I wrote that sentence. August 2021, on this newsletter, in a post called What Makes Cybersecurity a ‘Future-Proof’ Career? You can hear the hurry in it. A “however” at the front and a “though” at the back, the same hedge twice, the sound of a man who knew he owed the reader a caution before he got on with the part he actually wanted to write. I meant it. I just aimed it away from here.

The examples I reached for were other people’s industries. Trucking, where autonomous fleets were coming for the long-haul seat. Law, where, as I put it then, “technology allowed law firms to replace armies of young attorneys with e-discovery software.” I had the instrument. I used it. I pointed it at every profession I could see from where I was standing, and never once at the bottom rung of my own. This issue is me turning it around.

What the man in 2021 had going for him

I want to be fair to him, because he had reasons. The field had ridden every wave of technology it had ever met. Cloud arrived and became one more thing to secure. Mobile arrived and became one more thing to secure. Every new tool for as long as anyone in it could remember had the same effect on this profession, which was to make it larger. I wrote “Cybersecurity isn’t a destination. It’s a way of being,” and against that record I was reading the evidence in front of me correctly.

I had one more reason, and it was the one I trusted most, because it had happened to me. I came through that door myself, off a trading floor, after a long stretch of applications that mostly went nowhere. The seat I landed in taught me the trade. Somebody two chairs over answered my questions for a year. That is the mechanism, stated plainly, and it is the same mechanism for almost everyone reading this who is now senior. Go find anyone with fifteen years in security and ask them where they learned to read a log properly. They will describe a chair, a queue of alerts, and a person nearby who was willing to be interrupted. That is who the “us” in the title is. A specific group of people with one shared origin, and I am one of them.

He was not missing the macro picture

Here is the part that has been hardest to sit with. The frame I was writing inside in 2021 was the Fourth Industrial Revolution reading of what was coming: the argument that automation was about to reorganize whole categories of work rather than shave a few points off them. That frame sits in the subtitle of the other post from that spring, How to Reduce Career Risk and Outrun Job Automation, above the fold, where a reader meets it before the first paragraph.

So I was not guessing. I had the shape of it five years early, in writing, with my name on it. I applied it to trucking, and to law, and to the back office, and to every profession I could name. I never turned it on the chair I was sitting in.

The promise, and what was actually wrong with it

So here is the other sentence, the one I have been circling for two issues. It ran in March 2021, five months before I called the field future-proof, under a headline about reducing career risk. Here it is in full, with its punctuation exactly as I wrote it.

“In order to outrun automation in our careers—and stay ahead of the computers—we must be willing to pivot to roles in which human skills are valued and we’re not competing with algorithms and processors.”

March 2021. That was the advice, and people took it. I have met some of them. The strange part is that I still think it was good advice: the reasoning holds and the destination was chosen correctly. Security work is exactly the kind of work where human judgment is valued, and the senior end of this field is becoming more valuable every year.

The route is where it breaks. To reach the roles where human skills are valued, you first have to spend three or four years in a seat where mostly they are not. Triage. Tickets. The same alert forty times until the forty-first one is different and you finally understand why. That seat is the toll booth on the road I pointed at. And that seat is the one being cut away.

An accounting, not an apology

There is a distinction here I need to make carefully, because it is the difference between the two. As a claim about the profession, future-proof is holding up. The field still rides the wave. Senior work is getting harder to replace, and the problems that reach a senior desk keep getting less routine. If you sat me down and asked me to defend that sentence at the altitude I wrote it at, I could defend it this morning.

People read career advice at the altitude of their own career, which is the only sensible way to read it. I was writing about an industry. The person on the other end was reading about a Monday morning, a first badge, a job they could actually apply for. I wrote at the altitude of a field and I was read at the altitude of a career, and everything I got wrong lives in the gap between those two readings.

Which is why I want to be exact about the pronouns in the headline and the line under it, because between them they are doing two different jobs. The advice was mine. I wrote it. The automating is ours.

What the season has been circling

Four assumptions have been sitting underneath everything I have written here. First, that there is a ground floor everyone starts on. Second, that the door onto it is wide enough to walk through. Third, that the seat behind that door teaches you the trade. Fourth, that the climb from there is fair, or fair enough to be worth starting. Every one of the four rests on the same tier of work. Pull that tier and all of them lose the thing that made them true. There is a fifth, and it is the strongest of them, and I did not see it until this year.

Fifth, that something at the end would certify you

It never existed, and I know exactly how that lands in a field this full of certifications. I hold some myself and they have been worth holding, so take this as a distinction rather than a complaint. A certification and a certifying institution are two different things, and the difference is the whole of what I missed for five years.

Think about how it works everywhere else. You sit the bar in a given state, you pass, and that state licenses you to practice law. Before that day no employer can wave you through, and after it nobody gets to ask again. One authority, one examination, and a legal permission waiting on the other side of it. Other professions run the same machinery under different names, and in every case the standard is public and the answer is the same for everyone who walks in.

Cybersecurity has nothing of the kind. There is no bar exam here. Our certifications are products, sold by private bodies that compete with one another for the same candidates, and not one of them is required in order to do the work. You can build and run a security program without holding a single one. They tell a hiring manager something real about you, which is why people buy them and why I bought mine. None of them licenses you, and there is no afternoon when an institution looks at your work and says the word qualified out loud.

We use the language of a licensed profession in the loose way people do, and we have never built the thing that makes one. What we had instead was time in the chair. The market read years served as the qualifying event, because years served was the only evidence anybody could point to.

Here are two facts. Set them next to each other and they finish the argument without my help. First, the CISSP requires a minimum of five years of cumulative, full-time work experience in at least two of its eight domains. A bachelor’s or master’s in a computing field, or one credential from ISC2’s own approved list, may cover a single one of those five years. Pass the exam without the experience and you hold the Associate of ISC2 designation while you go and earn it, with six years to accumulate the five.

Second, in ISC2’s 2025 hiring trends research, 34% of hiring managers said they require the CISSP for entry-level roles. The number comes from the issuer, which sells the certification, so read it as the issuer’s own account of how its instrument is being used in the market. That is mid-pack, which is the part worth sitting with. In the same study, 38% said they require CISA for entry-level work, and CISA asks for five years of its own. Credentials that take five years of experience to hold, asked for by more than a third of the managers hiring into the job that is supposed to supply the experience.

Two institutions, and we built neither

Every one of those professions runs two institutions, and each does a different job. A formation mechanism: residency, articling, supervised audit hours, line checks. The part that teaches you the work. A gate: the boards, the bar, the CPA, the type rating. The part that licenses you to do it. Cybersecurity built neither one, and the chair absorbed both jobs without anybody deciding that it should. It did them for free, which is why nobody noticed. So the claim is larger than the one I have been making all season. The productive task and the developmental task were the same activity, yes. Sharper than that: the productive task, the developmental task, and the qualifying event were all one chair.

The hollowing is quiet because the seat is still budgeted

That chair is being cut away now. Early stages, uneven, faster in some shops than in others, and moving. The work at the bottom is being hollowed, not eliminated. The seat is often still there and still budgeted. It is being emptied a task at a time, which is slower to notice and harder to argue with. Which brings me back to the line at the top, and I would rather write it plainly in the body than leave it up there working as a headline.

We are automating the job that made us.

That sentence has an agent, and the agent is us. The same people, the ones the chair made. We are the ones buying the tooling, approving the architecture, and signing the budgets that are hollowing the tier we came up through. Each of those decisions is defensible on its own terms. That is precisely what makes this hard to stop, and it is why I do not think there is a villain in this story worth going to look for.

The next honest step

The question I owe you next is a mechanical one, and I would rather answer it with specifics than with a mood. What is actually doing the hollowing? What does it genuinely do well, and what does it still hand back to a person? A seat losing three of its ten tasks is a different problem from a seat losing seven, and which one we are in decides almost everything about what anybody should do about it. That is the next issue. Until then, one thing for each of you.

If you are trying to get in: keep studying for the certification, and stop treating it as the gate. The course gives you a structured path through material you would otherwise wander around in, and passing shows a hiring manager you cleared a consistent bar, which is worth something real. What it cannot give you is what the chair gave me, which was somebody two chairs over explaining what they had seen that I had missed. Ask a different question in your next interview, out loud, and ask it early. Who is going to teach me, by name, and what do the first ninety days look like? A hiring manager with a real answer is offering you the thing the certificate cannot. A hiring manager without one has told you something useful too.

If you are already up the ladder: you were made by a chair that is being emptied while you watch. You are allowed to say that in a planning meeting. Name what your team’s formation mechanism is now, in plain words, and if the honest answer is that there is not one yet, that sentence is worth more to your organization this quarter than any figure I could put in front of you.

I got this wrong in public in 2021. It seems only fair to correct it in the same place.

— Oritse

A note on where I stand: I spent years running security inside large financial institutions, and I sit on the advisory board of a company building autonomous security tools. Nothing non-public, from anywhere I have worked, goes into what I write here.

Next: what is actually doing the hollowing, and what it still hands back.

A cyber threat team at Citi needed somebody who could take what the analysts were finding and turn it into something an executive would actually read. I knew a little about security and a lot about explaining things. That was the whole of the job. Nobody wrote that hire up as an innovation, and if you had asked the people who made it, I doubt they would have called it anything more than solving a Tuesday problem. Everything I have done since runs back through that room.

In the first issue of this series, I described the chair almost everyone in this field learned in. The queue, the alerts that were nothing, the occasional one that was something, the senior analyst who walked you through what you had missed. I ended that issue by telling you there were many doors into this field, including the strange one I came through.

So here is the admission that story needs: I never sat in that chair.

I came in through a side door, and then I spent years on the other side of the table hiring people who had. Which is a strange vantage point, and it is the reason I want to talk about doors before we talk about what is happening to them.

The Man Who Did Not Exist

In March 2021, I wrote a piece on this newsletter called The Myth of the Cybersecurity Archetype. It was about a man named Chad.

Some people think all cybersecurity professionals are a guy named Chad, who got a degree in electrical engineering from Stanford. He worked as a systems administrator for a couple years, then as a network engineer for a few more, before becoming a SOC analyst.

Chad was not real. He was the composite in everyone’s head, and his job was to make good people decide not to apply. Against him I set three others: Luis, a lawyer who worked out after law school that he did not much like being a litigator. Samantha, a high school graduate who was seriously into technology. And Oti, who studied international affairs before finding out cybersecurity was a career you could have.

