How can Information Security professionals increase their visibility in the workplace?

Security professionals can increase their visibility in the marketplace by not agreeing to provide content to a content farm for free. Pay people to provide content, LinkedIn!

When talking about security, which often involves technical details, clear communication acts like a translator, making the tech stuff simple for everyone. This is crucial because if everyone understands why security matters, they're more likely to follow the rules and keep things safe. It's also important for higher-ups to grasp the significance of security. This support is essential for funding and backing security efforts. Clear communication is crucial during a security crisis. If something goes wrong, you need to quickly update everyone on what's happening and what's being done. Lastly, good communication builds trust. It shows that you're not just a tech expert but someone who cares about the company's safety.

La principal tarea es vencer la barrera comunicacional y comunicarse asertivamente, ya que regularmente el equipo de ciberseguridad, quienes hacen el mejor esfuerzo en comunicar el nivel de amenazas en que se encuentra la organización, pero la realidad es que a pesar que se pueda estar hablando el mismo idioma, las especificaciones técnicas del especialista no es claramente explicada o entendida por el personal no técnico. En este sentido, lo que se recomienda es tratar de hacer más simple la comunicación, pero siempre haciendo conocer la criticidad de la amenaza que se puede enfrentar la organización y las consecuencias de su materialización.

According to me, - 1. Be a business enabler 2. Substantiate your actions with reason. 3. Be empathy. 4. Be a good listener. 5. Be pragmatic in your approach and dealings. 6. Talk in language that is easily understandable. 7. Be a problem solver. 8. Give positive and constructive feedback. 9. Respect time (own & others). 10. Learn, Unlearn, Relearn & Restart. 11. Be a mentor with open mind. 12. Encourage to ask questions. 13. Work in line with the business vision, mission & goal. 14. Don't adapt - Fault Finding Exercise. 15. Finally - Be approachable. Overall, Information security & its professionals are not bad it is just that "they" and "their" activities are not perceived and understood in the right manner/spirit. Thank you!!!

Never underestimate the power of storytelling. As a Cybersecurity professional, most of us have been dealing with Cybersecurity for so long we've taken for granted the complexities and understanding that come second nature to us. By moving away from the technical jargon that we use on a daily basis and telling stories as to WHY we do some of the things we do will build understanding and drive a sense of teamwork. Consider the difference between “patch CVE-2024-12345, an XSS vuln because it is a Critical…” vs. “…a Cross Site Scripting vulnerability can be used by attackers to trick your own customers into taking actions based on a message they are reading on your own website, a source they know & trust.” Those are very different experiences.

Drama. Cybersecurity is the epicenter of Drama. Navigating that Drama is paramount to being a successful IT profession. To do this you must: 1. Network - Knowing everything is impossible. Knowing who to ask is closer to possible. 2. Grow - Find avenue's and methods to learn DAILY. I enjoy random podcasts, networking events, youtube and regular training. 3. Agility. Just like in sports, it's the difference between winninng and losing. Be bold in a strategy, but also know it's survivability is based solely on your ability to shift. "No battle plan survives first contact"...and neither should your cybersecurity plan. 4. Pace. In a race where you never stop running remember to re-prioritize regularly. Survive is the only option.

Act as an advocate for information security within the organization. Provide education and awareness sessions to help other departments understand the importance of security measures. When teams understand the "why" behind security practices, collaboration becomes more effective. Work closely with IT, legal, and compliance teams to contribute to incident response planning. Collaborate on developing procedures, communication plans, and recovery strategies. This ensures a coordinated response in the event of a security incident.

Relationships build culture and security is nothing without culture. Too many people look at security as a technology solution whereas security is driven by culture, informed by risk and delivered through people, process and technology. Get to know all the business units where you’re working, what they do and how they do it as well as what’s important to them. It’s only through building authentic and meaningful relationships that you can build a security program that your stakeholders will engage with. If you don’t get the culture bit right - nothing else in your program will succeed!

Colaborar estrechamente con distintos departamentos es clave para resaltar la visibilidad de la ciberseguridad. Integrarse con TI, operaciones y legal refuerza medidas, destacando su importancia en todo el negocio. Al alinearse con objetivos compartidos, se establece una cultura organizacional que valora la ciberseguridad. Facilita la identificación temprana de riesgos y la implementación de soluciones, demostrando el valor proactivo. Compartir conocimientos fomenta la comprensión mutua entre departamentos, contribuyendo a decisiones informadas y una respuesta más efectiva ante posibles incidentes. Esta colaboración mejora la madurez en ciberseguridad y eleva la percepción del equipo en toda la empresa.

Aprenda sempre, novas tecnologias s?o disponibilizadas diariamente, cabe a você estudar e acompanhar o que de melhor você pode aplicar em seu cotidiano. Claro que ter uma boa funda??o ajuda a entender novos conceitos, n?o se esque?a disso, mas ficar parado n?o te ajudará independente da sua base.

Developing technical information security skills is best achieved through applied hands-on experience and by teaching others. Creating a Capture the Flag (CTF) challenge is an unparalleled method to accomplish both goals. It allows you to design real-world scenarios that teach participants the intricacies of security technologies, from application to exploitation. The process of building and guiding others through the technical challenges you develop not only deepens your own technical skill but also invigorates and shares your passion for the field.

Ask yourself; what is the greatest need for the company in future; what is the general direction that the company is going? From there; look up all the technology that could help the company in its future direction and get schooled in those skills. Make it a point to communicate to your team leader and management first on this to get their views and buy in. See if they are willing to sponsor you; if they are not, then look for yourself what skills you will need in future and go learn them.

