Top Skill Set cho Network Security Professional – Không chỉ kỹ thuật
Không có một "kỹ năng số 1" duy nhất, nhưng nếu phải chọn cốt lõi nhất: Tư duy đối kháng (Adversarial Mindset) + Kiến thức hệ thống sâu (System Thinking).
1. Hard Skills – Kỹ thuật cốt lõi (Baseline)
| Domain | Kỹ năng / Công cụ bắt buộc | Level up |
|---|---|---|
| Network Protocols | TCP/IP, DNS, DHCP, ARP, BGP, OSPF, VLAN, VXLAN, IPv6, TLS/SSL, QUIC | Packet analysis (Wireshark/Zeek), Protocol fuzzing |
| Firewall/UTM | Palo Alto, FortiGate, Check Point, Cisco FTD – Policy, NAT, App-ID, User-ID, SSL Decrypt | Multi-vendor, Automation (Ansible/Terraform), Cloud NGFW |
| IDS/IPS/NSM | Suricata, Zeek, Snort, Corelight, Cisco Secure Network Analytics – Rule tuning, False positive reduction | Threat Hunting, MITRE ATT&CK mapping, Custom detection |
| VPN/ZTNA | IPsec, SSL VPN, WireGuard, Zscaler ZPA, Cloudflare Access, Tailscale, NetBird | Zero Trust Architecture, Device Trust, Continuous Auth |
| Cloud Security | AWS/Azure/GCP: IAM, VPC, SG, NACL, GuardDuty, Security Hub, Defender for Cloud, SCC | CSPM, CWPP, CIEM, DSPM, KSPM (K8s) |
| SIEM/Log | Splunk (SPL), Elastic (KQL/DSL), Sentinel (KQL), QRadar (AQL) – Parsing, Correlation, Dashboard | SOAR (Cortex XSOAR, Splunk SOAR, Tines), Detection as Code |
| Endpoint/EDR/XDR | CrowdStrike, SentinelOne, MDE, Cortex XDR – ASR, Tamper Protection, Live Response | Kernel internals, Rootkit detection, Memory forensics (Volatility) |
| Scripting/Automation | Python (requests, netmiko, nornir, scapy, pandas), Go, Bash, PowerShell, API/REST/GraphQL | Infrastructure as Code (Terraform, Ansible, Pulumi), GitOps |
| Vuln Mgmt | Tenable, Qualys, Rapid7, Greenbone, MS Defender Vuln Mgmt – Risk-based prioritization (EPSS, KEV) | Pen Testing (OSCP), Red Teaming, Bug Bounty |
| Crypto/PKI | TLS 1.2/1.3, mTLS, Certificate Lifecycle (ACME, cert-manager), HSM, KMS, Post-Quantum (Kyber, Dilithium) | Cryptanalysis basics, Side-channel awareness |
2. Soft Skills – Kỹ năng mềm quyết định thành bại
- Critical Thinking & Problem Solving: Phân tích root cause, không chỉ treat symptom.
- Communication (Technical → Non-technical): Viết báo cáo rủi ro cho Board, trình bày incident cho CEO.
- Continuous Learning (Growth Mindset): Thay đổi công cụ/tech 6-12 tháng/lần – phải tự học liên tục.
- Collaboration: Làm việc với NetOps, DevOps, AppSec, Legal, HR, Vendor.
- Ethics & Integrity: Xử lý dữ liệu nhạy cảm, responsible disclosure, tuân thủ pháp luật.
- Stress Management: On-call, incident response, burnout prevention.
3. Certifications – Bằng chứng kỹ năng (2024)
- Entry: CompTIA Security+, (ISC)² CC, Cisco CCST.
- Network Security Specialist: CCNP/CCIE Security, Palo Alto PCNSE, Fortinet NSE 4/5/7, Juniper JNCIP-SEC.
- Blue Team / SOC: SANS GCIH, GCFA, GNFA, GCED, Blue Team Level 1 (BTL1).
- Architecture/Management: CISSP, CISM, SABSA, TOGAF.
- Cloud: AWS Security Specialty, AZ-500, GCP Cloud Security Engineer.
- Offensive (để hiểu attacker): OSCP, OSEP, CRTO, eWPTX.
4. Lộ trình phát triển (Career Path)
SOC L1 Analyst → SOC L2/Senior → Threat Hunter / Detection Engineer
↓ ↓
Network Security Engineer → Senior → Lead / Architect → CISO / VP Security
↓ ↓
Cloud Security Engineer → Architect → Principal
↓ ↓
AppSec / DevSecOps Engineer → Architect
5. Lời khuyên: Xây "T-shaped" skill
- Deep (Chân vị): Chọn 1 domain (NetSec, CloudSec, AppSec, DFIR, Threat Intel) để đi sâu chuyên gia.
- Broad (Thanh ngang): Hiểu đủ các domain khác để nói chung ngôn ngữ, thiết kế end-to-end.
- Lab hàng tuần: Home lab (Proxmox + pfSense/OPNsense + AD + Linux + SIEM + Vuln VMs).
- CTF / Bug Bounty / Open Source: Thực chiến, xây portfolio, networking.