I also work in IT security but rarely reveal it to people. There are so many misconceptions about what the job entails, it usually derails the conversation and I spend the next 20 minutes insisting my job is incredibly boring, tedious, and nothing at all like the movies.

I usually just tell people I do "customer service". It's true enough.