What each role is actually like.

Imaging, app packaging, hardware swaps, deskside escalations, hands-on Windows/macOS estate work.

Intune policies, Autopilot, compliance baselines, app delivery, the modern desktop estate at scale.

Stakeholder meetings, capability maps, multi-year roadmaps, vendor reviews.

Phones, tickets, password resets, the literal front door of IT.

Hypervisors, storage, network fabric, the layer above the OS and below the app.

Run-book ownership. Endpoint, identity, light cloud, light networking, occasional firefighting.

Ticket queue, password resets, hardware swaps, fast feedback, low autonomy.

Patching, basic AD, file shares, supervised changes, the apprentice rung of sysadmin.

Own the boxes. Patching, backups, AD/Linux, the occasional 2am alert.

vCenter, NSX, storage fabric, the boring layer that keeps the lights on.

Long campaigns, C2 OPSEC, custom tooling. Adversary emulation as a craft, not a script-kiddie sport.

Threat-modelling features, reviewing code, hunting bugs in web/mobile, building paved roads with devs.

Board decks, budget defence, incident accountability, regulator calls. Most weeks are politics and translation, not engineering.

Guardrails, CSPM tuning, IaC scanning, incidents in 200 AWS accounts.

Evidence collection, audit prep, ISO/SOC2/PCI cycles, long workstreams with hard deadlines.

Sentinel content, Defender XDR tuning, KQL all day, the modern Microsoft detection engineer.

Write Sigma/Splunk rules, tune noise, hunt the gap your SIEM missed.

On-call rotations, evidence preservation, timeline reconstruction, security at its most clinical.

Weeks debugging a single primitive, bugs, mitigations, ROP, kernel internals.

Disk and memory imaging, chain of custody, court-ready reports, the slowest, most evidentiary lane.

Frameworks, audits, control evidence, translating tech into board language.

Identity lifecycle, SSO, federation, conditional access, the unsung gate.

Breaches, forensics, war rooms, the call at 3am that defines the quarter.

Tier-1 alert triage. Close the false positives, escalate the rest, learn the playbooks.

Reverse-engineering binaries, unpacking, writing YARA, deep solo focus.

Firewalls, segmentation, SSE/SASE, east-west controls, perimeter engineering as a craft.

Scope, recon, exploit, write the report nobody reads. Repeat next engagement.

Certificate authorities, HSMs, key rotation, signing infrastructure.

Guardrails, paved roads, golden images, policy-as-code, security inside the platform team.

Long campaigns, adversary emulation, AD chains, evasion against modern EDR.

Static + dynamic analysis of unknown binaries. IDA/Ghidra, sandboxes, hours of patience.

Risk registers, control mapping, vendor reviews. Translating security into business probabilities.

Reference architectures, trust boundaries, design review, security as a systems-design discipline.

SOAR playbooks, glue scripts, ticket enrichment, replacing your own toil.

1:1s, vendor calls, board updates, budget, security as a people-and-strategy job.

Triage in Sentinel, run playbooks, investigate XDR incidents. Tier-2 SOC for Microsoft estates.

Triaging alerts on rotation, writing tickets, chasing false positives.

Shift rotations, metrics, vendor management, mentoring tier-1.

Hypothesis-driven hunts across telemetry, proactive, low-alert, high-judgment.

Bug hunting at scale, fuzzing, CVE drops, conference talks if you're lucky.

Subscriptions, RBAC, networking, VMs, governance, the day-to-day operator of an Azure estate.

Whiteboards, design reviews, cost models, less keyboard time than you think.

Provision, glue services, fight IAM, own one cloud account end-to-end.

Ticketed cloud work. Provisioning, IAM cleanups, supervised changes inside someone else's design.

Tenants, Exchange Online, Teams, SharePoint, Entra, the productivity plane of Microsoft shops.

Customer calls, reference architectures, PoCs, occasional code review.

Pipelines, infra glue, on-call, the team everyone blames when CI is slow.

Bake security into the pipeline. SCA, SAST, IaC scanning, dev advocacy.

Cluster ops, operators, networking quirks, helm charts that nobody reads.

Metrics, traces, logs at scale. Prometheus, OTel, the cost spreadsheet.

Build the paved road. Internal platforms, golden paths, developer experience.

SLOs, error budgets, postmortems, building the thing that pages you less.

NOC-adjacent. Tickets, change windows, supervised configs, 2am pages occasionally.

Ansible + Python against network gear, CI for configs, less CLI than you'd think.

Packets, VLANs, BGP at 3am. Methodical, deep, occasionally on-site.

Monitoring screens, ticket triage, change-window execution, the network equivalent of Tier-1 SOC.