Take a peek into the exciting world of CAI with "Inside CAI"—your exclusive look at various career paths and what it’s like to be on #TeamCAI.

In celebration of National Cybersecurity Awareness Month, we’re shining a spotlight on the critical work our Cybersecurity Team does to safeguard CAI and clients from threats.

In this segment, we chat with Rex Johnson, CAI’s VP, Cybersecurity & Cloud Services. Get an insider’s perspective on the rewarding challenges and opportunities of a cybersecurity career at CAI and discover what makes working here impactful and dynamic.

Q.) What does a typical day look like for you on the cybersecurity team?

There is no such thing as a typical day for cybersecurity. The Cybersecurity Team serves as a strategic partner to our external clients. It is important to keep current on cybersecurity trends, as well as be adaptable to an ever-changing environment. I typically have periodic meetings with our clients’ Chief Information Officers (CIO) or Chief Information Security Officers (CISO). We discuss some of the concerns they have around protecting their most critical assets and resources, while maintaining and improving their cyber posture.

Often, we support our clients with various cyber assessments; penetration testing, purple teaming, or governance risk and compliance (GRC) assessments. Or helping them with a strategy for implementing security such as a managed detection and response service. There are times when a client is hit with a cyberattack. When that happens, immediate action is crucial. In these moments, we step in to support their incident response efforts, often serving as trusted breach coaches to guide them through the crisis.

Q.) What are some of the biggest challenges you face in your role, and how do you tackle them?

It used to be a challenge to get client executives to invest in cybersecurity. As it is not initially a revenue generator for companies, nor is it their core business. But with the number of breaches that occur on a regular basis, there is more interest in making the investment.

Cyber is more of a function of risk than IT. We know that it is impossible to always prevent a cyberattack for our clients. So, in the event of an attack, our goal is to mitigate the impact. Sometimes it is a tabletop exercise to test how they would respond to an actual cyberattack. This allows them to practice their roles should a breach happen and is one of the best ways for a client to be prepared. Continuous education is also very important for cybersecurity, as new technology may create new challenges. For example, while AI has been a great tool and provided the ability to use this technological advancement, the threat-actors are using this as well. It is vital to be aware of these threats and consider how to better safeguard against them.

Q.) How does collaboration play a role in your day-to-day activities?

Collaboration with clients’ boards and executives and internal security and IT teams are key to meeting business objectives and managing risk. Our goal is not to point out deficiencies but to support and empower teams to excel in their roles. Once mutual understanding is established, we can deliver the services and solutions that best meet their needs. A great example is purple team engagement. This is a collaborative effort between the client’s security (the blue team) and the ethical hackers (the red team). This allows us to simulate real-world cyberattacks, identify vulnerabilities, and improve security posture through shared insights and real-time feedback. These exercises have always helped our clients improve.

Q.)What skills are crucial for succeeding in cybersecurity, and how do you keep them sharp?

Cybersecurity has a variety of careers. There are penetration testers, security analysts, digital forensics, incident responders, GRC analysts, and cyber management. Regardless of the role, each can earn certifications that will require them to pursue Continuing Professional Education (CPE) annually either in-person, online, or through attending conferences such as B-Sides, DEF CON, Black Hat, RSAC. Available certifications depends on the career track:

For penetration testers:

Certified Ethical Hacker (CEH) – Focuses on ethical hacking and penetration testing skills
Offensive Security Certified Professional (OSCP) – Known for its rigorous hands-on exam, emphasizing practical penetration testing skills

For GRC:

Certified Information Systems Auditor (CISA) – Geared towards professionals who audit, control, monitor, and assess information technology and business systems
Certified Information Security Manager (CISM) – Aimed at management-focused individuals who oversee and manage enterprise information security
Certified in Risk and Information Systems Control (CRISC) – For IT professionals who manage enterprise risk and design controls to mitigate them

General entry-level certifications:

Certified in Cybersecurity (CC) – Offers foundational knowledge in security principles, business continuity, access controls, network security, and security operations
CompTIA Security+ – Validate foundational skills in cybersecurity
GIAC Security Essentials (GSEC) – For professionals who want to demonstrate technical skills in IT security

More advanced and senior certifications:

Certified Information Systems Security Professional (CISSP) – One of the most recognized certifications in the field for experienced security practitioners
Certified Cloud Security Professional (CCSP) – Focuses on securing cloud-based environments and services

Q.) How do you stay up-to-date with the latest trends and threats in cybersecurity?

Attaining the cybersecurity certifications and keeping up with the annual CPEs can certainly help. Additionally, you can consume news or podcasts that specialize in the cybersecurity industry. I personally subscribe to a few different services. One of them is the RSAC which is a global information security community gathered around the RSA Conference that provides an online daily news brief. I also recommend Cyberwire Daily from N2K Networks that offers cyber news, analysis, and expert interviews.

Q.) What advice would you give to someone aspiring to join the cybersecurity field?

Many people start their cybersecurity careers in a security analyst role—an entry-level position to get their foot in the door. From here, consider what cyber career field you would like to pursue. For some it’s penetration testing, for others it’s GRC, and others find digital forensics intriguing. The key is joining the right organizations to learn more and build upon your understanding. Some of these include the International Information Systems Security Certification Consortium (ISC2), Information Systems and Controller’s Association (ISACA), Women in Cybersecurity (WiCyS), among others.

In my time, I’ve seen individuals discover a deep excitement for the field and have gone on to pursue rewarding career paths. To anyone considering their next step, my advice is simple: follow your passion. When you find a career that truly ignites your curiosity and drive, the possibilities for growth and fulfillment are endless.

If you’re inspired by Rex’s advice and are ready to take the next step in your career, CAI offers an unparalleled cybersecurity career path. Join our talent community to receive updates on company news, events, and open roles. Whether you’re just starting out or looking to advance, there’s a place for you here!