Phân loại vai trò An ninh mạng (NICE Framework / NIST 800-181)
1. Defensive (Blue Team) – Phòng thủ & Vận hành
| Vai trò | Trách nhiệm chính | Kỹ năng then chốt | Chứng chỉ |
|---|---|---|---|
| SOC Analyst (Tier 1/2/3) | Monitor SIEM, triage alert, initial investigation, ticket escalation | Splunk/ELK/KQL, MITRE ATT&CK, Log analysis, Basic malware analysis | Security+, CySA+, GCFA, GCIH |
| Threat Hunter | Proactive hunt: hypothesis-driven, TTP mapping, anomaly detection | Advanced query, UEBA, Threat Intel, Python, YARA, Sigma | GCFA, GCTI, OSCP (offensive insight) |
| Incident Responder | Containment, eradication, recovery, forensics, root cause, report | DFIR (Volatility, FTK, Autopsy), Malware RE, Chain of custody | GCFE, GCFA, GNFA, OSCP |
| Security Engineer (Detection/Response) | Build detection rule, SOAR playbook, SIEM tuning, Detection-as-Code | Sigma, YARA, Python, CI/CD, Cloud log, MITRE ATT&CK | CySA+, GCFA, Cloud Cert |
| Vulnerability Management | Scan, prioritize (CVSS/EPSS), remediation tracking, patch coordination | Tenable/Qualys/Rapid7, Risk-based VM, Asset inventory | CySA+, PenTest+ |
2. Offensive (Red/Purple Team) – Tấn công & Kiểm thử
| Vai trò | Trách nhiệm chính | Kỹ năng then chốt | Chứng chỉ |
|---|---|---|---|
| Penetration Tester / Ethical Hacker | External/Internal/Web/App/Mobile/Cloud/API pentest, Report & Remediation | Recon, Exploit dev, PrivEsc, Pivoting, C2, Report writing | OSCP, OSWE, OSEP, PNPT, CRTO |
| Red Team Operator | Full kill-chain simulation, Evasion, Persistence, Lateral movement, OpSec | C2 framework (Cobalt Strike, Sliver), Malware dev (C#, Go, Rust), AV/EDR bypass | OSEP, OSWE, CRTO, Experience heavy |
| Adversary Emulation / Purple Team | Emulate specific APT (APT29, FIN7), Validate detection, Improve defense | MITRE ATT&CK, Caldera, Atomic Red Team, Detection engineering | GCFA, GCTI, Custom training |
3. Architecture & Engineering – Kiến trúc & Xây dựng
| Vai trò | Trách nhiệm chính | Kỹ năng then chốt | Chứng chỉ |
|---|---|---|---|
| Security Architect | Enterprise security architecture, Zero Trust, Reference architecture, Tech evaluation | SABSA, TOGAF, Zero Trust (NIST 800-207), Cloud, Network, App, Data, Identity | CISSP, CCSP, SABSA, Cloud Arch Cert |
| Network Security Engineer | Firewall, VPN, NAC, Segmentation, DDoS, ZTNA, Cloud Network Sec | Palo Alto/Forti/Cisco/Checkpoint, BGP/OSPF, Ansible/Terraform, Cloud Net | PCNSE, NSE7, CCNP/CCIE Sec, Cloud Net |
| Cloud Security Engineer | CSPM, CWPP, CIEM, Serverless/Container/K8s sec, IaC scanning, Identity | AWS/Azure/GCP native sec, Terraform, K8s (PSP/OPA/Gatekeeper), DevSecOps | AWS Security Specialty, AZ-500, GCP Cloud Security, CKS |
| Application Security Engineer | SAST/DAST/SCA/IAST pipeline, Secure code review, Threat modeling, DevSecOps | OWASP Top 10, CodeQL, Semgrep, GitLab/GitHub Actions, Languages (Java, Go, JS, Python) | OSWE, (ISC)² CSSLP, GSSP |
| Identity & Access Engineer (IAM) | IdP (Entra ID, Okta, Ping), SSO, MFA, PAM, IG, SCIM, Zero Trust Identity | SAML/OIDC/OAuth2, Kerberos, LDAP, PAM (CyberArk, BeyondTrust), Lifecycle | Okta Cert, Ping Cert, Microsoft Identity, CISSP |
4. Governance, Risk, Compliance (GRC) & Leadership
| Vai trò | Trách nhiệm chính | Kỹ năng then chốt | Chứng chỉ |
|---|---|---|---|
| GRC Analyst / Manager | Policy, Risk Assessment, Audit, Compliance (ISO, PCI, SOC2, GDPR, PDPA), Vendor Risk | Frameworks (NIST CSF, ISO 27001), Risk quant (FAIR), Audit, Policy writing | CISA, CRISC, CISSP, ISO 27001 LA |
| CISO / Security Director | Strategy, Budget, Board reporting, Culture, Legal/Regulatory, Team building | Leadership, Business alignment, Risk appetite, Crisis comms, M&A security | CISSP, CISM, MBA, Experience |
5. Chuyên ngành mới nổi (Emerging)
- AI/ML Security Engineer: Adversarial ML, Model poisoning, Data poisoning, LLM security (Prompt injection, RAG poisoning).
