CYBER SECURITY CAREER GUIDE Start Your Career | Develop New Skills

UNCLASSIFIED

CYBER SECURITY CAREER GUIDE Start your career | Develop new skills

IN THIS GUIDE

} WHAT IS CYBER SECURITY? Learn how cyber security affects your everyday life and why more professionals are needed.

} TYPES OF CAREERS Learn about the different roles you can play.

} WHO IS HIRING? Find out where your career can take you.

} CAREER PATHWAYS See how the path you choose leads to different career options.

} WHERE TO GO TO SCHOOL Find out where you can get the education you need to start your career or develop new skills.

} WORKING AT CANADA’S NATIONAL CRYPTOLOGIC AGENCY Find out why a career at the Communications Security Establishment (CSE) may be right for you. WHAT IS CYBER SECURITY?

Many teams worked together to create this guide from the comfort of their homes. Amid a worldwide pandemic, we managed to keep working. To create. To move forward. To communicate.

But the COVID-19 pandemic did not bring out the best in everyone. There were unscrupulous people trying to take advantage of Canadian citizens. Our healthcare systems were targeted. Criminals were looking for Canadians’ names, SINs, addresses, birth dates, and banking and credit card information.

Criminals tried to trick Canadians into clicking on links that would take them to malicious websites. The links were sent via text messages, emails, and social media apps. Once on the website, malicious code would start downloading onto devices to steal personal information.

Stop for a minute to think about all the things you do on your Hi, my name is Christine Beauchamp, and I phone, tablet, or laptop. Do you do your banking online? Do am the Director of Client Engagement and you have a mobile wallet? Do you chat on social media or send Incident Detection at the Canadian Centre pictures to friends? Do you have your assignments stored for Cyber Security (within CSE). there?

When I graduated from the University Wouldn’t it be nice if you could go online and not worry about of Ottawa with a degree in Sociology criminals trying to steal your money or identity? to combine with my degree in Russian translation, I did not see myself working That is what cyber security is. It is the constant pursuit in cyber security. But, just as quickly as to secure our information systems, the data on them, technology advances, career options and and the services they provide. It is about protecting the educational pathways grow. systems that all Canadians rely on like healthcare, banking, telecommunications, energy, and transportation. It is about In the following pages, you will find protecting businesses big or small. information on the cyber security field and the many educational paths that can lead Cyber security is about securing our future. you to your dream job. I hope this guide helps you find the path that best suits your interests—one that makes you want to get out of bed in the morning.

Whichever stream you choose, you will be making a difference by helping strengthen Canada’s digital safety and security. Whether you write code, set up equipment, design infrastructures, or train the next generation, you are helping to secure our future.

Good luck! I can’t wait to see where your path takes you.

2 CYBER SECURITY PROFESSIONALS ARE… MARK IN DEMAND WOOFF The number of jobs for cyber security professionals in Canada is growing by every year!1 “When you work at CSE, every day is an 7% opportunity to make a difference in the world of cyber security.” the 3.5number Million:of vacant positions worldwide by 2021.2

AYESHA WELL PAID SIDDIQUI The annual average salary of a cyber security professional in “At CSE, you will find yourself surrounded 3 2020 is . by a group of brilliant, dedicated, and $97,000 considerate experts who work towards a common goal. Explore the phenomenal opportunities and build a career you’ll be DIVERSITY REQUIRED proud to call yours!”

Today’s cyber security professionals know that the best solutions come from diverse teams. Having people of different backgrounds and experiences working together on a problem creates the best, most effective solutions. ANGELA Diversity provides access to a greater MCALLISTER range of talent. It provides greater insight into clients’ needs. It helps open doors to new markets and helps make a company more profitable and resilient. “My work is meaningful and helps protect Canada. I love knowing that I’m making a Cyber security is for everyone! positive contribution to Canada’s future.”

3 CYBER SECURITY PROFESSIONALS PROTECT THE SYSTEMS WE RELY ON

In the last 20 years, advancements in technology have changed the way people communicate, bank, shop, and pass the time. And, despite its small market size, Canada was the third most targeted country to possible cyber attacks in 2018. The growing threat of cyber attacks has made governments and industries more aware of the need to protect and defend the information and systems Canadians rely on. As a result, cyber security is growing as a recognizable discipline that encompasses multiple specialities in science, mathematics, business, social sciences, and computing and engineering faculties.

