There’s so much to learn, when you’re trying to get into cybersecurity. You study, learn, and network. Then along the way, you notice that occasionally people say information security, instead of cybersecurity. Some people use the two interchangeably. The usage is confusing, but you may be reluctant to ask.

The confusion is understandable. Many professionals in the field—yours truly included—regularly switch between the two terms or simply use the wrong one. Why? More on that shortly. First let us inquire, what is the difference between cybersecurity and information security?

Allow me to provide a non-technical analogy.

Everybody knows what a dog is, right? (One is sleeping next to me as I write this.) Regularly, we refer to dogs as canines. In fact, we act as if canine is simply a fancy word for dog. Here’s the thing… Dogs and canines aren’t necessarily the same thing. Sure, dogs are canines. But wolves, coyotes, and jackals are canines too. Yet when a police cruiser labeled “K-9 Unit” drives by, you would never expect a 120-pound wolf to stick its head out the window. Yet, despite the inaccuracy we still regularly treat dog and canine as synonyms in English.

In this analogy cybersecurity is the dog and information security is the canine. Cybersecurity involves confidentiality, integrity, and availability—known as the CIA Triad—for computer systems and networks. Information security is broader, encompassing domains such as identity and asset management (IAM), security assurance, security architecture, and more. Cybersecurity is part of information security, but information security is bigger than just cybersecurity.

So why do professionals in the field mix the two up? Largely because cybersecurity has developed a brand and awareness. Everyone has heard of cybersecurity nowadays. Even if they cannot explain precisely what cybersecurity is, they know it has to do with stopping bad guys on computers. It took a few decades for cybersecurity to enter the public’s consciousness. Thus it’s simpler to say cybersecurity, when you really mean information security.

Cybersecurity is part of information security, but information security is bigger than just cybersecurity.

To be fair, as people move around in their career, they may move from a cybersecurity role to an information security role, then back to another cybersecurity role. Of note however, the top job in this field is called the Chief Information Security Officer (CISO), not the Chief Cybersecurity Officer.

While professionals in the field are capable of in-depth discussions about the difference between cybersecurity and information security, rest assured that our friends and families have little interest in hearing them. Thus, if you bump into us at a barbecue, we’re likely to just say we work in cybersecurity. Even though we know, it’s an imperfect answer.

What is the most valuable skill set which I would recommend that information security newcomers learn? That’s an interesting question. After all, infosec isn’t a single job. The information security career field consists of easily over a dozen roles. So what single skill would be valuable across the spectrum? Easy. Cloud computing. It provides the greatest benefit across a range of roles for information security professionals.

Not every infosec role is technical, but it’s vital that every infosec professional achieves a reasonable level of technical acumen. In previous years, that might have included studying for the CompTIA Network+ or a similar certification.

The rise of cloud computing provides newcomers with a leapfrog opportunity. They can go directly to the new, in-demand skill without needing to focus on on-premise networking first. There’s even an advantage. Newcomers won’t have to unlearn legacy ways of doing things, based upon the limitations of on-premise technology.

Here’s the bonus. If you gain a solid understanding of cloud computing, you’ve also acquired a basic understanding of on-premise computing.

Cloud is the Future

In the not-to-distant future cloud security will simply be called “cybersecurity.” That’s because so much of organizations’ infrastructure will be in the cloud, that securing the cloud will no longer be a niche subset of cybersecurity. Not surprisingly, many infosec senior leaders today have no cloud background and don’t have the bandwidth to develop this new skill. This creates opportunity for the newer generation.

By learning cloud you can stand out with an in-demand skill set, which can be reasonably relevant for on-premise security as well. Cloud computing also introduces concepts like shift left and policy-as-code, which skilled infosec professionals can leverage to improve an organization’s entire security program.

How much demand is there for cloud-literate professionals? According to the consultancy Deloitte between 2017 and 2020 the number of cloud job postings increased by 97%. While 90% of IT leaders planned to expand their cloud environments, 80% said a shortage of cloud-literate staff is holding them back.

In the same Deloitte report, Megan Slabinski–a district president at the recruiting firm Robert Half–stated, “Cloud computing remains the number one most sought-after skill.” When you combine the cloud skills shortage with the cybersecurity workforce gap—3.4 million roles remained unfilled globally in 2022—a very compelling opportunity becomes evident.

Learning Cloud 

So where do you start? If you’ve already landed your first information security job, learn whichever cloud platform your organization is using. If you haven’t landed your first infosec job yet, learn AWS. It has a robust number of certifications and training available, and the concepts are transferable between platforms.

Learning a new cloud platform after AWS is like learning a second romance language. If you learned to speak Spanish already, learning Portuguese or Italian shouldn’t be too difficult.

Personally, I’ve found A Cloud Guru and Tutorials Dojo very effective resources in studying for and passing cloud certifications. I used ACG for certification courses and TD for practice tests.

I’m a supporter of certifications, because they provide a standardized way to learn a new skill set to an established standard. Of course, this must include a good amount of learning by doing. Your cloud certification journey should include ample time spent hands-on-keyboard in the console. After all, the goal is to learn new cloud skills. Certifications are simply evidence of having done so; they are not the genuine goal.

Cloud Adoption

Organizations across the globe are working on digital transformation efforts, which largely means that they’re working on their cloud adoption. If technology teams can build it, security teams need to defend it.

As such, you can expect the demand for security professionals with cloud skills to remain high. The shift towards cloud computing will force information security programs to shift as well. That includes integrating concepts which allow us to be more efficient and effective. If you want to be an information security leader of tomorrow, there’s a lot of benefit to learning cloud computing today.

We’ve discussed the value of networking the journey to your first cybersecurity job. A side effect of your networking is that you’ll develop a group of cybersecurity professionals and leaders who are interested in your success. These stakeholders are people who took the time to review your resume, talk to you about different cybersecurity specialties, made introductions for you, and so on.

There is one last step to your journey to become a cybersecurity professional. It’s by far the easiest. After you accept an offer for your first cybersecurity job, contact the people who helped you get there. It doesn’t need to be anything overly elaborate. Call them or send them an email and let them know about your success.

They’ll have interest in hearing about your new role. Tell them what excites you about the new position. You can even mention your ambitions in the coming years. Then of course, thank them for their role in your journey. Do this before making your big LinkedIn announcement of your new role.

After you accept an offer for your first cybersecurity job, contact the people who helped you get there.

This simple, but important step, serves a few purposes. First, the people who helped you genuinely wish you success. Cybersecurity needs more good people. If you're smart, curious, and driven, we need you. Let your stakeholders know that they helped add another cybersecurity professional to our ranks.

Second, the followthrough helps to further develop your cybersecurity relationships. There is a value to having a cybersecurity network that extends beyond your employer. By demonstrating that your contact is more than transactional, you can help develop relationships that go beyond one-time assistance.

Cybersecurity needs more good people. If you're smart, curious, and driven, we need you.

Third, you’ll demonstrate that you’re a class act. It’s easy to post your career update to LinkedIn with the presumption that all your stakeholders will see it there. It takes effort to individually create messages to the people who helped. The effort will serve as a demonstration of your character.

It can be challenging to get into cybersecurity. Because of that challenge it will feel truly amazing when you get that first job. After you do, make sure you stick the landing. Properly thank the people who helped you. It will impact how your cybersecurity stakeholders view you as a professional.

Becoming Cyber Newsletter

What Makes Cybersecurity a ‘Future-Proof’ Career?

In a world in which workers—both blue- and white-collar—increasingly see their livelihoods automated away, cybersecurity remains a future-proof career. That’s great for cybersecurity professionals. It can be motivating for aspiring entrants. While technology continues to disrupt seemingly every career field, this on…

Read more

5 years ago · Anonymous

Becoming Cyber Newsletter

Cybersecurity Is A Relationship Business

When people think of the cybersecurity profession, many naturally think of the technical aspect. You certainly need technical proficiency. Many would be surprised to hear, however, that cybersecurity is really a relationship business. Whether you look at the protected or the protectors, people are the lynchpin. The systems and applications, which cyberse…

Read more

5 years ago · Anonymous

I write a lot about the value of certifications on the road to landing your first cybersecurity job. However, on the internet you’ll see plenty of people loudly proclaiming that certifications are BS and the only thing that matters is hands-on experience. So which is it? In order to make yourself marketable, should you pursue certifications or hands-on experience? The short answer is: both.

Value of Certifications

A cybersecurity certification provides more than a fancy piece of paper, a colorful badge, or resume filler. It provides a roadmap to learn something new. For example, let’s take the Certified Ethical Hacker (CEH) certification. You could absolutely learn about ethical hacking without the CEH. The benefit you get from the certification is a curated agenda of skills and knowledge to work with.

Admittedly, passing a certification exam isn’t a demonstration of expertise in a given subject area. After all, the passing score for most certifications is somewhere around 70%. Back in your school days your parents wouldn’t have been particularly impressed with a report card touting 70%. What passing a certification does demonstrate is that you understand the topic to a widely understood, acceptable standard. The CompTIA Security+ exam is the same exam around the world. On the other hand, your college course or individual learning will vary in covered topics and depth.

