Boring Cybersecurity Theory: Main disciplines (Time to select your own way)

I didn’t put this article at the start of your journey – in my opinion, it’s hard to choose where you’re going if you haven’t yet seen what the road looks like, what challenges lie ahead, or who you’ll be walking beside.

Now that you’ve already explored some of the core ideas of cybersecurity ( threats, frameworks, ethics, risk) – it’s the perfect moment to step back and ask:
What kind of security professional do I want to become?

Welcome to Cybersecurity – A World of Many Roads

When most people hear the word „cybersecurity“, they picture someone in a hoodie hammering away at a keyboard in a dark room. In reality, though, cybersecurity is much more than just hacking or stopping hackers. It’s a vast and constantly evolving field, made up of many disciplines – each with its own tools, challenges, and mindset.

Think of it like a city – there’s construction, maintenance, policing, investigation, intelligence gathering, governance, and even education. Each of these areas has a role to play in keeping systems and people safe. And just like in a city, cybersecurity needs builders, thinkers, defenders, and strategists.

This article will help you understand the main domains in the cybersecurity world. You’ll see how they connect, what types of jobs exist in each one, and – more importantly – which direction might suit you.

Whether you prefer digging through logs, breaking into systems (legally), writing secure code, or shaping security policy, there’s a path here for you. All you have to do is find it.

Let’s begin with one of the most widely recognized models – the NIST NICE Framework.

Seven Core Disciplines (NIST NICE Framework)

Another framework? Yes – but hear me out. In cybersecurity, there’s pretty much a framework for everything: how to detect attacks, how to respond, how to manage risk… and yes – even how to structure careers.

To help make sense of the many roles in cybersecurity, the U.S. National Institute of Standards and Technology (NIST) created the NICE Framework – a structured way to group security work into seven high-level categories. Each one represents a different part of the cybersecurity lifecycle, and within each are roles that suit different interests and skillsets.

Let’s take a quick tour through each one – who works there, what they do, and why it might just be the right place for you.

Here’s a quick tour of the seven:

1. Securely Provision

Design and build secure systems from the ground up
If you love building systems, writing secure code, or designing cloud infrastructure – this is your zone. These roles focus on baking security in from the start.
Roles: Security Architect, Secure Software Developer, Cloud Security Engineer.

2. Operate & Maintain

Keep everything running safely
You’re the one making sure systems stay up, stay patched, and stay protected. Quiet when things are working – very loud when they aren’t.
Roles: System Admin, Patch Lead, IAM Engineer.

3. Protect & Defend

Detect and fight off threats
Welcome to the Blue Team. You’ll be monitoring, analyzing logs, blocking attacks, and leading incident response. If you like action and puzzles, this is your home turf.
Roles: SOC Analyst, Threat Hunter, Incident Responder.

4. Investigate

Dig into breaches and trace the digital fingerprints
Ever wanted to be a cyber detective? These roles involve forensics, malware analysis, and figuring out what really happened – byte by byte.
Roles: Forensics Analyst, Malware Analyst, Reverse Engineer.

5. Collect & Operate

Offensive security – the ethical attackers
Here you’ll find the Red Team. You break into systems to help others defend them. It’s creative, methodical, and definitely fun – if you like thinking like a hacker.
Roles: Penetration Tester, Red Team Operator, Exploit Researcher.

6. Analyze

Turn chaos into clarity
Threat intelligence, OSINT, behavior analytics – this is the strategic side of security. If you enjoy spotting patterns, researching actors, or thinking globally, this one’s for you.
Roles: CTI Analyst, OSINT Investigator, Threat Modeler.

7. Oversight & Governance

Keep the business side of security in order
From compliance and policy to risk management and privacy law, this is where cybersecurity meets law, ethics, and leadership.
Roles: Risk Analyst, GRC Officer, CISO, Privacy Engineer.

Each of these disciplines has its own rhythm, mindset, and mission. No path is “more cybersecurity” than another. It’s all about where your strengths lie – and what kind of work energizes you.

As in the hacking world, cybersecurity uses colors to classify not people, but teams, based on their methods and intentions.

The Color Team Model: Cybersecurity in Full Spectrum

If you’ve ever read about cybersecurity operations, Capture the Flag (CTF) events, or real-world attack simulations, you’ve probably come across terms like Red Team or Blue Team. This is known as the “color team model” – a popular way the cybersecurity community classifies roles based on their goals and tactics.

It’s not an official framework like NIST, but it’s widely used because… well, it works – and it paints a pretty vivid picture of what each role does in real-world operations.

Here’s a quick rundown:

🟥 Red Team – Attackers (Ethical Hackers)

These are the offensive professionals. They simulate real-world adversaries to test defenses. Red teamers try to breach systems, escalate privileges, steal data — but they do it with permission.
Goal: Show how a real attack might happen before an actual attacker gets there.
Typical roles: Penetration Tester, Red Teamer, Exploit Researcher.