I should probably admit that Oti was me. I put myself in that post five years ago and did not mention it, which at the time felt like modesty and now mostly looks like a missed opportunity.

Many Doors, One Floor

The doors were real, and I have watched people come through all of them. The veteran whose service built an instinct no course teaches. The lawyer who does not need to know how a network works, only enough to follow what happened and find where the exposure sits. The person moving across from IT or audit who already understands how the business makes its money. The career-changer at thirty-eight.

Two of those are mine. I was thirty-eight, and the reason anybody read my résumé at all was a man I barely knew from another part of the bank—a former Marine Corps intelligence officer who sent an email on my behalf because of where I had been in Afghanistan.

This is not folklore. In ISACA’s 2025 survey of more than 3,800 security professionals, 46% said that half or more of their cybersecurity staff had started their careers in a different field entirely. Close to half of this profession is made of people who used to do something else.

Here is the part I did not see for a long time, and it is the reason this issue exists. Those doors did not all lead to the same room. They led to the same floor.

If you have not seen it, Henry Jiang’s Map of Cybersecurity Domains lays this field out on one page: security architecture, security operations, governance, risk assessment, threat intelligence, application security, enterprise risk, physical security. It is the best ten minutes you can spend, if you are trying to work out where you might fit.

Now pick almost any branch of it. At the bottom of each one sat a job made mostly of repetition.

In security operations, it was the alert queue, which is the version everybody pictures. In vulnerability management, it was working a scanner’s output, tracking down whoever owned the server, and scanning again to find out whether anyone had actually fixed anything. In identity, it was access reviews—thousands of rows of who can reach what, asking managers to confirm things they would rather not think about. In governance, it was evidence collection—gathering the screenshots and records that prove a control does what the policy says it does. In third-party risk, it was vendor questionnaires—hundreds of them. In application security, it was triaging scanner findings, most of which were false positives.

None of it was glamorous. All of it was necessary. And every one of those jobs taught the person doing it something that could not be learned any faster.

The queue taught you what normal looks like on your own network. Vulnerability management taught you how the business actually runs, who owns what, and why an obvious fix can sit untouched for a year. Access reviews taught you how privilege accumulates, when nobody is watching. Evidence collection taught you the difference between a control that exists and a control that works. Questionnaires taught you to read a company’s security posture through what it declines to say.

That is the floor. Different rooms, different vocabulary, one shape underneath: high-volume, low-authority work, done in a building full of people better at it than you were, until one day you were one of them. The alert queue is only its most legible version, which is why it is the one I reached for first. It was never the only one.

Which is how I can tell you I never sat in that chair and still say I came up the way you did. I sat on the floor of a cyber threat management team. My high-volume, low-authority work was turning other people’s findings into language an executive could act on. I did a great deal of it, badly at first, next to people who were very good at the thing I was describing. Same machine, different room.

So the field was wide open at the entrance, but remarkably uniform once you stepped inside. Many doors, one ground floor. The doors were the different paths people took to arrive, but that shared floor was where everyone actually started.

The Door Was Wide Because the Floor Was Vast

We told ourselves a flattering story about this, and I told it too. We said the field was open because it was young, because it was meritocratic, because we knew that people who think alike miss things together. Some of that was true. It was not the mechanism.

Start with the simplest fact about this field, and it is easy to miss because it is an absence: in the United States, security has never been a licensed profession. Nothing stands at the door: no exam that decides whether you may do this work, no board that decides you are ready, nothing but the judgment of whoever is hiring. What we had instead was the floor. The field let people in and found out about them afterwards. A filter that runs after you arrive leaves the front of the building open.

The rest of the mechanism was that the ground floor was enormous. There were more entry seats than there were obvious candidates to fill them, so a hiring manager with ten of them could afford to spend two on people who did not look the part. That is not generosity. That is arithmetic. The ground floor paid for our openness, and the field took credit for an inclusive policy it never actually had to design. Which tells you what happens when the arithmetic changes.

What Happens When There Are Two Seats Instead of Ten

The work is still arriving. ISACA’s 2025 survey found 47% of security professionals now help build AI governance, up from 35% the year before, and 40% are pulled into AI implementation, up from 29%. That is a new responsibility, measured, inside twelve months.

The teams are not keeping pace with it. In the IANS 2025 benchmark of 587 security chiefs, 47% reported flat team sizes, and security fell from 11.9% to 10.9% of what companies spend on technology. Not collapsing. Flat, while the job gets bigger.

Now put yourself in the chair I sat in for years. You have two junior openings instead of ten. Each one is now a larger share of everything you have. The interesting résumé—the one from the person who has never done this, but you suspect could—is a bet. With ten seats you could carry two bets. With two, you cannot carry any.

The door narrows when every hire has to be safe. Not because anyone became prejudiced, but because each decision started carrying more weight, and weight makes people careful. Chad comes back, and he comes back as prudence. This is not confined to the noisiest floor. The same wave is arriving on all of them.

You can already see it in the one place it would show up first. Between ISACA’s 2024 and 2025 surveys, the share of companies training their own non-security staff into security roles fell from 41% to 29%. That is the internal transfer—the door I have spent a career telling people to walk through—closing by nearly a third inside a year while nobody announced it. Open entry-level roles held steady across the same period. The work at the bottom is being hollowed, not eliminated. This is a narrowing, not a collapse, which is precisely why it is worth naming now rather than afterwards.

I want to be careful here. That drop sits next to the arrival of capable AI tooling, and sitting next to something is not the same as being caused by it. I cannot prove the connection and I am not going to pretend otherwise.

The Case Against Everything I Just Said

There is an honest argument that runs the other way, and I would rather put it in front of you than have you find it later.

If software absorbs the technical grind, then the technical background matters less, and this field should get more open, not less. The person who understands the business, who writes clearly, who can sit with ambiguity, has never been better positioned. On that reading, the doors widen.

I think both things are happening at once. The skills barrier is coming down while the seats get scarcer. Which force wins is genuinely not settled, and anybody who tells you they know is guessing.

Two Ways to Read This

If you are standing outside trying to get in: your unusual background was never the problem, and it still is not. What is changing is not the field’s appetite for people like you. It is the number of places where a bet on you is cheap enough to make. That is a harder problem than prejudice, and it is also not about you.

If you run a team: the variety you are proud of was bought by a ground floor you are now automating. It was never a policy. If you want to keep it, you are about to have to choose it on purpose for the first time, and pay for it, in a year when everything else is being asked to justify itself. That is the honest state of the door.

Which brings me to something I owe to this list. Five years ago, I sat down and told you cybersecurity was a future-proof career, and I told you how to outrun automation by coming here. Those posts are still up. Next time, I am going to account for them.

— Oritse

When I said this newsletter was coming back, I made one claim and left it there: the first rung in the cybersecurity job ladder is being automated, and a lot of it should be. Here is the rest of that story.

Nearly everyone I respect in this field learned in a very similar way: in an unglamorous chair, doing tedious tasks, facing a seemingly endless alert queue. We came from different places—the military, the IT help desk, a computer science degree, a career change at 38—but we converged on the same roles. The bottom of the ladder in an Incident Response desk, a SOC shift, or across any number of technical cybersecurity disciplines. Working as Tier 1 analysts as the alerts came in.

When you strip away the mystique, here’s what the role really was. You watched a queue. Alerts fired—an anomalous geographical login, an unsigned binary executing in temp, unusual outbound beaconing—and your job was to look at each one and decide: something or nothing. The vast majority of alerts were false alarms. You closed out most alerts, documenting why they were benign, and moved to the next one. You escalated the alerts that might be something up the ladder to Tier 2 and Tier 3. These were people who could investigate further than you could. Monitor, triage, escalate. That was the day. Over and over again.

On paper, it risks looking like data entry with a security badge. Plenty of people treated it that way. However, something was happening in that chair. Something that never showed up in a job description.

You were learning to tell the difference between a real threat and noise. Developing tacit knowledge—knowledge that cannot be codified in documentation or frameworks, but is acquired through repeated environmental exposure. You could see the same innocuous pattern a hundred times. The one time it turned out to be someone inside the network, you built an instinct that no course sells. You learned what “normal” looks like at your company. You learned which servers talk to which, which alerts your finance team trips every month-end, and which vendor software just behaves badly. That context isn’t in any framework. You can only absorb it by sitting close to the traffic for long enough that the abnormal starts to jump out at you.

You also learned from proximity. When you escalated something and a senior analyst walked you through what they saw that you’d missed, you got something most professions would envy: someone showing you how they thought, not just what to do. One-on-one, on real stakes, in real time. The alert queue put you next to people who were really good at what they did. It gave you a reason to talk to them every day and it gave you a steady stream of concrete problems to be wrong about safely. That’s a huge thing. It’s how expertise actually gets transferred. Junior professionals and more experienced leaders working shoulder-to-shoulder on problems that matter.

So the honest description of those entry-level, Tier 1 roles isn’t “the boring job you do before you get to do the real work.” It was the school, the apprenticeship—though nobody ever called it that. It taught you triage instinct, adversary intuition, and organizational context under the cover of a modest title. We wrapped the most important cybersecurity learning inside its least respected role, then wondered why we couldn’t explain how anyone became good at this. The answer was hiding in plain sight: they sat in the seat, and the seat taught them.

Why did we mistake those entry-level tasks for toil? Partially, because a lot of it was. The repetition and burnout were real. It would be disingenuous to romanticize the after-hours, false-positive marathons in hindsight. Partially, because those who made it to the top of the ladder had a quiet incentive not to look too closely at the tasks at the bottom of the ladder. The mystique flattered everyone. Lastly, if we’re being honest with ourselves, because we never really had to think about it. The apprenticeship ran itself. Every year a new cohort sat down to stare at the alert queue and, a few years later, some of them would graduate to the group of seniors who would train the next cohort. You don’t stare too hard at a process that appears to perpetually keep working.

That’s exactly why this moment—this nascent agentic AI revolution—demands that we finally look at it. The process doesn’t function on autopilot anymore. That entry-level seat is being redesigned, but we’re not really clear what the next iteration will look like. More to the point, those most valuable teaching aspects of entry-role are at risk, because we never precisely named them, measured them, or built them intentionally. You can’t protect what you refuse to see clearly. So this is me trying to see the challenge of this moment clearly, on the record, before the cybersecurity profession really hits crunch time.

