Nobody applies for a job called “the person who makes security and operations stop fighting”. The role still exists on every serious platform team, and it has a name behind it: SecOps, the working deal signed between security and the teams that keep production alive. Mara fell into it the way most people do — she was the one who read the tickets. A scan had flagged the same NFS setting on forty hosts for the third quarter running, and while everyone argued about whose ticket it was, she wrote a one-page note saying who would fix it, by when, and what evidence would close it. The note got signed. The people who write such notes well have become genuinely employable, and this piece walks through the work as a set of four skills.
What SecOps Work Looks Like on an Ordinary Tuesday
Morning: the weekly queue review. Mara walks one register — never two — and reads only the anomalies: findings without owners, deadlines at risk, exceptions that drifted past their review date. The register itself is boring by design; every finding already carries a team and a date, assigned automatically where the asset inventory allows it. Midday: a negotiation. The payments squad cannot take the new SSH baseline this sprint, so the baseline moves onto a later ring and the exception gets a written reason and a renewal date — not a refusal, not a permanent shrug. Afternoon: enforcement. The container-host ring went to log-only eleven days ago; the logs are quiet, so twelve hosts move to enforce, and the calendar entry for the change window was agreed with the on-call lead weeks ago. Evening: none of it. That is the point. A well-run contract means security work stops being a 2 a.m. surprise.
Skill One: Writing Baselines People Can Actually Live With
The craft starts with choosing sources and stating them. Benchmarks exist for over a hundred platforms in two strictness tiers — sensible defaults versus stricter settings that can break things — and a skilled practitioner tailors rather than worships: every deviation from the benchmark is written down with a reason, in a file, versioned like code. Mara’s habit is to bring the affected team into the tailoring conversation before publishing, because a baseline imposed in silence gets sabotaged in silence. Test environments see the policy first, production last, and the gap between them is measured in observed logs, not optimism. Engineers who have internalised production readiness checks will recognise the instinct: state the intended condition, prove it gradually, and make the evidence reviewable.
Skill Two: Negotiating Dates Without Losing the Plot
Deadlines are where diplomacy earns its salary. The honest version is proportionate: a flaw that is actively exploited on an internet-facing host cannot share a clock with a cosmetic finding on an internal lab box, so dates are set per cell of importance and urgency, agreed with each owner group in advance. When someone cannot make a date, the exception process gives them a legal way to say so — reason, reviewer, renewal — and the register counts how many exceptions are overdue, because a number visible to both directors is worth more than a dozen reminders. NIST has some sharp words for the blame game that often surrounds these dates: treating patch-related outages as self-inflicted while counting incident outages as acts of God is, in the standard’s own wording, misleading and incomplete. Mara keeps that quote pinned up. It settles arguments about whose downtime “counts”.
Skill Three: Reading Numbers Like an Adult
The scorecard ritual is monthly, short and unsentimental. One estate-wide percentage is never spoken aloud, because averages launder failure — the art is in the cells: on-time rates split by importance and urgency, the middle and near-worst latency of actual fixes, and the count of findings nobody owns, read out weekly like a blood pressure. A September board pack might show 82.5% on time overall and a 20-point spread between internet-facing critical work and datacentre critical work, and a competent reader knows immediately which meeting to book. Alongside sits the counter-weight: how often security changes themselves disrupted service, because a function that breaks production while fixing it has confessed something. Teams fighting noisy dashboards will find kindred advice in this piece on alert fatigue — the cure in both cases is fewer, better-chosen signals.
Skill Four: Guarding the Machinery Nobody Sees
Scanning engines run as root or SYSTEM. Automation tokens can quarantine hosts. The people who edit routing rules decide which findings a human ever witnesses. Mara’s register of privileged plumbing treats all three like the keys to the kingdom, with the same habits listed for each.
- Named holders only, reviewed quarterly, no shared logins.
- Break-glass steps written down before the 2 a.m. they are needed.
- A second pair of eyes on every edit to routing rules.
She also keeps the promises the monitoring side is owed — logging process and storage at the entry tier, synchronised clocks, central collection, ninety days of retention and a weekly review habit at the next tier up — because the contract binds in both directions, and credibility is the currency it trades in.
Where a SecOps Career Actually Starts
Not with a certificate alone, though structured learning helps — this training guide map for building expertise is a fair starting itinerary. It starts with a queue nobody owns and the stubbornness to write the note Mara wrote: who, by when, with what evidence. Organisations hiring for this shape of work should test candidates on exactly that; the rest — benchmark trivia, tool syntax — is learnable. The definition that anchors the role, worth reading before any interview, is SecOps as a working contract at the Ops Atlas, and it fits on one screen.
The job title has not settled yet. The skills have: write baselines people can live with, negotiate dates honestly, read grouped numbers without flinching, and guard the plumbing. Teams that grow even one person in this mould stop relitigating ownership every quarter — and the queues, at last, begin to empty.