Career Overlap Transition record
RecordMove

Digital forensics expert to cyber incident responder

A digital forensics expert already meets 34% of what the cyber incident responder role asks for. The move turns on 11 required skills not yet in the profile.

Fig. 1 · Skill transfer ESCO v1.2.1 · directional
From digital forensics expert
34 % overlap
Distant match
To cyber incident responder
18 You already bring
11 Still to learn
75 Skills in the target role2
Learning distance Substantial retraining

73.7/ 100

1 How much of what a cyber incident responder is expected to do is already part of a digital forensics expert’s work. Directional: the figure for the reverse move differs, because moving into a speciality is not the same problem as moving out of one. 2 Every skill the cyber incident responder role is recorded as needing, required and optional together. What these numbers mean.

Why

Why this move works

A cyber incident responder role treats 12 of its required skills as things a digital forensics expert already does. You would walk in with these on day one.

  • GDPR
  • ICT network security risks
  • ICT security legislation
  • ICT security standards
  • attack vectors
  • collect cyber defence data

What stands in the way is 11 required skills the profile does not yet cover. Table 3 groups them; Table 4 says which to take first.

Table 2

Table 2 · What you already bring

Of the 18 skills that carry over, these are the ones fewest other occupations ask for. A cyber incident responder role needs them, and most people applying for one will not have them already. This is the part of a digital forensics expert background worth leading with.

Skill the target role also needs Area
  • already held collect cyber defence data information skills
  • already held GDPR business, administration and law
  • already held operating systems information and communication technologies (icts)
  • already held develop information security strategy assisting and caring
  • already held cyber attack counter-measures services
  • already held ICT encryption information and communication technologies (icts)

All 18 carried skills, including the 12 the cyber incident responder role treats as required.

Table 3

Table 3 · What you may need to learn

The 57 missing skills fall into 13 areas of the ESCO skill hierarchy, numbered in the order worth working in. Areas carrying the most required skills come first, and inside each one the required skills sit above the optional ones. Nothing here is a verdict on you: it is a list of what this particular job asks for that your current one does not.

Skill to pick up Tier
01 working with computers 2 required, 8 supplementary
  • still to learn ICT safety required
  • still to learn protect ICT devices required
  • optional, not held implement a firewall optional
  • optional, not held implement a virtual private network optional
  • optional, not held implement anti-virus software optional
  • optional, not held implement spam protection optional
  • optional, not held manage changes in ICT system optional
  • optional, not held manage keys for data protection optional
  • optional, not held optimise choice of ICT solution optional
  • optional, not held remove computer virus or malware from a computer optional
02 communication, collaboration and creativity 2 required, 4 supplementary
  • still to learn communicate with stakeholders required
  • still to learn engage with stakeholders required
  • optional, not held consult with business clients optional
  • optional, not held give live presentation optional
  • optional, not held provide user documentation optional
  • optional, not held troubleshoot optional
03 information and communication technologies (icts) 1 required, 8 supplementary
  • still to learn ethical hacking principles required
  • optional, not held C++ optional
  • optional, not held ICT process quality models optional
  • optional, not held Internet of Things optional
  • optional, not held Python (computer programming) optional
  • optional, not held cloud monitoring and reporting optional
  • optional, not held cloud security and compliance optional
  • optional, not held internet governance optional
  • optional, not held web application security threats optional
04 business, administration and law 1 required, 6 supplementary
  • still to learn risk management required
  • optional, not held ICT project management methodologies optional
  • optional, not held Process-based management optional
  • optional, not held lean project management optional
  • optional, not held project management optional
  • optional, not held business intelligence optional
  • optional, not held copyright legislation optional
05 information skills 1 required, 5 supplementary
  • still to learn create incident reports required
  • optional, not held implement ICT risk management optional
  • optional, not held ensure proper document management optional
  • optional, not held perform risk analysis optional
  • optional, not held perform scientific research optional
  • optional, not held track key performance indicators optional
06 assisting and caring 1 required, 3 supplementary
  • still to learn handle cybersecurity incidents required
  • optional, not held ensure information security optional
  • optional, not held protect personal data and privacy optional
  • optional, not held provide information optional

7 further areas in the appendix

Table 4

Table 4 · Where to start

The 3 entries a cyber incident responder role is least likely to hire without. The ordering is computed from the skill data, not from what pays.