Detractors claim that passing a certification simply demonstrates that you’re good at taking certification exams. There’s a bit of truth there. The exams are often in a familiar computerized, multiple choice format. (We’ll carve out an exception for the Offensive Security Certified Professional (OSCP) certification. I’ve never heard anyone claim this 100% hands-on exam is anything less than challenging.) All things considered, you’ll have an advantage if you’re good at standardized tests. That skill is not enough though. You need to actually learn the material.

Honestly, the loudest critics of cybersecurity certifications are a bit disingenuous about the realities of landing a job with no prior cyber or IT experience. Breaking into cybersecurity is hard. The HR software and recruiters are screening most people out based on the content of their resumes. In the absence of professional experience, certifications are valuable in helping get your resume to the hiring manager. Certifications help in the recruiting process.

Value of Hands-On Experience

While certifications provide a great roadmap to learn new skills, the best way to actually learn new skills is by doing. Build things. Take things apart. Break things. Fix things. Watching a demonstration is useful. What’s more useful? Working to get things to work on the second, third or fourth attempt. Those lessons will stick with you more than a demonstration. You get a lot of value from hands-on experience. After all, real life isn’t a multiple choice test.

How do you get hands-on experience? There are three effective ways to go about it:

1. Join a cybersecurity bootcamp

2. Use an online cybersecurity lab environment

3. Build a cybersecurity lab environment

Cyber Bootcamp

There are pros and cons to cybersecurity bootcamps. They can be worthwhile, but you’ll really want to do your research. Not all bootcamps are created equal. Here’s some with checking out.

• 21 Best Cyber Security Bootcamps | Course Report

• Cybersecurity | NPower

• Cybersecurity Analyst Training | CyberNow Labs

Online Cyber Lab

Want something easy to get your feet wet? Looking for a taste of cybersecurity to see, if it’s really for you? Online cybersecurity labs are a painless way to get access.

• Cybersecurity Lab | Nova Labs

• Immersive Labs

• Cyber Skyline Professional

• Infosec Skills | Infosec Institute

Home Cyber Lab

Nothing says “hands-on experience” like building your own cybersecurity lab. Obviously, you don’t know what you don’t know. So leverage some quality online guidance on how to build a home cybersecurity lab.

• Building a cybersecurity lab: A simple guide on using security operating systems to build a home lab | Medium

• Building a home cybersecurity lab | AT&T

• Building a Cybersecurity Homelab | Cyberwox Academy

Do Both

When pursuing your first cybersecurity job, it really shouldn’t be a decision between certifications or hands-on experience. You’ll want to do both. They each have benefits, which complement each other like peanut butter and chocolate.

If someone comes to an interview with a couple certifications on their resume and they’re prepared to talk about their hands-on experience, that person will be in an advantageous position. Sure it takes more time to do both. It’s an investment in yourself.

Recommended Posts

Becoming Cyber Newsletter

Do Cybersecurity Certifications Even Matter?

There’s a school of thought in cybersecurity—and in technology, in general—that certifications don’t matter. That experience is the only thing that matters. The thought goes that certification issuing organizations are just in the business of making money. Experience matters more than certifications and certifications are an ineffective measure of one’s…

Read more

5 years ago · Anonymous

Becoming Cyber Newsletter

Are Cybersecurity Bootcamps Worth the Money?

An aspiring cybersecurity professional, considering his training options, recently asked if cybersecurity bootcamps are worth it? That’s a common question, especially considering the variety of cybersecurity training options available. The short answer is…

Read more

5 years ago · 1 like · Anonymous

Landing your first cybersecurity job is challenging. With some hard work, networking and perseverance you’ll eventually hear those magic words: “We’d like to make you an offer.” It’s an amazing feeling after months of job hunting. Now it’s time to discuss a subject that your teachers and mentors may not have prepared you for: Money.

Salary Range

Cybersecurity is a well compensated career field. For some readers that initial offer may be more than you’ve ever made before. It might be more than your parents ever made. Your natural instinct is to quickly say “yes” and ring the register. Not so fast!

From the recruit’s perspective it’s easy to presume that the company has a specific salary planned for the role. It’s more likely that they have a salary range planned for each role. It only benefits the company, if you accept their first offer. After all, they likely have some wiggle room in what they can offer.

Often your prospective employer expects you to negotiate. Their planned salary range will reflect the position, the company, and the geography of the role. Whether the range is $70-80k or $100-120k, it’s a reasonable assumption that their initial offer was not at the top of the range. Negotiating can earn you some incremental gains.

Compounding Returns

You probably won’t be able to negotiate for a dramatically higher salary for your first cybersecurity job, but any increase in salary can have notable implications. Throughout the course of your career your salary in a given year will usually be a function of multiple factors including your previous year’s salary. Your employer will generally take your previous year’s salary into consideration for your annual and promotion pay raises (except when you change companies).

That means any extra salary you can negotiate will have a long lasting impact. Let’s say we presume you get just a 2% annual raise over the course of the next 30 years. Even in this modest scenario every extra $1,000 you can negotiate for is worth a total of $40,568 over the 30 year period.

Negotiating for an extra $5,000 may not sound like a big deal. After all, it’s only an extra $417 a month (before taxes). Even that’s worth an extra $202,840 over a 30-year period. But you’re not playing for just annual raises. You’re looking to get promoted and advance in your career. So let’s say that in addition to 2% annual raises you also get a promotion every five years with a 20% raise. Every extra $1,000 you negotiate for with your first cybersecurity job, would equate to over $64,000 for the course of 30 years. Negotiating for an additional $5,000 would be worth over $322,000 of lifetime earnings in this scenario.

Starting to get the point? Any additional salary you can negotiate can have long-term benefits.

Be Informed and Sensible

When it comes time to negotiate salary, it’s important to be informed about negotiation techniques and be sensible with your expectations.

Have a plan. When you get your verbal offer, it is okay not to give an answer right away. Thank them and ask if you can get back to them in a day or two. This will give you time to regroup and prepare for your counter. You don’t want to negotiate salary on the fly. Below are a few handy salary negotiation resources.

• How to Negotiate a Salary | Newsweek

• How to Negotiate Salary: 37 Tips You Need to Know | The Muse

• Fearless Salary Negotiation Tips with Josh Doody | Listen Money Matters [podcast]

• 13 Tips to Negotiate Your Salary and Job Offer | Indeed

• 15 Rules for Negotiating a Job Offer | Harvard Business Review

Being sensible in your expectations requires you to have an idea of what salary range is reasonable. Find company- and title-specific salary information with online resources like Salary.com, Glassdoor, or PayScale. Your salary negotiation isn't like the movies where they give some wildly inflated counteroffer. Make a counteroffer at the top of the range (or just above it). 

Your bargaining power may not currently be super high. This is after all your first cybersecurity job. However, any additional salary you can negotiate will have long-term, compounding effects. Many employers are expecting you to negotiate.

At the end of the day it’s important for you to be happy with your role and your salary. Cybersecurity is well paid. It’s also hard work. It’s not uncommon for cybersecurity professionals to work long hours, weekends, and occasionally holidays. You want to feel like you’re being compensated fairly for your hard work.

Recommended Posts:

Becoming Cyber Newsletter

Cybersecurity Is A Relationship Business

When people think of the cybersecurity profession, many naturally think of the technical aspect. You certainly need technical proficiency. Many would be surprised to hear, however, that cybersecurity is really a relationship business. Whether you look at the protected or the protectors, people are the lynchpin. The systems and applications, which cyberse…

Read more

5 years ago · Anonymous

Becoming Cyber Newsletter

Imposter Syndrome Is a Real, But You’re Not Alone

You’ve worked your butt off completing your cybersecurity training courses and certifications. You’ve finally scored your first cybersecurity interview. Are you doubting your skills and abilities? Are you starting to question why they would hire you? Do you begin to worry that despite the hard work you’ve put in, that you’ll be discovered as a fraud? Th…

Read more

5 years ago · Anonymous

When people think of cybersecurity, the first thing that comes to mind for many of them is penetration testing. Like a Wu Tang rapper, this cybersecurity specialty is known by many names, including ethical hacking, vulnerability assessment, and Red Teaming. The basic premise is that penetration testers (or pentesters) are good guys, who get paid to act like bad guys, without the pesky hassle of potential lawsuits and prison. What do pentesters actually do? The core of their mission is to find exploitable system vulnerabilities, process gaps, and flaws, so organizations can fix them before threat actors find them.

What is a Hacker?

The term hacker is widely used and misused, particularly in the media. A lot of definitions you’ll find imply an inherently nefarious character. They suggest that hacking is by definition synonymous with cybercrime. Technology writer Kamran Sharief provides a more extensive definition. He explains, “The term hacker refers to a computer expert. The concept has two primary meanings since it can refer to a hacker (a person who illegally accesses a system to take control or obtain private data) or an expert who is responsible for protecting and improving computer security.”

