In my 20+ years in Information Security I have been lucky enough to assess many different and varied enterprise type risks; from accreditations, audits and reviews to low level vulnerabilities (through exploits, forensic type network packet level inspection and vulnerability scanning). This has given me the insight into understanding and articulating what the risk actually is how likely it is to be exploited, though also suggestions into proportionate controls that could be used to manage it. In later life, I have maintained the majority of my technical interests and knowledge, though more focus has gone into how and why information needs protecting and the use of the Information Trinity (Information Management, Information Assurance and Information Governance). So what do I perceive my skills to be?Risk and Risk Management. Identifying, articulating and escalating; getting the right people to understand and own their risks. Vulnerability Management. Software asset management and and using the threat and vulnerability management process to either mitigate and / or remediate. Security Incident Management. To own the Security Incident Lifecycle, from triage to closure. Documenting and developing the processes at each stage. Whilst I realise the above tends to be quite 'high level' I have also been lucky enough to implement lower level technical controls. For instance FireEye deployments, ArcSight SIEM installations, and Threat and Vulnerability Management. My main quality ? I feel that I am that rare breed of technical person that has learnt to develop teams and interface with managers, rather than a sociable person who has learnt (or aspires) to be technical.