Vai trò bảo vệ hạ tầng mạng, hệ thống, dữ liệu khỏi tấn công. Bao gồm: Thiết kế, triển khai, vận hành, giám sát, ứng phó sự cố, cải tiến liên tục.
| Lĩnh vực | Kỹ năng / Công cụ điển hình |
|---|
| Mạng & Hạ tầng | TCP/IP, BGP/OSPF, VLAN, VPN (IPsec/WireGuard), Firewall (Palo Alto, FortiGate, Cisco ASA/Firepower), Load Balancer, Proxy, SD-WAN, DNS/DHCP, IPv6, Network Automation (Ansible, Python, Netmiko, Nornir) |
| Hệ điều hành | Linux (RHEL/Ubuntu/Debian) - CLI, Systemd, Journalctl, Auditd, Hardening (CIS Benchmarks), Kernel modules. Windows Server (AD, GPO, PowerShell, Event Logs, Sysmon, Defender for Identity) |
| Cloud Security | AWS (IAM, VPC, Security Hub, GuardDuty, Inspector, WAF, Shield), Azure (Microsoft Defender for Cloud, Sentinel), GCP (SCC, Chronicle). IaC Security (Terraform, CloudFormation scanning). Kubernetes Security (RBAC, Network Policy, Admission Control, Falco). |
| Endpoint & Detection | EDR/XDR (CrowdStrike, SentinelOne, Defender for Endpoint, Cortex XDR). SIEM (Splunk, Sentinel, Elastic, Chronicle). SOAR (Cortex XSOAR, Splunk SOAR, Tines). Threat Hunting (MITRE ATT&CK, Sigma, YARA, KQL/SPL). |
| Vulnerability Management | Scanner (Tenable, Qualys, Rapid7, Nuclei, Trivy). Risk-based prioritization (EPSS, CISA KEV, CVSS). Patch Management (WSUS, SCCM/Intune, Ansible, Automox). Penetration Testing (Burp, Nmap, Metasploit, Cobalt Strike - Red Team). |
| Identity & Access (IAM) | Zero Trust, SSO (SAML/OIDC), MFA (FIDO2/WebAuthn, TOTP), PAM (CyberArk, BeyondTrust, HashiCorp Boundary), JIT Access, SCIM, Identity Governance (SailPoint, Okta). |
| Application Security | SDLC/DevSecOps. SAST (SonarQube, Checkmarx, Semgrep), DAST, SCA (Dependabot, Snyk, Syft), Container Scan (Trivy, Grype), API Security, Threat Modeling (STRIDE, PASTA). |
| Cryptography & PKI | TLS 1.3, mTLS, Certificate Management (Vault, cert-manager, Let's Encrypt, AD CS). Key Management (HSM, KMS). Signing/Verification. |
| Scripting & Automation | **Python (bắt buộc)**, Go, Bash, PowerShell. API/REST, GraphQL. Infrastructure as Code (Terraform, Ansible). Git/GitLab CI/GitHub Actions. |
3. Kỹ năng mềm (Soft Skills) - Yếu tố quyết định thăng tiến
- Giao tiếp kỹ thuật cho phi kỹ thuật (Executive Summary, Risk Business Language).
- Viết báo cáo, tài liệu, runbook, playbook rõ ràng, có cấu trúc.
- Tư duy rủi ro (Risk-based thinking) - không phải "fix all vulns" mà "fix what matters".
- Làm việc chéo (Cross-functional): Dev, Ops, Legal, Privacy, Business, Vendor.
- Quản trị thời gian, ưu tiên (Prioritization) dưới áp lực (Incident Response).
- Học tập tự chủ, cập nhật liên tục (Threat Intel, CVE, Blog, Conference).