In practice you won’t hear the term hacker used very often in cybersecurity. It’s a little one-dimensional. More often you’ll hear cybersecurity professionals refer to penetration testers (good guys) and threat actors (bad guys).

Internal vs External

Internal penetration testing teams are more likely to be found in large organizations. They are an indicator of a well budgeted, mature cybersecurity organization. Smaller organizations will often outsource their penetration testing requirements to external firms.

As with all things in life, there’s a trade off between working in external or internal pentesting roles. Joining a penetration testing firm (external) may offer you a less “buttoned up” work environment. You’ll undoubtedly gain experience against a wide variety of companies in a number of industries. These external firms may give you more room to harness your inner pirate.

Joining a penetration testing team for a large organization (internal) can provide opportunities to test more complex corporate environments. There are opportunities to work with the Blue Team to identify things that need to be fixed (i.e., Purple Team). You might even get nicer toys to play with.

Red Team vs Blue Team

If you spend my time hanging around pentesters, you’ll undoubtedly hear references to Red Team and Blue Team. Cybersecurity borrows liberally from military concepts and terminology. The Red Team/Blue Team concept is a perfect example.

Military symbology has been used in Europe since the Napoleonic Wars. However, it wasn’t until World War I that England and France—former adversaries turned allies—agreed to use blue for allied symbols and red for adversary symbols. The tradition persists today among NATO militaries.

In cybersecurity terms, Red Team refers to penetration testers and Blue Team refers to security operations (SOC). The two are often pitted against each other during penetration tests or adversary emulation exercises. As you can imagine, nobody likes to lose. This can make for a touchy relationship at times.

Training and Certification

I’m generally a proponent of leveraging certifications to help get past the initial screening to get interviews. Studying for certifications can help, but in pentesting you really need to learn by doing. A good place to start getting your hands dirty is Hack the Box or similar lab environment. The platform provides you with a number of virtual machines to practice your hacking skills on.

But where can you learn those skills to begin with? The internet is awash with pentesting training. From Udemy to bootcamps to YouTube. The barrier to entry is low. Start with the more economical training options you can find and work your way up from there.

When it comes to certifications there are plenty to choose from. Here are some notable options:

• Offensive Security Certified Professional (OSCP)

• GIAC Penetration Tester (GPEN)

• GIAC Exploit Researcher and Advanced Penetration Tester (GXPN)

• EC-Council Certified Ethical Hacker (CEH)

• IACRB Certified Penetration Tester (CPT)

• IACRB Certified Expert Penetration Tester (CEPT)

• CompTIA PenTest+

The OSCP makes for a pretty solid calling card in the penetration testing community. As opposed to many cybersecurity certifications, there’s no multiple choice test to prove your knowledge. It’s 100% hands on. OSCP is a 24-hour exam in which people regularly run out of time. It’s definitely not your starting point, but something to work towards. How hard is it? Their motto is “try harder!”

Is Penetration Testing for You?

Start training and pwning boxes early. As Kamran Sharief wrote, “The term hacker refers to a computer expert.” You don’t become an expert by taking a single course… or even a few courses. You become an expert by becoming a student of your craft.

It’s very important to determine whether you actually like pentesting. A lot of people like the idea of penetration testing. To determine if pentesting is really your calling you need to get hands on keyboard. To be honest it’s perfectly fine if penetration testing isn’t your thing. There are a lot of specialties in cybersecurity. Most people in cyber aren’t pentesters.

However, if you get that dopamine rush from struggling through and finally cracking a box you’re not supposed to be able to access, then you just might be a future pentester.

Recommended Posts:

Becoming Cyber Newsletter

Cyber 201: What is a Security Operations Center?

Most lists of entry-level cybersecurity jobs will undoubtedly include the SOC analyst. The lingering question for many aspiring cybersecurity professionals is: “What’s a SOC?” We’re going to take a look at the Security Operations Center (SOC) and its role in the cybersecurity landscape. It’s important to have at le…

Read more

5 years ago · Anonymous

Becoming Cyber Newsletter

Cyber 201: What is Cyber Threat Intelligence?

When aspiring cybersecurity professionals consider specialties, cyber threat intelligence (CTI) often peaks their interest. Cyber threat intelligence certainly sounds cool. After all, we’ve all seen plenty of movies about spies and intelligence analysts. Most people don’t actually know much about CTI beyond its perceived d…

Read more

5 years ago · Anonymous

Cybercriminals have been attacking organizations all across the private and public sector. We hear about these attacks increasingly on the news—the mainstream news at that—nowadays. How can you leverage this awareness to help land your first cybersecurity job? If you identify companies in sectors with additional cybersecurity needs, you’ll find companies that are likely hiring. Let’s take a look at some key sectors with greater needs for cybersecurity talent. Some of them may surprise you.

Most Vulnerable Sectors

Generally speaking, companies which have suffered cyberattacks will invest to improve their defenses. So which sectors have suffered the most cyberattacks as of late? The publication IT Governance analyzed over 1,000 publicly disclosed security incidents that occurred in 2020. Their analysis revealed five sectors, which were most attacked.

• Healthcare and health sciences sector - 21% of all recorded breaches

• Public sector - 18% of all reported incidents

• Technology and media sector - 14% of all incidents

• Education sector - 14% of all incidents

• Retail and leisure sector - 9% of all incidents

Winston Churchill once said, “Never let a good crisis go to waste.” The coronavirus is that crisis for cybersecurity. The COVID-19 crisis has created a lot of new opportunities for cybercriminals. As a result of that additional cybercriminal activity, 70% of organizations plan to increase their cybersecurity spending following the pandemic.

These five sectors should provide good opportunities for cybersecurity employment. After all, nothing stimulates cybersecurity spending (and hiring) like a successful cyberattack. Especially one that you had to publicly disclose. As a result of the volume of cyberattacks they suffered in 2020, companies in these sectors need to invest in cybersecurity, which already has a talent shortage. This could be a good opportunity for new talent to get a chance.

Critical Infrastructure Sectors

In 2013 the United States introduced the National Infrastructure Protection Plan (NIPP) with the mission to “Strengthen the security and resilience of the Nation’s critical infrastructure, by managing physical and cyber risks through the collaborative and integrated efforts of the critical infrastructure community.” The NIPP designated 16 Critical Infrastructure Sectors, which were deemed to be vital to national security.

Given that the US government declared the cybersecurity in these sectors is strategically important to national security, you can safely assume that companies in these sectors appreciate the importance of investing in cybersecurity.

1. Chemical Sector

2. Commercial Facilities Sector

3. Communications Sector

4. Critical Manufacturing Sector

5. Dams Sector

6. Defense Industrial Base Sector

7. Emergency Services Sector

8. Energy Sector

9. Financial Services Sector

10. Food and Agriculture Sector

11. Government Facilities Sector

12. Healthcare and Public Health Sector

13. Information Technology Sector

14. Nuclear Reactors, Materials, and Waste Sector

15. Transportation Systems Sector

16. Water and Wastewater Systems Sector

The list of US Critical Infrastructure Sectors can be useful to aspiring cybersecurity professionals. Some sectors are less obvious than others. Naturally, organizations in these sectors are not evenly distributed around the country. Which of these sectors may be bigger where you live?

Knowing which sectors are deemed critical infrastructure is especially useful for anyone looking to get into cyber threat intelligence (CTI). After all, the “collaborative and integrated efforts” that the NIPP’s mission statement refers to includes intelligence sharing.

Find Organizations with Extraordinary Needs

In your cybersecurity job hunt, it can be helpful to identify sectors and organizations with an extraordinary need for talent. Some organizations come to appreciate their need for additional cybersecurity investment due to recent cyberattack. Other organizations have a constant recruiting need, which is highlighted by their critical infrastructure status.

You can find hidden gems of organizations by analyzing less obvious sectors with extraordinary needs. I’ll bet you wouldn't have thought of the retail and leisure sector or the food and agriculture sector. Use this knowledge of sectors with extraordinary cybersecurity requirements to be strategic about which companies you pursue, network with, and apply to. After all, these things take time (which is the ultimate finite resource). So be focused and approach companies in a targeted manner.

Recommended Posts

Becoming Cyber Newsletter

What Makes Cybersecurity a ‘Future-Proof’ Career?

In a world in which workers—both blue- and white-collar—increasingly see their livelihoods automated away, cybersecurity remains a future-proof career. That’s great for cybersecurity professionals. It can be motivating for aspiring entrants. While technology continues to disrupt seemingly every career field, this on…

Read more

5 years ago · Anonymous

Becoming Cyber Newsletter

Cybersecurity Is A Relationship Business

When people think of the cybersecurity profession, many naturally think of the technical aspect. You certainly need technical proficiency. Many would be surprised to hear, however, that cybersecurity is really a relationship business. Whether you look at the protected or the protectors, people are the lynchpin. The systems and applications, which cyberse…

Read more

5 years ago · Anonymous

When aspiring cybersecurity professionals consider specialties, cyber threat intelligence (CTI) often peaks their interest. Cyber threat intelligence certainly sounds cool. After all, we’ve all seen plenty of movies about spies and intelligence analysts. Most people don’t actually know much about CTI beyond its perceived desirability. It may be one of the harder cybersecurity specialties to get into. So let’s take a look at what CTI is and the skills it requires.

