There’s so much to learn, when you’re trying to get into cybersecurity. You study, learn, and network. Then along the way, you notice that occasionally people say information security, instead of cybersecurity. Some people use the two interchangeably. The usage is confusing, but you may be reluctant to ask.

The confusion is understandable. Many professionals in the field—yours truly included—regularly switch between the two terms or simply use the wrong one. Why? More on that shortly. First let us inquire, what is the difference between cybersecurity and information security?

Allow me to provide a non-technical analogy.

Everybody knows what a dog is, right? (One is sleeping next to me as I write this.) Regularly, we refer to dogs as canines. In fact, we act as if canine is simply a fancy word for dog. Here’s the thing… Dogs and canines aren’t necessarily the same thing. Sure, dogs are canines. But wolves, coyotes, and jackals are canines too. Yet when a police cruiser labeled “K-9 Unit” drives by, you would never expect a 120-pound wolf to stick its head out the window. Yet, despite the inaccuracy we still regularly treat dog and canine as synonyms in English.

In this analogy cybersecurity is the dog and information security is the canine. Cybersecurity involves confidentiality, integrity, and availability—known as the CIA Triad—for computer systems and networks. Information security is broader, encompassing domains such as identity and asset management (IAM), security assurance, security architecture, and more. Cybersecurity is part of information security, but information security is bigger than just cybersecurity.

So why do professionals in the field mix the two up? Largely because cybersecurity has developed a brand and awareness. Everyone has heard of cybersecurity nowadays. Even if they cannot explain precisely what cybersecurity is, they know it has to do with stopping bad guys on computers. It took a few decades for cybersecurity to enter the public’s consciousness. Thus it’s simpler to say cybersecurity, when you really mean information security.

Cybersecurity is part of information security, but information security is bigger than just cybersecurity.

To be fair, as people move around in their career, they may move from a cybersecurity role to an information security role, then back to another cybersecurity role. Of note however, the top job in this field is called the Chief Information Security Officer (CISO), not the Chief Cybersecurity Officer.

While professionals in the field are capable of in-depth discussions about the difference between cybersecurity and information security, rest assured that our friends and families have little interest in hearing them. Thus, if you bump into us at a barbecue, we’re likely to just say we work in cybersecurity. Even though we know, it’s an imperfect answer.

What is the most valuable skill set which I would recommend that information security newcomers learn? That’s an interesting question. After all, infosec isn’t a single job. The information security career field consists of easily over a dozen roles. So what single skill would be valuable across the spectrum? Easy. Cloud computing. It provides the greatest benefit across a range of roles for information security professionals.

Not every infosec role is technical, but it’s vital that every infosec professional achieves a reasonable level of technical acumen. In previous years, that might have included studying for the CompTIA Network+ or a similar certification.

The rise of cloud computing provides newcomers with a leapfrog opportunity. They can go directly to the new, in-demand skill without needing to focus on on-premise networking first. There’s even an advantage. Newcomers won’t have to unlearn legacy ways of doing things, based upon the limitations of on-premise technology.

Here’s the bonus. If you gain a solid understanding of cloud computing, you’ve also acquired a basic understanding of on-premise computing.

Cloud is the Future

In the not-to-distant future cloud security will simply be called “cybersecurity.” That’s because so much of organizations’ infrastructure will be in the cloud, that securing the cloud will no longer be a niche subset of cybersecurity. Not surprisingly, many infosec senior leaders today have no cloud background and don’t have the bandwidth to develop this new skill. This creates opportunity for the newer generation.

By learning cloud you can stand out with an in-demand skill set, which can be reasonably relevant for on-premise security as well. Cloud computing also introduces concepts like shift left and policy-as-code, which skilled infosec professionals can leverage to improve an organization’s entire security program.

How much demand is there for cloud-literate professionals? According to the consultancy Deloitte between 2017 and 2020 the number of cloud job postings increased by 97%. While 90% of IT leaders planned to expand their cloud environments, 80% said a shortage of cloud-literate staff is holding them back.

In the same Deloitte report, Megan Slabinski–a district president at the recruiting firm Robert Half–stated, “Cloud computing remains the number one most sought-after skill.” When you combine the cloud skills shortage with the cybersecurity workforce gap—3.4 million roles remained unfilled globally in 2022—a very compelling opportunity becomes evident.

Learning Cloud 

So where do you start? If you’ve already landed your first information security job, learn whichever cloud platform your organization is using. If you haven’t landed your first infosec job yet, learn AWS. It has a robust number of certifications and training available, and the concepts are transferable between platforms.

Learning a new cloud platform after AWS is like learning a second romance language. If you learned to speak Spanish already, learning Portuguese or Italian shouldn’t be too difficult.

Personally, I’ve found A Cloud Guru and Tutorials Dojo very effective resources in studying for and passing cloud certifications. I used ACG for certification courses and TD for practice tests.

I’m a supporter of certifications, because they provide a standardized way to learn a new skill set to an established standard. Of course, this must include a good amount of learning by doing. Your cloud certification journey should include ample time spent hands-on-keyboard in the console. After all, the goal is to learn new cloud skills. Certifications are simply evidence of having done so; they are not the genuine goal.

