You might be grouping this in "policy", but I'd break out "compliance". Getting a company certified under PCI, HIPAA, and friends is a specific and important r

You might be grouping this in "policy", but I'd break out "compliance". Getting a company certified under PCI, HIPAA, and friends is a specific and important role in cybersecurity that doesn't require advanced hands on technical knowledge.