Multipotentialite Persons of Cybersecurity

There is a word I like: multipotentiality . It means being good at many different things, instead of one narrow thing. Most schools and most jobs push people to pick one lane early and stay in it. Cybersecurity does not work that way, and the best security people I have met are proof of that.

A curious mind, first

Good security people are curious. Not curious like “I read the news once a week”, curious like “why does this work like this, and what happens if I push it a little further.” They take things apart, on purpose or by accident, and they want to know why something failed before they fix it. This curiosity is not a nice extra. It is the actual engine behind the job. Attackers are curious by nature, so defenders need to be curious too, or they are always one step behind.

Good (curious) at a lot of disciplines

Because attacks can come from anywhere, a good security person cannot stay stuck in one specialty. Over time they end up decent, not necessarily expert, at a very wide spectrum of topics, such as:

• Operating systems, Windows, Linux, macOS, and how each one breaks
• Identity and Authentication, how theses mechanism works
• Software development, enough to read code and spot a bad pattern
• Cloud infrastructure, identity, permissions, and how fast misconfigurations spread
• Cryptography, at least enough to know what “good enough” looks like
• Hardware and firmware, because attacks do not stop at the software layer
• Databases, how data is stored, queried, and leaked
• Legal and compliance basics, because a breach is also a legal event
• Networking, how traffic actually moves and where it leaves trails or marks
• Physical security, badges, locks, and the person who holds the door open
• Incident response and forensics, staying calm and methodical after things go wrong

Nobody is a true expert in all of these at once. But a good security person can hold a conversation in each one, know when to go deeper and know when to ask question to a specialist.

Often it is heard about T shaped people. I would even argue that good it security people are mmmmm shaped when we talk about skills.

The human side matters just as much

Here is the part people underestimate. Technical range alone does not make someone good at this job. The best ones I know are also strong on a very human level. They communicate well, because a vulnerability nobody understands is a vulnerability nobody fixes. They can explain a risk to an engineer and to a board member, in two completely different ways. They have empathy, because most incidents are caused by a tired person who made an understandable mistake, not a bad person. They stay calm under pressure, because panic during an incident spreads faster than the incident itself. They know how to build trust, because people only tell you about the thing they broke if they believe you will help, not punish.

Observations

What I have noticed, working with a lot of different security people over the years, is that this combination is not optional, it is the actual essence of the job. The curious mind that keeps learning new disciplines, and the human skills that let that knowledge actually reach people, both have to be there. One without the other does not really work. A brilliant technician nobody trusts will be worked around. A great communicator with no technical depth will be politely ignored the first time it matters. The multipotentialite, the person comfortable being a generalist across many fields and comfortable with people, is not a nice bonus profile for this field.

Last but not least, look for potential of the people you’re hiring: not what they know as a specialist, but their potential to become an IT Multipotentialite.