Hold that image in your head: the ladder and the role on the first rung that taught everyone who ever climbed it. Next time, I want to look at who actually got to climb the ladder. There are many doors to get into this field, including the strange one that I came through. That’s why the field’s habit of letting people in from uncommon paths was one of its quiet strengths.

If the main door is narrowing, we’re going to need to remember the other ways in.

— Oritse

This newsletter has been quiet for a while. It starts again on Thursday 20 August.

Here is what changed. The first cybersecurity job—the bottom of the alert queue, where nearly everyone I respect in this field started—is being automated. Not gone. Being automated, right now, while people are still sitting in it. And the uncomfortable part is that a lot of it should be: it was repetitive work that burned people out. But that queue was also where you learned the job. Hand the toil to software and the apprenticeship goes with it.

That knot is what the next season is about. An issue every two weeks. No hype, no invented numbers, and no pretending the old map still works when it doesn’t.

The 2021 archive is still here, including two issues where I argued cybersecurity was a future-proof career and told you how to outrun automation. I am not taking those down. I will account for them properly in a few weeks.

If you subscribed years ago to break in, stay with me. It is a harder and more interesting problem now.

—Oritse

A note on where I stand: I’m a practicing security executive and an advisory-board member of a company building autonomous (“agentic”) security tools. I keep anything non-public—about my employer or that company—out of what I write here.

There’s so much to learn, when you’re trying to get into cybersecurity. You study, learn, and network. Then along the way, you notice that occasionally people say information security, instead of cybersecurity. Some people use the two interchangeably. The usage is confusing, but you may be reluctant to ask.

The confusion is understandable. Many professionals in the field—yours truly included—regularly switch between the two terms or simply use the wrong one. Why? More on that shortly. First let us inquire, what is the difference between cybersecurity and information security?

Allow me to provide a non-technical analogy.

Everybody knows what a dog is, right? (One is sleeping next to me as I write this.) Regularly, we refer to dogs as canines. In fact, we act as if canine is simply a fancy word for dog. Here’s the thing… Dogs and canines aren’t necessarily the same thing. Sure, dogs are canines. But wolves, coyotes, and jackals are canines too. Yet when a police cruiser labeled “K-9 Unit” drives by, you would never expect a 120-pound wolf to stick its head out the window. Yet, despite the inaccuracy we still regularly treat dog and canine as synonyms in English.

In this analogy cybersecurity is the dog and information security is the canine. Cybersecurity involves confidentiality, integrity, and availability—known as the CIA Triad—for computer systems and networks. Information security is broader, encompassing domains such as identity and asset management (IAM), security assurance, security architecture, and more. Cybersecurity is part of information security, but information security is bigger than just cybersecurity.

So why do professionals in the field mix the two up? Largely because cybersecurity has developed a brand and awareness. Everyone has heard of cybersecurity nowadays. Even if they cannot explain precisely what cybersecurity is, they know it has to do with stopping bad guys on computers. It took a few decades for cybersecurity to enter the public’s consciousness. Thus it’s simpler to say cybersecurity, when you really mean information security.

Cybersecurity is part of information security, but information security is bigger than just cybersecurity.

To be fair, as people move around in their career, they may move from a cybersecurity role to an information security role, then back to another cybersecurity role. Of note however, the top job in this field is called the Chief Information Security Officer (CISO), not the Chief Cybersecurity Officer.

While professionals in the field are capable of in-depth discussions about the difference between cybersecurity and information security, rest assured that our friends and families have little interest in hearing them. Thus, if you bump into us at a barbecue, we’re likely to just say we work in cybersecurity. Even though we know, it’s an imperfect answer.

What is the most valuable skill set which I would recommend that information security newcomers learn? That’s an interesting question. After all, infosec isn’t a single job. The information security career field consists of easily over a dozen roles. So what single skill would be valuable across the spectrum? Easy. Cloud computing. It provides the greatest benefit across a range of roles for information security professionals.

Not every infosec role is technical, but it’s vital that every infosec professional achieves a reasonable level of technical acumen. In previous years, that might have included studying for the CompTIA Network+ or a similar certification.

The rise of cloud computing provides newcomers with a leapfrog opportunity. They can go directly to the new, in-demand skill without needing to focus on on-premise networking first. There’s even an advantage. Newcomers won’t have to unlearn legacy ways of doing things, based upon the limitations of on-premise technology.

Here’s the bonus. If you gain a solid understanding of cloud computing, you’ve also acquired a basic understanding of on-premise computing.

Cloud is the Future

In the not-to-distant future cloud security will simply be called “cybersecurity.” That’s because so much of organizations’ infrastructure will be in the cloud, that securing the cloud will no longer be a niche subset of cybersecurity. Not surprisingly, many infosec senior leaders today have no cloud background and don’t have the bandwidth to develop this new skill. This creates opportunity for the newer generation.

By learning cloud you can stand out with an in-demand skill set, which can be reasonably relevant for on-premise security as well. Cloud computing also introduces concepts like shift left and policy-as-code, which skilled infosec professionals can leverage to improve an organization’s entire security program.

How much demand is there for cloud-literate professionals? According to the consultancy Deloitte between 2017 and 2020 the number of cloud job postings increased by 97%. While 90% of IT leaders planned to expand their cloud environments, 80% said a shortage of cloud-literate staff is holding them back.

In the same Deloitte report, Megan Slabinski–a district president at the recruiting firm Robert Half–stated, “Cloud computing remains the number one most sought-after skill.” When you combine the cloud skills shortage with the cybersecurity workforce gap—3.4 million roles remained unfilled globally in 2022—a very compelling opportunity becomes evident.

Learning Cloud 

So where do you start? If you’ve already landed your first information security job, learn whichever cloud platform your organization is using. If you haven’t landed your first infosec job yet, learn AWS. It has a robust number of certifications and training available, and the concepts are transferable between platforms.

Learning a new cloud platform after AWS is like learning a second romance language. If you learned to speak Spanish already, learning Portuguese or Italian shouldn’t be too difficult.

Personally, I’ve found A Cloud Guru and Tutorials Dojo very effective resources in studying for and passing cloud certifications. I used ACG for certification courses and TD for practice tests.

I’m a supporter of certifications, because they provide a standardized way to learn a new skill set to an established standard. Of course, this must include a good amount of learning by doing. Your cloud certification journey should include ample time spent hands-on-keyboard in the console. After all, the goal is to learn new cloud skills. Certifications are simply evidence of having done so; they are not the genuine goal.

Cloud Adoption

Organizations across the globe are working on digital transformation efforts, which largely means that they’re working on their cloud adoption. If technology teams can build it, security teams need to defend it.

As such, you can expect the demand for security professionals with cloud skills to remain high. The shift towards cloud computing will force information security programs to shift as well. That includes integrating concepts which allow us to be more efficient and effective. If you want to be an information security leader of tomorrow, there’s a lot of benefit to learning cloud computing today.

We’ve discussed the value of networking the journey to your first cybersecurity job. A side effect of your networking is that you’ll develop a group of cybersecurity professionals and leaders who are interested in your success. These stakeholders are people who took the time to review your resume, talk to you about different cybersecurity specialties, made introductions for you, and so on.

There is one last step to your journey to become a cybersecurity professional. It’s by far the easiest. After you accept an offer for your first cybersecurity job, contact the people who helped you get there. It doesn’t need to be anything overly elaborate. Call them or send them an email and let them know about your success.

They’ll have interest in hearing about your new role. Tell them what excites you about the new position. You can even mention your ambitions in the coming years. Then of course, thank them for their role in your journey. Do this before making your big LinkedIn announcement of your new role.

After you accept an offer for your first cybersecurity job, contact the people who helped you get there.

This simple, but important step, serves a few purposes. First, the people who helped you genuinely wish you success. Cybersecurity needs more good people. If you're smart, curious, and driven, we need you. Let your stakeholders know that they helped add another cybersecurity professional to our ranks.

Second, the followthrough helps to further develop your cybersecurity relationships. There is a value to having a cybersecurity network that extends beyond your employer. By demonstrating that your contact is more than transactional, you can help develop relationships that go beyond one-time assistance.

Cybersecurity needs more good people. If you're smart, curious, and driven, we need you.

Third, you’ll demonstrate that you’re a class act. It’s easy to post your career update to LinkedIn with the presumption that all your stakeholders will see it there. It takes effort to individually create messages to the people who helped. The effort will serve as a demonstration of your character.

It can be challenging to get into cybersecurity. Because of that challenge it will feel truly amazing when you get that first job. After you do, make sure you stick the landing. Properly thank the people who helped you. It will impact how your cybersecurity stakeholders view you as a professional.

Becoming Cyber Newsletter

What Makes Cybersecurity a ‘Future-Proof’ Career?

In a world in which workers—both blue- and white-collar—increasingly see their livelihoods automated away, cybersecurity remains a future-proof career. That’s great for cybersecurity professionals. It can be motivating for aspiring entrants. While technology continues to disrupt seemingly every career field, this on…

Read more

5 years ago · Anonymous

Becoming Cyber Newsletter

Cybersecurity Is A Relationship Business

When people think of the cybersecurity profession, many naturally think of the technical aspect. You certainly need technical proficiency. Many would be surprised to hear, however, that cybersecurity is really a relationship business. Whether you look at the protected or the protectors, people are the lynchpin. The systems and applications, which cyberse…

Read more

5 years ago · Anonymous

I write a lot about the value of certifications on the road to landing your first cybersecurity job. However, on the internet you’ll see plenty of people loudly proclaiming that certifications are BS and the only thing that matters is hands-on experience. So which is it? In order to make yourself marketable, should you pursue certifications or hands-on experience? The short answer is: both.

Value of Certifications

A cybersecurity certification provides more than a fancy piece of paper, a colorful badge, or resume filler. It provides a roadmap to learn something new. For example, let’s take the Certified Ethical Hacker (CEH) certification. You could absolutely learn about ethical hacking without the CEH. The benefit you get from the certification is a curated agenda of skills and knowledge to work with.