Although only a subset of businesses participates directly by producing or selling cyber security solutions or by building or operating networks, every business uses technology to deliver its products and/or services securely and efficiently to consumers. Cyber security, as a result, has become more important to protect the computer systems of all businesses in all industries.

FINANCE AND BANKING GOVERNMENT The industry maintains valuable Cyber attacks on governments are information such as client identities, increasing daily because a successful bank account information, financial attack provides access to large amounts assets, and intellectual property. of private and sensitive information.

HEALTH COMMUNICATIONS Systems hold sensitive patient The industry transmits a large amount information and encompass medical of sensitive information such as online implant devices such as pacemakers retail transactions, email messages, that may be exploitable. web-browsing activity, social media platforms, and user’s private information. TRANSPORTATION An industry vulnerable to cyber attacks ENERGY AND UTILITIES to air and ground transportation An ideal target for cyber attacks on systems. As well, the industry holds industrial control systems to access sensitive and valuable information such data or to cause physical damage to as birth dates, and passport numbers. infrastructures.

SAFETY Emergency response teams, law enforcement, call-center communications-management software, CCTV systems, interactive voice response systems, and emergency alert systems are all vulnerable to attack.

4 WHO IS HIRING?

Everyone!

That may be an exaggeration, but it is not far from the truth. Businesses of all kinds have proprietary information they need to protect. They also have the personal information of their employees, clients, suppliers, and business partners to protect.

Every online retailer, bank, school, law firm, medical facility, utility, government has information and systems that need protection. Companies that engineer systems or new technologies, or companies that perform design work have intellectual property that needs to be protected.

Basically, if a business uses the internet or a network to perform its tasks, it needs cyber security professionals! Cyber security is fundamental to good business.

Private sector companies and government agencies both offer exciting career opportunities. Plus, the skills and experience acquired in either sector are attractive to both types of employers. So, mobility from one to another is always an option. The facts below highlight why cyber security professionals are in high demand.

Any device that is connected to the internet is vulnerable to cyber attacks. Worldwide, there will be ~38.6 billion devices internet-connected devices by 2025.4 Cyber attacks happen every 39 seconds.5

WHAT DO CYBER SECURITY PROFESSIONALS DO?

The great part about cyber security is that it Cyber security professionals work in diverse fields and encompasses many different fields. Yes, there are the perform important roles, such as: extremely technical roles. But there are also many } Defending our nation different fields that contribute to a business’s security posture (how good their cyber defences are). } Securing our telecommunications infrastructure } Safeguarding our money As today’s companies do more of their business online, } Protecting our electrical distribution systems the need for cyber security professionals continues to grow. } Protecting our identities } Ensuring our medical information remains private Job roles can be separated into four basic categories. } Stopping ransomware attacks Let your interests guide you when choosing a career path. } And many more

5 1. GOVERN AND SUPPORT NO EXPERIENCE? NO PROBLEM. Manage and provide direction and support to ensure an organization So, you’ve decided to make the jump and enroll in a conducts effective cyber security cyber security program. Now what, you ask? “Will I be work. Roles include cyber legal able to find a job in the field after school if I have no advisor, policy analyst, privacy work experience in cyber security?” officer, and risk analyst. The odds are in your favour. Consider this: graduates of cyber security programs tend to be quickly recruited by public and private sector organizations. 2. PROTECT AND DEFEND In fact, the shortage of cyber security professionals Detect, prevent, respond to, and is so pronounced that organizations are retraining recover from cyber incidents and employees in basic cyber security skills on the job! As threats. Roles include cyber threat a skilled graduate of a cyber security program, you are assessor, data scientist/modeler, big sure to be an attractive candidate for many employers. data analyst, cyber security analyst, information security analyst, To increase your odds, do the following: vulnerability assessment analyst, and penetration tester. NETWORK Get a LinkedIn account and start connecting with 3. DESIGN AND DEVELOP people in the industry. Businesses post jobs there and Develop, secure, test, and integrate recruiters use it as a tool to find candidates. hardware, software, and systems throughout a product’s life cycle. Roles include security architect, UNDERSTAND THE BASICS OF IT security engineer, application Understanding the fundamentals of IT, such as developer, and secure software administering & configuring systems, networks, developer. database management and coding will go a long way towards getting your first job. 4. OPERATE AND MAINTAIN Administer, maintain, and support FOCUS YOUR INTERESTS to ensure effective and efficient It is impossible to be an expert in all categories. Focus performance and cyber security. on an area (e.g. networking security) and understand Roles include network security it well. Think ahead 5-10 years to your dream job, then operator, cryptanalyst, and technical look for an entry-level position that will give you the support specialist. right skills.

