Security, Privacy & GRC - Security
Security Specialist
IC / Practitioner
Independently auditedProtects the company's systems, data, and customers from real adversaries. Owns a defined area of the function and the outcomes it produces.
Audited package
Built, independently audited role package. Everything on this page is written for this seat.
Your Stack (Swappable)
This role works against whatever tools you already run. We list the tool categories the role operates in, never a named vendor, so you are never asked to replace a system that works.
- Vulnerability & Cloud Posture
- Identity & Access (SSO/IAM)
- ITSM / Service Desk
- Endpoint & Device (MDM/UEM)
- Team Chat & Collaboration
- GRC & Compliance
- Docs & Knowledge
Deliverables
- Detection rules and tuning notes
- Risk and architecture reviews
- Incident write-ups
- Control evidence packs
Responsibilities
- Run security assessments across systems, processes, departments, and vendors - producing risk-rated findings and remediation recommendations someone acts on
- Own the security hygiene basics as a program - MFA, patching, backups, offboarding, and asset inventory - with a cadence, a metric, and an owner
- Run the security awareness and phishing program end to end, targeting high-risk groups from the actual click/report data
- Administer, configure, and troubleshoot the common security tools, not just read their dashboards
- Review access and third-party/vendor risk proportionate to the data at stake, and produce the cleanup or the questions to raise before signing
- Advise project, change, and engineering teams on "secure enough" in language they can act on
- Support incidents hands-on - timeline, containment checklist, plain-language update - and escalate cleanly to whoever owns the incident when it exceeds a generalist
- Prioritize a competing inbound flood by risk and blast radius, negotiating deadlines and handing off what belongs with a specialist
The essence of this seat
The Security Specialist is the broad, hands-on generalist of a security team - often the "security team of one" or a flexible contributor who covers a bit of everything rather than owning one deep lane.
Signature move
Triage by risk and blast radius before you touch anything. The first move on any inbound - a ticket, an assessment request, a suspicious login - is to rank it by real impact, not by who asked most recently; an active investigation always beats a routine review, and the queue is worked in that order
What good looks like
triages a genuinely mixed cross-domain pile by risk and blast radius, not recency or volume; puts the possible-incident signal first and lets it preempt everything; unblocks the deadline-bound item with a proportionate "secure enough" answer rather than a perfect review; sequences program work with a stated reason; surfaces chronic overload as a resourcing conversation rather than absorbing it silently
Decision rights
- - how you assess and prioritize your own work, assessment methodology and risk ratings, awareness-program content and cadence, tool configuration within policy, and the day-to-day security hygiene calls
Working vocabulary
What this role does
The Security Specialist is the broad, hands-on generalist of a security team - often the "security team of one" or a flexible contributor who covers a bit of everything rather than owning one deep lane. They run a vendor assessment when nobody else will, administer the security tools, own awareness and phishing, review access, support an incident, and advise project teams on what "secure enough" looks like. The defining verb is operate / apply / respond: they apply security knowledge to specific problems, operate the controls and programs already in place, and respond to what lands on the desk. Where an Information Security Engineer (generalist) builds, automates, and engineers security across the whole stack (037_Information_Security_Engineer_Generalist/) and a Security Analyst analyzes and advises, the Specialist is the operational practitioner who runs it, applies it, and keeps the basics working hands-on. This is an individual-contributor role, reporting into an IT or Security lead; the Lead Cyber Security Specialist adds coordination - leading initiatives and mentoring juniors - but stays hands-on and broad. What separates great from average is connecting the dots across the breadth, and prioritizing well when resources are scarce. A mediocre specialist completes assigned tasks in isolation. A great one notices the department failing phishing is the same one with stale access, treats hygiene as a program rather than a to-do list, fixes root causes, and knows exactly when to stop - pulling in a domain specialist for depth, or the engineering generalist (037) when the fix needs to be built and automated rather than operated by hand. Breadth of practice is the value; the discipline is not letting breadth become shallowness on the things that matter.
Best-fit customer
security teams that need consistent triage, review, and evidence quality
Need more than one role?
Buying the whole team or the complete department lowers your effective cost per role at every tier of the ladder.