Admittedly, passing a certification exam isn’t a demonstration of expertise in a given subject area. After all, the passing score for most certifications is somewhere around 70%. Back in your school days your parents wouldn’t have been particularly impressed with a report card touting 70%. What passing a certification does demonstrate is that you understand the topic to a widely understood, acceptable standard. The CompTIA Security+ exam is the same exam around the world. On the other hand, your college course or individual learning will vary in covered topics and depth.

Detractors claim that passing a certification simply demonstrates that you’re good at taking certification exams. There’s a bit of truth there. The exams are often in a familiar computerized, multiple choice format. (We’ll carve out an exception for the Offensive Security Certified Professional (OSCP) certification. I’ve never heard anyone claim this 100% hands-on exam is anything less than challenging.) All things considered, you’ll have an advantage if you’re good at standardized tests. That skill is not enough though. You need to actually learn the material.

Honestly, the loudest critics of cybersecurity certifications are a bit disingenuous about the realities of landing a job with no prior cyber or IT experience. Breaking into cybersecurity is hard. The HR software and recruiters are screening most people out based on the content of their resumes. In the absence of professional experience, certifications are valuable in helping get your resume to the hiring manager. Certifications help in the recruiting process.

Value of Hands-On Experience

While certifications provide a great roadmap to learn new skills, the best way to actually learn new skills is by doing. Build things. Take things apart. Break things. Fix things. Watching a demonstration is useful. What’s more useful? Working to get things to work on the second, third or fourth attempt. Those lessons will stick with you more than a demonstration. You get a lot of value from hands-on experience. After all, real life isn’t a multiple choice test.

How do you get hands-on experience? There are three effective ways to go about it:

1. Join a cybersecurity bootcamp

2. Use an online cybersecurity lab environment

3. Build a cybersecurity lab environment

Cyber Bootcamp

There are pros and cons to cybersecurity bootcamps. They can be worthwhile, but you’ll really want to do your research. Not all bootcamps are created equal. Here’s some with checking out.

• 21 Best Cyber Security Bootcamps | Course Report

• Cybersecurity | NPower

• Cybersecurity Analyst Training | CyberNow Labs

Online Cyber Lab

Want something easy to get your feet wet? Looking for a taste of cybersecurity to see, if it’s really for you? Online cybersecurity labs are a painless way to get access.

• Cybersecurity Lab | Nova Labs

• Immersive Labs

• Cyber Skyline Professional

• Infosec Skills | Infosec Institute

Home Cyber Lab

Nothing says “hands-on experience” like building your own cybersecurity lab. Obviously, you don’t know what you don’t know. So leverage some quality online guidance on how to build a home cybersecurity lab.

• Building a cybersecurity lab: A simple guide on using security operating systems to build a home lab | Medium

• Building a home cybersecurity lab | AT&T

• Building a Cybersecurity Homelab | Cyberwox Academy

Do Both

When pursuing your first cybersecurity job, it really shouldn’t be a decision between certifications or hands-on experience. You’ll want to do both. They each have benefits, which complement each other like peanut butter and chocolate.

If someone comes to an interview with a couple certifications on their resume and they’re prepared to talk about their hands-on experience, that person will be in an advantageous position. Sure it takes more time to do both. It’s an investment in yourself.

Recommended Posts

Becoming Cyber Newsletter

Do Cybersecurity Certifications Even Matter?

There’s a school of thought in cybersecurity—and in technology, in general—that certifications don’t matter. That experience is the only thing that matters. The thought goes that certification issuing organizations are just in the business of making money. Experience matters more than certifications and certifications are an ineffective measure of one’s…

Read more

5 years ago · Anonymous

Becoming Cyber Newsletter

Are Cybersecurity Bootcamps Worth the Money?

An aspiring cybersecurity professional, considering his training options, recently asked if cybersecurity bootcamps are worth it? That’s a common question, especially considering the variety of cybersecurity training options available. The short answer is…

Read more

5 years ago · 1 like · Anonymous

Landing your first cybersecurity job is challenging. With some hard work, networking and perseverance you’ll eventually hear those magic words: “We’d like to make you an offer.” It’s an amazing feeling after months of job hunting. Now it’s time to discuss a subject that your teachers and mentors may not have prepared you for: Money.

Salary Range

Cybersecurity is a well compensated career field. For some readers that initial offer may be more than you’ve ever made before. It might be more than your parents ever made. Your natural instinct is to quickly say “yes” and ring the register. Not so fast!

From the recruit’s perspective it’s easy to presume that the company has a specific salary planned for the role. It’s more likely that they have a salary range planned for each role. It only benefits the company, if you accept their first offer. After all, they likely have some wiggle room in what they can offer.

Often your prospective employer expects you to negotiate. Their planned salary range will reflect the position, the company, and the geography of the role. Whether the range is $70-80k or $100-120k, it’s a reasonable assumption that their initial offer was not at the top of the range. Negotiating can earn you some incremental gains.

Compounding Returns

You probably won’t be able to negotiate for a dramatically higher salary for your first cybersecurity job, but any increase in salary can have notable implications. Throughout the course of your career your salary in a given year will usually be a function of multiple factors including your previous year’s salary. Your employer will generally take your previous year’s salary into consideration for your annual and promotion pay raises (except when you change companies).

That means any extra salary you can negotiate will have a long lasting impact. Let’s say we presume you get just a 2% annual raise over the course of the next 30 years. Even in this modest scenario every extra $1,000 you can negotiate for is worth a total of $40,568 over the 30 year period.

Negotiating for an extra $5,000 may not sound like a big deal. After all, it’s only an extra $417 a month (before taxes). Even that’s worth an extra $202,840 over a 30-year period. But you’re not playing for just annual raises. You’re looking to get promoted and advance in your career. So let’s say that in addition to 2% annual raises you also get a promotion every five years with a 20% raise. Every extra $1,000 you negotiate for with your first cybersecurity job, would equate to over $64,000 for the course of 30 years. Negotiating for an additional $5,000 would be worth over $322,000 of lifetime earnings in this scenario.

Starting to get the point? Any additional salary you can negotiate can have long-term benefits.

Be Informed and Sensible

When it comes time to negotiate salary, it’s important to be informed about negotiation techniques and be sensible with your expectations.

Have a plan. When you get your verbal offer, it is okay not to give an answer right away. Thank them and ask if you can get back to them in a day or two. This will give you time to regroup and prepare for your counter. You don’t want to negotiate salary on the fly. Below are a few handy salary negotiation resources.

• How to Negotiate a Salary | Newsweek

• How to Negotiate Salary: 37 Tips You Need to Know | The Muse

• Fearless Salary Negotiation Tips with Josh Doody | Listen Money Matters [podcast]

• 13 Tips to Negotiate Your Salary and Job Offer | Indeed

• 15 Rules for Negotiating a Job Offer | Harvard Business Review

Being sensible in your expectations requires you to have an idea of what salary range is reasonable. Find company- and title-specific salary information with online resources like Salary.com, Glassdoor, or PayScale. Your salary negotiation isn't like the movies where they give some wildly inflated counteroffer. Make a counteroffer at the top of the range (or just above it). 

Your bargaining power may not currently be super high. This is after all your first cybersecurity job. However, any additional salary you can negotiate will have long-term, compounding effects. Many employers are expecting you to negotiate.

At the end of the day it’s important for you to be happy with your role and your salary. Cybersecurity is well paid. It’s also hard work. It’s not uncommon for cybersecurity professionals to work long hours, weekends, and occasionally holidays. You want to feel like you’re being compensated fairly for your hard work.

Recommended Posts:

Becoming Cyber Newsletter

Cybersecurity Is A Relationship Business

When people think of the cybersecurity profession, many naturally think of the technical aspect. You certainly need technical proficiency. Many would be surprised to hear, however, that cybersecurity is really a relationship business. Whether you look at the protected or the protectors, people are the lynchpin. The systems and applications, which cyberse…

Read more

5 years ago · Anonymous

Becoming Cyber Newsletter

Imposter Syndrome Is a Real, But You’re Not Alone

You’ve worked your butt off completing your cybersecurity training courses and certifications. You’ve finally scored your first cybersecurity interview. Are you doubting your skills and abilities? Are you starting to question why they would hire you? Do you begin to worry that despite the hard work you’ve put in, that you’ll be discovered as a fraud? Th…

Read more

6 years ago · Anonymous

When people think of cybersecurity, the first thing that comes to mind for many of them is penetration testing. Like a Wu Tang rapper, this cybersecurity specialty is known by many names, including ethical hacking, vulnerability assessment, and Red Teaming. The basic premise is that penetration testers (or pentesters) are good guys, who get paid to act like bad guys, without the pesky hassle of potential lawsuits and prison. What do pentesters actually do? The core of their mission is to find exploitable system vulnerabilities, process gaps, and flaws, so organizations can fix them before threat actors find them.

What is a Hacker?

The term hacker is widely used and misused, particularly in the media. A lot of definitions you’ll find imply an inherently nefarious character. They suggest that hacking is by definition synonymous with cybercrime. Technology writer Kamran Sharief provides a more extensive definition. He explains, “The term hacker refers to a computer expert. The concept has two primary meanings since it can refer to a hacker (a person who illegally accesses a system to take control or obtain private data) or an expert who is responsible for protecting and improving computer security.”

In practice you won’t hear the term hacker used very often in cybersecurity. It’s a little one-dimensional. More often you’ll hear cybersecurity professionals refer to penetration testers (good guys) and threat actors (bad guys).

Internal vs External

Internal penetration testing teams are more likely to be found in large organizations. They are an indicator of a well budgeted, mature cybersecurity organization. Smaller organizations will often outsource their penetration testing requirements to external firms.

As with all things in life, there’s a trade off between working in external or internal pentesting roles. Joining a penetration testing firm (external) may offer you a less “buttoned up” work environment. You’ll undoubtedly gain experience against a wide variety of companies in a number of industries. These external firms may give you more room to harness your inner pirate.

Joining a penetration testing team for a large organization (internal) can provide opportunities to test more complex corporate environments. There are opportunities to work with the Blue Team to identify things that need to be fixed (i.e., Purple Team). You might even get nicer toys to play with.

Red Team vs Blue Team

If you spend my time hanging around pentesters, you’ll undoubtedly hear references to Red Team and Blue Team. Cybersecurity borrows liberally from military concepts and terminology. The Red Team/Blue Team concept is a perfect example.

