"Working in cybersecurity" does not describe one job, but a set of jobs with very different day-to-day realities. Between an analyst monitoring alerts at night in an operations centre, a penetration tester looking for flaws in an application on behalf of a client and a security manager negotiating a budget with senior management, there is little in common apart from the goal of protecting information systems. Before building a resume or choosing a programme, you need to know which family of jobs appeals to you. This article describes the three main families, their entry points for a junior, the employers who hire and what the resume should show for each.
The three families of jobs
ANSSI 🔗, the French national agency responsible for information systems security, has published an overview of the jobs in the field. They can be grouped into three families.
- Detection and incident response: monitoring systems, spotting attacks, containing them and restoring service. This is the domain of SOCs (security operations centres) and CERTs or CSIRTs (incident response teams).
- Offensive security: attacking systems, with permission, to reveal their weaknesses before attackers do. This is the domain of penetration testing and red teams.
- Governance, risk and compliance: organising security, analysing risks, setting rules, checking they are applied and meeting regulatory requirements. This is the domain of CISOs, GRC consultants and auditors.
Alongside these three families there are engineering jobs: security architects, network security engineers, application or cloud security specialists, who design and deploy protections. Many developers and administrators move into them naturally.
Detection and response: SOC and CERT
Day to day
The SOC analyst, presented by Onisep in its job profile 🔗, spends their days in detection tools: a SIEM that centralises logs, an EDR that monitors workstations and servers, sometimes network probes. They sort alerts, eliminate false positives, investigate suspicious signals and escalate confirmed incidents.
SOCs often work in tiers. Tier 1 qualifies alerts, tier 2 investigates in depth, tier 3 handles complex incidents, hunts threats and improves detection rules. Many SOCs provide round-the-clock monitoring, with shifted hours or on-call duty.
Incident response teams step in when an attack is confirmed: analysing compromised machines, containment, eradication, return to normal, lessons learned. At national level, CERT-FR 🔗 plays this role for the administration and publishes security alerts and advisories that professionals follow closely.
Who it suits
This job suits curious, methodical profiles who are comfortable working under pressure. It requires good foundations in systems (Windows, Linux), networking and log analysis.
Offensive security: pentesting and red teams
Day to day
A penetration tester carries out intrusion tests on behalf of clients: a web application, a mobile application, an internal network, a cloud environment. An engagement lasts from a few days to a few weeks. It starts with precise scoping of the perimeter and the rules, continues with the tests themselves and ends with a report describing each vulnerability, its level of risk and how to fix it.
Writing takes up a large part of the job. A pentester who is technically excellent but unable to explain their findings to a development team or to management delivers only part of the expected value.
Red teams go further: they simulate a realistic, prolonged attack, with objectives (accessing a piece of data, taking control of a domain) and trying to evade detection. They test the technical defences as much as the detection team’s ability to react.
Who it suits
This job suits technology enthusiasts who like understanding how things work in order to subvert them, and who practise regularly: training platforms, CTF-style competitions, vulnerability watch. Hands-on certifications play an important role, as detailed in our article on cybersecurity certifications by role.
Governance, risk and compliance
Day to day
The chief information security officer (CISO) defines an organisation’s security policy, steers risk analysis, sets priorities and reports to senior management. Around them work compliance officers, risk managers and consultants who support organisations in their efforts: implementing an information security management system under the ISO 27001 standard, preparing for an audit, raising team awareness.
Regulation weighs more and more heavily. The European NIS 2 directive extends security obligations to a large number of entities, and ANSSI has opened a dedicated space 🔗 to support them. Compliance jobs also intersect with personal data protection: the data protection officer, whose role the CNIL specifies 🔗, often works with the CISO. On the legal side, the resume of a GDPR lawyer or DPO 🔗 shows how this neighbouring profile presents its compliance work.
Who it suits
These jobs suit profiles who like organising, persuading and bridging technology and senior management. They are rarely first jobs: people often reach them after a few years in technical roles, audit or consulting.
Entry points for a junior
Each family has its entry points.
- Detection: the tier 1 SOC analyst role is the most common entry point, accessible after a degree in computing or cybersecurity, sometimes after a career change from systems administration or support.
- Offensive: junior pentester roles exist, especially at specialised providers, but require already solid practice. Many get there after an internship at a security audit firm or after a first experience in a SOC or in development.
- Governance: junior GRC consultant roles, at consulting firms or IT services companies, welcome graduates in cybersecurity, information systems management or audit.
- Engineering: a developer or systems administrator can move into application security, cloud security or security engineering within their team.
The main employers are specialised cybersecurity providers, large IT services companies with dedicated branches, consulting firms, large companies with their own SOC or security team, security solution vendors and public administrations. The public platform Cybermalveillance.gouv.fr 🔗 also gives an overview of the threats affecting individuals and small organisations, which is useful for understanding the terrain.
For the job search strategy itself, our article on the first job in tech offers a method that also applies to cybersecurity: target employers who train, multiply points of contact, prepare proof.
What the resume should show
The resume should first state clearly which family of jobs you are targeting. A resume that hesitates between SOC, pentesting and governance reads like one from a candidate who has not yet chosen.
Depending on the family:
- Detection: your foundations in systems and networking, the detection tools you know, a personal lab (log collection, detection rules), an entry-level certification.
- Offensive: your results on training platforms or in CTFs, published write-ups, hands-on certifications, possibly vulnerabilities reported responsibly.
- Governance: your knowledge of frameworks (ISO 27001, risk analysis methods), regulations, audit or compliance assignments, your ability to write and present.
- Engineering: your technical achievements where security was at stake (access management, hardening, segmentation, secrets, pipeline security).
The DevOps or SRE engineer resume template shows an operations profile whose experience (clusters, access, monitoring) is a good basis for moving towards security engineering.
In a sector where acronyms and certifications act as filters, the document’s readability matters. The TechCV editor presents your skills and certifications as plain text, in standard sections, which recruitment software can extract. You can build your resume around the family of jobs you are targeting.
Frequently asked questions
Do you need a specialised cybersecurity degree?
It is not always mandatory, but it is an asset, especially for a first job. ANSSI labels programmes under the name SecNumedu, a useful reference point. Profiles from general computing, networking or development also enter the field, often with a certification and personal practice.
Is night work unavoidable in a SOC?
No, but it is common in SOCs that provide round-the-clock monitoring. Some work office hours with on-call duty, others in rotating teams. Ask during the first interview.
Can you move from SOC to pentesting?
Yes, it is a common progression. Detection experience is even an asset for a pentester, who better understands what defenders see. It requires regular offensive practice alongside, and often a hands-on certification.
Does cybersecurity hire non-technical profiles?
Yes, especially in governance, compliance, awareness and project management. Technical literacy remains essential to talk with teams and understand risks, but not every role requires you to be able to carry out an attack or analyse a system log.