GAIN PRACTICAL EXPERIENCE Gain as much hands-on experience as possible. A co- op position or internship will help you get a sense of IT procedures and real-world business operations. Even if you’re not in a program that offers these types of positions, you can accomplish a lot with self-directed learning. Many universities or certification authorities offer free online resources.

6 CYBER SECURITY PROFESSIONALS COME FROM ALL PROGRAMS

Organizations of all kinds face a formidable task when it comes to protecting their networks and the important information those networks store, process, or transmit. Surprisingly, the responsibility of protecting those networks does not rest solely on the shoulders of the highly technical staff who design, operate, and maintain the networks.

EVERY EMPLOYEE HAS A ROLE TO PLAY! Employees need to behave in a safe and cyber-secure manner. To do so, they must be trained. Therefore, learning and teaching professionals are required to develop and deliver courses. But, what does “safe and secure manner” really mean? Perhaps a policy analyst or a communication expert can help define the needs of the organization.

Organizations must also ensure they are compliant with the growing list of laws and standards. This points to a need for lawyers and policy makers who understand the implications of cyber security on day-to-day operations. To hire the people with the appropriate skills, human resources professionals must know what certifications and experience to look for.

Similarly, effectively enforcing cyber security policies requires coordination between groups within an organization. This requires the ability to work with diverse groups to define technical measures that have the right balance between security and usability.

To remain cyber secure, businesses need staff that have knowledge beyond that of just computers. There is a need for cyber security professionals who specialize in business, law, criminal justice, risk management, statistics, human resources, social and political science, and many other disciplines. Even knowing a foreign language can help get a job in cyber intelligence.

BOTTOM LINE You don’t need to be highly technical or understand the inner workings of a computer to work in cyber security. However, you do need to understand the basics of the cyber security eco-system. Many universities and colleges offer introductory cyber security courses; take one as an elective to see if working in this field interests you. If so, try taking more advanced courses or getting an entry-level security certification. Your institute may even offer courses to prepare you for certification exams.

7 PATHWAYS TO SUCCESS

GET A GET A COLLEGE DIPLOMA OR GET A BACHELOR’S CERTIFICATION GRADUATE CERTIFICATE OR GRADUATE DEGREE

Entry-Level Positions Entry-Level Positions Entry-Level Positions } IT Support Specialist } Network Support Specialist } IT Security Specialist } Computer Network Support } } Specialist Network Security Operator Security Tester } } } Junior Cyber Security Analyst System Administrator Incident Responder } Security Administrator } Cyber Security Operations } Cyber Security Operations Analyst Analyst } Vulnerability Analyst

A certification is a good way to kick start your career.

To advance into more senior positions, most With Work Experience employers require a With Work Experience bachelor’s degree or } Penetration Tester } Cyber Security Researcher extensive experience. } Vulnerability Analyst } Cyber Security Engineer } Cyber Security Specialist } Cyber Security Architect } IT Support Specialist } Digital Forensic Analyst } Technical Support Specialist } Information Systems } Cyber Security Supervisor Security Manager } Cyber Security Manager

8 CERTIFICATIONS EMPLOYERS VALUE

Certifications are a great way to kick start your career as they are focused on ensuring you have the skills required to do the job. Make sure to figure out which one will be best for your chosen career path. Below is a list of the certifications valued by Canadian employers. Certifications can be earned through self-study or in class. Some certification classes and exams are offered through multiple vendors and some college programs will prepare you to write a certification exam.*