Military symbology has been used in Europe since the Napoleonic Wars. However, it wasn’t until World War I that England and France—former adversaries turned allies—agreed to use blue for allied symbols and red for adversary symbols. The tradition persists today among NATO militaries.

In cybersecurity terms, Red Team refers to penetration testers and Blue Team refers to security operations (SOC). The two are often pitted against each other during penetration tests or adversary emulation exercises. As you can imagine, nobody likes to lose. This can make for a touchy relationship at times.

Training and Certification

I’m generally a proponent of leveraging certifications to help get past the initial screening to get interviews. Studying for certifications can help, but in pentesting you really need to learn by doing. A good place to start getting your hands dirty is Hack the Box or similar lab environment. The platform provides you with a number of virtual machines to practice your hacking skills on.

But where can you learn those skills to begin with? The internet is awash with pentesting training. From Udemy to bootcamps to YouTube. The barrier to entry is low. Start with the more economical training options you can find and work your way up from there.

When it comes to certifications there are plenty to choose from. Here are some notable options:

• Offensive Security Certified Professional (OSCP)

• GIAC Penetration Tester (GPEN)

• GIAC Exploit Researcher and Advanced Penetration Tester (GXPN)

• EC-Council Certified Ethical Hacker (CEH)

• IACRB Certified Penetration Tester (CPT)

• IACRB Certified Expert Penetration Tester (CEPT)

• CompTIA PenTest+

The OSCP makes for a pretty solid calling card in the penetration testing community. As opposed to many cybersecurity certifications, there’s no multiple choice test to prove your knowledge. It’s 100% hands on. OSCP is a 24-hour exam in which people regularly run out of time. It’s definitely not your starting point, but something to work towards. How hard is it? Their motto is “try harder!”

Is Penetration Testing for You?

Start training and pwning boxes early. As Kamran Sharief wrote, “The term hacker refers to a computer expert.” You don’t become an expert by taking a single course… or even a few courses. You become an expert by becoming a student of your craft.

It’s very important to determine whether you actually like pentesting. A lot of people like the idea of penetration testing. To determine if pentesting is really your calling you need to get hands on keyboard. To be honest it’s perfectly fine if penetration testing isn’t your thing. There are a lot of specialties in cybersecurity. Most people in cyber aren’t pentesters.

However, if you get that dopamine rush from struggling through and finally cracking a box you’re not supposed to be able to access, then you just might be a future pentester.

Recommended Posts:

Becoming Cyber Newsletter

Cyber 201: What is a Security Operations Center?

Most lists of entry-level cybersecurity jobs will undoubtedly include the SOC analyst. The lingering question for many aspiring cybersecurity professionals is: “What’s a SOC?” We’re going to take a look at the Security Operations Center (SOC) and its role in the cybersecurity landscape. It’s important to have at le…

Read more

5 years ago · Anonymous

Becoming Cyber Newsletter

Cyber 201: What is Cyber Threat Intelligence?

When aspiring cybersecurity professionals consider specialties, cyber threat intelligence (CTI) often peaks their interest. Cyber threat intelligence certainly sounds cool. After all, we’ve all seen plenty of movies about spies and intelligence analysts. Most people don’t actually know much about CTI beyond its perceived d…

Read more

5 years ago · Anonymous

Cybercriminals have been attacking organizations all across the private and public sector. We hear about these attacks increasingly on the news—the mainstream news at that—nowadays. How can you leverage this awareness to help land your first cybersecurity job? If you identify companies in sectors with additional cybersecurity needs, you’ll find companies that are likely hiring. Let’s take a look at some key sectors with greater needs for cybersecurity talent. Some of them may surprise you.

Most Vulnerable Sectors

Generally speaking, companies which have suffered cyberattacks will invest to improve their defenses. So which sectors have suffered the most cyberattacks as of late? The publication IT Governance analyzed over 1,000 publicly disclosed security incidents that occurred in 2020. Their analysis revealed five sectors, which were most attacked.

• Healthcare and health sciences sector - 21% of all recorded breaches

• Public sector - 18% of all reported incidents

• Technology and media sector - 14% of all incidents

• Education sector - 14% of all incidents

• Retail and leisure sector - 9% of all incidents

Winston Churchill once said, “Never let a good crisis go to waste.” The coronavirus is that crisis for cybersecurity. The COVID-19 crisis has created a lot of new opportunities for cybercriminals. As a result of that additional cybercriminal activity, 70% of organizations plan to increase their cybersecurity spending following the pandemic.

These five sectors should provide good opportunities for cybersecurity employment. After all, nothing stimulates cybersecurity spending (and hiring) like a successful cyberattack. Especially one that you had to publicly disclose. As a result of the volume of cyberattacks they suffered in 2020, companies in these sectors need to invest in cybersecurity, which already has a talent shortage. This could be a good opportunity for new talent to get a chance.

Critical Infrastructure Sectors

In 2013 the United States introduced the National Infrastructure Protection Plan (NIPP) with the mission to “Strengthen the security and resilience of the Nation’s critical infrastructure, by managing physical and cyber risks through the collaborative and integrated efforts of the critical infrastructure community.” The NIPP designated 16 Critical Infrastructure Sectors, which were deemed to be vital to national security.

Given that the US government declared the cybersecurity in these sectors is strategically important to national security, you can safely assume that companies in these sectors appreciate the importance of investing in cybersecurity.

1. Chemical Sector

2. Commercial Facilities Sector

3. Communications Sector

4. Critical Manufacturing Sector

5. Dams Sector

6. Defense Industrial Base Sector

7. Emergency Services Sector

8. Energy Sector

9. Financial Services Sector

10. Food and Agriculture Sector

11. Government Facilities Sector

12. Healthcare and Public Health Sector

13. Information Technology Sector

14. Nuclear Reactors, Materials, and Waste Sector

15. Transportation Systems Sector

16. Water and Wastewater Systems Sector

The list of US Critical Infrastructure Sectors can be useful to aspiring cybersecurity professionals. Some sectors are less obvious than others. Naturally, organizations in these sectors are not evenly distributed around the country. Which of these sectors may be bigger where you live?

Knowing which sectors are deemed critical infrastructure is especially useful for anyone looking to get into cyber threat intelligence (CTI). After all, the “collaborative and integrated efforts” that the NIPP’s mission statement refers to includes intelligence sharing.

Find Organizations with Extraordinary Needs

In your cybersecurity job hunt, it can be helpful to identify sectors and organizations with an extraordinary need for talent. Some organizations come to appreciate their need for additional cybersecurity investment due to recent cyberattack. Other organizations have a constant recruiting need, which is highlighted by their critical infrastructure status.

You can find hidden gems of organizations by analyzing less obvious sectors with extraordinary needs. I’ll bet you wouldn't have thought of the retail and leisure sector or the food and agriculture sector. Use this knowledge of sectors with extraordinary cybersecurity requirements to be strategic about which companies you pursue, network with, and apply to. After all, these things take time (which is the ultimate finite resource). So be focused and approach companies in a targeted manner.

Recommended Posts

Becoming Cyber Newsletter

What Makes Cybersecurity a ‘Future-Proof’ Career?

In a world in which workers—both blue- and white-collar—increasingly see their livelihoods automated away, cybersecurity remains a future-proof career. That’s great for cybersecurity professionals. It can be motivating for aspiring entrants. While technology continues to disrupt seemingly every career field, this on…

Read more

5 years ago · Anonymous

Becoming Cyber Newsletter

Cybersecurity Is A Relationship Business

When people think of the cybersecurity profession, many naturally think of the technical aspect. You certainly need technical proficiency. Many would be surprised to hear, however, that cybersecurity is really a relationship business. Whether you look at the protected or the protectors, people are the lynchpin. The systems and applications, which cyberse…

Read more

5 years ago · Anonymous

When aspiring cybersecurity professionals consider specialties, cyber threat intelligence (CTI) often peaks their interest. Cyber threat intelligence certainly sounds cool. After all, we’ve all seen plenty of movies about spies and intelligence analysts. Most people don’t actually know much about CTI beyond its perceived desirability. It may be one of the harder cybersecurity specialties to get into. So let’s take a look at what CTI is and the skills it requires.

Newest Intelligence Discipline

Intelligence has a long and storied history. In the modern era it’s been divided into a number of intelligence collection disciplines or INTs, including:

• Human intelligence (HUMINT) - gathered from a person

• Signals intelligence (SIGINT) - gathered from interception of electronic transmissions

• Geospatial intelligence (GEOINT) - gathered from satellite and aerial photography

• Measurement and signature intelligence (MASINT) - gathered from an array of signatures (distinctive characteristics)

• Open-source intelligence (OSINT) - gathered from open sources

• Technical intelligence (TECHINT) - gathered from analysis of weapons and equipment

• Financial intelligence (FININT) - gathered from analysis of monetary transactions

Cyber threat intelligence—sometimes called Cyber intelligence (CYBINT) in the Intelligence Community (IC)—is simply the newest kid on the intel block.

CTI still draws upon a rich tradition and methods of intelligence gathering and assessment. For example, CTI’s analytical process will look familiar to any intelligence professional. It uses the same Intelligence Cycle, which is the basis for every intel discipline.

Intel in the Private Sector

Intelligence has long been the domain of nation-states. Countries with large budgets and government mandates conducted intelligence operations on behalf of their citizens. They did so predominantly against other nation-states. With CTI the game changes a bit. Globally the majority of information systems are owned by private organizations and individuals.

Cyber threat intelligence… is simply the newest kid on the intel block.

Governments have little, if any, visibility into activity on private information systems within their country’s borders. That visibility is the domain of the private sector. This puts responsibility for CTI in the hands of private organizations. However, they lack the collection assets that governments have. Instead companies utilize a range of security vendors for collection. These vendors also help protect companies from legal liability. Depending on the industry, companies may also participate in intelligence sharing organizations, like sector-based ISACs.

Just like with countries, bigger companies with large budgets are likely to have more robust CTI programs. Smaller companies may have just one or two cybersecurity (or IT) analysts monitoring threat feeds as an additional duty. Large companies with mature CTI programs may have a fully-staffed organization of intelligence professionals, supporting a mature Security Operations Center (SOC).

