The cyber security jobs market is growing, and the recent pandemic has widened the skills gap in this area. As outlined in our global cyber security report for 2023, 72% of employers believe that events in recent years have had a significant impact on their cyber risk profile. However, 90% claim that the skills gap is affecting their organisations’ ability to implement their proposed cyber security strategy. People with the right cyber security skills are in demand.

This leaves many experienced workers, as well as those starting their careers, facing an interesting decision: should you take an in-house role, or look for cyber security consultant jobs? Let’s examine the pros and cons of each way of working, and the opportunities available in each role.

Cyber security consultant jobs vs. in-house employment: the pros and cons

1. In-house

What does a typical in-house cyber security role entail? If you work in-house with a specific company, you will work with the same team and IT environment every day. Each cyber security role is different but your responsibilities may include assessing potential threats to your corporate network, prioritising threats, escalating threats and investigating any breaches. Many cyber security professionals are also involved in training programmes, helping the organisation build a strong culture of awareness and prevention. And you may help to develop and implement a cyber security response or recovery plan for your business. What are the pros and cons of working in-house? However, in-house cyber security experts sometimes suffer from a lack of exposure. In some organisations, cyber specialists can get stuck dealing with tickets, where they prioritise and escalate threats day in and day out, rather than investigating these threats. If you do find yourself stuck in a rut, you could ask for more challenging projects. Alternatively, you may want to start investigating a consulting role or work in a Managed Security Services Provider (MSSP) environment.

2. Consulting

What does a typical cyber security consultant job entail? When consulting, you will work on a specific short-term project before moving on to the next one. These projects can vary in length but are usually a few months in duration, where you often work with multiple clients. In an MSSP role, you typically work with several long-term clients as well. The day-to-day responsibilities are similar to a consulting role but you get the opportunity to work with the same set of organisations. For example, in a consulting role you may provide a specific cyber security service like penetration tests. At an MSSP, you are likely to provide an extensive range of cyber security services for organisations looking to outsource their SOC operations. Is a consulting or MSSP role best for you? Both consulting and MSSP roles give cyber security specialists exposure to a wide range of business and IT environments. So, these roles are ideal for individuals who want to expand their areas of expertise. They are also very diverse, which is perfect for people who find the routine work of an in-house role monotonous. In a consulting role, you also have little to no opportunity to change the way your employer works. Your input and wider business impact is very limited. If the firm you’re working for doesn’t have an efficient way to onboard and service clients, every engagement can quickly get very repetitive. With both a consulting and MSSP role, it’s important to assess whether your personality is suited to these fast-paced engagements with multiple clients.

Author

Miguel Duran
Director, Cyber Security, Hays North America

Having joined Hays in 2013, Miguel now leads our work on cyber security in North America. An award winning Information Technology recruitment consultant, Miguel has vast knowledge of the specialism and works with talented individuals and renowned organisations to match them with what they need.