What does an information security expert do