Title should be adjusted to the actual title of the blog post: (Technical) Infosec Core Competencies InfoSec is a management practice. These technical skills a

Title should be adjusted to the actual title of the blog post: (Technical) Infosec Core Competencies InfoSec is a management practice. These technical skills are nice to have, but with the exception of #1 (understanding CVEs, CWEs, and CVSSs), you do not need the skills on this list in order to acquire and be productive in an InfoSec job. Someone with these technical skills is cut out to be a security researcher, part of a Red Team, working on the detection side of a SOC, or similar. Those are great and valuable roles, but not quite InfoSec. For an InfoSec job, give me someone who knows security management frameworks, can read security guidance, who can lead on processes we use to manage IT security, who can generate (and optionally build) security status reports, who gets the organizational chain of command for how IT security work gets done.