Newest Intelligence Discipline

Intelligence has a long and storied history. In the modern era it’s been divided into a number of intelligence collection disciplines or INTs, including:

• Human intelligence (HUMINT) - gathered from a person

• Signals intelligence (SIGINT) - gathered from interception of electronic transmissions

• Geospatial intelligence (GEOINT) - gathered from satellite and aerial photography

• Measurement and signature intelligence (MASINT) - gathered from an array of signatures (distinctive characteristics)

• Open-source intelligence (OSINT) - gathered from open sources

• Technical intelligence (TECHINT) - gathered from analysis of weapons and equipment

• Financial intelligence (FININT) - gathered from analysis of monetary transactions

Cyber threat intelligence—sometimes called Cyber intelligence (CYBINT) in the Intelligence Community (IC)—is simply the newest kid on the intel block.

CTI still draws upon a rich tradition and methods of intelligence gathering and assessment. For example, CTI’s analytical process will look familiar to any intelligence professional. It uses the same Intelligence Cycle, which is the basis for every intel discipline.

Intel in the Private Sector

Intelligence has long been the domain of nation-states. Countries with large budgets and government mandates conducted intelligence operations on behalf of their citizens. They did so predominantly against other nation-states. With CTI the game changes a bit. Globally the majority of information systems are owned by private organizations and individuals.

Cyber threat intelligence… is simply the newest kid on the intel block.

Governments have little, if any, visibility into activity on private information systems within their country’s borders. That visibility is the domain of the private sector. This puts responsibility for CTI in the hands of private organizations. However, they lack the collection assets that governments have. Instead companies utilize a range of security vendors for collection. These vendors also help protect companies from legal liability. Depending on the industry, companies may also participate in intelligence sharing organizations, like sector-based ISACs.

Just like with countries, bigger companies with large budgets are likely to have more robust CTI programs. Smaller companies may have just one or two cybersecurity (or IT) analysts monitoring threat feeds as an additional duty. Large companies with mature CTI programs may have a fully-staffed organization of intelligence professionals, supporting a mature Security Operations Center (SOC).

Intelligence Training

Cyber threat intelligence can be a highly desired specialty for aspiring cybersecurity professionals. That’s understandable. It sounds interesting and people tend to be familiar with the concept of intelligence. A challenge is that government—military and civilian agencies—has long been the training ground for intelligence professionals.

How do you get into CTI if you don’t have neither cybersecurity nor intelligence experience? For starters you need to have a solid understanding of the technology and tools, particularly from the threat actor’s perspective. Studying for penetration tester certifications, such as the Certified Ethical Hacker (CEH), can help with that.

Just like with countries, bigger companies with large budgets are likely to have more robust CTI programs.

When it comes to CTI specifically, the cybersecurity training ecosystem is a bit less mature. There aren’t as many training courses and certifications for CTI as other cybersecurity specialties. Here are a few courses and certifications, which can help you learn about CTI and potentially get the attention of CTI recruiters and hiring managers.

• FOR578: Cyber Threat Intelligence | SANS Institute

• Certified Threat Intelligence Analyst (C|TIA) | EC-Council

• MITRE ATT&CK Defender (MAD) ATT&CK Cyber Threat Intelligence | Cybrary

• MITRE ATT&CK Defender (MAD) ATT&CK Cyber Threat Intelligence Certification | MITRE Engenuity

Of course, there’s always something to be said for self-education. Here are some well curated reading lists for anyone seeking to specialize in cyber threat intelligence.

• A Cyber Threat Intelligence Self-Study Plan: Part 1

• A Top 10 Reading List if You’re Getting Started in Cyber Threat Intelligence

• CTI Reading List

CTI is growing in popularity and many organizations are seeking to grow their intel teams. If you don’t have cybersecurity or intelligence experience, it will take some work and/or time to get into CTI. That’s to be expected though. If you want it bad enough, you’ll put in the work.

Recommended Posts

Becoming Cyber Newsletter

Cyber 201: What is a Security Operations Center?

Most lists of entry-level cybersecurity jobs will undoubtedly include the SOC analyst. The lingering question for many aspiring cybersecurity professionals is: “What’s a SOC?” We’re going to take a look at the Security Operations Center (SOC) and its role in the cybersecurity landscape. It’s important to have at le…

Read more

5 years ago · Anonymous

Becoming Cyber Newsletter

Future Trends: Cloud Security

Future Trends We may not be able to predict the future, but we can certainly foresee the technological trends which will impact it. Any technology, which businesses and governments use to evolve and grow, is going to need securing and defending. Future Trends in technology therefore drive future needs for cybersecurity professionals…

Read more

5 years ago · Anonymous

You’ve been working hard to learn the necessary skills to become a cybersecurity professional. Your hopes and dreams have fueled these efforts. There’s hope for a future-proof career, which allows you to maintain relevance in an increasingly technology driven world. There’s the dream of improving your economic security at a time in which increased income inequality wreaks havoc on the middle class. There might even be the hope of pursuing a specific cybersecurity specialty, which seems fun and exciting to you.

Hiring Managers Are Selfish

The truth of the matter is that your hopes and dreams for entering cybersecurity aren’t the hiring manager's concern. Every applicant has their own hopes and dreams. The hiring manager on the other hand has a business need to fill. This makes hiring managers understandably selfish. The hiring manager’s primary concern is going to be filling those business needs with the talented people, who can execute them and be a beneficial part of the team.

The truth of the matter is that your hopes and dreams for entering cybersecurity aren’t the hiring manager's concern.

Some applicants will include executive summaries in their resumes with explanations of what they're looking for in a cybersecurity job. That’s not going to resonate with hiring managers. Those hiring managers want to know what you can do for them, not what they can do for you. This is especially true for candidates pursuing their first cybersecurity job.

Look at things from the hiring manager’s perspective. She could receive up to a couple hundred applications for a single cybersecurity role. Now imagine that she has more than one role open. That’s a lot of people’s hopes and dreams to sort through. The hiring manager is going to focus on her organizational needs. After all, that’s what she gets paid to do.

Focus On The Organization’s Needs

To engage in a manner that resonates with hiring managers, focus on the organization’s needs rather than your own. That means getting a feel for what the hiring manager is looking for in a specific role. What challenges is the organization seeking to solve? What will the primary mission be for whoever gets hired for this role?

Once you have a feel for that, you can better engage with the hiring manager. Instead of talking about what you want, you can talk about your understanding of her organizational requirements and how you can help fulfill them. What cybersecurity skills have you developed that would be an asset? What non-cybersecurity skills do you have (e.g., strong communications skills) that would be valuable for the role? What personality traits do you possess that would be key for this role and team?

To engage in a manner that resonates with hiring managers, focus on the organization’s needs rather than your own.

Once you reframe your focus from your hopes and dreams to the organization’s needs, you’ll be in a better position to describe yourself as the best candidate for the job. You don’t need to avoid discussion of your hopes and dreams all together. Just reframe them. Where do the organization’s needs and your goals intersect? Talk about that. Just remember to keep it as a secondary discussion point after you’ve adequately expressed how you can help fulfill their objectives.

Engagement Opportunities Are Precious

Opportunities to engage with hiring managers are precious. Most applications and resumes won’t actually make it into their hands. Knowing that, make the most of the opportunity, when you have a hiring manager’s attention. Approach that engagement from the perspective of what you can do for the organization.

Your hopes and dreams are important for sure. However they’re more important to you, than anyone else. During the interview process isn’t really the time to focus on them. The hiring manager needs to be selfish to achieve organizational objectives. If you focus on those organizational objectives, you can find yourself in an advantageous position to advance your hopes and dreams as well.

Recommended Posts

Becoming Cyber Newsletter

Celebrate the Small Victories Along the Journey to Your First Cybersecurity Job

The journey towards your cybersecurity career can be an arduous one. It takes time and a lot of effort to self-educate, credentialize, network, apply and interview for roles. That makes it important to celebrate the small victories. After an achievement like, passing a certification exam, you might be tempted to immediately begin studying for the next ce…

Read more

5 years ago · Anonymous

Becoming Cyber Newsletter

Are Cybersecurity Bootcamps Worth the Money?

An aspiring cybersecurity professional, considering his training options, recently asked if cybersecurity bootcamps are worth it? That’s a common question, especially considering the variety of cybersecurity training options available. The short answer is…

Read more

5 years ago · 1 like · Anonymous

The journey to landing your first cybersecurity job can be a tough one. Some companies won’t have the courtesy to even send you a simple, rejection email. You’ll have interviews that you feel like you nailed, but they don’t go anywhere. Despite the headaches, eventually you’ll land your first cybersecurity job. And when you do, it’ll feel amazing. You’ll want to jump in the air and shout with excitement. You’ll yell “YES!” to no one in particular. It’s a pretty awesome feeling.