- OT/ICS Security Engineer: Purdue Model, IEC 62443, SCADA/ICS protocols (Modbus, DNP3, OPC UA), IT/OT convergence.
- Product Security / AppSec (Embedded/IoT/Automotive): Secure boot, Firmware analysis, Fuzzing, ISO 21434, UN R155.
- Bug Bounty Hunter (Freelance): Platform: HackerOne, Bugcrowd, Intigriti. Top hunter $100k-$1M+/năm.
Lương tham chiếu (Việt Nam 2024 - USD/tháng Gross)
| Vai trò | Junior | Mid | Senior | Lead/Architect |
|---|---|---|---|---|
| SOC Analyst | $800-1,500 | $1,500-2,800 | $2,800-4,500 | $4,500-6,500 |
| Penetration Tester | $1,000-1,800 | $2,000-3,500 | $3,500-6,000 | $6,000-9,000 |
| Security Engineer | $1,200-2,000 | $2,200-4,000 | $4,000-6,500 | $6,500-10,000 |
| Cloud Sec Engineer | $1,500-2,500 | $2,800-4,500 | $4,500-7,500 | $7,500-12,000 |
| Security Architect | - | $3,500-5,500 | $5,500-9,000 | $9,000-15,000+ |
Lộ trình phát triển (Career Roadmap)
Entry (0-2 năm) ├── Helpdesk / NOC / SysAdmin / Dev → Security+ / Network+ / (ISC)² CC ├── Junior SOC Analyst (Tier 1) → CySA+ / Splunk Core ├── Junior Pen Tester (Bug Bounty, CTF) → OSCP / PNPT └── Junior Sec Engineer (FW/Cloud/Config) → Vendor Cert (PCNSA/AWS Sec) Mid (3-5 năm) ├── SOC Tier 2/3 / Threat Hunter → GCFA / GCTI / Cloud Cert ├── Pen Tester / Red Teamer → OSWE / OSEP / CRTO ├── Security Engineer (Net/Cloud/App/IAM) → Architect Cert (CCSP/SABSA) └── GRC Analyst → CISA / CRISC / ISO 27001 LA Senior (5-8 năm) ├── Lead/Principal Engineer (Technical Track) ├── Security Architect (Enterprise/Cloud/App) ├── Engineering Manager / SOC Manager / GRC Lead └── Staff Researcher / Distinguished Engineer Executive (8+ năm) ├── Director / VP Security └── CISO (Chief Information Security Officer)
Kỹ năng cốt lõi chung (Core Skills cho mọi vai trò)
- Scripting/Automation: Python (bắt buộc), Go, Bash, PowerShell.
- Cloud: AWS/Azure/GCP – ít nhất 1 cloud sâu.
- Container/K8s: Docker, Kubernetes, Helm, OPA/Gatekeeper, Falco.
- CI/CD & DevSecOps: GitLab/GitHub Actions, SAST/DAST/SCA integration, Policy-as-Code.
- MITRE ATT&CK: Nói chung ngôn ngữ chung của ngành.
- Communication: Viết báo cáo, present cho non-tech, influence stakeholders.
Kết luận
An ninh mạng KHÔNG CHỈ LÀ HACK. Hệ sinh thái việc làm rộng, đa dạng từ kỹ thuật sâu (Red/Blue/Engineer/Architect) đến quản trị (GRC/Leadership). Chọn hướng phù hợp sở trường, build portfolio (GitHub, Blog, CTF, Cert), network cộng đồng (OWASP, Null, BSides, VNSEC). Cập nhật liên tục – ngành thay đổi mỗi 6-12 tháng.