Cyber Security Fundamentals Cyber Security Nexus Practitioner

GIAC Security Essentials Offensive Security Certified Professional

CompTIA Security+ GIAC Information Security Professional

CompTIA Advanced Security Practitioner GIAC Security Leadership Certification

Certified Information Systems Security Professional GIAC Information Security Fundamentals

Certified Information Security Manager GIAC Certified Perimeter Protection Analyst

Certified in Risk and Information Systems Control GIAC Certified Intrusion Analyst

Systems Security Certified Practitioner GIAC Certified Incident Handler

Certified Chief Information Security Officer GIAC Certified UNIX Security Administrator

CyberSec First Responder GIAC Certified Windows Security Administrator

Certified Secure Computer User GIAC Certified Enterprise Defender

Certified Secure Software Lifecycle Professional GIAC Certified Web Application Penetration Tester

Certified Wireless Security Professional GIAC Assessing Wireless Networks

CertNexus CyberSAFE® Global Industrial Cybersecurity Professional

Certified Ethical Hacker GIAC Critical Controls Certification

Certified Information Systems Auditor GIAC Penetration Tester

Certified Cloud Security Professional GIAC Security Expert

9 UNIVERSITIES WITH CYBER SECURITY PROGRAMS

Just as quickly as technology advances, career options and educational disciplines grow. Every year new programs are created. If you don’t see your preferred institution on this list, be sure to check its website for new programs.*

ALBERTA Athabasca University Graduate Certificate in Information Security (PBC-IS) Concordia University of Edmonton Graduate Diploma in Information Assurance Graduate Diploma in Information Security Master of Information Systems Assurance Management Master of Information Systems Security Management Mount Royal University Certificate in Cyber Security Fundamentals Advanced Cyber Security The King’s University Computer Science – Cyber Security Stream University of Alberta Certificate in Information Access and Protection of Privacy University of Calgary Bachelor of Computer Science (Security Concentration Option) Graduate Certificate in Network Security Graduate Certificate in Software Security

BRITISH COLUMBIA University of Victoria Master of Engineering in Telecommunications and Information Security (MTIS)

MANITOBA University of Winnipeg Certificate in Information Assurance and Security Certificate Diploma in Network Security Diploma

NEW BRUNSWICK Eastern College Diploma in Advanced Systems Management and Cyber Security Oulton College Diploma in System Management and Cyber Security University of New Brunswick Bachelor of Computer Science (Cybersecurity specialization) Master of Cyber Security Université de Moncton Certificat en gestion de la sécurité de l'information des entreprises

NEWFOUNDLAND AND LABRADOR College of the North Atlantic Advanced Diploma in Cyber Security - Infrastructure

10 ONTARIO Carleton University Graduate Diploma in Infrastructure Protection and International Security Master of Infrastructure Protection and International Security Bachelor of Computer and Internet Security Northeastern University Master of Science in Cybersecurity Queen’s University NSERC CREATE Cyber Security Ryerson University Certificate in Computer Security and Digital Forensics MBA in Management of Technology and Innovation, Data Security and Privacy Specialization University of Guelph Certificate in Information Management, Privacy, and Access Master of Cybersecurity Threat Intelligence University of Ontario Institute of Bachelor of Information Technology Bridge Technology Bachelor of Information Technology Networking and Information Technology Security Master of Information Technology Security University of Waterloo Graduate Diploma in Computer Networking and Security University of Toronto Bachelor of Computer Science Specialist Program in Information Security Certificate in Cyber Security Management Master of Engineering in Communications with focus on Identity, Privacy and Security Master of Information, with a Specialization in Identity, Privacy and Security York University Certificate in Advanced Cyber Security Certificate in Cyber Security Certificate in Cyber Security Fundamentals Bachelor of Computer Security LLM in Privacy and Cybersecurity Law

QUÉBEC Concordia University Master of Applied Science (MASc) in Information Systems Security Master of Engineering (MEng) in Information Systems Security Université de Sherbrooke Diplôme d’études supérieures spécialisées de 2e cycle en gouvernance, audit et sécurité des technologies de l’information Microprogramme de 2e cycle en gouvernance, audit et sécurité des technologies de l’information Maîtrise en administration, concentration gouvernance, audit et sécurité des technologies