When you get to that celebratory, fist pumping stage, you’ll undoubtedly have someone to thank for helping you get there. We like to believe that we’re self-made professionals, who depended only on our own hard work, intelligence, and perseverance. Sure, that’s true... but it’s not the whole story. We all get some help along the way.

We All Get Some Help

You might have a friend or an acquaintance in industry, who gave you feedback on your resume. Likely some people sat down with you for informational interviews. Maybe a cybersecurity professional that you reached out to on LinkedIn gave you some time. If you’re really fortunate maybe someone referred you for a cybersecurity job. Whether it be something big or small, we all get help along the way.

You can email those people to thank them—and you should—but you can’t really pay them back. The only thing you can really do is pay it forward.

Pay It Forward

What does it mean to pay it forward? As you get established as a cybersecurity professional, people will reach out to you for help getting into the industry. A friend will want to introduce you to a nephew or a sister, who’s considering a cybersecurity career. A student or alum for your alma mater may contact you on LinkedIn hoping for a 30-minute chat. Take the time. That’s paying it forward.

In the beginning it’ll be easier to make the time. You’ll have fewer responsibilities at work as you get started in your cybersecurity career. Then something ironic will happen. As you progress in your career you will have 1) more insight to share with aspiring cybersecurity professionals and 2) less bandwidth to share it. Make the time.

Remember what it’s like being on the other side trying to get into the industry. You can accomplish this without becoming a full-giver of advice. You can go to the occasional Meet Up to share some insight with people trying to get into cyber. You can participate in career panels at your alma mater or another local school. You can start a newsletter to help people get into cybersecurity (wink).

Stay Motivated to Help

Everyone in cybersecurity is busy, but we can all find at least a little time to help others get into the industry. Each time you help someone find their first cybersecurity job, you have a long-term impact on their economic livelihood. That’s not a small thing.

Anytime that you feel too busy to have to have that phone chat or review that resume for an aspiring cybersecurity professional, remember that fiery fist-pumping emotion from when you finally landed your first cybersecurity job. It’s an amazing feeling. In some way—big or small—you can help someone else have that feeling. You can spread the joy.

Remember the ecstatic feeling of landing your first cybersecurity job and how thankful you were to everyone who helped you. You can’t really pay it back to those people who helped you... but you can pay it forward.

Recommended Posts:

Becoming Cyber Newsletter

Your First Cybersecurity Job May Be Closer Than You Think

Finding your first cybersecurity job is challenging, even after the certifications and the networking. For many people an opportunity exists a little closer to home. You can find opportunities to transition to a cybersecurity role at your current employer. That first cybersecurity role is always going to involve someone taking a chance on you. However, …

Read more

5 years ago · Anonymous

Becoming Cyber Newsletter

Get Your Foot in the Door, Find the Low Hanging Fruit

Plenty of career changers pivot toward cybersecurity with great ambitions. They have goals to quickly become managers, then executives, then CISOs. Maybe they seek to become world-class penetration testers or forensic investigators. The ambition is laudable. However, these goals are dependent on landing that—often elusive—first cybersecurity job…

Read more

5 years ago · Anonymous

In a world in which workers—both blue- and white-collar—increasingly see their livelihoods automated away, cybersecurity remains a future-proof career. That’s great for cybersecurity professionals. It can be motivating for aspiring entrants. While technology continues to disrupt seemingly every career field, this one seems immune. So what makes cybersecurity different than so many other fields?

What Does ‘Future-Proof’ Even Mean?

According to the Collins Dictionary, “If something is future-proof, it will continue to be useful or successful in future if the situation changes.” Change is certainly coming. Could a shortage of cybersecurity professionals make the field future-proof? After all, there was a cyber workforce gap of approximately 3.12 million cybersecurity professionals globally in 2020 (including over 879,000 in the United States).

However, current demand doesn’t necessarily equate to future demand though. After all, there’s increasing demand for commercial truck drivers today. That doesn’t mean the profession will survive the coming onslaught of autonomous commercial fleets.

In a world in which workers—both blue- and white-collar—increasingly see their livelihoods automated away, cybersecurity remains a future-proof career.

Being smart or well-educated doesn’t make one’s career future-proof either. Lawyers first saw their monopoly on legal service under assault by DIY websites like LegalZoom. Then technology allowed law firms to replace armies of young attorneys with e-discovery software. Now there’s concern of artificial intelligence outright replacing lawyers.

As waves of technological advances fuel what Klaus Schwab of the World Economic Forum dubbed the Fourth Industrial Revolution, past professional demand does not guarantee future success. Some professions will become the 21st century equivalent of the buggy whip maker.

What Makes Cybersecurity Different?

Klaus referred to the Fourth Industrial Revolution as “a series of social, political, cultural, and economic upheavals that will unfold over the 21st century.” A number of professions are currently fighting to maintain their relevance in this period of change, attempting to withstand the successive waves of technology.

“If something is future-proof, it will continue to be useful or successful in future if the situation changes.”

Cybersecurity was made for this period. Rather than attempting to withstand waves of technology, cybersecurity rides the waves like the nimblest of surfers. As the world becomes increasingly interconnected the susceptibility of attack by bad actors increases. Therefore, each wave of technology represents something new that needs to be secured.

Cybersecurity isn’t a destination. It’s a way of being. That’s the secret sauce that allows it to be a future-proof career. The likelihood of finishing securing the information systems (which touch the lives of billions of people globally) is about the same as the likelihood of you reaching the end of the internet.

Retaining Purpose

During these pivotal times future-proof careers can provide not just economic security. They can also provide a continued sense of purpose. That’s valuable in a world in which people’s jobs are regularly automated away.

We are just scratching the surface of the conveniences and opportunities that this era of epochal change will create. These conveniences and opportunities will come at a cost however. Don’t wait for the revolution to come find you. Pursuing a future-proof career—whether it be cybersecurity or another field—can help retain your sense of agency and pursue. After all, the future is now.

Recommended Posts:

Becoming Cyber Newsletter

Get Your Foot in the Door, Find the Low Hanging Fruit

Plenty of career changers pivot toward cybersecurity with great ambitions. They have goals to quickly become managers, then executives, then CISOs. Maybe they seek to become world-class penetration testers or forensic investigators. The ambition is laudable. However, these goals are dependent on landing that—often elusive—first cybersecurity job…

Read more

5 years ago · Anonymous

Becoming Cyber Newsletter

Cybersecurity Is A Relationship Business

When people think of the cybersecurity profession, many naturally think of the technical aspect. You certainly need technical proficiency. Many would be surprised to hear, however, that cybersecurity is really a relationship business. Whether you look at the protected or the protectors, people are the lynchpin. The systems and applications, which cyberse…

Read more

5 years ago · Anonymous

Most lists of entry-level cybersecurity jobs will undoubtedly include the SOC analyst. The lingering question for many aspiring cybersecurity professionals is: “What’s a SOC?” We’re going to take a look at the Security Operations Center (SOC) and its role in the cybersecurity landscape. It’s important to have at least a basic understanding of how the SOC fits in organizationally, regardless of where you land your first cybersecurity job.

According to security vendor CrowdStrike, “A security operations center (SOC) includes the people, processes and technologies responsible for monitoring, analyzing and maintaining an organization’s information security.” So what does that actually mean? Let’s focus on those stated tasks: monitor, analyze and maintain.

Monitor

Basically, security operation centers monitor everything that happens on its organization’s network continuously looking for anomalies. As you can imagine, that's a lot of traffic to monitor, so the people, processes and technologies become very important.

In order to maximize the visibility SOCs have of their network, they need to understand which technology and process gives them visibility of which portions of their network. Just ensuring full visibility is a big task. Once an organization has visibility to fully monitor their network for anomalies, then they need to do something with all that data.

Analyze

Anomalies don’t always represent bad or malicious activity. After all, by definition an anomaly is simply, “something that is different from what is ordinary or expected.” That means that monitoring can produce a lot of suspicious events—any observable occurrence in a network or system—which aren’t threats.

According to security vendor CrowdStrike, “A security operations center (SOC) includes the people, processes and technologies responsible for monitoring, analyzing and maintaining an organization’s information security.”

How does the SOC determine which suspicious events are actually threats? People, processes and technologies really come into play here. Obviously, SOC analysts are a big part of the equation. (There’s a reason why we call them analysts.) However, you can’t just throw people at the problem. Qualified cybersecurity professionals are a limited resource (thus the skills shortage) and it’s unsustainable, leading to burnout.

Organizations therefore need to design processes and adopt technologies, which allow them to employ their people most effectively. Well designed and executed processes and technologies allow SOCs filter out suspicious events, in order to intelligently utilize the time of SOC analysts.

Maintain

At first glance, maintaining an organization’s information security may sound like a mundane task. But what is the actual task? It is to maintain the confidentiality, integrity, and availability (CIA) of an organization’s information systems. That sounds like a bigger task, doesn’t it? How do you maintain the CIA triad after you’ve identified malicious incidents through analysis? You contain whatever has disrupted confidentiality, integrity or availability of your organization’s information systems.