Each entry opens a course search for that skill. Career Overlap earns nothing from these links.

Appendix

Appendix · The rest of the record

All 18 skills that carry over
Skill Type
  • already held GDPR knowledge
  • already held ICT network security risks knowledge
  • already held ICT security legislation knowledge
  • already held ICT security standards knowledge
  • already held attack vectors knowledge
  • already held collect cyber defence data skill
  • already held cyber attack counter-measures knowledge
  • already held cyber security knowledge
  • already held operating systems knowledge
  • already held provide ICT consulting advice skill
  • already held security engineering knowledge
  • already held security threats knowledge
  • already held ICT encryption knowledge
  • already held cloud technologies knowledge
  • already held develop information security strategy skill
  • already held implement ICT security policies skill
  • already held information security strategy knowledge
  • already held manage IT security compliances skill
The 7 learning areas not shown above
Skill to pick up Tier
07 engineering, manufacturing and construction 1 required, 2 supplementary
  • still to learn building systems monitoring technology required
  • optional, not held embedded systems optional
  • optional, not held safety engineering optional
08 services 1 required, 1 supplementary
  • still to learn incidents and accidents recording required
  • optional, not held defence standard procedures optional
09 health and welfare 1 required
  • still to learn operational tactics for emergency responses required
10 management skills 6 supplementary
  • optional, not held lead disaster recovery exercises optional
  • optional, not held manage ICT change request process optional
  • optional, not held create project specifications optional
  • optional, not held define quality standards optional
  • optional, not held manage a team optional
  • optional, not held perform project management optional
11 constructing 1 supplementary
  • optional, not held monitor system performance optional
12 core skills and competences 1 supplementary
  • optional, not held manage digital identity optional
13 generic programmes and qualifications 1 supplementary
  • optional, not held leadership principles optional
46 supplementary skills, helpful but not required
Skill to pick up Tier
  • optional, not held C++ optional
  • optional, not held ICT process quality models optional
  • optional, not held ICT project management methodologies optional
  • optional, not held Internet of Things optional
  • optional, not held Process-based management optional
  • optional, not held Python (computer programming) optional
  • optional, not held cloud monitoring and reporting optional
  • optional, not held cloud security and compliance optional
  • optional, not held consult with business clients optional
  • optional, not held defence standard procedures optional
  • optional, not held embedded systems optional
  • optional, not held implement ICT risk management optional
  • optional, not held implement a firewall optional
  • optional, not held implement a virtual private network optional
  • optional, not held implement anti-virus software optional
  • optional, not held implement spam protection optional
  • optional, not held internet governance optional
  • optional, not held lead disaster recovery exercises optional
  • optional, not held lean project management optional
  • optional, not held manage ICT change request process optional
  • optional, not held manage changes in ICT system optional
  • optional, not held manage keys for data protection optional
  • optional, not held monitor system performance optional
  • optional, not held optimise choice of ICT solution optional
  • optional, not held project management optional
  • optional, not held web application security threats optional
  • optional, not held business intelligence optional
  • optional, not held copyright legislation optional
  • optional, not held create project specifications optional
  • optional, not held define quality standards optional
  • optional, not held ensure information security optional
  • optional, not held ensure proper document management optional
  • optional, not held give live presentation optional
  • optional, not held leadership principles optional
  • optional, not held manage a team optional
  • optional, not held manage digital identity optional
  • optional, not held perform project management optional
  • optional, not held perform risk analysis optional
  • optional, not held perform scientific research optional
  • optional, not held protect personal data and privacy optional

