Cyber security roles: job descriptions and responsibilities

What are the main types of cyber security roles?

Most security jobs belong to one of five families. A large organisation has a separate team for each. In a small company one or two people cover several, and some of the work goes to outside firms.

• Security operations and incident response: SOC analysts, incident responders, threat intelligence analysts and digital forensics investigators, who detect attacks and deal with them
• Security engineering and architecture: security engineers, cloud security engineers, application security engineers and security architects, who design and build the defences
• Offensive security: penetration testers and red teamers, who attack systems with permission to find weaknesses before criminals do
• Governance, risk and compliance (GRC): GRC analysts and leads, risk managers and security auditors, who set the rules, manage risk and prove compliance
• Leadership: the CISO, deputy CISO, head of security and virtual CISO (vCISO), who set the strategy and answer for security to the board

SOC analyst

A SOC analyst monitors the organisation for signs of attack. Analysts work in a security operations centre (SOC), either in-house or at a managed security provider, and are often the first to spot an incident. Larger SOCs split analysts into tiers: junior analysts sort the alerts and senior analysts investigate. ENISA lists SOC analyst as another title for its Cyber Incident Responder profile.

• Watch alerts from security tools such as a SIEM (security information and event management) system and EDR (endpoint detection and response)
• Separate real threats from false alarms and escalate the real ones
• Investigate suspicious activity on laptops, servers, networks and cloud accounts
• Tune detection rules so the team sees fewer false alarms
• Record what happened and hand confirmed incidents to the responders

Incident responder

An incident responder takes over once an attack is confirmed. The job is to contain it, remove the attacker and get systems running again while keeping the evidence. The role often includes on-call duty, since attacks happen at any hour.

• Contain the incident, for example by isolating infected machines or disabling stolen accounts
• Find the root cause and how far the attacker got
• Remove the attacker's access and restore systems from clean backups
• Preserve evidence for investigators, insurers and regulators
• Write the incident report and help meet reporting deadlines, such as the EU NIS2 early warning within 24 hours of becoming aware of a significant incident, or the US SEC rule that listed companies disclose a material incident within four business days of deciding it is material
• Maintain the incident response plan and run exercises to test it

Threat intelligence analyst

A threat intelligence analyst studies the attackers: who is likely to target the organisation, how they operate and what the defenders should look for. ENISA calls the role Cyber Threat Intelligence Specialist and describes it as turning data into actionable intelligence reports for the people who need them.

• Collect information from threat feeds, industry sharing groups, government advisories and open sources
• Track threat actors and their tactics, techniques and procedures (TTPs)
• Give the SOC indicators and attack patterns to hunt for
• Brief engineers, executives and the board on the threats that matter to the business

Digital forensics investigator

A digital forensics investigator recovers and analyses evidence from computers, phones, cloud services and networks after an incident or a crime. The findings may end up in court or in an insurance claim, so investigators follow strict rules on how evidence is collected and stored. Some work in-house, and many work for specialist firms or law enforcement.

• Make forensic copies of disks, memory and logs without changing the originals
• Keep a chain of custody that records who handled each piece of evidence
• Reconstruct what an attacker or insider did, and when
• Write reports that lawyers, insurers and courts can rely on

Security engineer

A security engineer builds and runs the tools and controls that protect the organisation. ENISA calls this profile the Cybersecurity Implementer and gives Cybersecurity Engineer and DevSecOps Engineer as other titles for it. Security engineer is one of the broadest titles in the field, so the job advert should say which area the role focuses on.

• Deploy and maintain security tools such as firewalls, EDR, email security and identity and access management
• Harden systems with secure configurations
• Run vulnerability scans and make sure fixes are applied
• Automate security checks and responses
• Work with IT and development teams to fix security problems

Cloud security engineer

A cloud security engineer secures cloud platforms such as AWS, Microsoft Azure and Google Cloud. Cloud providers secure the infrastructure they run, and the customer secures what it builds and configures on top. Cloud providers call this split the shared responsibility model, and the cloud security engineer looks after the customer side.

• Design secure cloud accounts, networks and access policies
• Find and fix misconfigurations, such as storage left open to the internet
• Build security checks into infrastructure as code and deployment pipelines
• Monitor cloud logs and respond to cloud alerts

Application security engineer

An application security (AppSec) engineer helps developers build software that is secure from the start. The role is common in software companies and in banks, retailers and other businesses that write their own code.

• Review designs and run threat modelling before code is written
• Add code scanning, dependency checks and security tests to the build pipeline
• Triage findings from scans, penetration tests and bug bounty reports
• Train developers in secure coding

Security architect

A security architect designs how security fits across the organisation's systems, so that separate tools and teams work as one. ENISA's Cybersecurity Architect profile plans and designs security-by-design solutions for infrastructure, systems, software and services. The architect decides how the defences should be designed, and the engineers build and run them.

