL/ES|QL, Threat Intel, Python/Go | GCTI, OSCP, Custom Certs |
| Cloud Security Engineer | CSPM, CWPP, CIEM, IaC Security, Serverless/Container/K8s Security | AWS/Azure/GCP Native, Terraform, Kubernetes, CNAPP (Wiz, Lacework, Prisma) | AWS/Azure/GCP Security Specialty, CKS, PCCSA |
| Identity & Access Management (IAM) Engineer | IdP (Entra ID, Okta, Ping), MFA, SSO, PAM, IG, Zero Trust Access | SAML/OIDC/SCIM, Lifecycle, JIT, Conditional Access, Entitlements | Okta Certs, Microsoft SC-300, SailPoint, CyberArk |
| GRC / Compliance Analyst | Policy, Risk Assessment, Audit, Compliance (PCI, ISO, SOC2, HIPAA, GDPR, PDPA) | Frameworks (NIST CSF, ISO 27001), Risk Quantification (FAIR), Audit | CISA, CISM, CRISC, ISO 27001 LA |
| Application Security (AppSec) Engineer | SAST/DAST/IAST/SCA, Secure SDLC, DevSecOps, API Security, WAF Rules | Code Review, Threat Modeling, Shift Left, Semgrep, Checkmarx, Snyk, SonarQube | GSSP-.NET/Java, CSSLP, OSWE |
ตำแหน่ง "พิเศษ/เฉพาะทาง" (Specialized / Emerging Roles)
| Role | Description | Why Special |
|---|---|---|
| OT/ICS Security Engineer | ปกป้อง Industrial Control Systems (SCADA, PLC, DCS, Historian) — Purdue Model, IEC 62443 | OT Protocols (Modbus, DNP3, OPC UA), Safety vs Security, No Active Scanning, Air-gap Myths |
| IoT/Embedded Security Engineer | Firmware Analysis, Hardware Hacking, Side-channel, Secure Boot, TPM, Secure Elements | Reverse Engineering, JTAG/UART/SPI, Fault Injection, Crypto Implementation |
| Malware Analyst / Reverse Engineer | Static/Dynamic Analysis, Unpacking, Deobfuscation, YARA, Signature/Behavioral Detection | Assembly (x86/ARM/MIPS), IDA Pro/Ghidra, Debuggers, Kernel Internals |
| Cryptography Engineer | Implement/Review Crypto Protocols, TLS, Post-Quantum (PQC), HSM, Key Management | Advanced Math (Number Theory, Elliptic Curves), Constant-time Code, FIPS 140-3 |
| Security Researcher (Vuln Research) | Zero-day Discovery, Fuzzing (AFL++, LibFuzzer), Exploit Dev, Patch Analysis, Bug Bounty | Root Cause Analysis, Exploit Mitigations (CFI, CET, PAC, MTE), Disclosure Process |
| Purple Teamer | Bridge Red + Blue: Simulate Attacks → Improve Detection/Prevention → Automate | Both Offense & Defense, Atomic Red Team, Detection Engineering, CI/CD for Detections |
| Detection Engineer | Build/Maintain Detection Rules (Sigma, KQL, SPL, ES|QL, YARA), ATT&CK Coverage, FP Reduction | Data Engineering, Rule Lifecycle, Testing (Unit/Integration), MITRE ATT&CK Mapping |
| Security Automation / SOAR Engineer | Automate Response, Enrichment, Case Mgmt, Playbook Dev (Python, Go, Terraform, Ansible) | API Integration, Workflow Orchestration, Idempotency, Testing, Observability |
| Bug Bounty Hunter (Freelance) | Find Vulns in Scope → Report → Get Paid (HackerOne, Bugcrowd, Intigriti, YesWeHack) | Web/API/Mobile/Cloud/Chain, Recon, Automation, Report Writing, Persistence |
| Cyber Threat Intelligence (CTI) Analyst | Collect/Analyze/Disseminate Threat Intel (Strategic, Operational, Tactical) | STIX/TAXII, MISP, Diamond Model, ATT&CK, APT Tracking, Geopolitical Context |
| Product Security Engineer | Secure Product Lifecycle (Design → Deploy → Decommission), SBOM, VEX, SLSA | SDLC Integration, Threat Modeling, Supply Chain, Coordinated Vuln Disclosure |
| Security Data Scientist / ML Engineer | ML for Security: UEBA, Anomaly Detection, Phishing Classification, Malware Family Classification | Python, PyTorch/TensorFlow, MLOps, Feature Engineering, Explainability, Adversarial ML |
Leadership / Executive Roles
| Role | Scope | Key Competencies |
|---|---|---|
| CISO (Chief Information Security Officer) | Enterprise Security Strategy, Risk, Budget, Board Reporting, Culture, Regulation | Business Alignment, Risk Management, Communication, Crisis Leadership, Regulatory |
| VP/Director of Security Engineering | Build/Run Security Platform (Detection, Response, Identity, Cloud, AppSec) | Technical Depth, Team Building, Vendor Mgmt, Architecture, Delivery |
| Security Program Manager / TPM | Drive Security Initiatives (Zero Trust, Cloud Migration, Compliance, Tool Consolidation) | Program Mgmt, Stakeholder Mgmt, Technical Fluency, Metrics/KPIs |
3 Roles ปกติใน Information Security Organization (Classic Model)
- CISO / Security Officer: Strategy, Governance, Risk, Compliance, Budget, Board
- Security Manager / Director: Operations (SOC, Vuln Mgmt, IR, Awareness), Team Leadership
- Security Engineer / Analyst (Individual Contributors): Hands-on Implementation, Detection, Response, Architecture
Modern Model เพิ่ม: Privacy Officer (DPO), Product Security Lead, Trust & Safety Lead, AI Safety/Red Team Lead
Skills Matrix: Technical vs Soft Skills
- Technical: Networking (TCP/IP, BGP, VXLAN), OS (Linux/Windows Internals), Cloud (AWS/Azure/GCP), Scripting (Python, Go, Bash), Security Tools, Cryptography
- Soft: Communication (Exec/Board), Risk Translation, Project Management, Mentoring, Cross-functional Collaboration, Ethics
สรุป
Network Security/Cybersecurity มี Roles หลากหลายมากกว่า 20+ ตำแหน่ง จาก Hands-on (Engineer, Analyst, Hunter, Researcher) ไปจนถึง Strategic (Architect, CISO, GRC) และ Specialized (OT, IoT, Crypto, ML, Product Sec) การเลือก Path ขึ้นอยู่กับ: Interest (Break vs Build vs Govern), Aptitude (Deep Technical vs Broad), Career Goal (IC vs Management), Market Demand — ทุก Role ต้องการ Continuous Learning เพราะ Threat Landscape เปลี่ยนแปลงเร็ว
