Welp, I got an offer in IR. But is it a good decision?

[tanner]

I'm just gonna post what I did on Reddit (and got no responses)...

 

I've worked in security for not quite two years now, largely doing endpoint security stuff (McAfee administration, tier 3 troubleshooting, etc) for a Fortune 50 company. This is something I've learned I enjoy, and although not part of my job officially, I especially liked finding and investigating threats.  

 

As part of a reorg within the company and our parent, I was moved from that to a new OT (operational technology, think the sort of stuff they use on the factory floor) security team. It was all brand new to me, and I still have a hell of a lot to learn. At first I was a bit annoyed that I was moved to this team, but now looking at the long-term, I feel like I was pretty lucky for this to happen. My understanding is that OT security is still very much an emerging field with lots of companies needing it, and not many people with the experience. I'm honestly still not totally sure how happy I am in this role. We're doing more consulting than anything, and I'm a very technical hands-on person.  

 

A couple weeks ago I was offered a job at another company doing endpoint stuff again, but this is closer to an incident response position. I think that's the type of path I'd like to go down in the future. They offered me significantly more than I'm making now, and even more than I asked for - right now I'm getting 72k, I asked the new company for 80, and they offered 85.   Seems like it should be a fairly straightforward decision, right? Yeah, no. I have a number of things that are making this difficult.   

 

1. Like I said, the OT position is just one I happened to be placed in during reorg. But since it's such a niche area with high demand and small supply, I feel like getting into this with literally no experience is almost like winning the lottery career-wise. That said, I'm not very happy in this right now. Is going back to IT after less than a year in OT really a very wise move? In the short-term it's a no-brainer, but I'm trying to look down the road too.   

 

2. My current company may be having another position in IR opening up in the next few months. This one will be focusing on OT stuff as well, but I have no idea if I'd actually get it or not.   

 

3. I'm interviewing for a different position within my same team at the end of the week, just doing more technical stuff like design work and actual implementation. I think it's somewhat likely I'll get this one since my manager is also the hiring manager for this position. I'm not certain what the pay will be for this one, but it's more than I make now, probably less than I'll make at the other company.  

 

So I'm a bit conflicted here. I kinda feel like in the long term, the OT positions will be better for my career since the pool of people in the space is smaller. But on the other hand, all big companies will need people in IR, whereas OT is only really needed by more industrial companies. Obviously the increase in pay would be nice, but that's not a huge concern for me right now.  

 

What do y'all think? Should I stay where I am, in the more specialized field, or go to the IR side?

[v0ltage]

While we can't answer this or make the decision for you, and I certainly wouldn't encourage you to take a job particularly if you're already on the fence about it.  Only you know what you want to do in your career, what interests you and it's a case of mapping that out how you're going to get there and do something which you enjoy doing.  There is no right answer I can give you, But I will try and offer some guidance for you.

First off, the extra money is nice but shouldnt always be the deal breaker.  Whats the culture like at this new place, benefits package, hours, how much further do you need to travel, parking options etc etc.  Check reviews out on sites like glass door for example to try and gauge an idea of what it maybe like to work for this company.  What recent news stories have there been on that company? (negative or positive).  I'm assuming your in the US (based on the salary number) so I really won't be in tune with cultural differences with you folk across the pond.  sure others on this forum will be better versed.

You say you are not happy in your current role, but ultimately what would make you happy?  What is it about your current role you do not like or would want to change / avoid in future?  Does the new role fix that or satiate your need from an experience perspective.

I've never worked in IR specifically, but have been the responder to some ransomware incidents for large global companies / central government, but there was recently a study on the mental health effects to Incident Responders, I believe the first study of it's kind.  Here's the link to an article on said study with brief findings:  https://www.cybersecuritydive.com/news/incident-response-impacts-wellbeing/633593/#:~:text=Incident responders also reported bouts,and can be long-lasting.

I'm not trying to sway you either way, but just like in our industry... data is key to make the right decision and action.  Hope some of the rambling actually helps you, I'm pretty tired and just cannot wait for the xmas break!.

 

[Grubbslinger]

There is nothing wrong with moving jobs but the move should get you closer to your ultimate goals. If you are looking to get into IR for Endpoints, then it may be the right move. If you want to get into IR in a much more specialized field, it might be better to stay in OT, gain experience in that tech while studying IR, and then moving into OT IR (Ya acronyms). If your goal is to make more money then that can be a factor in taking the new job. 

Its very hard to know what you ultimately want to do and not feel like you might miss an opportunity. But keep this in mind: 2 years is a blip in your overall career. I started out as a historian for a military helmet museum. There will be a lot of opportunities that come up. Its much more important to stay focused and dedicated to what makes you happy and fulfilled. If you can do that, then you'll never have to worry about not having opportunities in the future.

Edited December 9, 2022 by Grubbslinger