Insurers, brokers and reinsurers need people who understand how cyber attacks actually happen, and most security practitioners do not realise how directly their skills transfer into those roles. Cyber insurance sits where security, law and finance meet: an underwriter prices a company's controls, a claims handler steers a live incident to a settled loss, and a risk engineer tells both whether a ransomware supplemental is telling the truth. This guide maps the main roles, the skills each one needs, realistic routes in from security operations, incident response, GRC and consulting, the qualifications that insurance employers recognise, and how to prove you are ready. It is written for security practitioners considering a move and for hiring managers building cyber teams. For what a policy covers and how buyers should approach renewal, see the Cyber Insurance Guide.
Key takeaways
- There are several jobs, not one. Underwriting, claims, risk engineering, broking, and modelling or portfolio work each use security knowledge differently, and each has its own entry route.
- Security depth is the scarce input. Insurance firms can teach policy wordings and pricing; they find it much harder to teach someone how an identity provider, an EDR rollout or a backup design really behaves under attack.
- Insurance literacy is the gap to close. Security people moving across must learn coverage, exclusions, limits, retentions, accumulation and the regulatory duties of an insurer.
- Insurance qualifications matter here. The Institutes' Associate in Cyber Risk Management (ACRM) and CPCU in the US, and Chartered Insurance Institute (CII) qualifications in the UK, sit alongside security certifications such as CISSP or CISM.
- Translation is the daily work. Every role turns technical facts into an underwriting, claims or portfolio decision, so writing and explaining matter as much as technical skill.
The main roles
Cyber teams inside insurers and brokers are usually small, so titles vary and people often cover more than one area. The table below describes the work rather than any single employer's job titles.
| Role | Where it sits | Core question | Typical outputs |
|---|---|---|---|
| Cyber underwriter | Insurer or managing general agent (MGA) | Should we write this risk, on what terms and at what price? | Quote or decline, terms and conditions, subjectivities (controls the insured must have in place before cover binds), referral notes |
| Cyber claims handler or claims manager | Insurer, MGA or third-party administrator | Is this loss covered, and how do we manage it to the right outcome? | Coverage position, panel vendor appointments, reserves, settlement |
| Cyber risk engineer | Insurer underwriting team, sometimes a broker | What do this company's controls really look like, and what would improve them? | Pre-bind assessments, scan reviews, risk improvement recommendations, portfolio insights |
| Broker cyber specialist | Broker | How do we present this client's risk and place the right cover? | Submission packs, market comparisons, claims advocacy |
| Cyber modeller or portfolio analyst | Insurer, reinsurer, catastrophe modelling firm | How much could we lose from one event hitting many policyholders? | Accumulation scenarios, portfolio exposure reports, reinsurance inputs |
| Product and wordings specialist | Insurer or MGA | Does the policy language match the risks we intend to cover and exclude? | Policy wordings, endorsements, exclusion reviews |
Cyber underwriter
The US Bureau of Labor Statistics (BLS) describes underwriters as the people who evaluate applications, decide whether to approve them, and set coverage amounts and premiums, often reviewing recommendations from underwriting software. In cyber, the evidence is the application form, ransomware and other supplementals, external scan results and, for larger risks, a call with the client's security lead. The underwriter decides whether multi-factor authentication (MFA) really covers remote access and privileged accounts, whether backups are isolated, and whether the answers hang together. BLS notes that new underwriters typically train under senior underwriters for up to 12 months, and that automation handles simpler lines while complex risks still need human analysis. Cyber for mid-sized and large companies falls in the second group.
Cyber claims handler
Cyber claims are run as live incidents. The handler takes the first notification, confirms the policy is in force, appoints panel vendors (breach counsel, forensic investigators, restoration and notification firms), sets and revises reserves, and later negotiates business interruption and third-party elements. BLS describes adjusters as investigating claims and negotiating settlements, and examiners as reviewing claims against guidelines. It also notes that licensing for adjusters varies by US state, with some insurer-employed adjusters working under the company's licence. A security background helps the handler challenge forensic scope, understand why restoration takes as long as it does, and spot when a claimed loss does not match the technical story. See the Cyber Insurance Claims guide for the process from the insured's side.
Cyber risk engineer
Risk engineers are the technical specialists in an underwriting team. They interview applicants about their controls, review external attack surface findings, read penetration test summaries, and write recommendations that underwriters can turn into subjectivities or terms. Some also work after binding, helping policyholders improve controls and feeding lessons from claims back into underwriting questions. This is the most direct move for an experienced security engineer, architect or consultant, because the work is close to a security assessment but with a different customer: the underwriter.
Broking, modelling and wordings
- Broker cyber specialist: prepares client submissions, explains control questions to clients, and advocates during claims. Strong for consultants who enjoy client work.