Information security is a broad field. Identify specific areas of interest or specialization that align with your career goals. This focused approach allows you to tailor your learning journey and acquire skills that are directly applicable to your role. Develop a structured learning plan that outlines the skills you want to acquire, the resources you'll use, and a timeline for achieving your goals. This plan can include a mix of formal education, online courses, self-paced learning, and practical application.

Inteligência emocional, resiliência, oratória e psicologia s?o pontos importantes a serem desenvolvidos. Além de habilidades de negocia??o com seus pares e executivos. Essas habilidades ajudar?o a convencer e angariar os recursos necessários para um bom desempenho do departamento de Seguran?a da Informa??o.

Don’t underestimate the power of story telling. I am lucky to have a diverse and very interesting background and my path to becoming a senior security executive makes it easier for me to tell stories that are memorable for my stakeholders. My stories are always designed to be personal and from my own experience but I ensure that they lead to a lesson on what we need to achieve and how we need to get there. People remember stories, they don’t remember conversations about threat actors, attack surfaces, CVV scores, number of vulnerabilities and other techy stuff. They want to know how secure we are, what happens if we’re not secure and where the risks are.

In the ever-changing world of cybersecurity, staying updated with the latest tech and security trends is key. Going for those extra certifications and attending workshops or courses not only beefs up your knowledge but also shows you're committed to your role, boosting your credibility at work. You don't have to shout about your skills from the rooftops; your expertise will naturally showcase your value. Also, networking with peers and other departments can raise awareness of the information security team's efforts and build relationships that facilitate collaborative security efforts.

Most professionals in any workplace are not security savvy/knowledgeable. Take the opportunity to “generalize” and share the knowledge you possess by translating it to messaging that is easy to understand by the general population. That is appreciated by the general public, and helps demystify security overall.

You need to be visible not only in the organization you are working for but also in the industry in general as much as possible. Try to be a substantial voice in your field, and to do that, you should start with smaller steps. LinkedIn itself is a good platform to start with. Start writing about topics, not just by researching them but by incorporating your experience as much as possible. Try to enlist as a contributor to a security website and share your knowledge with others. This way, you will get noticed not only in your organization but in the information security industry as well.

La participación activa en discusiones y la presentación de soluciones aportan perspectivas valiosas, ayudando a abordar desafíos de manera colaborativa. Además, compartir experiencias y buenas prácticas mejora la conciencia de la importancia de la ciberseguridad en todos los niveles de la empresa. La visibilidad también brinda la oportunidad de destacar logros, demostrando la eficacia del equipo de seguridad. En última instancia, al compartir conocimientos, se contribuye a la mejora continua, fortaleciendo la postura de seguridad global y posicionando a los profesionales como líderes en la protección de la información y los activos de la empresa.

Seeking recognition can make people uncomfortable but seeking feedback should be a routine exercise. Schedule regular check-ins with your supervisor to discuss your progress, challenges, and goals. Document your achievements and maintain a record of your contributions. Share success stories in appropriate forums, such as team meetings or in a company newsletter, highlighting how it aligns with team or organizational goals. Participate in new projects, especially those that are cross-departmental or have high visibility within the organization. If your company has a system for recognizing employee achievements, be sure to contribute. Nominate others for their good work, and you'll likely find that what goes around comes around.

Too many awards is a bad thing. It takes you away from real work. You then become a poster boy or poster girl without any real substance. Focus on the awards, certifications, etc that are beneficial to you, and the target audience. Have the substance to back up the award. Otherwise, you’ll just be purely focusing on getting the awards and not on the things that really matter.

Information Security professionals can boost visibility by actively seeking feedback and recognition. Regularly communicate achievements and contributions to leadership, highlighting the impact on organizational security. Engage in cross-functional collaboration, sharing insights on potential risks and solutions with other departments. Actively participate in relevant forums, conferences, and industry events to network and showcase expertise.

Feedbacks constantes ajudam no seu relacionamento com superiores, pares e subordinados. Dessa forma você consegue ajustar os caminhos de forma muito mais rápida e eficaz, além de problemas serem resolvidos muitas vezes em um estágio inicial.

Cybersecurity professionals should also think of doing some internal branding to change the perspective of the users. Most users have the notion that Security is a hindrance to their work. Steps should be taken to communicate the value generated by Cybersecurity to ensure business continuity and it is a business enabler. This could be done by creating a culture of security by embedding it in to the DNA of the organization.

Try to learn as much about the business or the function within the business that you are trying to reach. Build relationships and work on building trust. Assure the business that your goals are the same as theirs - to help make the business as successful as possible. Be a partner that wants to help solve problems. Be an educator to help people understand risks and risk management. Be a good listener so that you can hear different perspectives. Find common ground when opinions are divided. When leadership is lacking, become a leader.

Es ist wichtig, klare Kommunikationswege im Unternehmen zu schaffen und auf die IT-Sicherheitsabteilung aufmerksam zu machen. Hier hilft auch die Security-Awareness.

Be proactive, try to head problems off at the pass. Be pragmatic, don’t let perfection get in the way of achievable. This will get you big in

Si la comunicación debe ser por ejemplo a un plano ejecutivo, siempre es importante tener un programa de métricas que soporten nuestra "historia", para ello creo importante separar las métricas según 3 categorías: 1. Progreso del programa de seguridad, 2. Postura de seguridad, 3. Performance de la operación de seguridad. A su vez, las métricas deben dise?arse según los niveles o puntos de vista en: 1. Operativas, 2. Tácticas y 3. Estratégicas