Nhóm vai trò Kỹ thuật (Technical / Hands-on)
| Vị trí | Mô tả công việc | Kỹ năng cốt lõi | Chứng chỉ điển hình |
|---|---|---|---|
| Security Analyst (SOC L1/L2/L3) | Giám sát SIEM, triage alert, investigation, basic response | Splunk/Elastic/KQL, MITRE ATT&CK, Log analysis, Ticketing | Security+, CySA+, GCIH, GCFA |
| Threat Hunter | Proactive tìm kiếm mối đe dọa ẩn (hypothesis-driven, TTP-based) | Threat Intel, YARA, Sigma, KQL/Splunk, Python, MITRE ATT&CK expert | GCTI, GMON, OSCP, OSEP |
| Incident Responder / DFIR | Chống chọi sự cố, forensic (disk, memory, network), malware analysis | Volatility, FTK/EnCase, Autopsy, Malware RE (IDA/Ghidra), IR playbook | GCFA, GNFA, GREM, OSCP |
| Penetration Tester / Red Teamer | Mô phỏng tấn công (External, Internal, Web App, API, Cloud, Wireless, Social) | Burp Suite, Cobalt Strike, BloodHound, CrackMapExec, Custom tooling, C2 dev | OSCP, OSWE, OSEP, CRTO, PNPT |
| Security Engineer (Network/Cloud/AppSec) | Triển khai, vận hành, tự động hóa control: FW, WAF, EDR, SIEM, CASB, CSPM, SAST/DAST | Terraform/Ansible, Python/Go, CI/CD, K8s, Cloud (AWS/Azure/GCP), Zero Trust | CISSP, CCSP, AWS Security Specialty, AZ-500 |
| Security Architect | Thiết kế kiến trúc bảo mật enterprise, reference architecture, threat modeling, vendor eval | SABSA/TOGAF, Zero Trust, SASE, Crypto, PKI, Risk modeling (FAIR), Communication | CISSP-ISSAP, CCSP, SABSA, TOGAF |
| DevSecOps / AppSec Engineer | Nhúng security vào SDLC: SAST/DAST/SCA/Container/IaC scanning, Secure code review, SDL | GitLab/GitHub Actions/Jenkins, SonarQube, Checkmarx, Snyk, Trivy, Semgrep, OWASP SAMM | CSSLP, GSSP-.NET/Java, DevSecOps cert |
| IAM / PAM Engineer | Identity lifecycle, SSO (SAML/OIDC), MFA, PAM (CyberArk, BeyondTrust), ZTNA, Entra ID/Okta | AD/Azure AD, SCIM, JIT access, Cert-based auth, FIDO2, Access certification | CISSP, Okta/Azure AD certs, CyberArk |
Nhóm vai trò Quản trị & Chiến lược (Governance / Management)
- CISO / VP Security / Security Director: Chiến lược, ngân sách, báo cáo Board, tuân thủ pháp lý, crisis management.
- GRC Analyst / Manager: Risk assessment, policy management, audit coordination, compliance mapping (NIST, ISO, PCI, GDPR, PDPA).
- Security Awareness / Training Manager: Phishing simulation, secure coding training, security champions program.
- Product Security / PSIRT: Vulnerability coordination, disclosure, patch release, SBOM, supply chain security.
- Security Sales Engineer / Solutions Architect (Vendor side): PoC, demo, RFP response, technical advisory cho khách hàng.
Mức lương tham khảo (Việt Nam / Mỹ - 2024)
| Vị trí | Việt Nam (USD/tháng net) | Mỹ (USD/năm gross) |
|---|---|---|
| SOC Analyst L1 | $800 - $1,500 | $70k - $95k |
| SOC Analyst L2/L3 | $1,500 - $3,000 | $95k - $140k |
| Threat Hunter | $2,000 - $4,000 | $120k - $180k |
| Incident Responder | $2,000 - $4,500 | $110k - $170k |
| Penetration Tester | $1,800 - $4,000 | $100k - $160k |
| Security Engineer | $1,800 - $3,500 | $110k - $165k |
| Security Architect | $3,000 - $6,000+ | $150k - $230k+ |
| CISO (Enterprise) | $5,000 - $15,000+ | $200k - $400k+ |
Xu hướng tuyển dụng 2024-2025
- Cloud Security (AWS/Azure/GCP), Container/K8s Security, IaC Security – hottest skills.
- Automation / Security Engineering (Python, Go, Terraform, Ansible, SOAR) – giảm/manual ops.
- Zero Trust / ZTNA / SASE implementation – thay thế VPN.
- Threat Intelligence & Hunting – proactive defense.
- OT/ICS/IoT Security – Industry 4.0, Critical Infra.
- AI/ML Security (Adversarial ML, Model governance, LLM security) – emerging.
- Soft skills + Business acumen – communication, risk translation, stakeholder management.
Lộ trình phát triển (Career Path)
Junior Analyst (SOC L1)
→ SOC L2/L3 / Junior Engineer
→ Senior Engineer / Threat Hunter / Pen Tester / IR Specialist
→ Lead / Principal Engineer / Architect
→ Engineering Manager / Director / CISO
Hoặc: Specialist track → Principal/Staff Engineer (IC track)