Junior Cyber Security Analyst Review

My role involves a degree of administration related to an low level of cyber security knowledge. This includes: - daily monitoring of my security team's mailbox, and replying or investigating reported security incidents; - reaching out to relevant IT teams on the project about known vulnerabilities for hardware used on the project or discovered issues with implemented or unimplemented security controls; - reviewing and approving certain project management activities (i.e. increased permissions and access for users) - reviewing or updating current or deprecated security policies or design documents. - discussing with my security team the best course of action for discovered or ongoing security issues.

I have mostly developed existing skills such as e-mail or face-to-face communication, researching technical terms and components and document design or data manipulation in Microsoft Word/Excel. I have started to develop my skill for investigating and resolving security incidents - I can work with my team and others (e.g. security operating centres) to ask for relevant analysis (look for a certain action on a certain day) to help narrow down the causes of an incident or summarise the investigation thus far. As my role is somewhat removed from technical hands-on with code or engineering design I have not really developed my programming knowledge on-the-job. This has been covered by the University modules.

I greatly enjoy the programme as it has delivered viable employment and a supportive start to my career. My company, my line manager and my team have been supportive and understanding. They are happy to offer guidance, advice and knowledge to help me advance. The Degree Apprenticeship helps me link my workplace experience with the theory and content learnt from my University course modules. However, some of the content feels too irrelevant for my expectations and we are obliged to attend long (10-hour) days at the University with few, small allotted breaks when learning. For example, my first semester for a Technology (Cyber Security) Degree covered modules such as "Business Expertise" and aspects such as employability through CVs etc. For this module my Apprenticeship group was mixed in with a larger regular University student group. The result was that some of the apprentices (myself included) felt that such teaching hours were wasted and we could be learning concepts more directly relevant to a currently employed person or to my apprenticeship stream. Fortunately, the University is open to feedback and have received our suggestions and complaints through e-mails, surveys and other feedback forms.

My first week at CGI was a bit unorganised but I was introduced to the vital aspects and mandatory activities of CGI alongside my introductory training. I quickly met my line manager and team who helped me start my role, and are very supportive. I am aware of where to access important resources in CGI and understand to a suitable degree the organisation and culture of my company. I have planned calls with my mentor and I feel open to discuss and resolve concerns and issues with my role or my study. Overall, my employment is well structured. However, there has been issues with the organisation of the Degree Apprenticeship from the side of the University. There have been frequent issues or miscommunications such as the extended absence of one tutor for both the information systems module and the programming (semester 1) which led to difficulty in understanding and applying the content of the module to the final assessment. We received a substitute tutor but we felt that the learning was strained as the substitute could only help so much. Another issue is the lack of clear communication about some aspects of the Apprenticeship. It took a while for some students to obtain their mentors despite CGI's preparation. In addition, semester reviews can be sent out on short notice causing difficulty with scheduling the time with my mentor. There can be discrepancy between what the mentors are told, what the University staff know and what we are told. We were apparently told of a requirement on our induction in the first semester but never reminded. It took months before we were explicitly informed of what to do and how to achieve this, but this required a programme leader to intervene/disrupt temporarily one of our taught modules. Lastly, the University has some excellent resources - the Canvas system is one example as it is convenient to find resources, submit assignments and read announcements. However, as apprentices we are spammed with irrelevant announcements to day release students yet we do not always receive important Apprenticeship announcements through the system (despite its convenience). I am under the impression they have the capacity create and use an 'apprenticeship' group to filter convenient and relevant announcements for our programme, yet this does not seem to have been put in place.

I receive plenty of support from my employer - my line manager and mentor are very helpful, she is happy to provide guidance, advice and recommendations for my industry and my study. We have weekly calls to catch-up and discuss concerns or opportunities. She also forwards on resources, news and events for the cyber security industry. My project manager is very helpful and understanding, he supports me where he can on my role in the programme, but is understandingly busy. We have weekly team meetings for discussion on our tasks and issues on the project. Corporate provide newsfeeds and help explain member benefits and services or provide important announcements and changes e.g. actions to update to Windows 10 and concise guidance on how to do so.

We receive some support from the University but there have been cases where it is insufficient or sometimes a 'non-answer'. In semester 1, when the class encountered difficulties with the FAQ and assessment brief for our information systems assignment, they were not able to clearly explain some of our confusions (as the original tutor was absent, the substitute and programme leader could only help so much).

I feel that especially in the second semester the teachings are starting to become more relevant and applicable to my role. The introduction to Cyber Security module is particularly relevant to my role and has helped provide me a broader understanding of my industry and the opportunities within it. Some of the content covered is applicable to my role and project e.g. standards and policies, cryptography, risk analysis.

CGI offers a subsidies Sports & Social Club which offers social events and meals for a cheap monthly fee. I have enjoyed the activities I applied for that were offered by the club thus far. In addition, CGI offers substantial training and learning budget to its members, so I can attend professional networking events if I justify the benefit to my line manager and mentor. For example, I attended a SASIG Gateway event to learn more about raising security awareness in all employees. I also intend to go to the Infosecurity Europe 2019 conference.

Yes

CGI offers strong employment benefits, a strong organisational structure and support, plenty of career opportunities and industries. The pathway offered by their Degree Apprenticeship programme is thus far a viable alternative to a full-time University Degree. In addition, CGI shows it understands the need to train the workforce by offering such a scheme aimed at the younger workforce whilst retaining older & experienced members to help mentor recruits.

I advise others to practice writing their CV and understanding their current strengths and aspirations for employment and productivity. They should also research the company enough to give an outline of what they are and what they do. This helps you check you want to belong to the company. They should also practice interview questions to help narrow down and justify their aims for applying for a role or scheme in CGI. The assessment centre that CGI runs was a helpful learning experience and also helped me achieve a better understanding of what CGI does.