A lateral move - Network Engineer -> IT Auditor?

f0rgiv3n

My mind is going a million miles an hour these days and came across something that I never thought about before. I might have an opportunity to make a change, a BIG change. I'm currently (and have been) a network engineer, an "IT guy". The nitty gritty nuts and bolts. I've always had my end goal set to be information security. I figured, the only way to secure something is to know how it works... which is what led me this far.

I NEVER thought about becoming an IT auditor until I worked with some on a few projects recently. There's a possibility that I could make a move into IT auditor from where I'm at. It's scary because I'd be leaving the technical nuts and bolts side of things that I've always known and moving towards more of a "big picture" side of things.

Pros:
Gives me a stepping stone towards more of an executive position in the future.
A big portion of it is information security
I'm all about process improvement, which is another big portion of the job
Better pay
It would make me a more rounded individual by having the deep technical experience as well as the auditing/business side.
No late night deployments

Cons:
I'm scared. I feel like I'd be "leaving" what I've always known (by nuts and bolts, I mean actual equipment configuration)
No late night deployments (yes, it's on both pro and con... sometimes this part is fun, sometimes it sucks)
I would for certain lose some technical knowledge since I wouldn't be using it (but since I always planned on more managerial/big picture stuff... this was going to have to happen eventually?)

Neither Pro nor Con:
Risk. I would be taking a big risk: What if I don't like it? But what if I DO like it?!
I'm planning on getting my MBA here soon, which would help out for certain with this path.
I recently made a personal discovery that I don't think I want to have to "keep up" with technology for the rest of my career. Meaning that in order to keep my standard that I set for myself as far as professional knowledge/ability, I wouldn't really ever be able to slow down from what I'm at now...


Can you guys provide any insight/input for me? It's not like I have a job offer or anything, but I'm considering whether or not I should throw my hat into the mix.

DevilWAH

Never be sacred. Or at least don't let is stand in your way, just as bad is people who think they know it all and go in all guns blazing and wreak everything.

I say if it looks interesting throw your hat in the mix and see what happens. If it does interest you you will quickly learn and before you know it you will wonder why you where worried. One thing I have learnt is you don't get any where waiting for the "perfect opatunities", you have to pick whats on offer and make it the Perfect role once you are in it.

Look it at this way if you turned it down you might weight years for another role you like to come along. If you take this job in 6 months to a year you will have another set of expertise and experience on your CV.

paul78

I couldn't help noticing that the way you expressed your concerns was in terms of risks weighted with pragmatic pros and cons. That in itself tells me that you have the mindset to be a great auditor. Good luck to you. To learn more about IT auditing and governance, surf over to the ISACA web site.

CodeBlox

Take a leap of faith! I did and it got me out of helpdesk and into a Systems Admin role.

Essendon

Do you WANT to be an auditor? When auditors come to your company to do their thing, are you like - Gee, I wish I was that guy. If yes, it may just be the thing for you.

Werent you gunning for the CCIE mate?

paul78

Essendon wrote: »

When auditors come to your company to do their thing, are you like....

Good point. When an auditor visits, we are unusually polite and friendly but deep down we would prefer to throw sticks and stones at them

hollister

I made a similar switch about 5 years ago, when family circumstances made the call schedule and allnighters impossible. While I could see myself maybe going back into an incident response or vulnerability management type job, audit is much more my thing now than operations. A few thoughts:

1. Do shortcuts and sloppy work irritate you?
2. Do you get frustrated when you don't have the resources to make the system secure (and can't get them)?
3. Are you a good writer?
4. Do you document your work carefully and completely?
5. Do you care more about getting things fixed than taking the credit (or getting people in trouble)?
6. Can you read people well?
7. Do you know how and when to dig for more information?
8. Can you think on your feet?
9. Can you explain technical problems to non-technical people?
10. Are you comfortable speaking in front of senior management

If you answered yes to most, audit may be a good fit. I like it because our recommendations get fast results (much faster than when I made the same recommendations as an IT manager!). It's also a field where you have to constantly learn and adapt. It was hard for me to not be the expert anymore so I understand your concern there - but you will become the expert on the controls, laws and standards and can use this to keep your old friends out of trouble.

(One other thing - they won't be your friends anymore. But strive to remain allies.)

Message me if you want to chat offline. Good luck with your decision.

A funny take on it here: Computer audit FAQ