🟦 Blue Team – Defenders

The Blue Team builds and maintains defensive mechanisms. They monitor systems, detect anomalies, respond to incidents, and make it as hard as possible for attackers to succeed.
Goal: Stop or slow down attackers and minimize damage.
Typical roles: SOC Analyst, Incident Responder, Threat Hunter, SIEM Engineer.

🟪 Purple Team – Bridge Between Red and Blue

Purple teams don’t replace Red or Blue – they connect them. A Purple Teamer might help a Blue Team improve detection by analyzing Red Team techniques or facilitate joint exercises.
Goal: Share insights and improve defense through collaboration.
Typical roles: Detection Engineer, Purple Team Analyst, Adversary Emulation Lead.

🟩 Green Team – Builders and Coders

Often overlooked, Green Teams work on secure software development. Their job is to build systems and code with security in mind from day one. Think DevSecOps, secure APIs, encryption, etc.
Goal: Bake security into the foundation, so it’s harder to break later.
Typical roles: DevSecOps Engineer, Secure Developer, Cloud Security Architect.

⚪ White Team – Rules and Coordination

White Teams act as referees in exercises like Red vs. Blue simulations. In real life, they handle governance, oversight, and policy, ensuring ethical boundaries are respected and standards are followed.
Goal: Coordinate and enforce fairness, legality, and scope.
Typical roles: Compliance Officer, GRC Lead, Security Awareness Coordinator.

🟨 Yellow / Gold Team – Leadership and Strategy

This team focuses on high-level decisions, business alignment, and long-term planning. They’re not in the trenches but set the direction and strategy.
Goal: Ensure cybersecurity supports business goals and complies with regulations.
Typical roles: CISO, Security Program Manager, Risk & Policy Advisor

Each team represents a different aspect of cybersecurity – and while the colors may vary depending on context, the core idea is the same:

Cybersecurity isn’t a solo effort. It’s a team sport – and everyone plays a different role.

Connecting Frameworks and Colors

How NICE Roles Map to Red, Blue, and Everything In Between
Now that you’ve seen both the NIST NICE disciplines and the color team model, let’s bridge the two.

Why?
Because while frameworks help define structure, real-world cybersecurity work rarely stays in clean categories. A Red Teamer might use skills from „Collect & Operate“ but also dive into analysis. A Blue Teamer might patch systems (Operate & Maintain) while investigating an incident.

Here’s a simplified view of how the NICE categories align with color team concepts:

Keep in mind: these lines blur in real-world environments. Your role may sit at the intersection of two or even three teams – and that’s completely normal.

So where do YOU fit?

• Like building secure systems from scratch? → You’re likely Green or White aligned.
• Love breaking things to find flaws? → Red Team might be your jam.
• Prefer defending and investigating? → Blue and Purple are calling.
• Want to strategize, govern, or teach? → White and Yellow roles could suit you best.

There’s no wrong answer – but there is a right fit for your interests, mindset, and energy. The fun part is figuring it out.

Choosing Your Path: What Fits You Best?

Now that you’ve explored the landscape, it’s time for the big question:

Where do you see yourself in this world of roles, colors, and responsibilities?

Don’t worry – you don’t need to have it all figured out today. But here are some ways to start narrowing it down.

Start with your instincts:

Ask yourself:

• Do I like building things, or breaking them?
• Do I prefer real-time action, or quiet analysis?
• Am I more comfortable with people and policy, or with code and systems?
• Do I enjoy watching patterns, telling stories from data, or writing procedures?
• Do I want to be in the front lines, or working behind the scenes?

Your honest answers will already start pointing you toward a discipline (and maybe even a color team).

🛠️ Match your mindset to disciplines:

Not sure yet? That’s fine.

Here’s a secret most professionals won’t tell you:

Many cybersecurity careers are built by exploring first, specializing later.

Start with what excites you. Learn broadly. Play around. Watch CTFs, take a short course, read breach reports, or try OSINT on yourself. The field is wide – and there’s more than one way to get in.

You don’t need to be a hacker or a genius to belong here. You just need curiosity and persistence. The rest will come.

Final Points

Final Points – because this is, for now, the end. Not the end-end, of course – I’m sure there will be more articles in the future, though I can’t promise when. My hope is that what you’ve read here gives you enough structured and connected ideas to start building your own picture of cybersecurity.

Funny thing is, this series wasn’t even meant to be a series. At first, it was just going to be one short article to help prepare for a workshop. But the more I wrote, the more I realized how much there was to say – and I didn’t want to just skim over it. One article turned into many, and here we are.

I’ve probably given you more than enough to start thinking – and that’s the point. I wanted you to see just how wide and varied this field really is. It’s not just “hacking” or “defending”. It’s building, breaking, analyzing, guiding, fixing, and leading.

Now the map is in front of you. The next step? Choose a direction. Build a plan. Start small – a course, a pet project, maybe an internship. Don’t worry about knowing everything; you’ll learn along the way.

Cybersecurity is a journey, and you’re already on it. It’s not a straight line – it twists, it turns, it surprises. And who knows? Maybe one day, somewhere along the way, our paths will cross.