Behind the scenes: A day in the life of a cybersecurity curriculum director

2 years ago 332

The Kennedy Space Center kick-started Andee Harston's vocation successful cybersecurity. Here's however she worked her mode up to overseeing the cybersecurity program for Infosec.

Andrea Harston (who goes by Andee) grew up successful Florida, not acold from the Kennedy Space Center. "The municipality that I was successful — that was truly what the system was built disconnected of, was the abstraction program," she said. "It was a communal occurrence to locomotion extracurricular and spot the abstraction shuttle oregon instrumentality a tract travel to the Kennedy Space Center and spot each of the chill exertion that was there." This kick-started her ain involvement successful technology, and her archetypal extremity was to gain a bachelor's grade and get a occupation astatine the Center.

Harston's archetypal occupation was moving connected an AS/400 astatine the Center, editing motorboat documentation, and moving connected a assortment of contracts there. She did everything from method penning to grooming and improvement to grooming management. She did bundle investigating and helped make and papers their motorboat cognition software. "That was my instauration to the satellite of accusation technology," she said.

Now, Harston is the cybersecurity program manager for Infosec. But her vocation successful IT and information has taken twists implicit the past 2 decades. After the Space Center, she worked for 11 years astatine Computer Sciences Corporation, wherever she wrote motorboat documentation. There, 1 of her roles was the grooming development. She followed this with a mates of years successful the backstage sector, successful a method penning rol, earlier returning to Kennedy Space Center arsenic a method writer. Later, she took a occupation astatine AECOM, wherever she was archetypal introduced to cybersecurity. "I really started penning information documentation for them — things similar catastrophe betterment plans, incidental effect plans, continuity of operations — successful the capableness of the method writer," she explained.

The cybersecurity squad determination had much than a twelve accusation systems, and it was "the happening, popping spot to be." She rapidly earned her archetypal certification, a CISA A, a national auditor certification, and started grooming to go an assessor. She besides worked arsenic an assessor, ISSO (information strategy information officer), for aggregate contracts, and concisely arsenic information power prof for NDTI (New Directions Technology Inc.), besides astatine Kennedy Space Center.

SEE: How to physique a palmy vocation successful cybersecurity (free PDF) (TechRepublic)

"I fundamentally acted successful the capableness of an interior assessor and an outer assessor for the bulk of my cybersecurity vocation for the Space Center," she said.

On apical of the CISA, Harston has racked up certifications successful adept hazard absorption framework, and CERM, the certified autarkic assessor certification. Although these certifications are important, "the world of the occupation a batch of times does not align with the framework," she said, "and you whitethorn person radical who are operating successful antithetic capacities than what is really written connected insubstantial oregon whether it's a testable objective."

Much of her learning took spot connected the job, since "there's truthful galore antithetic experiences and unsocial anomalies that tin occur," she said. "There's conscionable truthful galore things that you prime up auditing a control, due to the fact that however you audit the aforesaid power for a antithetic strategy whitethorn beryllium a wholly antithetic experience." She describes existent satellite acquisition much similar "shades of gray" –– wherever determination tin beryllium "a batch of subjectivity successful assessment.

Harston's bachelor's grade is successful concern administration, not cybersecurity. But she recommends a foundational certification, similar Security+, for anyone funny successful the field. "It volition assistance you exponentially. It tin unfastened a batch of doors for you," she said. The quality of the tract means that certifications ever request to get refreshed. "It's not conscionable a one-and-done degree. It's similar a continuing learning process to support your cognition up to date."

On a emblematic day, Harston gets up astir 6:00 a.m. and logs onto her computer. The bulk of her enactment is to reappraisal contented by vetted taxable substance experts, who person been subcontracted by Infosec to make contented for antithetic learning tasks. Most of the contented comes successful videos and slides. Harston reviews it for method accuracy, arsenic good arsenic contented for the website's resources page. This could beryllium thing from "a definite certification, a method walkthrough of circumstantial ransomware, oregon a blistery topic, similar the quality origin successful cybersecurity oregon something," she explained.

"I'll reappraisal that from a method position conscionable to marque sure, 'Hey, does this idiosyncratic cognize what they're talking about? Is the accusation close and close and being presented successful a mode that the students tin devour easy and effectively?'" She is simply a de facto fact-checker, making definite the worldly covers each the indispensable details and is accurate, and cites due sources (i.e.,, not Wikipedia). If it doesn't, she sends it backmost for revision. Harston besides makes definite that the worldly covers the learning objectives required by the manufacture — which are much circumstantial erstwhile it comes to certifications.

Harston's squad has 2 different employees nether her, who enactment connected hands-on skills and the IQ product, oregon the information consciousness training, and she says it's a collaborative process.

"They'll say, 'Hey, we person a script present for 1 of our caller take your ain escapade modules and we privation to cognize if utilizing a fastener surface connected a machine successful this script is unafraid capable for the learning nonsubjective we're trying to teach.' So they'll tally that by maine oregon I'll springiness input there," she explained. She spends astir fractional of her clip successful meetings, and the different fractional reviewing content.

SEE: Top 3 reasons cybersecurity pros are changing jobs (TechRepublic)

She besides listens to clients for feedback astir what they would similar to spot much of. Clients who be conferences and tin study backmost astir products tin adhd value. Sometimes she volition collaborate with the merchandise team. "I'll say, 'Hey, we person this petition from a lawsuit that they privation this definite functionality integrated into the system.' So determination is simply a batch of squad collaboration arsenic well, successful summation to getting that feedback from the client."

On apical of loving the probe facet of her work, different item of Harston's occupation is the accidental for changeless learning from radical astatine the apical of their field.

"When I near the DOD, I specifically sought retired this benignant of presumption with this peculiar institution — to me, it was the matrimony betwixt that cybersecurity knowledge, which I love, and that acquisition component, which I truly similar a batch arsenic well," she said. For those funny successful pursuing her path, Harston recommends uncovering a mentor. If determination isn't idiosyncratic readily available, she suggests joining a nonrecreational organization, specified arsenic Limited Cybersecurity, a nonprofit offering resources and networking opportunities, oregon National Institute of Standards and Technology, which offers nationalist moving groups.

"The bully happening astir the authorities model is they're each online, each the accusation you ever would privation oregon request to cognize is there," Harston said. "It mightiness beryllium overwhelming looking astatine the bulk of it, but there's a batch of large radical that you tin scope retired to that would beryllium blessed to springiness you resources you request to instrumentality the adjacent measurement successful your career."

Cybersecurity Insider Newsletter

Strengthen your organization's IT information defenses by keeping abreast of the latest cybersecurity news, solutions, and champion practices. Delivered Tuesdays and Thursdays