6 further entries not listed here

59 held skills the cyber incident responder role does not ask for
Skill Type
  • not needed by the target role Aircrack (penetration testing tool) knowledge
  • not needed by the target role Backbox (penetration testing tool) knowledge
  • not needed by the target role BlackArch knowledge
  • not needed by the target role Cain and Abel (penetration testing tool) knowledge
  • not needed by the target role ICT infrastructure knowledge
  • not needed by the target role John The Ripper (penetration testing tool) knowledge
  • not needed by the target role Kali Linux knowledge
  • not needed by the target role LDAP knowledge
  • not needed by the target role LINQ knowledge
  • not needed by the target role MDX knowledge
  • not needed by the target role Maltego knowledge
  • not needed by the target role Metasploit knowledge
  • not needed by the target role N1QL knowledge
  • not needed by the target role Nessus knowledge
  • not needed by the target role Nexpose knowledge
  • not needed by the target role OWASP ZAP knowledge
  • not needed by the target role Parrot Security OS knowledge
  • not needed by the target role SPARQL knowledge
  • not needed by the target role Samurai Web Testing Framework knowledge
  • not needed by the target role THC Hydra knowledge
  • not needed by the target role WhiteHat Sentinel knowledge
  • not needed by the target role Wireshark knowledge
  • not needed by the target role XQuery knowledge
  • not needed by the target role analyse network configuration and performance skill
  • not needed by the target role apply reverse engineering skill
  • not needed by the target role audit techniques knowledge
  • not needed by the target role check methods knowledge
  • not needed by the target role computer forensics knowledge
  • not needed by the target role data storage knowledge
  • not needed by the target role design computer network skill
  • not needed by the target role digital data processing skill
  • not needed by the target role educate on data confidentiality skill
  • not needed by the target role establish an ICT security prevention plan skill
  • not needed by the target role forensic intelligence knowledge
  • not needed by the target role gather data for forensic purposes skill
  • not needed by the target role hardware architectures knowledge
  • not needed by the target role hardware platforms knowledge
  • not needed by the target role identify ICT security risks skill
  • not needed by the target role identify ICT system weaknesses skill
  • not needed by the target role implement ICT network diagnostic tools skill

19 further entries not listed here

23 gaps that are knowledge rather than practice

Knowledge gaps usually close through study. Practical skill gaps usually need something you can point at.

Skill to pick up Tier
  • still to learn building systems monitoring technology required
  • still to learn ethical hacking principles required
  • still to learn incidents and accidents recording required
  • still to learn operational tactics for emergency responses required
  • still to learn risk management required
  • optional, not held C++ optional
  • optional, not held ICT process quality models optional
  • optional, not held ICT project management methodologies optional
  • optional, not held Internet of Things optional
  • optional, not held Process-based management optional
  • optional, not held Python (computer programming) optional
  • optional, not held cloud monitoring and reporting optional
  • optional, not held cloud security and compliance optional
  • optional, not held defence standard procedures optional
  • optional, not held embedded systems optional
  • optional, not held internet governance optional
  • optional, not held lean project management optional
  • optional, not held project management optional
  • optional, not held web application security threats optional
  • optional, not held business intelligence optional
  • optional, not held copyright legislation optional
  • optional, not held leadership principles optional
  • optional, not held safety engineering optional
Index

Other moves recorded from digital forensics expert

Full index of moves from digital forensics expert

FAQ

Common questions about this move

Can a digital forensics expert become a cyber incident responder?

Yes, and it is a substantial move. A digital forensics expert already covers 34% of what a cyber incident responder is expected to do: 18 skills carry over, 12 of which the cyber incident responder role treats as required.

What skills does a digital forensics expert need to become a cyber incident responder?

11 required skills are missing, plus 46 optional ones. They fall into 13 areas of the ESCO skill hierarchy, led by working with computers. The single most important is ICT safety.

How hard is the move from digital forensics expert to cyber incident responder?

Its learning distance is 73.7 out of 100, which is the substantial band. That accounts for both how much is missing and how specialised those skills are.

Note

How this record was compiled

Both occupations are taken from ESCO, which lists the skills and knowledge each occupation is expected to have and marks every one required or optional. Nothing here is a prediction about hiring, and nothing here knows that a particular employer wants a particular certificate. Treat Table 3 as a starting point for your own research rather than a syllabus. The full method states what these figures can and cannot tell you.