- Modeller or portfolio analyst: builds scenarios where one event, such as a cloud provider outage or a widely exploited software flaw, hits many insureds at once. It needs statistics, programming and a clear view of shared technology dependencies. See the Cyber Risk Quantification Guide for the quantitative methods.
- Wordings specialist: usually a lawyer or senior underwriter, but security input on how terms such as "system failure", "war" or "state-backed attack" map to real incidents is valuable.
Skills: what transfers and what to learn
| Skill area | What security people already bring | What to learn |
|---|---|---|
| Attack paths | How ransomware groups get in (stolen credentials, exposed remote access, unpatched edge devices, phishing) and move to domain admin | How those paths map to loss types: first-party business interruption, data restoration, extortion, third-party liability |
| Control assessment | Judging MFA coverage, EDR deployment, backup isolation, privileged access and logging | Which controls insurers weight most, and how to reach a view in a short call with limited evidence |
| Incident response | Forensic workflow, containment, recovery timelines, evidence handling | Panel vendor models, reserving, coverage triggers, waiting periods for business interruption |
| Risk quantification | Scenario thinking, sometimes FAIR | Frequency and severity data, loss ratios, accumulation, how pricing and capital work |
| Regulation | Breach notification rules, NIS2, DORA, GDPR | Insurance regulation, for example the NAIC Insurance Data Security Model Law in the US and supervisory expectations for cyber underwriting |
| Communication | Technical reports and briefings | Writing short, defensible underwriting or claims notes that a non-technical colleague can act on |
See the FAIR Model and Open FAIR Standard Guide and the NAIC Insurance Data Security Model Law Guide.
Insurance vocabulary to master first
- First party and third party: losses the insured suffers directly (restoration, business interruption, extortion) versus claims made against it (privacy liability, regulatory defence).
- Limit, sublimit and retention: the maximum the policy pays, smaller caps on specific covers such as social engineering fraud, and the amount the insured pays first.
- Claims-made and retroactive date: most cyber policies respond to claims first made in the policy period, for events after a stated date.
- Subjectivity and warranty: conditions an insured must meet before or during cover, often control requirements such as MFA on remote access.
- Accumulation and systemic risk: the risk of one event triggering many policies at once, which drives reinsurance and capital decisions.
- Loss ratio and combined ratio: how an insurer judges whether a book of business is profitable.
Where identity fits
Identity controls carry heavy weight in cyber underwriting. Application forms and supplementals ask about MFA on email, remote access and privileged accounts, about service accounts, and about how local and domain administrator rights are managed. A candidate who can explain how attackers abuse dormant accounts, over-privileged service accounts, long-lived API keys and OAuth grants, and what evidence shows those risks are controlled, stands out in interviews for underwriting and risk engineering roles. See the Identity Controls for Cyber Insurance Questionnaires Guide.
Routes in
| Starting point | Best-fit target role | What you already have | Gap to close |
|---|---|---|---|
| Security engineer or architect | Risk engineer | Control depth, design judgement | Speed of assessment with partial evidence; insurance vocabulary |
| DFIR analyst or incident manager | Claims handler, panel liaison | Incident lifecycle, forensic realism | Coverage analysis, reserving, negotiation |
| GRC analyst or auditor | Underwriter, broker specialist | Questionnaires, control frameworks, evidence | Technical depth on attack paths; pricing basics |
| Security consultant | Broker specialist, risk engineer | Client handling, broad exposure to many environments | Insurance products and market practice |
| Data scientist or threat intelligence analyst | Modeller, portfolio analyst | Statistics, data pipelines, campaign tracking | Actuarial concepts, accumulation scenarios |
| Insurance professional in another line | Cyber underwriter or claims | Insurance fundamentals, market relationships | Security fundamentals and threat knowledge |
See the DFIR Analyst Career Guide, the GRC Analyst Career Guide and the Cybersecurity Risk Manager Career Guide, which covers the closest corporate-side role.
A practical 90-day transition plan
- Weeks 1 to 3, learn the product: read two or three published cyber policy wordings and application forms end to end, and list every control question with what evidence would prove it.
- Weeks 4 to 6, practise the judgement: take environments you know and write a one-page underwriting view for each: key exposures, controls that reduce them, missing controls, and terms you would ask for.
- Weeks 7 to 9, build credentials: start an insurance qualification such as ACRM 401 or a CII unit, and talk to brokers and underwriters about how their teams are organised.
- Weeks 10 to 12, apply with evidence: bring a redacted sample assessment or claims-style incident timeline to interviews. Many cyber teams hire for demonstrated judgement over titles.