4. Chứng chỉ (Certifications) - Lộ trình gợi ý
| Cấp độ | Chứng chỉ | Trọng tâm | Giá trị |
|---|
| Entry | CompTIA Security+ (SY0-701) | Foundation knowledge | Bắt buộc hầu hết JD entry. DoD 8570 baseline. |
| Entry | (ISC)² Certified in Cybersecurity (CC) | Foundation, free exam | Miễn phí, entry path to CISSP. |
| Network Sec | Cisco CCNA (200-301) + CCNP Security (SCOR + concentration) | Network Security Infrastructure | Mạnh về Network Security Engineer. |
| Blue Team | Splunk Core/Power User, GIAC GCIH, GCFA, GNFA, SOC-200 (OffSec) | IR, Forensics, Network Monitoring | Technical depth, hands-on. |
| Red Team | eJPT → PNPT/OSCP → OSEP/OSEE/OSWE | Penetration Testing, Exploit Dev | OSCP = Gold standard hands-on. |
| Cloud | AWS Security Specialty, AZ-500, CCSP (cần 5yr exp) | Cloud Provider Security | Yêu cầu cao thị trường Cloud. |
| Management | CISM, CISA, CISSP (cần 5yr exp), ISO 27001 LA | Governance, Risk, Compliance, Audit | Cần cho Lead/Manager/CISO track. |
| Architecture | SABSA, TOGAF, (ISC)² CISSP-ISSAP, Cloud Architect Certs | Security Architecture | Senior/Architect role. |
5. Thực tế công việc (Day-to-Day)
- SOC Analyst: Triage alert (SIEM/EDR), Enrichment (VT, AbuseIPDB, TI), Triage playbook, Escalation, Ticketing, Threat Hunting (dedicated time), Purple Team exercise.
- Security Engineer: Deploy/Config FW, EDR, SIEM, VPN, NAC, PAM. Automation (Ansible, Terraform, Python). Hardening (CIS Benchmark). Vuln Scan/Patch coordination. Proof of Concept (PoC) tool mới.
- Cloud Security Engineer: CSPM/CNAPP config, IAM policy review, Terraform security scan, Incident response cloud, Serverless/Container security, Compliance automation (AWS Config, Azure Policy).
- AppSec Engineer: Code review, SAST/DAST/SCA pipeline, Threat modeling, Developer training, Bug bounty triage, Supply chain security (SBOM, SLSA).
- GRC Analyst: Risk assessment, Policy review, Audit support (SOC2, ISO, PCI), Vendor assessment, Compliance monitoring, Awareness training.
6. Mức lương tham chiếu (Việt Nam / US - 2024)
| Vai trò | Việt Nam (USD/năm) | US (USD/năm) |
|---|
| SOC Analyst L1 | 12,000 - 20,000 | 70,000 - 95,000 |
| Security Engineer | 20,000 - 40,000 | 100,000 - 150,000 |
| Penetration Tester | 18,000 - 35,000 | 90,000 - 140,000 |
| Cloud Security Engineer | 25,000 - 45,000 | 120,000 - 170,000 |
| Security Architect | 35,000 - 60,000+ | 150,000 - 220,000+ |
| CISO / VP Security | 60,000 - 150,000+ | 200,000 - 500,000+ |
7. Thách thức & Cân bằng cuộc sống
- Stress cao: Incident response (ngày đêm, cuối tuần), on-call rotation, pressure từ management/board.
- Burnout: Thiếu nhân sự, alert fatigue, continuous learning burden.
- Giải pháp: Automation (SOAR), Staffing đủ, Management support, Mental health resources, Clear escalation path, Compensatory time off.
Kết luận: Network Security Specialist cần **T-shaped skills**: Sâu một mảng (Network/Cloud/AppSec/IR/GRC) + Rộng nền tảng (Network, OS, Scripting, Cloud, Identity, Crypto). **Hands-on lab + Certs + Portfolio + Community** là chìa khóa vào nghề và thăng tiến. Chọn môi trường công ty có **security maturity cao, invest vào tool/training, culture blameless** để phát triển bền vững.
