What does working in a Security Operations Centre (SOC) actually look like when you’ve previously been learning cyber security in a university environment?
Ben McHendry, an Ethical Hacking student at Abertay University, joined Acumen Cyber for an internship to find out. Rather than just observing from the sidelines, Ben spent his time working alongside Acumen’s security engineers, investigating real security activity, getting hands-on with industry tools and seeing how cyber security works when there is a customer at the other end of the investigation.
We caught up with Ben to find out what he learned, what surprised him and what advice he would give to other cyber security students considering an industry placement.
Why did you choose Acumen for your placement year?
“I decided to do my internship with Acumen because, from what I could see, it would give me a better understanding of the industry and the chance to get hands-on experience with tools I’d never normally have the opportunity to use. It also looked like an all-round great company where I could learn from people already working in cyber security and gain experience that will help me in the future, whether that’s at Acumen or somewhere else. Although I’d definitely rather it was Acumen!”
How have you developed as an engineer during your time at Acumen?
“I feel like I’ve developed numerous skills as an engineer and gained a much better understanding of things I either knew very little about before or hadn’t come across at all. One of the biggest things I’ve learned is that not everything is as it first seems. You can look at something and think there’s a problem, but the context around it really matters.
I’ve also improved my querying skills and learned languages I didn’t have much experience with before, such as ES|QL and KQL. That’s helped me investigate problems faster and made it easier to work out what’s actually happening and how to solve it. I’ve also learned how to tune out noise and reduce false alerts, so we’re not creating tickets for activity we already know is legitimate.”
What has it been like working directly with experienced and senior engineers?
“It’s been a really great experience working alongside senior and experienced engineers. I’ve learned things that training alone couldn’t teach me and that really only come from experience. Whenever I’ve had an issue or been unsure about something, the engineers have always been happy to talk me through it, explain what they know and help me understand how I can use that knowledge in my own work.
I’ve not only gained knowledge in areas I knew very little about before, but I’ve also made friends within the industry who I can learn from, network with and talk to about subjects we’re all interested in.”
How have you been able to put your learning into practice during real investigations?
“I've been carrying out investigations and sharing my findings, including screenshots, with another engineer, who then verified whether I'd reached the correct conclusion with the right supporting evidence. Where this was successful, they used my findings in their own investigation and response.”
What have you learned about working with and supporting customers?
“One of the biggest things I’ve learned from working with and supporting customers is that every customer is different. They don’t all have the same security coverage, and some have more technical knowledge than others, so you need to tailor how you communicate depending on who you’re speaking to.
Customers also have different rules and policies around how certain situations should be handled. For example, some allow us to reset passwords or isolate machines straight away, while others require us to contact them for approval before taking action. It’s taught me how important it is to understand each customer and the way they want us to work with them.”
What’s the biggest thing you’ll take away from your internship at Acumen?
“I think the biggest thing I’ll take away from this internship is that something can initially look extremely malicious, but once you investigate the surrounding context, you might realise it’s actually normal activity. That’s really changed the way I approach an investigation.
I’ll also take away all the new querying languages I’ve learned, along with hands-on experience using tools such as Elastic and SentinelOne. I’m sure these are skills I’ll use in future opportunities, as well as during my final year at university.”
What advice would you give to other students considering a cybersecurity internship?
“The advice I’d give to students considering a cybersecurity internship is to look into the company first and make sure it’s somewhere you feel you’ll genuinely learn, rather than somewhere you’ll just work.
I’d also say don’t be afraid to ask questions, no matter how big or small. Even if it’s something you already know a little about, asking someone with experience in the industry can give you a much better understanding and help you develop your own skills and knowledge.
Lastly, I’d say have fun and make the most of it. There’s obviously a lot of training, learning and shadowing involved, but getting to know the people you’re working with and enjoying the experience is important too. That’s definitely been the case for me during my placement at Acumen.”
Building the next generation of security engineers
Ben's internship shows why practical hands on industry experience can be such a valuable addition to a cybersecurity degree. Technical knowledge provides the basis, but working alongside experienced engineers gives students the opportunity to develop the judgement, confidence and understanding that come from investigating real activity.
At Acumen Cyber, we believe great engineers aren't born. They're built. That means giving people the opportunity to learn, ask questions, make use of experienced mentors and get meaningful exposure to the realities of cyber security.
Ben now returns to Abertay for his final year with new technical skills, real SOC experience and a much clearer understanding of where a career in cyber security could take him.
To find out more about why universities and employers should work together to tackle the cyber skills gap, read our recent article in DIGIT, featuring insights from Abertay University and Acumen Cyber’s Head of Security Operations, Peter King, here: https://www.digit.fyi/comment-building-cyber-talent-takes-more-than-a-degree/