Intelligence Training

Cyber threat intelligence can be a highly desired specialty for aspiring cybersecurity professionals. That’s understandable. It sounds interesting and people tend to be familiar with the concept of intelligence. A challenge is that government—military and civilian agencies—has long been the training ground for intelligence professionals.

How do you get into CTI if you don’t have neither cybersecurity nor intelligence experience? For starters you need to have a solid understanding of the technology and tools, particularly from the threat actor’s perspective. Studying for penetration tester certifications, such as the Certified Ethical Hacker (CEH), can help with that.

Just like with countries, bigger companies with large budgets are likely to have more robust CTI programs.

When it comes to CTI specifically, the cybersecurity training ecosystem is a bit less mature. There aren’t as many training courses and certifications for CTI as other cybersecurity specialties. Here are a few courses and certifications, which can help you learn about CTI and potentially get the attention of CTI recruiters and hiring managers.

• FOR578: Cyber Threat Intelligence | SANS Institute

• Certified Threat Intelligence Analyst (C|TIA) | EC-Council

• MITRE ATT&CK Defender (MAD) ATT&CK Cyber Threat Intelligence | Cybrary

• MITRE ATT&CK Defender (MAD) ATT&CK Cyber Threat Intelligence Certification | MITRE Engenuity

Of course, there’s always something to be said for self-education. Here are some well curated reading lists for anyone seeking to specialize in cyber threat intelligence.

• A Cyber Threat Intelligence Self-Study Plan: Part 1

• A Top 10 Reading List if You’re Getting Started in Cyber Threat Intelligence

• CTI Reading List

CTI is growing in popularity and many organizations are seeking to grow their intel teams. If you don’t have cybersecurity or intelligence experience, it will take some work and/or time to get into CTI. That’s to be expected though. If you want it bad enough, you’ll put in the work.

Recommended Posts

Becoming Cyber Newsletter

Cyber 201: What is a Security Operations Center?

Most lists of entry-level cybersecurity jobs will undoubtedly include the SOC analyst. The lingering question for many aspiring cybersecurity professionals is: “What’s a SOC?” We’re going to take a look at the Security Operations Center (SOC) and its role in the cybersecurity landscape. It’s important to have at le…

Read more

5 years ago · Anonymous

Becoming Cyber Newsletter

Future Trends: Cloud Security

Future Trends We may not be able to predict the future, but we can certainly foresee the technological trends which will impact it. Any technology, which businesses and governments use to evolve and grow, is going to need securing and defending. Future Trends in technology therefore drive future needs for cybersecurity professionals…

Read more

5 years ago · Anonymous

You’ve been working hard to learn the necessary skills to become a cybersecurity professional. Your hopes and dreams have fueled these efforts. There’s hope for a future-proof career, which allows you to maintain relevance in an increasingly technology driven world. There’s the dream of improving your economic security at a time in which increased income inequality wreaks havoc on the middle class. There might even be the hope of pursuing a specific cybersecurity specialty, which seems fun and exciting to you.

Hiring Managers Are Selfish

The truth of the matter is that your hopes and dreams for entering cybersecurity aren’t the hiring manager's concern. Every applicant has their own hopes and dreams. The hiring manager on the other hand has a business need to fill. This makes hiring managers understandably selfish. The hiring manager’s primary concern is going to be filling those business needs with the talented people, who can execute them and be a beneficial part of the team.

The truth of the matter is that your hopes and dreams for entering cybersecurity aren’t the hiring manager's concern.

Some applicants will include executive summaries in their resumes with explanations of what they're looking for in a cybersecurity job. That’s not going to resonate with hiring managers. Those hiring managers want to know what you can do for them, not what they can do for you. This is especially true for candidates pursuing their first cybersecurity job.

Look at things from the hiring manager’s perspective. She could receive up to a couple hundred applications for a single cybersecurity role. Now imagine that she has more than one role open. That’s a lot of people’s hopes and dreams to sort through. The hiring manager is going to focus on her organizational needs. After all, that’s what she gets paid to do.

Focus On The Organization’s Needs

To engage in a manner that resonates with hiring managers, focus on the organization’s needs rather than your own. That means getting a feel for what the hiring manager is looking for in a specific role. What challenges is the organization seeking to solve? What will the primary mission be for whoever gets hired for this role?

Once you have a feel for that, you can better engage with the hiring manager. Instead of talking about what you want, you can talk about your understanding of her organizational requirements and how you can help fulfill them. What cybersecurity skills have you developed that would be an asset? What non-cybersecurity skills do you have (e.g., strong communications skills) that would be valuable for the role? What personality traits do you possess that would be key for this role and team?

To engage in a manner that resonates with hiring managers, focus on the organization’s needs rather than your own.

Once you reframe your focus from your hopes and dreams to the organization’s needs, you’ll be in a better position to describe yourself as the best candidate for the job. You don’t need to avoid discussion of your hopes and dreams all together. Just reframe them. Where do the organization’s needs and your goals intersect? Talk about that. Just remember to keep it as a secondary discussion point after you’ve adequately expressed how you can help fulfill their objectives.

Engagement Opportunities Are Precious

Opportunities to engage with hiring managers are precious. Most applications and resumes won’t actually make it into their hands. Knowing that, make the most of the opportunity, when you have a hiring manager’s attention. Approach that engagement from the perspective of what you can do for the organization.

Your hopes and dreams are important for sure. However they’re more important to you, than anyone else. During the interview process isn’t really the time to focus on them. The hiring manager needs to be selfish to achieve organizational objectives. If you focus on those organizational objectives, you can find yourself in an advantageous position to advance your hopes and dreams as well.

Recommended Posts

Becoming Cyber Newsletter

Celebrate the Small Victories Along the Journey to Your First Cybersecurity Job

The journey towards your cybersecurity career can be an arduous one. It takes time and a lot of effort to self-educate, credentialize, network, apply and interview for roles. That makes it important to celebrate the small victories. After an achievement like, passing a certification exam, you might be tempted to immediately begin studying for the next ce…

Read more

5 years ago · Anonymous

Becoming Cyber Newsletter

Are Cybersecurity Bootcamps Worth the Money?

An aspiring cybersecurity professional, considering his training options, recently asked if cybersecurity bootcamps are worth it? That’s a common question, especially considering the variety of cybersecurity training options available. The short answer is…

Read more

5 years ago · 1 like · Anonymous

The journey to landing your first cybersecurity job can be a tough one. Some companies won’t have the courtesy to even send you a simple, rejection email. You’ll have interviews that you feel like you nailed, but they don’t go anywhere. Despite the headaches, eventually you’ll land your first cybersecurity job. And when you do, it’ll feel amazing. You’ll want to jump in the air and shout with excitement. You’ll yell “YES!” to no one in particular. It’s a pretty awesome feeling.

When you get to that celebratory, fist pumping stage, you’ll undoubtedly have someone to thank for helping you get there. We like to believe that we’re self-made professionals, who depended only on our own hard work, intelligence, and perseverance. Sure, that’s true... but it’s not the whole story. We all get some help along the way.

We All Get Some Help

You might have a friend or an acquaintance in industry, who gave you feedback on your resume. Likely some people sat down with you for informational interviews. Maybe a cybersecurity professional that you reached out to on LinkedIn gave you some time. If you’re really fortunate maybe someone referred you for a cybersecurity job. Whether it be something big or small, we all get help along the way.

You can email those people to thank them—and you should—but you can’t really pay them back. The only thing you can really do is pay it forward.

Pay It Forward

What does it mean to pay it forward? As you get established as a cybersecurity professional, people will reach out to you for help getting into the industry. A friend will want to introduce you to a nephew or a sister, who’s considering a cybersecurity career. A student or alum for your alma mater may contact you on LinkedIn hoping for a 30-minute chat. Take the time. That’s paying it forward.

In the beginning it’ll be easier to make the time. You’ll have fewer responsibilities at work as you get started in your cybersecurity career. Then something ironic will happen. As you progress in your career you will have 1) more insight to share with aspiring cybersecurity professionals and 2) less bandwidth to share it. Make the time.

Remember what it’s like being on the other side trying to get into the industry. You can accomplish this without becoming a full-giver of advice. You can go to the occasional Meet Up to share some insight with people trying to get into cyber. You can participate in career panels at your alma mater or another local school. You can start a newsletter to help people get into cybersecurity (wink).

Stay Motivated to Help

Everyone in cybersecurity is busy, but we can all find at least a little time to help others get into the industry. Each time you help someone find their first cybersecurity job, you have a long-term impact on their economic livelihood. That’s not a small thing.

Anytime that you feel too busy to have to have that phone chat or review that resume for an aspiring cybersecurity professional, remember that fiery fist-pumping emotion from when you finally landed your first cybersecurity job. It’s an amazing feeling. In some way—big or small—you can help someone else have that feeling. You can spread the joy.

Remember the ecstatic feeling of landing your first cybersecurity job and how thankful you were to everyone who helped you. You can’t really pay it back to those people who helped you... but you can pay it forward.

Recommended Posts:

Becoming Cyber Newsletter

Your First Cybersecurity Job May Be Closer Than You Think

Finding your first cybersecurity job is challenging, even after the certifications and the networking. For many people an opportunity exists a little closer to home. You can find opportunities to transition to a cybersecurity role at your current employer. That first cybersecurity role is always going to involve someone taking a chance on you. However, …

Read more

5 years ago · Anonymous

Becoming Cyber Newsletter

Get Your Foot in the Door, Find the Low Hanging Fruit

Plenty of career changers pivot toward cybersecurity with great ambitions. They have goals to quickly become managers, then executives, then CISOs. Maybe they seek to become world-class penetration testers or forensic investigators. The ambition is laudable. However, these goals are dependent on landing that—often elusive—first cybersecurity job…

Read more

5 years ago · Anonymous

In a world in which workers—both blue- and white-collar—increasingly see their livelihoods automated away, cybersecurity remains a future-proof career. That’s great for cybersecurity professionals. It can be motivating for aspiring entrants. While technology continues to disrupt seemingly every career field, this one seems immune. So what makes cybersecurity different than so many other fields?

What Does ‘Future-Proof’ Even Mean?

According to the Collins Dictionary, “If something is future-proof, it will continue to be useful or successful in future if the situation changes.” Change is certainly coming. Could a shortage of cybersecurity professionals make the field future-proof? After all, there was a cyber workforce gap of approximately 3.12 million cybersecurity professionals globally in 2020 (including over 879,000 in the United States).

