This is a careers column I can honestly say I wish I didn't have to write--at least when it comes to the topic we've chosen. I wish we didn't need to have security personnel for people or for computers, but we do. There are people out there whose idea of a good time is wreaking havoc in as many computers as they can, and the computer world needs more than a few good people to help prevent them from doing so.

If you've got a desire to protect, serve, and defend (and you like computers), consider a career in computer security. There are many positions available in the spectrum of IT security, ranging from the highly technical to more touchy-feely kinds of jobs like training people how to avoid being victims of computer crime.

The need for info security

Hiring-plan data on IT security positions is hard to come by, in part because security is often a facet of other IT jobs. However, according to a 1998 study done by the Computer Security Institute (CSI), security staffs at small organizations are growing at a rate of 68 percent per year. Medium and large organizations were also hiring, but at a slower pace--27 percent for medium companies and 24 percent for larger ones.

These statistics indicate that companies of all sizes are interested in security, which points out something we all know: Security is a necessity, not a luxury. I've talked in this column before about positions that are fundamental to the health and well-being of any company with a few computers. Info security belongs on that list, too.

In today's tough hiring market, most companies don't put security-related IT positions high on their list of must-have employees because they're trying to get more high-profile workers like e-commerce gurus. So if you're interested in an info-security position, keep in mind that while all kinds of companies should be eager to hire you, they may feel they need other IT staff more urgently. In my opinion, this is a mistake that can cost a company everything.

One of the hottest spots for finding an info-security position is with any company doing e-commerce. With e-commerce, you have to give ready access to your Web server, so the old security measures of restricting access don't work anymore. Companies involved in e-commerce have to come up with some way to protect themselves and their data without shutting the door to the Web entirely.

specially vulnerable are dot-com companies that make their living solely on e-commerce, such as Amazon.com. These sites can't afford to be down or unavailable for even a few minutes, and the more visible ones are the targets for all kinds of virtual mischief.

Types of positions

As I indicated earlier, info-security jobs cover a wide range of possibilities. There are two general categories, though, and you should choose the one that best suits your personality. The first is an in-house staff position, in which you help one company with its security needs. The second is an outside contractor or consultant position where you work with a variety of companies on an as-needed basis.

In-house security positions often are mixed with network engineering or administrative positions, especially when companies are small enough that they don't need full-time security personnel. It makes sense--the person who handles the passwords for the network could also handle other security measures. In-house security positions are a natural extension or evolution in the career path of a network engineer.

From the viewpoint of companies, outside consultants in the security field can be the folks who try to crack your security. Or, they can be the guys who set up your security plan, implement it, and maintain it. They can also be the consultants companies call when you find out someone has broken their security and they've got a mess on their hands. In both categories, you'll start out in a junior or entry-level position handling the day-to-day aspects of security and, once again, a background in network administration comes in handy. The next level is where you start to get into evaluating risks and planning appropriate security measures. The top level is where you get to sit in with senior management and do long-range planning on security for the whole organization.

Given the urgency with which many companies feel that they must hire other kinds of IT staff, your best bet today may be to work for an outside consulting firm. You'll be able to pick up a wide range of experience if you volunteer for the tough jobs and, who knows, one of your company's customers might just come courting.

Location and remuneration

If you work for an outside contractor, the company is going to send you where the projects are. That means you'll have to travel, but it also means you could probably live just about anywhere you can get a land line or satellite feed for your computer. You may also be able to do some of your job from your home, especially if your job is trying to crack security.

If you want an in-house security job, your best bet is to focus on areas where there are large clusters of computers. Thus, any of the technology corridors in the country, such as those near Boston, San Francisco, or Seattle, would offer plenty of opportunity. So would areas where the defense industry has settled.

You could expect to earn about $40 per hour in entry-level positions with some training or certification but little experience. To earn more, you'd need to stay up-to-date with the latest certifications and security technology. You'd also need to gain some experience. But after a few years, you could earn $100-$150 per hour--more if you're running your own consulting firm.

You can get more information on the kinds of jobs and the compensation levels for these jobs by visiting a few of the Web sites of computer-security placement firms. Two examples: Computer Security Placement Services and Security Pros.

It's worth the effort

Becoming an info security expert is a worthwhile pursuit, especially with more and more companies depending on their computers and digital repositories for a large part, or all, of their income. You will need to put in some time learning the ropes and keeping up with the latest in potential threats. The risks are high, but so are the rewards-both in money and in career satisfaction. After all, evil never sleeps and the good guys need all the help they can get.

Contributing Editor Molly W. Joss also writes Ask Molly, a daily careers column on ComputerUser.com. Ask her an IT career-related question at askmolly@computeruser.com

Skills and training requirements

The old image of the info security expert is that of a hacker--in fact, some people think that all they need to do is find someone who could give Clifford Stoll a run for his money. The new image of the info security expert is that of a well-rounded computer generalist with knowledge and training in computer security and in dealing with people.

The ability to deal with people and to convey a quiet air of confidence in a time of crisis is especially important for outside security consultants. Think about it--when someone breaks into your home, wouldn't you rather have a policeman with a brain and a heart than one who's just interested in how they got in your house?

You will need extensive training in security measures in the areas of prevention, crisis control, and recovery. A background in network technology is a helpful start, but you will need specialized training as well. You'll also have to keep up with your training and certifications.

There are certification and training programs specifically designed for info security. Case in point: the programs offered by the International Computer Security Association (ICSA). The ICSA offers programs for general computer-security certification as well as certification for specific security products such as those from Check Point Software Technologies and Cisco Systems.

M.W.J.