• Set security architecture principles and reference designs
• Review new systems and projects before they are built
• Choose security technology and decide how it fits together
• Plan large changes, such as a move to a zero trust model

Penetration tester and red teamer

A penetration tester, also called an ethical hacker, attacks systems with the owner's permission to find weaknesses before criminals do. A red team goes further: it behaves like a real attacker for weeks at a time and tests whether the SOC notices and responds.

CREST, a global industry body, accredits penetration testing companies and certifies individual testers. Some regulators require testing too: under the EU's DORA, financial entities that their supervisor identifies must run threat-led penetration testing at least every three years.

• Agree the scope and rules of engagement with the client
• Test web applications, networks, cloud environments or staff, for example with phishing
• Exploit the weaknesses found to show their real impact
• Write a report that ranks the findings by risk and explains how to fix them
• Retest once the fixes are in place

GRC analyst and GRC lead

Governance, risk and compliance (GRC) specialists make sure security is run in a planned, documented way that meets laws and standards. A GRC analyst does the day-to-day work and a GRC lead runs the programme. ENISA lists GRC consultant as another title for its Cyber Legal, Policy & Compliance Officer profile.

• Write and maintain security policies and standards
• Map controls to frameworks and laws such as ISO 27001, SOC 2, NIST CSF, NIS2, DORA and PCI DSS
• Prepare for audits and collect the evidence auditors ask for
• Answer customers' security questionnaires
• Assess suppliers and other third parties
• Track risks and the actions agreed to reduce them

Cyber security risk manager

A risk manager identifies, analyses and reduces the security risks to the organisation's systems and services, in line with its strategy and risk appetite. In smaller teams the GRC lead or the CISO does this job.

• Run risk assessments and keep the risk register up to date
• Agree risk appetite with leadership
• Recommend whether to fix, transfer, avoid or accept each risk
• Report risk in business terms to executives and risk committees

Security auditor

A security auditor checks independently whether security controls work and whether they meet laws, regulations and standards. Auditors work in internal audit teams or for outside firms, such as an ISO 27001 certification body or the CPA firm that issues a SOC 2 report.

• Plan each audit and agree its scope
• Test controls by reviewing evidence, interviewing staff and sampling records
• Report findings and check that they are fixed

CISO, head of security and vCISO

The leadership roles own the whole security programme and answer for it to the CEO and the board. Titles vary: ENISA lists Head of Information Security, Information Security Manager and Information Security Officer as other titles for its CISO profile. Larger teams add a deputy CISO, and smaller companies often hire a virtual or fractional CISO (vCISO) part time. Our CISO and vCISO guides cover these roles in depth.

• Set the security strategy and budget
• Own cyber risk and report it to the board
• Build and lead the security team
• Lead compliance with laws such as NIS2 and DORA
• Lead the response to major incidents

Official frameworks for cyber security roles

Three public frameworks, from the EU, the US and the UK, describe cyber security roles in detail. Employers use them to write job descriptions, and training providers use them to design courses.

• ENISA's European Cybersecurity Skills Framework (ECSF) describes 12 role profiles, from CISO to penetration tester, with the tasks, skills and knowledge each one needs. ENISA is revising the framework and plans a public consultation for the end of 2026.
• The NICE Framework, run by NIST in the US, sorts cyber security work into five categories of work roles. Version 2.2.0 is current. NICE notes that its work roles are not the same thing as job titles.
• The UK Cyber Security Council defines 15 specialisms, such as Security Testing, Incident Response and Cyber Security Governance & Risk Management. It awards four professional titles: Associate, Practitioner, Principal and Chartered Cyber Security Professional.

How to get into cyber security

There is no single route in. Common first jobs are SOC analyst, junior penetration tester and GRC analyst. Many people move across from IT support, networking, software development, audit or law.

From there, people specialise or move up. An analyst may become an incident responder or threat hunter, an engineer may become an architect, and people from any family can move into leadership as head of security or CISO.

How to write a cyber security job description

A good job description tells candidates what the job really involves. Include these points:

• A title people search for, plus the main focus. "Security engineer" covers very different jobs, so say whether the role is about cloud, identity, detection or application security.
• The five to eight things the person will own in the first year, rather than every tool you run
• The frameworks and laws that apply, such as ISO 27001, SOC 2, NIS2 or DORA
• Who the role reports to and how big the team is
• Must-have skills kept apart from nice-to-have ones. List a certification as a requirement only when a law, a regulator or a client contract asks for it.
• The working pattern: on-site, hybrid or remote, and any on-call duty
• The salary range

How CISO Talents helps

CISO Talents is a verified network for hiring CISOs, vCISOs and security experts. At launch, each expert's profile shows one main role from the families in this guide, from SOC and incident response to penetration testing, GRC, architecture and CISO, along with their skills, frameworks and certifications. Companies can post a permanent job, which always shows its salary range, or a scoped request through a guided brief for a vCISO, a penetration test, or ISO 27001, SOC 2, NIS2 or DORA readiness. A Verified Leader badge means our team reviewed the person's CISO, vCISO, deputy CISO, head of security or GRC lead role.