However, current demand doesn’t necessarily equate to future demand though. After all, there’s increasing demand for commercial truck drivers today. That doesn’t mean the profession will survive the coming onslaught of autonomous commercial fleets.

In a world in which workers—both blue- and white-collar—increasingly see their livelihoods automated away, cybersecurity remains a future-proof career.

Being smart or well-educated doesn’t make one’s career future-proof either. Lawyers first saw their monopoly on legal service under assault by DIY websites like LegalZoom. Then technology allowed law firms to replace armies of young attorneys with e-discovery software. Now there’s concern of artificial intelligence outright replacing lawyers.

As waves of technological advances fuel what Klaus Schwab of the World Economic Forum dubbed the Fourth Industrial Revolution, past professional demand does not guarantee future success. Some professions will become the 21st century equivalent of the buggy whip maker.

What Makes Cybersecurity Different?

Klaus referred to the Fourth Industrial Revolution as “a series of social, political, cultural, and economic upheavals that will unfold over the 21st century.” A number of professions are currently fighting to maintain their relevance in this period of change, attempting to withstand the successive waves of technology.

“If something is future-proof, it will continue to be useful or successful in future if the situation changes.”

Cybersecurity was made for this period. Rather than attempting to withstand waves of technology, cybersecurity rides the waves like the nimblest of surfers. As the world becomes increasingly interconnected the susceptibility of attack by bad actors increases. Therefore, each wave of technology represents something new that needs to be secured.

Cybersecurity isn’t a destination. It’s a way of being. That’s the secret sauce that allows it to be a future-proof career. The likelihood of finishing securing the information systems (which touch the lives of billions of people globally) is about the same as the likelihood of you reaching the end of the internet.

Retaining Purpose

During these pivotal times future-proof careers can provide not just economic security. They can also provide a continued sense of purpose. That’s valuable in a world in which people’s jobs are regularly automated away.

We are just scratching the surface of the conveniences and opportunities that this era of epochal change will create. These conveniences and opportunities will come at a cost however. Don’t wait for the revolution to come find you. Pursuing a future-proof career—whether it be cybersecurity or another field—can help retain your sense of agency and pursue. After all, the future is now.

Recommended Posts:

Becoming Cyber Newsletter

Get Your Foot in the Door, Find the Low Hanging Fruit

Plenty of career changers pivot toward cybersecurity with great ambitions. They have goals to quickly become managers, then executives, then CISOs. Maybe they seek to become world-class penetration testers or forensic investigators. The ambition is laudable. However, these goals are dependent on landing that—often elusive—first cybersecurity job…

Read more

5 years ago · Anonymous

Becoming Cyber Newsletter

Cybersecurity Is A Relationship Business

When people think of the cybersecurity profession, many naturally think of the technical aspect. You certainly need technical proficiency. Many would be surprised to hear, however, that cybersecurity is really a relationship business. Whether you look at the protected or the protectors, people are the lynchpin. The systems and applications, which cyberse…

Read more

5 years ago · Anonymous

Most lists of entry-level cybersecurity jobs will undoubtedly include the SOC analyst. The lingering question for many aspiring cybersecurity professionals is: “What’s a SOC?” We’re going to take a look at the Security Operations Center (SOC) and its role in the cybersecurity landscape. It’s important to have at least a basic understanding of how the SOC fits in organizationally, regardless of where you land your first cybersecurity job.

According to security vendor CrowdStrike, “A security operations center (SOC) includes the people, processes and technologies responsible for monitoring, analyzing and maintaining an organization’s information security.” So what does that actually mean? Let’s focus on those stated tasks: monitor, analyze and maintain.

Monitor

Basically, security operation centers monitor everything that happens on its organization’s network continuously looking for anomalies. As you can imagine, that's a lot of traffic to monitor, so the people, processes and technologies become very important.

In order to maximize the visibility SOCs have of their network, they need to understand which technology and process gives them visibility of which portions of their network. Just ensuring full visibility is a big task. Once an organization has visibility to fully monitor their network for anomalies, then they need to do something with all that data.

Analyze

Anomalies don’t always represent bad or malicious activity. After all, by definition an anomaly is simply, “something that is different from what is ordinary or expected.” That means that monitoring can produce a lot of suspicious events—any observable occurrence in a network or system—which aren’t threats.

According to security vendor CrowdStrike, “A security operations center (SOC) includes the people, processes and technologies responsible for monitoring, analyzing and maintaining an organization’s information security.”

How does the SOC determine which suspicious events are actually threats? People, processes and technologies really come into play here. Obviously, SOC analysts are a big part of the equation. (There’s a reason why we call them analysts.) However, you can’t just throw people at the problem. Qualified cybersecurity professionals are a limited resource (thus the skills shortage) and it’s unsustainable, leading to burnout.

Organizations therefore need to design processes and adopt technologies, which allow them to employ their people most effectively. Well designed and executed processes and technologies allow SOCs filter out suspicious events, in order to intelligently utilize the time of SOC analysts.

Maintain

At first glance, maintaining an organization’s information security may sound like a mundane task. But what is the actual task? It is to maintain the confidentiality, integrity, and availability (CIA) of an organization’s information systems. That sounds like a bigger task, doesn’t it? How do you maintain the CIA triad after you’ve identified malicious incidents through analysis? You contain whatever has disrupted confidentiality, integrity or availability of your organization’s information systems.

Maintaining an organization’s information security leans heavily on people, processes and technologies. In order to maintain security the SOC needs to understand what “right” looks like (i.e., get a good baseline of normal network activity). It will need to develop processes to standardize complex tasks. As part of these processes, the SOC will really depend on its people. SOC analysts at various levels will need to execute interconnected tasks in a coordinated manner to maintain the organization’s information security.

Sounds like challenging work? It is. But it can be exciting and it’s important.

SOC Analysts Tiers

You’ll hear about SOC Level 1, 2, and 3 Analysts. Those roles with a higher number require greater experience and have greater responsibilities. A SOC Level 1 Analyst is a front-line cybersecurity professional responsible for monitoring and responding to security related alerts. A SOC Level 3 Analyst is more of a subject matter expert (SME) and/or manager.

A SOC Level 1 Analyst role can be a good place to start one’s cybersecurity career. SOC Level 1 Analysts are always in demand and the role provides a lot of hands-on experience.

Training Programs

• Certified SOC Analyst (CSA) | EC-Council

• Become a SOC Analyst - Level 1 | Cybrary

• Become a SOC Analyst - Level 2 | Cybrary

• Become a SOC Analyst - Level 3 | Cybrary

• Microsoft Certified: Security Operations Analyst Associate

A Security Operations Center is a big investment, so many organizations will outsource the roles to a Managed Security Service Provider (MSSP). Whether using an in-house SOC or an external MSSP, Security Operations is often the first line of defense against cyberattacks.

Recommended Posts

Becoming Cyber Newsletter

Do Cybersecurity Certifications Even Matter?

There’s a school of thought in cybersecurity—and in technology, in general—that certifications don’t matter. That experience is the only thing that matters. The thought goes that certification issuing organizations are just in the business of making money. Experience matters more than certifications and certifications are an ineffective measure of one’s…

Read more

5 years ago · Anonymous

Becoming Cyber Newsletter

Future Trends: Cloud Security

Future Trends We may not be able to predict the future, but we can certainly foresee the technological trends which will impact it. Any technology, which businesses and governments use to evolve and grow, is going to need securing and defending. Future Trends in technology therefore drive future needs for cybersecurity professionals…

Read more

5 years ago · Anonymous

Let’s face it, cybersecurity isn’t for everyone. Sure there's a lot of hype around the field. While tons of people are talking about cybersecurity, that doesn’t mean that everyone will enjoy it. What are some key reasons that you shouldn’t get into cybersecurity?

You Value Routine In Your Work Schedule

For a variety of reasons you may highly value routine in your work schedule. Maybe you have commitments outside of work that are inflexible time-wise. Perhaps you simply don’t want to sacrifice time with friends or family for your career. A predictable work schedule might be very important to you.

Cybersecurity can often present a work schedule that is less than predictable. At its essence, cybersecurity is—as the name states—security work. That means that when things go wrong, people’s personal schedules can suffer. Bad actors don’t respect weekends or holidays. In fact some will intentionally target them.

Bad actors don’t respect weekends or holidays.

You’ll struggle to find many experienced cybersecurity professionals, who have never had their evening, weekend, or a holiday disrupted by work. Of course, some roles (such as, incident responders) are more hectic than others. To many extents though, a career in cybersecurity involves accepting the lack of routine that accompanies it. If you value a fixed work routine above all else, cybersecurity might not be right for you.

You Prefer Not to Depend on Others

No one can successfully defend an organization alone. Maybe you prefer a level of autonomy in which you don’t have to deal with other people. Perhaps you want to succeed or fail on your own merits. Does being dependent on others for your success frustrates you?

There are some cybersecurity roles in which you wouldn’t be dependent upon or accountable to others for your success, such as independent researchers. However, when it comes to defending organizations, cybersecurity is a team sport. You have to work well with others to be effective and you’re dependent on them for your organizational success.

You can undoubtedly find a specialized niche that doesn’t require other people. By and large you’ll need to depend on others in cybersecurity. If you value autonomy over teamwork, cybersecurity might not be right for you.

You’re Not a Fan of Studying

Technology changes. Industry frameworks evolve. The line between “learning” and “doing” blur in cybersecurity. Cybersecurity requires life-long learning. Not everyone enjoyed school, but you’ll need to be willing to study new topics to succeed. For example, different organizations will have varying technology stacks. If you have no desire to learn new technologies over the course of your career, you’ll find yourself with limited career options.

Cybersecurity requires life-long learning.

Becoming Cyber often discusses the best entry-level certifications to break into cybersecurity. As you progress in your career there will likely be expectations of obtaining more advanced certifications, like the Certified Information Systems Security Professional (CISSP) or Certified Information Security Manager (CISM). Getting in the door doesn’t mean you’re done studying for certifications.

Technology continues to advance over time. In order to stay relevant, you need to keep studying and learning. You need to keep up. If you’re not a fan of continued learning, cybersecurity may not be right for you.

What Next?

