Hai vai trò CỐT LÕI (Core Roles) của Security Team trong Network Security
Theo NIST CSF / NICE Framework / Thực tế doanh nghiệp, 2 vai trò không thể thiếu:
1. Security Operations & Monitoring (SOC / SecOps) – "Mắt & Tai"
Trách nhiệm: Giám sát 24/7, Phát hiện (Detection), Phân tích (Triage/Investigation), Phản ứng sơ bộ (Initial Response), Threat Hunting.
- Tier 1 Analyst (Monitor/Triage): Xem alert SIEM/EDR/NDR, enrich IOC, false positive tuning, tạo ticket, escalate.
- Tier 2 Analyst (Investigation): Deep dive: Timeline, Scope, Root Cause, MITRE ATT&CK mapping, Containment actions (block IP, isolate host, reset cred).
- Tier 3 / Threat Hunter (Proactive): Hypothesis-driven hunt, Behavioral analytics, Custom detection (Sigma/YARA), Threat Intel integration, Purple Teaming.
- SOC Manager/Lead: Shift management, SLA/KPI (MTTD, MTTR), Tool tuning, Process improvement, On-call rotation.
Công cụ: SIEM (Splunk, Elastic, Sentinel), EDR/XDR, NDR, TIP, SOAR, Ticketing (Jira/ServiceNow), Communication (Slack/Teams/War Room).
2. Security Engineering & Architecture (SecEng/Arch) – "Lá chắn & Kiến trúc sư"
Trách nhiệm: Thiết kế, Triển khai, Vận hành, Tự động hóa các control an ninh mạng & hạ tầng. "Build & Run" defensive capabilities.
- Network Security Engineer: Firewall (Policy, Upgrade, Migration), VPN/ZTNA, NAC, Segmentation (VLAN/Micro-seg), DDoS, DNS Sec, Load Balancer Sec.
- Cloud Security Engineer: CSPM, CWPP, CIEM, K8s Security, Serverless Sec, IaC Security (Terraform/Ansible + Policy-as-Code), Cloud Network (TGW, Firewall, NACL/SG).
- Detection Engineer: Detection-as-Code (Sigma, KQL, SPL, YARA), CI/CD for Detection Rules, MITRE ATT&CK Coverage Mapping, False Positive Reduction, Unit/Integration Test for Rules.
- Security Architect: Enterprise Security Architecture (SABSA, Zero Trust NIST 800-207), Reference Architecture, Tech Evaluation/POC, Standards/Policies, Risk Assessment, Board Reporting.
- Automation/Platform Engineer: SOAR Playbook Dev, Internal Security Tools/Platform, CI/CD Pipeline Security, Developer Experience (SecDevOps).
Công cụ: Firewall/Cloud FW, ZTNA/VPN, NAC, SIEM/NDR/EDR API, IaC (Terraform/Ansible), CI/CD (GitLab/GitHub Actions/Jenkins), Policy-as-Code (OPA/Rego, Sentinel), Scripting (Python/Go).
Tại sao CHỈ 2 vai trò này là cốt lõi? (So sánh với các vai trò khác)
| Vai trò | Phân loại | Lý do KHÔNG phải core network security team |
|---|---|---|
| GRC / Compliance / Audit | Governance | Chức năng hỗ trợ (Support function) – Policy, Audit, Risk. Không vận hành control kỹ thuật hàng ngày. |
| Red Team / Pen Tester | Offensive | Thường là team riêng (Red Team) hoặc external vendor. Mục tiêu: Test defense, không phải operate defense. |
| Application Security (AppSec) | Product Security | Focus SDLC, Code, Pipeline. Giao nhau với SecEng (WAF, API Gateway) nhưng domain khác. |
| Identity & Access Management (IAM) | Infra/Platform | Thường thuộc IT/Platform team. SecTeam consume IAM (SSO, MFA, PAM) chứ không build IdP. |
| Physical Security / Fraud / Privacy | Specialized | Domain riêng biệt. |
Mô hình tổ chức phổ biến (Modern Security Org)
CISO ├── VP/Director Security Operations │ ├── SOC (Tier 1/2/3, Hunt, Intel) ← CORE 1: SecOps │ └── Incident Response (DFIR, Crisis Mgmt) ├── VP/Director Security Engineering │ ├── Network/Cloud Security Engineering ← CORE 2: SecEng (Net/Cloud) │ ├── Detection Engineering (Rules, Pipeline) │ ├── Application Security (SAST/DAST/SCA) ← Often separate AppSec org │ ├── Identity & Access Engineering (PAM) ← Often Platform/IT │ └── Automation/Platform (SOAR, Tools) ├── VP/Director GRC / Risk / Compliance │ ├── Policy, Audit, Risk, Vendor Risk, Privacy └── VP/Director Product Security (AppSec, PSIRT) ← Often under CTO/CPO
Kỹ năng chung cho cả 2 vai trò cốt lõi
- MITRE ATT&CK Fluency: Ngôn ngữ chung.
- Cloud Native: AWS/Azure/GCP Security Services, K8s, Container, Serverless.
- Automation/Code: Python, Go, Terraform, Ansible, Git, CI/CD.
- Data Analysis: SQL, KQL, SPL, Elastic DSL, Pandas, Jupyter.
- Communication: Write runbook, incident report, executive summary, stakeholder management.
Kết luận
Security Team trong Network Security phải có 2 chân đi:
- SecOps (SOC): "Nhìn & Phản ứng" – Detect, Triage, Hunt, Initial Response.
- SecEng (Engineering/Architecture): "Xây & Vận hành" – Design, Deploy, Automate, Harden, Maintain Controls.