Maintaining an organization’s information security leans heavily on people, processes and technologies. In order to maintain security the SOC needs to understand what “right” looks like (i.e., get a good baseline of normal network activity). It will need to develop processes to standardize complex tasks. As part of these processes, the SOC will really depend on its people. SOC analysts at various levels will need to execute interconnected tasks in a coordinated manner to maintain the organization’s information security.

Sounds like challenging work? It is. But it can be exciting and it’s important.

SOC Analysts Tiers

You’ll hear about SOC Level 1, 2, and 3 Analysts. Those roles with a higher number require greater experience and have greater responsibilities. A SOC Level 1 Analyst is a front-line cybersecurity professional responsible for monitoring and responding to security related alerts. A SOC Level 3 Analyst is more of a subject matter expert (SME) and/or manager.

A SOC Level 1 Analyst role can be a good place to start one’s cybersecurity career. SOC Level 1 Analysts are always in demand and the role provides a lot of hands-on experience.

Training Programs

• Certified SOC Analyst (CSA) | EC-Council

• Become a SOC Analyst - Level 1 | Cybrary

• Become a SOC Analyst - Level 2 | Cybrary

• Become a SOC Analyst - Level 3 | Cybrary

• Microsoft Certified: Security Operations Analyst Associate

A Security Operations Center is a big investment, so many organizations will outsource the roles to a Managed Security Service Provider (MSSP). Whether using an in-house SOC or an external MSSP, Security Operations is often the first line of defense against cyberattacks.

Recommended Posts

Becoming Cyber Newsletter

Do Cybersecurity Certifications Even Matter?

There’s a school of thought in cybersecurity—and in technology, in general—that certifications don’t matter. That experience is the only thing that matters. The thought goes that certification issuing organizations are just in the business of making money. Experience matters more than certifications and certifications are an ineffective measure of one’s…

Read more

5 years ago · Anonymous

Becoming Cyber Newsletter

Future Trends: Cloud Security

Future Trends We may not be able to predict the future, but we can certainly foresee the technological trends which will impact it. Any technology, which businesses and governments use to evolve and grow, is going to need securing and defending. Future Trends in technology therefore drive future needs for cybersecurity professionals…

Read more

5 years ago · Anonymous

Let’s face it, cybersecurity isn’t for everyone. Sure there's a lot of hype around the field. While tons of people are talking about cybersecurity, that doesn’t mean that everyone will enjoy it. What are some key reasons that you shouldn’t get into cybersecurity?

You Value Routine In Your Work Schedule

For a variety of reasons you may highly value routine in your work schedule. Maybe you have commitments outside of work that are inflexible time-wise. Perhaps you simply don’t want to sacrifice time with friends or family for your career. A predictable work schedule might be very important to you.

Cybersecurity can often present a work schedule that is less than predictable. At its essence, cybersecurity is—as the name states—security work. That means that when things go wrong, people’s personal schedules can suffer. Bad actors don’t respect weekends or holidays. In fact some will intentionally target them.

Bad actors don’t respect weekends or holidays.

You’ll struggle to find many experienced cybersecurity professionals, who have never had their evening, weekend, or a holiday disrupted by work. Of course, some roles (such as, incident responders) are more hectic than others. To many extents though, a career in cybersecurity involves accepting the lack of routine that accompanies it. If you value a fixed work routine above all else, cybersecurity might not be right for you.

You Prefer Not to Depend on Others

No one can successfully defend an organization alone. Maybe you prefer a level of autonomy in which you don’t have to deal with other people. Perhaps you want to succeed or fail on your own merits. Does being dependent on others for your success frustrates you?

There are some cybersecurity roles in which you wouldn’t be dependent upon or accountable to others for your success, such as independent researchers. However, when it comes to defending organizations, cybersecurity is a team sport. You have to work well with others to be effective and you’re dependent on them for your organizational success.

You can undoubtedly find a specialized niche that doesn’t require other people. By and large you’ll need to depend on others in cybersecurity. If you value autonomy over teamwork, cybersecurity might not be right for you.

You’re Not a Fan of Studying

Technology changes. Industry frameworks evolve. The line between “learning” and “doing” blur in cybersecurity. Cybersecurity requires life-long learning. Not everyone enjoyed school, but you’ll need to be willing to study new topics to succeed. For example, different organizations will have varying technology stacks. If you have no desire to learn new technologies over the course of your career, you’ll find yourself with limited career options.

Cybersecurity requires life-long learning.

Becoming Cyber often discusses the best entry-level certifications to break into cybersecurity. As you progress in your career there will likely be expectations of obtaining more advanced certifications, like the Certified Information Systems Security Professional (CISSP) or Certified Information Security Manager (CISM). Getting in the door doesn’t mean you’re done studying for certifications.

Technology continues to advance over time. In order to stay relevant, you need to keep studying and learning. You need to keep up. If you’re not a fan of continued learning, cybersecurity may not be right for you.

What Next?

Cybersecurity is a great career field. If it’s not right for you, that’s okay. There are other high growth, future-oriented careers out there. You can learn more about them in books like The Industries of the Future by Alec Ross. If you are not dissuaded in your cybersecurity interests, there is plenty of work. We just need to land you that first cybersecurity job. Let’s get back to work.

Recommended Posts:

Becoming Cyber Newsletter

Your First Cybersecurity Job May Be Closer Than You Think

Finding your first cybersecurity job is challenging, even after the certifications and the networking. For many people an opportunity exists a little closer to home. You can find opportunities to transition to a cybersecurity role at your current employer. That first cybersecurity role is always going to involve someone taking a chance on you. However, …

Read more

5 years ago · Anonymous

Becoming Cyber Newsletter

Plotting Your Cybersecurity Career Path

We talk a lot about pursuing your first cybersecurity job, but what comes after that? Cyber Seek is a usual tool for plotting out the first few hops of your cybersecurity career. Cyber Seek’s interactive Career Pathway displays a succession of potential cybersecurity jobs. It starts with Feeder Roles, then progresses to Entry-Level, Mid-Level, then Adva…

Read more

5 years ago · Anonymous

One great thing about the cybersecurity industry is that it offers people economic security, when the middle class is under pressure. Experienced cybersecurity professionals enjoy a 0% unemployment rate. Many potential career changers really want to know, “How much can I make in cybersecurity?” I’ll spare you the standard explanation that it depends.

In 2020, the median income for an information security analyst was $103,590 per year (with less than 5 years experience) according to the US Bureau of Labor Statistics (BLS). (That’s a 3.9% increase from 2019.) Meanwhile, the US median household income was $68,400 in that same year. You read that right. In the US, the individual median information security analyst earned 51% more than the entire median household in 2020!

Where are all these jobs? All over the United States, but the highest numbers are in Virginia, Texas, California, New York and Florida.  The highest paying states however are California, New York, New Jersey, District of Columbia, and Virginia.

Cybersecurity is an exciting, future-proof career field, which offers a lot of opportunities. The BLS states, “Employment of information security analysts is projected to grow 31 percent from 2019 to 2029, much faster than the average for all occupations.” That’s at least a solid decade of cybersecurity job growth ahead of us.

In the US, the individual median information security analyst earned 51% more than the entire median household in 2020!

But we know it can be daunting to try something new. This is especially true for career changers. However, the economic security, which the field offers, may be tempting enough to get you to make the leap. Go ahead and take a bet on yourself!

Recommended Posts:

Becoming Cyber Newsletter

Life is Short, Take a Chance and Bet on Yourself

By one estimate the average American will spend 109,980 hours at work in their lifetime. That’s one third of your life.This is a number that I think about, when I hear people talking themselves out of pursuing new opportunities. Not that we should all quit our careers and pursue passion projects, like opening a pottery center. (Admittedly, that’s pretty…

Read more

5 years ago · Anonymous

Becoming Cyber Newsletter

Your First Cybersecurity Job May Be Closer Than You Think

Finding your first cybersecurity job is challenging, even after the certifications and the networking. For many people an opportunity exists a little closer to home. You can find opportunities to transition to a cybersecurity role at your current employer. That first cybersecurity role is always going to involve someone taking a chance on you. However, …

Read more

5 years ago · Anonymous

Cybersecurity is an exciting career field with a diversity of roles. Ethical hackers may come to mind for a lot of people. But there’s so much more to cybersecurity. How can you find the role that you’ll be passionate about? There are some good resources to help you find a target role to begin your cybersecurity career, which suit your interests and skill sets. 

Learn By Viewing

YouTube is a great resource for learning about cybersecurity careers. You can find some articulate, experienced and passionate professionals to explain all the different types of cybersecurity jobs.

Dr. Gerald Auger’s YouTube video, 5 Entry Level Cyber Jobs You Need to Know About, is a reliable resource. Dr. Auger lays out common job duties, required soft skills, job growth, and median salary for each of these roles. He also explains the downside of each role, which is surprisingly helpful. After all, when trying to decide which role suits you, it is generally helpful to determine early which roles don’t suit you.

