The merging of the traditional IT professional with security

I was just reading this article by Kelly Jackson Higgins at Dark Reading about companies converging NOCs and SOCs. While the article's topic was very interesting, one quote hit me in particular:

But that doesn't mean the NOC and SOC will completely merge. In fact, security analysts say you need a healthy separation between some duties, especially where security policy implementation and auditing is concerned.

While I agree with this premise of separation of duties of network people and security people, it made me think along another tangent (surprise, surprise).  So many people are talking about security and network convergence now.  Security is moving more and more into the edge (the edge is still there people!).  UTM's and NAC are all the rage.  Non-security companies are snapping up small security companies (EMC, Citrix, etc.)  The stuff is coming together, and security is the central focus of it all.

So where does that leave the IT professional?  I wrote a few days ago about the life of the security professional not being grand and glitzy and that people needed to think twice before they moved into IT Security.  But with the industry convergence, does the average IT professional have any choice but to become something of a security professional as well?  It seems to me that something of a melding is inevitable because security is key to it all.

Think about it this way.  When you teach a security awareness class to your company employees, you don't leave out the IT people.  If anything, you go deeper, and you possibly have a whole other segment dedicated to them because of the sensitive nature of what they do and the access they hold.  So they are (or should be) drilled heavily in security.

Now think about when you buy a router or a switch these days.  More than likely it has some form of security software built in, even if you do not use it.  So the convergence is obvious.  So when you do start using those features, do you have your security people set it up, or do you have your network people do it?  More than likely it is the network people.  And to set that up, they need to have some knowledge and skills in what they are doing.

To be sure, the separation of duties is always important.  It still should be the pure security folks who are writing the policies, auditing and assessing the network, etc.  But I also think that because of the focus on security in the industry and the convergence of security technologies with networking and storage and everything else, we will see the traditional networking and server folks becoming more and more security focused.  Those jobs can never go away, but I see a definite blurring of the lines coming from the traditional networking side of IT.