One of the problems with learning cybersecurity is that the deeper you go, the more job titles you discover.
Cybersecurity analyst.
Security engineer.
SOC analyst.
Penetration tester.
Incident responder.
Security architect.
Threat intelligence analyst.
And then there’s one of the broadest titles of them all:
Cybersecurity specialist.
But what does a cybersecurity specialist actually do?
I’ve been asking that question as part of my own cybersecurity learning journey.
I’m not a cybersecurity specialist.
I’m an SEO Manager who has spent most of his career around websites, search engines, digital marketing and technology. I’m currently learning cybersecurity because I want to understand more about the systems underneath the websites I’ve spent years working with.
So this isn’t me explaining what my day looks like as a cybersecurity professional.
It’s me standing outside the profession, looking in, and trying to understand what the job actually involves.
And one thing became clear fairly quickly:
Cybersecurity isn’t just people sitting in dark rooms trying to stop hackers.
“Cybersecurity Specialist” Seems to Be an Umbrella Term
This was probably the first thing I needed to understand.
When you search for cybersecurity specialist roles, the responsibilities can vary considerably.
One company might want someone monitoring security alerts and investigating suspicious activity.
Another might expect vulnerability assessments, security controls and risk management.
Another might include identity and access management or incident response.
And another might use “cybersecurity specialist” for a role that overlaps heavily with security engineering.
That initially made the career harder for me to understand.
Then I realised something.
We do exactly the same thing in SEO.
Two people can both be called SEO Specialists and have completely different working days.
One might spend most of their time on content.
Another works almost entirely on technical SEO.
Another specialises in local search.
Another does everything.
The title gives you a general area.
The job description tells you what the person actually does.
I’m beginning to look at cybersecurity roles the same way.
A Lot of the Job Appears to Be About Protecting Systems
At the broadest level, the job makes sense.
A business has things it needs to protect.
Computers.
Networks.
Applications.
Websites.
Cloud infrastructure.
Accounts.
Customer and employee information.
Intellectual property.
Financial information.
Access to internal systems.
A cybersecurity specialist helps reduce the chances of those things being accessed, damaged, stolen, manipulated or disrupted by someone who shouldn’t be able to do so.
Simple enough.
Except once you start asking how, the field becomes enormous.
That’s where all the different security roles begin appearing.
Monitoring Seems to Be a Big Part of Some Security Roles
One area I’ve been learning about is security monitoring.
Organisations generate an incredible amount of information.
Someone logs into an account.
A computer connects to a server.
A firewall allows or blocks traffic.
A user accesses a file.
A device connects to a network.
Most of that activity is completely normal.
The problem is identifying the activity that isn’t.
Maybe an employee usually logs in from Johannesburg during normal working hours, and suddenly their account is attempting to authenticate from somewhere completely unexpected.
Maybe there are repeated failed login attempts.
Maybe a device starts communicating with an unusual destination.
Maybe a user suddenly accesses something they normally don’t.
The interesting question becomes:
Is this normal behaviour, a mistake, or evidence that something is wrong?
That’s where monitoring and investigation come in.
Which Is Why Logs Suddenly Make More Sense to Me
I’ve encountered logs through technical SEO before.
Server log analysis can help SEOs understand how search engine crawlers interact with a website.
Which URLs is Googlebot requesting?
How often?
What status codes is it encountering?
Where is crawl activity being spent?
Cybersecurity looks at logs through a completely different lens.
Who accessed this system?
When?
From where?
What happened before and after the event?
Was this account supposed to perform that action?
Are several events connected?
I’m obviously simplifying something professionals can spend entire careers doing, but the underlying idea fascinates me.
The same system can leave evidence that means completely different things depending on the question you’re asking.
An SEO sees Googlebot.
A security professional might be looking for an attacker.
Both are reading footprints.
Cybersecurity Specialists Also Look for Vulnerabilities
Another part of the job I’ve been exploring is vulnerability management.
Software isn’t perfect.
Configurations aren’t perfect.
People definitely aren’t perfect.
That creates weaknesses.
Some may come from outdated software.
Others from poor configurations, weak passwords, excessive permissions, unpatched systems, exposed services, application vulnerabilities or misconfigured cloud environments.
The job isn’t necessarily to dramatically shout:
“We’ve been hacked!”
Sometimes it’s much less exciting:
“We found something that could become a problem. Let’s fix it before someone takes advantage of it.”
I’m starting to think this preventive side of cybersecurity is probably much closer to reality than the Hollywood version.
A lot of good security work might be completely invisible.
Nothing happened.
Because somebody did their job.
Patching Suddenly Sounds Much More Important
Before learning more about cybersecurity, software updates were easy to think of as:
That annoying notification asking me to restart my computer.
Security gives updates a different context.
If a vulnerability is discovered and a patch becomes available, leaving the vulnerable software exposed can create unnecessary risk.
But even this becomes more complicated inside real organisations.
You can’t necessarily update every system immediately without considering whether the update could break something important.
So now you’re balancing security against operational stability.
How serious is the vulnerability?