The roles which Dr. Auger discusses are:

• Cyber Defense Incident Responder

• Cyber Forensics Expert

• Cyber Security Engineers

• Cyber Operator

• Vulnerability Assessment Analyst

There are certainly more cybersecurity roles, but these are good building blocks for your understanding of entry-level roles. Search “entry level cybersecurity jobs” in YouTube and you’ll find a variety of other videos vying to explain the various roles and responsibilities in cybersecurity.

Learn By Doing

After you get a basic understanding of entry-level cybersecurity roles, one or two may jump out as a good fit for you. Obviously, you don’t want to pursue a cybersecurity role simply based on having watched a couple of videos. You want to get a better feel for whether this role is really what you want. Do you find it intriguing and fulfilling?

Cybrary’s online Career Paths training will be quite useful. It’s a low commitment way to get exposure to and hands-on experience in cybersecurity roles of interest. The Career Paths training include:

• Become a SOC Analyst 1

• Become a Systems Administrator

• Become a Cyber Security Engineer

• Become a Penetration Tester

• Become an Incident Handler

• Become an Azure Cloud Engineer

As you start down a Career Path, if it excites and motivates you to keep learning, then you’re likely on the right path. If it is not what you expected and you're not feeling it, at least you determined that early on. You can back up and try something different. Learning by doing is a valuable way to test your cybersecurity interests.

What Next

Your cybersecurity career will undoubtedly have many twists and turns. You may be quite surprised by what you end up doing ten years from now. But as you seek to find your way into the career field, it’s helpful to find something you’re passionate about. It gives you something to aspire to. Starting your cybersecurity career journey with a goal, based on your interests and aptitude, will provide you with a target to aim for.

Recommended Posts

Becoming Cyber Newsletter

This Uncommon Cybersecurity Skill Can Help Propel Your Career

Cybersecurity is a career field full of smart people with a wide variety of deeply technical skills. It can be intimidating for career changers. There is a key skill that you can bring to cybersecurity, which will help set you apart from your peers. It’s a skill that some of the most experienced and technical cybersecurity professionals don’t have. That…

Read more

5 years ago · Anonymous

Becoming Cyber Newsletter

Get Your Foot in the Door, Find the Low Hanging Fruit

Plenty of career changers pivot toward cybersecurity with great ambitions. They have goals to quickly become managers, then executives, then CISOs. Maybe they seek to become world-class penetration testers or forensic investigators. The ambition is laudable. However, these goals are dependent on landing that—often elusive—first cybersecurity job…

Read more

5 years ago · Anonymous

If you’ve spent any time on LinkedIn, you’ve undoubtedly seen people with little golden LinkedIn logos on their profiles. Those are people with LinkedIn Premium accounts. Sure they may look cool, but are LinkedIn Premium accounts worth the money for aspiring cybersecurity professionals?

LinkedIn already offers a lot of resources with basic accounts for free. When considering paying for a premium account, it’s important to recognize what you’re trying to achieve. Then you can weigh the cost and benefits.

Networking is a key function in discovering opportunities for your first cybersecurity job. Basic LinkedIn resources are generally adequate. However, a LinkedIn Premium account will provide you with benefits which are largely worth the cost.

LinkedIn Premium Costs

There are four types of LinkedIn Premium subscriptions. Fortunately, the subscription intended for job hunters—Premium Career—is the most affordable of them. In the United States the Premium Career subscription will run you $29.99 per month. Admittedly, that’s not cheap, but is half the price of the next most inexpensive subscription, Premium Business.

When considering paying for a premium account, it’s important to recognize what you’re trying to achieve.

LinkedIn offers a complimentary month, so that monthly Premium Career subscription can be a good way to get a feel for LinkedIn Premium and determine if it's worth the cost for you. You can save 33% by paying annually, but you can switch to annual payment at any given time. The monthly subscription is therefore still a good place to start.

Benefits of LinkedIn Premium Career

Networking and building relationships among cybersecurity professionals is vital to your transition to a cybersecurity career. By definition this involves reaching out to people you don’t know. It leaves you with the question of how to contact people you don’t know on LinkedIn? After all, the platform put restrictions on that for basic accounts.

Networking is a key function in discovering opportunities for your first cybersecurity job.

Some people opt to simply send connection requests to strangers hoping they’ll be accepted. There’s certainly a population of people, who will accept any connection request sent their way. For many people though, it’s considered poor etiquette.

LinkedIn Premium allows you to use InMail to message people outside of your network. This is huge, because it allows you to intentionally engage with people outside of your personal network. A thoughtfully written message is preferred to a random LinkedIn connection request. If you do it right, today’s LinkedIn message will be tomorrow’s LinkedIn connection.

Additional benefits to the Premium Career subscription are Job Insights to LinkedIn job posts, interview preparation, access to LinkedIn Learning courses, a Resume Builder, and greater transparency on who’s viewed your profile in the last 90 days. These are all bonuses. The ability to message people outside of your network will be the single greatest benefit for aspiring cybersecurity professionals building their networks in the community. It can have tangible benefits for aspiring professionals.

• LinkedIn offers U.S. service members and veterans a free 1-year Premium Career subscription in collaboration with ID.me.

Way Forward

Networking is an important part of finding your first cybersecurity job and LinkedIn is the premier social media site upon which to do so. You can certainly network using a basic LinkedIn account. This may be adequate, if your network includes a number of people already working in cybersecurity. Otherwise, a LinkedIn Premium Career account can be a good, near-term investment to start making cybersecurity connections outside of your network. Step up your online networking to help find your first cybersecurity job.

Recommended Posts:

Becoming Cyber Newsletter

Expanding Your Cyber Network on LinkedIn Improves Your Job Search

LinkedIn is an important professional social network, which is valuable to your cybersecurity job search. This builds up the Build Your Network phase of our six-phase Roadmap to a Cybersecurity Career. Connecting with fellow cybersecurity aspirants, industry professionals, and cybersecurity mentors expands your likelihood of learning about open cybersec…

Read more

5 years ago · Anonymous

Becoming Cyber Newsletter

Follow Cybersecurity Leaders on LinkedIn

Social media offers a great opportunity for aspiring cybersecurity professionals. It provides a chance for you to learn from cybersecurity leaders, who you don’t personally know. On LinkedIn—the social media platform of professionals—you can “follow” people, who you don’t know, which is huge…

Read more

5 years ago · Anonymous

Much of cybersecurity is focused on protecting information technology (IT). You’re familiar with the staples of IT…. servers, desktops, network attached storage, etc. The at-risk infrastructure that gets less press is operational technology (OT). NIST defines OT as “Programmable systems or devices that interact with the physical environment (or manage devices that interact with the physical environment).”

While IT operates in the world of data, OT operates in the physical world. It includes infrastructure like industrial control systems (ICS), building management systems, fire control systems, and physical access control mechanisms. Most people rarely think about these systems until they stop working. The Colonial Pipeline ransomware attack is an excellent example.

While most cybersecurity programs focus on IT security, there is a real need for cybersecurity professionals in OT security. It can be an advantageous specialty for career changers, who have prior experience with OT systems, or people who just appreciate the tangibleness of OT. If you can develop the skills, you’ll undoubtedly find ready demand for them.

What Makes OT Different?

The casual observer may assume there’s not much difference between IT and OT. We’ve heard of medical MRI machines and British nuclear submarines operating on Windows XP. One could extrapolate that the OT world runs on Microsoft just like the IT world does. (Note: No one should be running Windows XP anymore.) That assumption, while understandable, is wrong.

Instead OT deals with software the most people would be unfamiliar with, like Siemen’s WinCC RT Professional, Schneider Electric’s Wonderware, or Inductive Automation’s Ignition. OT systems are traditionally isolated and self-contained. Designed to run autonomously. OT devices are however being put on the internet at a rapid pace.

While this allows a limited technical staff to maintain a lot of infrastructure, it also opens up organizations to a world of bad actors. Russian state actors have attacked the US power grid and other critical infrastructure for years.

Career Opportunities

Operational technology represents a suite of tools that most people have no experience with. This provides an opportunity to anyone with prior experience with OT or simply motivation. But how do you get OT security experience? Fortunately, some notable cybersecurity organizations offer both training and certification.

The casual observer may assume there’s not much difference between IT and OT… That assumption, while understandable, is wrong.

(ISC)2 offers the course, Exploring Cybersecurity in Industrial Control Systems. This course explores the fundamental concepts around security concerns within industrial control systems (ICS) helping you understand how ICS supports critical infrastructure and the global need for ICS security, as it proliferates in various industries. It is an affordable introduction to anyone exploring OT security.

EC-Council offers a ICS/SCADA Cybersecurity program. This is a relatively affordable training and certification option. However, you must have at least one year of information security experience to be eligible for the program.

SANS Institute’s ICS410: ICS/SCADA Security Essentials course provides a foundational set of standardized skills and knowledge for industrial cybersecurity professionals. Certifications from SANS Institute’s sister organization GIAC continually represents the gold standard for technical cybersecurity certification. ICS410’s accompanying certification, Global Industrial Cyber Security Professional (GICSP), will certainly help an aspiring OT security professional to stand out.