11 COLLEGES WITH CYBER SECURITY PROGRAMS

ALBERTA Allison College Diploma in Information Technology and Cyber Security Bow Valley College Certificate in Cybersecurity CDI College Certificate in Cyber Security Specialist Northern Alberta Institute of Certificate in Core Security+ Technology Certificate in Enterprise Security Certificate in System Security Robertson College Diploma in Network Security Technician Southern Alberta Institute of Certificate in Cyber Security for Control Systems Technology Certificate in Information Security Analyst Certificate in Information Systems Security Certificate in IT Security Certificate of Achievement QCT College Diploma in Cyber Security Specialist

BRITISH COLUMBIA British Columbia Institute of Certificate in Forensic Investigation - Digital Forensics and Cybersecurity Technology Option Certificate in Network Administration and Security Professional (NASP) Diploma in Industrial Network Cybersecurity Bachelor of Computer Systems - Network Security Administration Bachelor of Computer Systems - Network Security Applications Development Bachelor of Forensic Investigation - Digital Forensics and Cybersecurity Bachelor of Computer Systems, Network Security Applications Development Okanagan College Certificate in Blockchain

MANITOBA Manitoba Institute of Trades and Diploma in Network Security Technology Diploma in Cyber Defence and Cloud Administration Red River College Diploma in Post-graduate diploma in Information Security

12 NEW BRUNSWICK New Brunswick Community College Post-graduate Diploma in Information Technology: Cybersecurity Diplôme en Réseautique et sécurité Informatique Diplôme en Cybersécurité Master of Cyber Security

NOVA SCOTIA Nova Scotia Community College Diploma in Cyber Security Diploma in IT Systems Management and Security

ONTARIO Algonquin College Diploma in Computer Systems Technology - Security Centennial College Certificate in Cybersecurity Collège La Cité Diplôme en Technologie de l'information - Sécurité informatique Conestoga College Certificate in Network Security Investigations Certificate in Cyber Security Certificate in Computer Application Security Certificate in Information Technology Network Security Durham College Certificate in Information Systems Security – Computers and Networking Fanshawe College Diploma in Cyber Security Certificate in Information Security Management Certificate in Network and Security Architecture Fleming College Diploma in Computer Security and Investigations George Brown College Certificate in Network Security Fundamentals Certificate Certificate in Information Security Management Certificate Certificate in Network and System Security Analysis Georgian College Certificate in Information Systems Security Humber College Certificate in Cyber Crime Specialist Lambton College Certificate in Cyber Security and Computer Forensics Certificate in Cyber Security Certificate in Cyber Infrastructure Specialist Loyalist College Certificate in Cyber Security Mohawk College Diploma in Computer Systems Technology - Network Engineering and Security Analyst Certificate in Cyber Security Analytics

13 Sault College Certificate in Network Architecture and Security Analytics Certificate in Cyber Security – Canadian Context Seneca College Bachelor of Informatics and Security Certificate in Cyber Security Certificate in Cyber Security and Threat Management

Sheridan College Bachelor of Applied Information Sciences (Information Systems Security) Certificate in Cybersecurity - Legal and Ethical Policies and Procedures Certificate in Cybersecurity Foundations Willis College Diploma in Cyber Security Analyst

QUEBEC Collège Ahuntsic Attestation d’études collégiales (AEC) - Réseautique et sécurité informatique Diplôme d’études collégiales (DEC) - Techniques de l’informatique - Profil réseaux et sécurité Cégep de l'Outaouais DEC en Techniques de l'informatique - Programmation et sécurité DEC en Techniques de l'informatique - Réseaux et cybersécurité Cégep de Saint-Hyacinthe DEC en Techniques de l’informatique - Réseaux et cybersécurité Cégep de Sherbrooke AEC en Cybersécurité et sécurité intégrée Cégep Garneau AEC en Cyberenquête Cégep Limoilou DEC en Techniques de l'informatique - Gestion des réseaux Cégep Saint-Jean-sur-Richelieu AEC d’Administration des réseaux et sécurité informatique Collège de Bois-de-Boulogne AEC en Sécurité informatique et réseautique DEC en Techniques de l'informatique - Profil infrastructures et sécurité Collège de Maisonneuve AEC en Gestion de réseaux et sécurité des systèmes DEC en Techniques de l'informatique - Infrastructure et sécurité des réseaux Collège LaSalle DEC en Techniques de l'informatique - Gestion de réseaux et sécurité Collège Lionel-Groulx AEC en Administration des réseaux et sécurité informatique Collège Montmorency Techniques de l’informatique - Spécialisation: Réseaux et sécurité informatiques Collège Rosemont AEC en Microprogramme de perfectionnement en sécurité des réseaux DEC en Techniques de l'informatique - Profil réseautique: sécurité et virtualisation HEC Montréal Certificat en analyse de la sécurité de l'information et des systèmes Heritage College AEC in Microsoft Network and Security Administrator