Is it being actively exploited?
What could happen if we patch?
What could happen if we don’t?
How quickly can we test the update?
That’s something I’m increasingly noticing about cybersecurity.
There are fewer simple answers than I expected.
Access Seems to Be Another Huge Part of Security
One concept that keeps coming up is access.
Who should be able to access what?
It sounds simple until you think about a large organisation with hundreds or thousands of employees, contractors, administrators, departments, systems, databases and cloud platforms.
Not everybody should have access to everything.
So security involves thinking about identity, authentication, permissions and giving people only the access they actually need.
This immediately makes sense to me from years of working with websites.
How many WordPress websites have ten administrator accounts when perhaps only two people actually need administrator access?
How many old users still have access?
How many people share passwords?
Who has access to Google Analytics?
Google Tag Manager?
Search Console?
The hosting account?
The domain registrar?
I’ve spent years around these systems from an SEO perspective.
Cybersecurity makes me look at them and ask:
Why does this person still have access?
Sometimes Something Actually Does Go Wrong
This is where incident response comes in.
A suspicious event has been identified.
Now what?
First, someone has to determine whether it’s actually an incident.
Then the organisation needs to understand what happened.
When did it begin?
How did the attacker get in?
What systems and accounts were involved?
Is the activity still happening?
What data might have been exposed?
How do we contain it?
How do we remove the threat?
How do we restore normal operations?
And how do we prevent the same thing happening again?
That process appeals to the investigative part of my brain.
Not the incident itself, obviously.
Nobody wants the incident.
But the investigation does.
SEO Has Already Trained Me to Ask “What Changed?”
I keep noticing this connection.
Something goes wrong with an SEO campaign.
Organic traffic drops.
My brain starts working through possibilities.
When did it start?
Was anything deployed?
Did tracking change?
Did rankings fall?
Did Google roll out an update?
Did pages become deindexed?
Did URLs or redirects change?
You establish a timeline.
You gather evidence.
You develop hypotheses.
You eliminate possibilities.
You keep digging until the evidence starts telling a coherent story.
I’m not suggesting that investigating an SEO decline qualifies someone to respond to a cyberattack.
Those are completely different levels of responsibility.
But I’m starting to recognise a familiar way of thinking:
Something changed. Find out what happened.
I like that.
Then There’s the Human Side of Cybersecurity
This is probably one of the biggest things I’ve underestimated.
When people think about cybersecurity, we tend to think about technology.
Firewalls.
Encryption.
Malware.
Networks.
Code.
But humans use all of those systems.
And humans make mistakes.
We reuse passwords.
Click things.
Lose devices.
Send information to the wrong person.
Approve requests without checking.
Give people more access than they need.
Fall for convincing messages.
Ignore updates.
That means cybersecurity specialists aren’t only protecting technology.
They may also help people use technology more safely through security awareness, policies, training and better processes.
This part interests me because technical knowledge alone doesn’t seem sufficient.
You also need communication.
Technical Knowledge Isn’t Much Use If You Can’t Explain the Risk
That’s something my current career has taught me too.
SEO is technical in places.
But being good at SEO isn’t only about knowing SEO.
You need to explain it.
There’s no point finding an important technical problem if you can’t explain to a developer what needs fixing.
There’s no point having a brilliant strategy if the client doesn’t understand why you’re recommending it.
Cybersecurity seems to have a similar challenge.
Imagine telling someone:
“This is a CVSS 9.8 vulnerability.”
Okay.
What does that mean for the business?
What could happen?
How urgent is it?
What needs to be done?
Who’s responsible?
What’s the risk if nothing happens?
Being able to translate technical problems into understandable business language looks like a valuable skill in both industries.
The Tools Are Only Part of the Job
There are a lot of security tools.
SIEM platforms.
Endpoint detection tools.
Vulnerability scanners.
Firewalls.
Network monitoring tools.
Identity systems.
Cloud security platforms.
Threat intelligence tools.
When you’re new to cybersecurity, it’s easy to look at all those tools and think:
I need to learn every one of these.
I’ve already made that mistake in SEO.
I don’t want to repeat it.
Knowing how to click buttons in a tool isn’t the same as understanding the problem the tool is helping you investigate.
That’s why I’m trying to learn the concepts underneath the platforms first.
What are logs?
What is a vulnerability?
What is authentication?
What is network traffic?
What is an alert?
What is an incident?
Once I understand the problem, learning another interface becomes much easier.
Networking, Linux and Python Keep Appearing
These three keep showing up as I learn more.
Networking has probably been one of the more humbling parts.
IP addresses.
Ports.
Protocols.
TCP.
UDP.
DNS.
Packets.
Firewalls.
Routing.
You can recognise all those terms without really understanding how they connect.
Cybersecurity forces you to care about those connections because you need to understand what normal communication looks like before you can recognise abnormal communication.
Linux keeps appearing too.
Servers, permissions, files, processes, commands, logs, networking tools and security tools.
At first, the command line can feel unnecessarily hostile.
You make one typo and Linux responds with the digital equivalent of:
Absolutely not.
