Kỹ năng cốt lõi cho Network Security Engineer
1. Kỹ năng kỹ thuật cứng (Hard Skills)
| Lĩnh vực | Kỹ năng cụ thể | Công nghệ/Vendor điển hình |
|---|---|---|
| Firewall/UTM/NGFW | Cấu hình rule, NAT, VPN, App-ID, User-ID, SSL Decryption, HA, Logging | Palo Alto (PCNSE), Fortinet (NSE 4/7), Check Point (CCSA/CCSE), Cisco Firepower/ASA, Sophos XG |
| Mạng & Routing/Switching | VLAN, Trunking, STP, OSPF, BGP, EIGRP, BFD, VRRP/HSRP, QoS, MPLS, SD-WAN | Cisco (CCNA/CCNP/CCIE), Juniper (JNCIA/JNCIP), Arista, Aruba |
| VPN & Remote Access | IPsec (Site-to-Site, Remote Access), SSL VPN, WireGuard, ZTNA, Clientless | Palo Alto GlobalProtect, FortiClient, Cisco AnyConnect, Pulse/Ivanti, OpenVPN, Tailscale |
| IDS/IPS/NDR | Signature tuning, Anomaly detection, Packet capture analysis, Rule writing | Snort/Suricata, Zeek, Cisco FirePOWER, Palo Alto, Darktrace, ExtraHop, Vectra |
| Cloud Network Security | VPC/VNet, Security Groups, NACL, Transit Gateway, Firewall Manager, Cloud NGFW | AWS (Network Firewall, TGW), Azure (Firewall, NSG, vWAN), GCP (Cloud Armor, NGFW) |
| Zero Trust / Segmentation | Micro-segmentation, Identity-based policy, SASE/SSE, Software-Defined Perimeter | Illumio, Guardicore (Akamai), Zscaler, Cloudflare One, Netskope, Palo Alto Prisma SASE |
| Scripting/Automation | Python (Netmiko, NAPALM, Scapy, Pan-os-python), Ansible, Terraform, REST API, Go | Infrastructure as Code, Config backup, Bulk changes, Compliance audit, SOAR integration |
| SIEM/Log Analysis | Query language, Rule creation, Dashboard, Alert tuning, Threat hunting | Splunk (SPL), Elastic (KQL/Lucene), Microsoft Sentinel (KQL), IBM QRadar (AQL), Chronicle |
| Vulnerability Management | Scanning, Prioritization (CVSS/EPSS), Patching coordination, Remediation tracking | Tenable, Qualys, Rapid7, OpenVAS, Microsoft Defender Vulnerability Management |
| Cryptography/PKI | TLS 1.3, mTLS, Certificate lifecycle, ACME, HSM, IPsec, SSH, WireGuard crypto | OpenSSL, cfssl, Smallstep, Venafi, HashiCorp Vault, AWS ACM, Azure Key Vault |
2. Kỹ năng mềm (Soft Skills)
- Troubleshooting hệ thống: Phân tích log, packet capture (Wireshark/tcpdump), flow analysis.
- Giao tiếp: Báo cáo rủi ro cho management, hướng dẫn user, phối hợp cross-team (NetOps, SecOps, DevOps, Cloud).
- Tư duy rủi ro: Threat modeling (STRIDE, PASTA), risk assessment, cost-benefit security control.
- Học liên tục: CVE mới, vendor advisory, framework (MITRE ATT&CK, NIST CSF, Zero Trust Architecture).
- Quản trị thời gian & ưu tiên: Xử lý alert fatigue, balance BAU vs project.
3. Chứng chỉ (Certifications) – Lộ trình gợi ý
- Cơ bản: CompTIA Security+, Cisco CCNA.
- Chuyên mạng: CCNP Enterprise / CCNP Security, JNCIP-ENT/SEC.
- Chuyên firewall: Palo Alto PCNSE, Fortinet NSE 4/7, Check Point CCSE.
- Nâng cao: CISSP, CCSP (Cloud), GCSA/GSEC (SANS), OSCP (Offensive).
- Architect: SABSA, TOGAF, vendor-specific Architect certs.
4. Trách nhiệm công việc điển hình
- Thiết kế, triển khai, vận hành firewall, VPN, IDS/IPS, segmentation.
- Quản trị rule change management (tickets, approval, validation, rollback).
- Giám sát bảo mật 24/7 (SOC tier 2/3), điều tra sự cố, threat hunting.
- Đánh giá lỗ hổng, phối hợp vá lỗi, hardening hạ tầng.
- Kiến trúc Zero Trust, SASE, Cloud security posture.
- Tuân thủ: PCI-DSS, HIPAA, GDPR, NIST 800-53, CMMC.
- Tài liệu hóa: Network topology, Data flow diagram, Runbook, Policy/Standard.
5. Xu hướng mới (2024+)
- AI/ML cho SecOps: UEBA, Automated response, LLM-assisted threat intel.
- eBPF/XDP: Kernel-level visibility, high-performance filtering.
- Confidential Computing: TEEs, attestation cho workload nhạy cảm.
- Post-Quantum Cryptography (PQC): Chuẩn bị chuyển đổi thuật toán (Kyber, Dilithium).
- SBOM/Software Supply Chain Security: SLSA, Sigstore, in-toto.
Lời khuyên: Chuyên sâu 1-2 vendor (Palo Alto + Fortinet, hoặc Cisco + Cloud) + automation (Python/Ansible/Terraform) + cloud security = profile rất hot thị trường.