Qualifications that insurance employers recognise
| Qualification | Body | Relevance | Facts from the issuer (checked November 2026) |
|---|---|---|---|
| Associate in Cyber Risk Management (ACRM) | The Institutes (US) | The most direct cyber insurance credential | Three courses plus ethics, including ACRM 401 Effectively Managing Cyber Risk and ACRM 402 Successfully Implementing Cyber Coverages; online, self-paced, typically 6 to 9 months; exams of 50 questions in 65 minutes in four testing windows a year |
| Chartered Property Casualty Underwriter (CPCU) | The Institutes (US) | Broad insurance credential for underwriting and claims careers | Eight courses plus ethics: core courses CPCU 500, 520, 530, 540 and 550, a concentration, and an elective that can be ACRM 401; typically 18 to 24 months |
| Associate in Commercial Underwriting (AU), Associate in Claims (AIC) | The Institutes (US) | Underwriting or claims fundamentals | Listed among The Institutes' claims and underwriting designations |
| CII qualifications | Chartered Insurance Institute (UK) | The standard route to recognised insurance knowledge and chartered status in the UK market | The CII offers qualifications for all levels of knowledge and experience; check its current units for cyber content |
| CISSP, CISM, CRISC | ISC2, ISACA | Show security and risk depth to insurance employers | See the linked certification guides |
See the CISSP Certification Guide and the CISM Certification Guide. Choose one insurance credential and one security credential; collecting more does less than a strong portfolio of written assessments.
Deciding which role suits you
- If you like breadth and fast decisions: underwriting. You will see dozens of companies a month and must reach a view quickly.
- If you like incidents and negotiation: claims. Expect pressure, many stakeholders and long tails on large losses.
- If you want to stay closest to technical work: risk engineering. It keeps you in architecture and controls, with insurance as the client.
- If you enjoy data and code: modelling and portfolio analytics.
- Small versus large employers: at an MGA or small insurer one person may underwrite, engineer and support claims; at a large carrier or global broker roles are narrower, with clearer progression and formal training.
Outlook and progression
BLS projects US employment of insurance underwriters as a whole to decline 4 percent from 2025 to 2035, while still expecting about 6,800 openings a year from people leaving the occupation. For claims adjusters, appraisers, examiners and investigators it projects a 6 percent decline over the same period, with about 21,600 openings a year. These figures cover all lines of insurance, not cyber specifically, and BLS links the underwriting decline to automation of simpler policies. The practical reading for security people is that routine work is being automated, while complex, judgement-heavy specialisms such as cyber depend on scarce technical knowledge. See the Cyber Insurance Statistics Guide for market data.
Typical progression runs from assistant or analyst to underwriter, claims handler or risk engineer, then senior and lead roles, then head of cyber underwriting, claims or risk engineering. Some people move into portfolio management, product leadership or reinsurance; others return to corporate security as risk managers or CISOs with a rare understanding of how insurers judge risk.
Measuring your progress
- Assessments written: number of one-page underwriting or risk engineering views produced and reviewed by an insurance practitioner.
- Vocabulary test: you can explain limits, retentions, waiting periods, subjectivities and accumulation without notes.
- Credential progress: courses passed in one insurance designation.
- Network: conversations held with underwriters, claims managers and brokers in your target market.
- Interview feedback: whether hiring managers comment on judgement and clarity, not only technical knowledge.
Common failure patterns
- Treating underwriting as an audit: asking for every control in depth when the job needs a defensible view from limited evidence.
- Ignoring the wording: giving technical opinions on a claim without reading what the policy actually covers and excludes.
- Over-weighting tools: judging a company by product names rather than coverage, configuration and evidence.
- Skipping insurance qualifications: security credentials alone rarely persuade an insurance hiring panel.
- Writing for engineers: long technical reports that an underwriter or claims manager cannot turn into a decision.
Practitioner checklist
- Pick a target role from underwriting, claims, risk engineering, broking or modelling.
- Read at least two cyber policy wordings and two application forms in full.
- Write three sample underwriting views on environments you know, and get feedback.
- Learn the core insurance vocabulary: limits, retentions, subjectivities, claims-made, accumulation.
- Start one insurance qualification (ACRM, CPCU or a CII unit).
- Keep one current security certification that matches your target role.
- Build a short identity controls explainer you can use in interviews.
- Talk to practitioners in your target market before applying.
Standards and references
- US Bureau of Labor Statistics: Insurance Underwriters, Occupational Outlook Handbook
- US Bureau of Labor Statistics: Claims Adjusters, Appraisers, Examiners, and Investigators
- The Institutes: Associate in Cyber Risk Management (ACRM)
- The Institutes: Chartered Property Casualty Underwriter (CPCU)
- The Institutes: Designations
- Chartered Insurance Institute: Qualifications
Related NHI Mgmt Group resources: Cyber Insurance Guide, Cybersecurity Risk Manager Career Guide, Cybersecurity Careers Guide, Insurance Sector Cybersecurity Programme Guide.