What Next?

OT security isn’t for everybody, but it represents a vitally important niche of cybersecurity. Much of a nation’s critical infrastructure would be considered operational technology. If you’re curious whether OT security is right for you, check out a few introductory videos on YouTube. If you’re still interested after that, explore your training options. There will undoubtedly be no shortage of demand for this cybersecurity niche.

Recommended Posts:

Becoming Cyber Newsletter

Future Trends: IoT Security

Future Trends As cyberpunk author William Gibson once said, “The future is already here – it's just not evenly distributed.” We continue to explore Future Trends, which are already seeded and growing today. Technology, which drives people’s lives, businesses, and governments, will alway need to be protected and secured…

Read more

5 years ago · Anonymous

Becoming Cyber Newsletter

Future Trends: Cloud Security

Future Trends We may not be able to predict the future, but we can certainly foresee the technological trends which will impact it. Any technology, which businesses and governments use to evolve and grow, is going to need securing and defending. Future Trends in technology therefore drive future needs for cybersecurity professionals…

Read more

5 years ago · Anonymous

A common mistake persists among aspiring cybersecurity professionals, when it comes to resume writing. Some continue to believe their resume’s content is the only thing that matters. It’s understandable.

You spend so much time trying to develop the right resume bullets to capture all your relevant experience. With such limited space, it’s tempting to use it all. After you’ve spent hours writing and rewriting your resume, it is easy to expect that someone will dutifully read it all.

In reality style matters just as much as substance. A well designed resume is going to get more attention. It makes it easier for recruiters and hiring managers to find the information they’re looking for. Conversely a well written resume—which is hard on the eyes—will do you a disservice.

Myth That Someone Is ‘Reading’ Your Resume

When people think of their resume being read, many have this image of someone sitting at a desk and reading their resume top-to-bottom like the latest suspense novel. Sounds cool, but that's fiction. No one is reading your resume top-to-bottom. You’re lucky if someone spends 30 seconds reviewing your resume.

What does a resume review really look like? One common scenario is that someone reviews your application directly in an Applicant Tracking System (ATS) or similar recruiting software. When this occurs, your application is literally a line item amongst the dozens or hundreds of applicants. The recruiter may view your resume within the ATS to determine which resumes to send to the hiring manager. The recruiter has plenty of applications to choose from. If she chose to view your resume, she won’t linger on it. The recruiter will make a decision and move on.

You’re lucky if someone spends 30 seconds reviewing your resume.

The second scenario is really a continuation of the first one. The hiring manager receives a batch of resumes—via email or through an HR software tool—from the recruiter to review. Even if the hiring manager spends more time reviewing it, your resume is being compared against the others resumes. (When was the last time you compared your resume to someone else’s?) The hiring manager is a busy person, so she makes a decision of who should be interviewed, informs the recruiter, then moves on with her day.

Purpose In Style 

Writing and designing your resume thoughtfully so that it is readable and well-organized is important. Not just because it makes the document easier to read. Consider resume writing to be a demonstration of your ability to synthesize big concepts into a digestible, readable product.

When a candidate sends a three-page resume representing their six years of work experience, they’ve just demonstrated an inability to be concise. When a student drafts a single-space, densely packed resume that looks like a wall of text, they demonstrate an inability to be creative and engaging in their writing. When a career changer provides a resume full of work experience bullets that don’t actually say anything of substance, they demonstrate suboptimal deductive reasoning. These are all negative indicators.

An attractive looking resume allows the reader to make positive inferences about your professionalism and attitude.

Is it unfair to make conclusions about a candidate’s aptitude in brevity, creativity, or deductive reasoning, based on a one- to two-page resume? Maybe. But what else does the hiring manager have to go off of? Furthermore, some candidates will succeed in doing so.

Design Your Masterpiece

Your resume is about your experience and how you present it to the world. How to present your experience can certainly be daunting, especially when venturing into a new career field, like cybersecurity. You can’t control your past experience. (Given the luxury of 20-20 hindsight it’s easy to dwell on what you should have majored in school or what past jobs you should have taken.) You do control how you present that past and current experience.

Every candidate has the same canvas to work with in crafting their resumes. The most experienced candidates do not necessarily have the best looking resumes. The goal of your resume is to make a hiring manager say, I want to talk to that candidate.

A well designed resume allows the reader to easily find the relevant information to come to that conclusion. An attractive looking resume allows the reader to make positive inferences about your professionalism and attitude.

Even if you're not the best fit for the job you are applying for, they may refer you to another role. You have the same one- to two-pages to design your resume as everyone else. Be thoughtful about it. Go forth and design your resume masterpiece.

Recommended Posts:

Becoming Cyber Newsletter

You Should Probably Have More Than One Resume… Here’s Why

As you seek your first cybersecurity job you’re probably open to different types of roles in several industries. That’s okay. If you’re trying to apply to all of those positions with the same resume, you may write an increasingly bloated resume. That’s not okay…

Read more

5 years ago · Anonymous

Becoming Cyber Newsletter

The Best Way to Get Your Resume in the Hands of a Hiring Manager

The average online job posting will receive up to 250 applications. As you can imagine no one is actually reading all 250 resumes. Instead each resume will be reviewed by an applicant tracking system (ATS). A recruiter will review the resumes, which passed the ATS review, then the recruiter sends the (perceived) most viable candidates to the hiring mana…

Read more

5 years ago · Anonymous

Time Is Of The Essence

When it comes to landing their first cybersecurity jobs, students typically have a distinct advantage over career changers. Students have time on their side. Career changers are either working full-time (studying cybersecurity on nights and weekends) or they’re between jobs (trying to get a cybersecurity job before their savings and/or benefits run out).

Sure, days can be long for undergraduate students and longer for graduate students. However, with a global shortage of 3.12 million cybersecurity professionals, rest assured that days are even longer for cybersecurity teams. The underlying question is, How much do you really want to get into cybersecurity?

If most students will opt not to pursue the Security+ certification, then those who do will stand out.

Ask any cybersecurity professional and they’ll tell you stories about working 12 or 16 hour days, tales of working on holidays, or having to cancel personal plans at the last minute. That’s security work. By definition the schedule for cybersecurity is threat-driven. Despite this, cybersecurity professionals still prioritize and make the time to study, learn new skills, and earn new certifications. All this without the generous vacation schedule that students enjoy.

Why CompTIA Security+?

Students pursuing cybersecurity careers come from numerous fields of study. There’s no one path to a cybersecurity career though. That can make it difficult to stand out amongst all the applicants for entry-level positions. One needs to do just that to make it to the hiring manager for her to consider for potential interviews.

A CompTIA Security+ certification allows students to rise above their peers in the application process. Hiring managers have a reasonable understanding of the knowledge level they can expect from Security+ certification holders. If most students will opt not to pursue the Security+ certification, then those who do will stand out. This is advantageous for making it through early resume screening.

Certifications aren't just about having a pretty piece of paper with a seal and your name. It’s about the knowledge that you gain along the way. The knowledge that you gain while studying for the CompTIA Security+ will prepare you with the knowledge to excel during cybersecurity interviews (and on the job). Some interviewers may even skip interview questions regarding material covered in the certification exam all together.

Way Forward

I’ve advised plenty of students over the years to get their CompTIA Security+ while still in school. It’s additional work, but it’s a manageable amount of work and will contribute directly to their earning potential upon graduation. Most don’t do it. They give the excuse that they don’t have enough time.

Students can certainly land their first cybersecurity job without a Security+ certification. Having the certification—any cybersecurity certification, really—will simply increase your chances of being selected for interviews and help prepare them with requisite knowledge. Certifications provide recruiters a standardized measure to use in your favor during resume screening and provides hiring managers with an apples-to-apples measure, when selecting candidates to interview. (Hint: If two candidates have similar educational backgrounds and experience, or lack thereof, the candidate with a cybersecurity certification is more likely to get the interview.)

If you do get an interview without pursuing CompTIA Security+ or some other cybersecurity certification, whatever you do, don’t tell the interviewer that you were thinking about pursuing certification, but didn’t have the time. It won’t impress.

In 2016, a seventeen year old became the youngest person ever to pass the CompTIA Security+. I have confidence that this is a manageable feat for ambitious university students pursuing cybersecurity careers.

Recommended Posts:

Becoming Cyber Newsletter

Do Cybersecurity Certifications Even Matter?

There’s a school of thought in cybersecurity—and in technology, in general—that certifications don’t matter. That experience is the only thing that matters. The thought goes that certification issuing organizations are just in the business of making money. Experience matters more than certifications and certifications are an ineffective measure of one’s…

Read more

5 years ago · Anonymous

Becoming Cyber Newsletter

Best Certifications for Breaking into Cybersecurity

Education has become increasingly democratized in recent years. There are a lot of paths available for your cybersecurity self-education: college/graduate school, bootcamps, online courses, YouTube videos, books, etc. This variety of learning pathways make the Credentialization phase of your…

Read more

5 years ago · Anonymous