Cybersecurity is a great career field. If it’s not right for you, that’s okay. There are other high growth, future-oriented careers out there. You can learn more about them in books like The Industries of the Future by Alec Ross. If you are not dissuaded in your cybersecurity interests, there is plenty of work. We just need to land you that first cybersecurity job. Let’s get back to work.

Recommended Posts:

Becoming Cyber Newsletter

Your First Cybersecurity Job May Be Closer Than You Think

Finding your first cybersecurity job is challenging, even after the certifications and the networking. For many people an opportunity exists a little closer to home. You can find opportunities to transition to a cybersecurity role at your current employer. That first cybersecurity role is always going to involve someone taking a chance on you. However, …

Read more

5 years ago · Anonymous

Becoming Cyber Newsletter

Plotting Your Cybersecurity Career Path

We talk a lot about pursuing your first cybersecurity job, but what comes after that? Cyber Seek is a usual tool for plotting out the first few hops of your cybersecurity career. Cyber Seek’s interactive Career Pathway displays a succession of potential cybersecurity jobs. It starts with Feeder Roles, then progresses to Entry-Level, Mid-Level, then Adva…

Read more

5 years ago · Anonymous

One great thing about the cybersecurity industry is that it offers people economic security, when the middle class is under pressure. Experienced cybersecurity professionals enjoy a 0% unemployment rate. Many potential career changers really want to know, “How much can I make in cybersecurity?” I’ll spare you the standard explanation that it depends.

In 2020, the median income for an information security analyst was $103,590 per year (with less than 5 years experience) according to the US Bureau of Labor Statistics (BLS). (That’s a 3.9% increase from 2019.) Meanwhile, the US median household income was $68,400 in that same year. You read that right. In the US, the individual median information security analyst earned 51% more than the entire median household in 2020!

Where are all these jobs? All over the United States, but the highest numbers are in Virginia, Texas, California, New York and Florida.  The highest paying states however are California, New York, New Jersey, District of Columbia, and Virginia.

Cybersecurity is an exciting, future-proof career field, which offers a lot of opportunities. The BLS states, “Employment of information security analysts is projected to grow 31 percent from 2019 to 2029, much faster than the average for all occupations.” That’s at least a solid decade of cybersecurity job growth ahead of us.

In the US, the individual median information security analyst earned 51% more than the entire median household in 2020!

But we know it can be daunting to try something new. This is especially true for career changers. However, the economic security, which the field offers, may be tempting enough to get you to make the leap. Go ahead and take a bet on yourself!

Recommended Posts:

Becoming Cyber Newsletter

Life is Short, Take a Chance and Bet on Yourself

By one estimate the average American will spend 109,980 hours at work in their lifetime. That’s one third of your life.This is a number that I think about, when I hear people talking themselves out of pursuing new opportunities. Not that we should all quit our careers and pursue passion projects, like opening a pottery center. (Admittedly, that’s pretty…

Read more

5 years ago · Anonymous

Becoming Cyber Newsletter

Your First Cybersecurity Job May Be Closer Than You Think

Finding your first cybersecurity job is challenging, even after the certifications and the networking. For many people an opportunity exists a little closer to home. You can find opportunities to transition to a cybersecurity role at your current employer. That first cybersecurity role is always going to involve someone taking a chance on you. However, …

Read more

5 years ago · Anonymous

Cybersecurity is an exciting career field with a diversity of roles. Ethical hackers may come to mind for a lot of people. But there’s so much more to cybersecurity. How can you find the role that you’ll be passionate about? There are some good resources to help you find a target role to begin your cybersecurity career, which suit your interests and skill sets. 

Learn By Viewing

YouTube is a great resource for learning about cybersecurity careers. You can find some articulate, experienced and passionate professionals to explain all the different types of cybersecurity jobs.

Dr. Gerald Auger’s YouTube video, 5 Entry Level Cyber Jobs You Need to Know About, is a reliable resource. Dr. Auger lays out common job duties, required soft skills, job growth, and median salary for each of these roles. He also explains the downside of each role, which is surprisingly helpful. After all, when trying to decide which role suits you, it is generally helpful to determine early which roles don’t suit you.

The roles which Dr. Auger discusses are:

• Cyber Defense Incident Responder

• Cyber Forensics Expert

• Cyber Security Engineers

• Cyber Operator

• Vulnerability Assessment Analyst

There are certainly more cybersecurity roles, but these are good building blocks for your understanding of entry-level roles. Search “entry level cybersecurity jobs” in YouTube and you’ll find a variety of other videos vying to explain the various roles and responsibilities in cybersecurity.

Learn By Doing

After you get a basic understanding of entry-level cybersecurity roles, one or two may jump out as a good fit for you. Obviously, you don’t want to pursue a cybersecurity role simply based on having watched a couple of videos. You want to get a better feel for whether this role is really what you want. Do you find it intriguing and fulfilling?

Cybrary’s online Career Paths training will be quite useful. It’s a low commitment way to get exposure to and hands-on experience in cybersecurity roles of interest. The Career Paths training include:

• Become a SOC Analyst 1

• Become a Systems Administrator

• Become a Cyber Security Engineer

• Become a Penetration Tester

• Become an Incident Handler

• Become an Azure Cloud Engineer

As you start down a Career Path, if it excites and motivates you to keep learning, then you’re likely on the right path. If it is not what you expected and you're not feeling it, at least you determined that early on. You can back up and try something different. Learning by doing is a valuable way to test your cybersecurity interests.

What Next

Your cybersecurity career will undoubtedly have many twists and turns. You may be quite surprised by what you end up doing ten years from now. But as you seek to find your way into the career field, it’s helpful to find something you’re passionate about. It gives you something to aspire to. Starting your cybersecurity career journey with a goal, based on your interests and aptitude, will provide you with a target to aim for.

Recommended Posts

Becoming Cyber Newsletter

This Uncommon Cybersecurity Skill Can Help Propel Your Career

Cybersecurity is a career field full of smart people with a wide variety of deeply technical skills. It can be intimidating for career changers. There is a key skill that you can bring to cybersecurity, which will help set you apart from your peers. It’s a skill that some of the most experienced and technical cybersecurity professionals don’t have. That…

Read more

5 years ago · Anonymous

Becoming Cyber Newsletter

Get Your Foot in the Door, Find the Low Hanging Fruit

Plenty of career changers pivot toward cybersecurity with great ambitions. They have goals to quickly become managers, then executives, then CISOs. Maybe they seek to become world-class penetration testers or forensic investigators. The ambition is laudable. However, these goals are dependent on landing that—often elusive—first cybersecurity job…

Read more

5 years ago · Anonymous

If you’ve spent any time on LinkedIn, you’ve undoubtedly seen people with little golden LinkedIn logos on their profiles. Those are people with LinkedIn Premium accounts. Sure they may look cool, but are LinkedIn Premium accounts worth the money for aspiring cybersecurity professionals?

LinkedIn already offers a lot of resources with basic accounts for free. When considering paying for a premium account, it’s important to recognize what you’re trying to achieve. Then you can weigh the cost and benefits.

Networking is a key function in discovering opportunities for your first cybersecurity job. Basic LinkedIn resources are generally adequate. However, a LinkedIn Premium account will provide you with benefits which are largely worth the cost.

LinkedIn Premium Costs

There are four types of LinkedIn Premium subscriptions. Fortunately, the subscription intended for job hunters—Premium Career—is the most affordable of them. In the United States the Premium Career subscription will run you $29.99 per month. Admittedly, that’s not cheap, but is half the price of the next most inexpensive subscription, Premium Business.

When considering paying for a premium account, it’s important to recognize what you’re trying to achieve.

LinkedIn offers a complimentary month, so that monthly Premium Career subscription can be a good way to get a feel for LinkedIn Premium and determine if it's worth the cost for you. You can save 33% by paying annually, but you can switch to annual payment at any given time. The monthly subscription is therefore still a good place to start.

Benefits of LinkedIn Premium Career

Networking and building relationships among cybersecurity professionals is vital to your transition to a cybersecurity career. By definition this involves reaching out to people you don’t know. It leaves you with the question of how to contact people you don’t know on LinkedIn? After all, the platform put restrictions on that for basic accounts.

Networking is a key function in discovering opportunities for your first cybersecurity job.

Some people opt to simply send connection requests to strangers hoping they’ll be accepted. There’s certainly a population of people, who will accept any connection request sent their way. For many people though, it’s considered poor etiquette.

LinkedIn Premium allows you to use InMail to message people outside of your network. This is huge, because it allows you to intentionally engage with people outside of your personal network. A thoughtfully written message is preferred to a random LinkedIn connection request. If you do it right, today’s LinkedIn message will be tomorrow’s LinkedIn connection.

Additional benefits to the Premium Career subscription are Job Insights to LinkedIn job posts, interview preparation, access to LinkedIn Learning courses, a Resume Builder, and greater transparency on who’s viewed your profile in the last 90 days. These are all bonuses. The ability to message people outside of your network will be the single greatest benefit for aspiring cybersecurity professionals building their networks in the community. It can have tangible benefits for aspiring professionals.

• LinkedIn offers U.S. service members and veterans a free 1-year Premium Career subscription in collaboration with ID.me.

Way Forward

Networking is an important part of finding your first cybersecurity job and LinkedIn is the premier social media site upon which to do so. You can certainly network using a basic LinkedIn account. This may be adequate, if your network includes a number of people already working in cybersecurity. Otherwise, a LinkedIn Premium Career account can be a good, near-term investment to start making cybersecurity connections outside of your network. Step up your online networking to help find your first cybersecurity job.

Recommended Posts:

Becoming Cyber Newsletter

Expanding Your Cyber Network on LinkedIn Improves Your Job Search

LinkedIn is an important professional social network, which is valuable to your cybersecurity job search. This builds up the Build Your Network phase of our six-phase Roadmap to a Cybersecurity Career. Connecting with fellow cybersecurity aspirants, industry professionals, and cybersecurity mentors expands your likelihood of learning about open cybersec…

Read more

6 years ago · Anonymous

Becoming Cyber Newsletter

Follow Cybersecurity Leaders on LinkedIn

Social media offers a great opportunity for aspiring cybersecurity professionals. It provides a chance for you to learn from cybersecurity leaders, who you don’t personally know. On LinkedIn—the social media platform of professionals—you can “follow” people, who you don’t know, which is huge…

Read more

5 years ago · Anonymous