14 Institut supérieur d'informatique AEC in Computer Networks and Security AEC en réseaux informatiques et sécurité Polytechnique Montréal Certificat en Cyberenquête Certificat en Cyberfraude Certificat en Cybersécurité des réseaux informatiques Undergraduate microprogram in Networking and Security Microprogramme de 1er cycle en Cyberinvestigation Microprogramme de 1er cycle en Réseautique et sécurité

SASKATCHEWAN Saskatchewan Polytechnic Post-graduate Certificate in Cyber Security

15 WORK AT CANADA’S NATIONAL CYBER CENTRE

The Canadian Centre for Cyber Security (Cyber Centre) is Canada’s authority on cyber security. As part of the Communications Security Establishment (CSE), we have been at the cyber security game for over 70 years. We are trusted experts in cyber security with a clear and focused mandate to collaborate with government, the private sector and academia. We are hackers, builders, creators, developers, researchers, and scientists. We live cyber security every day. We offer a perspective and insight that isn’t available to the same degree anywhere else in Canada. We make Canada a safer place to be online.

A CAREER THAT MAKES A DIFFERENCE CANADA-WIDE STUDENT PROGRAM Canadian networks and systems face cyber threats At CSE we hire students from all over Canada: last every day, and with the help of our very skilled and summer we had 209 students. talented employees (like you), CSE works to prevent and eliminate To apply for a student work term, you do not need } Cyber Criminal Activities, Identity theft, Extortion, to be in a formalized co-op program. You must be Blackmail, Theft a full-time student who is either registered as a student during the work term or returning to school } Terrorists Activities, Radicalization, Recruitment, immediately following the work term. Fund Raising, Destruction

} Insider Threat (Employees), Disgruntlement, HOW CAN I APPLY? Financial Gain, Espionage To become part of our team, apply online at www.cse-cst.gc.ca/en/careers-carrieres WHY WORK AT CSE?

CSE has been named one of Canada’s Top Employers CAN YOU CRACK THE CODE? for Young People in 2017, 2018, 2019 and 2020 and was also selected as a Top Employer in the National Try our puzzle challenges at www.cse-cst.gc.ca/en/ Capital Region in 2013, 2014, 2015, 2018 and 2020. puzzles-enigmes or check out our Twitter account Besides offering meaningful work that protects (@CSE_CST) for new puzzles. Canada and Canadians, and the chance to work with some of the most advanced technologies in the world, we offer } Competitive wages and benefits, including a defined benefit pension plan } Education programs to help employees complete a degree or professional accreditation } Specialized in-house training programs } Telework options, which enable you to work from anywhere in Canada } Work-life balance with flexible hours and paid vacation starting at 15 working days annually, as well as additional personal paid days-off

16 NOTES

* If an institution or organization believes it has a program or certification that should be added to any the lists in this guide, please email [email protected]

REFERENCES

1 https://www2.deloitte.com/content/dam/Deloitte/ca/Documents/risk/ca-cyber-talent-campaign-report-pov- aoda-en.PDF

2 https://www.herjavecgroup.com/wp-content/uploads/2018/07/HG-and-CV-The-Cybersecurity-Jobs- Report-2017.pdf

3 https://neuvoo.ca/salary/?job=Cyber%20Security

4 https://www.strategyanalytics.com/access-services/devices/connected-home/consumer-electronics/reports/ report-detail/global-connected-and-iot-device-forecast-update

5 https://www.securitymagazine.com/articles/87787-hackers-attack-every-39-seconds