But slowly, the terminal becomes less intimidating.
Then there’s Python.
I’m learning it because I want to become more capable at solving problems with technology.
SEO gives me use cases around data, URLs, APIs and automation.
Cybersecurity adds logs, file processing, pattern detection and repetitive analysis.
I’m still learning all three.
I’m building pieces.
And I like that the pieces connect.
Does a Cybersecurity Specialist Hack Things?
This was one of my beginner questions.
The answer seems to be:
It depends on the role.
Penetration testers and offensive security professionals may actively test systems for vulnerabilities under authorised conditions.
But that’s one part of cybersecurity.
Someone working defensively might spend much more time monitoring, investigating, configuring controls, managing vulnerabilities, reviewing access, responding to incidents and reducing risk.
This was useful for me to learn because popular culture makes cybersecurity and hacking feel almost synonymous.
They’re not.
Some security professionals try to break things safely to discover weaknesses.
Others spend their careers trying to make sure those weaknesses aren’t there in the first place.
The Job Isn’t Just “Stopping Hackers”
The more I learn, the less useful that description becomes.
Cybersecurity seems much more like risk management through technology, processes and people.
You probably can’t guarantee that nobody will ever attack an organisation.
You can’t eliminate every vulnerability.
You can’t prevent every employee mistake.
The job is reducing risk.
Making attacks harder.
Detecting suspicious activity.
Responding quickly when something happens.
Protecting important assets.
Limiting damage.
Learning from incidents.
Improving controls.
That’s much less dramatic than the movie version.
It’s also much more interesting.
What Does a Typical Day Look Like?
This is where I have to be careful.
There probably isn’t one typical day for a “cybersecurity specialist.”
The title is too broad.
Depending on the organisation and role, a day could involve reviewing alerts, investigating suspicious activity, checking vulnerabilities, helping with access requests, reviewing security configurations, responding to incidents, documenting findings, meeting other technical teams or improving controls.
Another cybersecurity specialist might do almost none of those things.
That’s why, if I were considering a cybersecurity job, I wouldn’t stop at the title.
I’d read the responsibilities carefully.
What problem is this company actually hiring this person to solve?
That’s the question.
What Skills Seem Important From the Outside?
As someone still exploring the field, I’m noticing that the skills aren’t purely technical.
You obviously need technical foundations appropriate to your area.
But I’m also seeing the importance of curiosity, analytical thinking, attention to detail, communication and patience.
Especially patience.
Because investigations don’t always give you an obvious answer.
Neither does troubleshooting.
And if cybersecurity is anything like technical SEO, sometimes you’ll spend three hours investigating something only to discover the problem was caused by one ridiculous configuration somebody changed six months ago.
Technology has a sense of humour like that.
Could I See Myself Doing This?
That’s a question I’ve started asking.
The answer is:
Maybe.
There are parts of cybersecurity that genuinely appeal to me.
Investigation.
Technical problem-solving.
Understanding how systems communicate.
Looking at data and finding patterns.
Automation.
Learning how websites and networks actually work underneath the interfaces we normally see.
But I’m not currently planning a dramatic career change.
I enjoy SEO.
I’ve spent years building experience in it, and search itself is becoming more interesting as AI changes the industry.
Cybersecurity is another direction my curiosity is pulling me.
Maybe it eventually becomes part of my professional work.
Maybe it makes me a stronger technical SEO.
Maybe it remains something I simply enjoy learning.
I don’t need to decide yet.
I’m Exploring the Career Before Trying to Become the Career
I think that’s important.
The internet has this strange tendency to turn every interest into an identity immediately.
You finish your first Python tutorial:
Python Developer.
Complete a cybersecurity certificate:
Cybersecurity Professional.
Buy running shoes:
Athlete.
I’m trying not to do that.
I’m learning cybersecurity.
That’s enough.
I want to understand the field before deciding where, if anywhere, I fit within it.
That means understanding the foundations, trying labs, getting better at Linux, learning networking, continuing with Python, making mistakes and asking beginner questions.
And documenting what I discover along the way.
So, What Does a Cybersecurity Specialist Actually Do?
My answer today is very different from what it would have been before I started learning.
I probably would have said:
They protect computers from hackers.
Technically, that’s somewhere in the neighbourhood.
But it’s nowhere near enough.
From what I’ve learned so far, cybersecurity specialists can help organisations understand and reduce security risks, monitor systems, investigate suspicious activity, identify vulnerabilities, manage access, support incident response, implement security controls and help people use technology more safely.
Exactly which of those responsibilities they handle depends heavily on the role and organisation.
And that’s probably the most important thing I’ve learned.
Cybersecurity isn’t one job.
It’s a collection of different jobs trying to solve different parts of the same enormous problem:
How do we keep the technology, systems and information we depend on reasonably secure?
I’m still standing outside the field looking in.
But the more I understand what the people inside actually do, the more interesting the view becomes.
And for now, that’s exactly where I want to be.
Not pretending to be a cybersecurity specialist. Just becoming someone who understands cybersecurity a little better every day.