Cloud Adoption

Organizations across the globe are working on digital transformation efforts, which largely means that they’re working on their cloud adoption. If technology teams can build it, security teams need to defend it.

As such, you can expect the demand for security professionals with cloud skills to remain high. The shift towards cloud computing will force information security programs to shift as well. That includes integrating concepts which allow us to be more efficient and effective. If you want to be an information security leader of tomorrow, there’s a lot of benefit to learning cloud computing today.

I write a lot about the value of certifications on the road to landing your first cybersecurity job. However, on the internet you’ll see plenty of people loudly proclaiming that certifications are BS and the only thing that matters is hands-on experience. So which is it? In order to make yourself marketable, should you pursue certifications or hands-on experience? The short answer is: both.

Value of Certifications

A cybersecurity certification provides more than a fancy piece of paper, a colorful badge, or resume filler. It provides a roadmap to learn something new. For example, let’s take the Certified Ethical Hacker (CEH) certification. You could absolutely learn about ethical hacking without the CEH. The benefit you get from the certification is a curated agenda of skills and knowledge to work with.

Admittedly, passing a certification exam isn’t a demonstration of expertise in a given subject area. After all, the passing score for most certifications is somewhere around 70%. Back in your school days your parents wouldn’t have been particularly impressed with a report card touting 70%. What passing a certification does demonstrate is that you understand the topic to a widely understood, acceptable standard. The CompTIA Security+ exam is the same exam around the world. On the other hand, your college course or individual learning will vary in covered topics and depth.

Detractors claim that passing a certification simply demonstrates that you’re good at taking certification exams. There’s a bit of truth there. The exams are often in a familiar computerized, multiple choice format. (We’ll carve out an exception for the Offensive Security Certified Professional (OSCP) certification. I’ve never heard anyone claim this 100% hands-on exam is anything less than challenging.) All things considered, you’ll have an advantage if you’re good at standardized tests. That skill is not enough though. You need to actually learn the material.

Honestly, the loudest critics of cybersecurity certifications are a bit disingenuous about the realities of landing a job with no prior cyber or IT experience. Breaking into cybersecurity is hard. The HR software and recruiters are screening most people out based on the content of their resumes. In the absence of professional experience, certifications are valuable in helping get your resume to the hiring manager. Certifications help in the recruiting process.

Value of Hands-On Experience

While certifications provide a great roadmap to learn new skills, the best way to actually learn new skills is by doing. Build things. Take things apart. Break things. Fix things. Watching a demonstration is useful. What’s more useful? Working to get things to work on the second, third or fourth attempt. Those lessons will stick with you more than a demonstration. You get a lot of value from hands-on experience. After all, real life isn’t a multiple choice test.

How do you get hands-on experience? There are three effective ways to go about it:

1. Join a cybersecurity bootcamp

2. Use an online cybersecurity lab environment

3. Build a cybersecurity lab environment

Cyber Bootcamp

There are pros and cons to cybersecurity bootcamps. They can be worthwhile, but you’ll really want to do your research. Not all bootcamps are created equal. Here’s some with checking out.

• 21 Best Cyber Security Bootcamps | Course Report

• Cybersecurity | NPower

• Cybersecurity Analyst Training | CyberNow Labs

Online Cyber Lab

Want something easy to get your feet wet? Looking for a taste of cybersecurity to see, if it’s really for you? Online cybersecurity labs are a painless way to get access.

• Cybersecurity Lab | Nova Labs

• Immersive Labs

• Cyber Skyline Professional

• Infosec Skills | Infosec Institute

Home Cyber Lab

Nothing says “hands-on experience” like building your own cybersecurity lab. Obviously, you don’t know what you don’t know. So leverage some quality online guidance on how to build a home cybersecurity lab.

• Building a cybersecurity lab: A simple guide on using security operating systems to build a home lab | Medium

• Building a home cybersecurity lab | AT&T

• Building a Cybersecurity Homelab | Cyberwox Academy

Do Both

When pursuing your first cybersecurity job, it really shouldn’t be a decision between certifications or hands-on experience. You’ll want to do both. They each have benefits, which complement each other like peanut butter and chocolate.

If someone comes to an interview with a couple certifications on their resume and they’re prepared to talk about their hands-on experience, that person will be in an advantageous position. Sure it takes more time to do both. It’s an investment in yourself.

Recommended Posts

Becoming Cyber Newsletter

Do Cybersecurity Certifications Even Matter?

There’s a school of thought in cybersecurity—and in technology, in general—that certifications don’t matter. That experience is the only thing that matters. The thought goes that certification issuing organizations are just in the business of making money. Experience matters more than certifications and certifications are an ineffective measure of one’s…

Read more

5 years ago · Anonymous

Becoming Cyber Newsletter

Are Cybersecurity Bootcamps Worth the Money?

An aspiring cybersecurity professional, considering his training options, recently asked if cybersecurity bootcamps are worth it? That’s a common question, especially considering the variety of cybersecurity training options available. The short answer is…

Read more

5 years ago · 1 like · Anonymous

Cybercriminals have been attacking organizations all across the private and public sector. We hear about these attacks increasingly on the news—the mainstream news at that—nowadays. How can you leverage this awareness to help land your first cybersecurity job? If you identify companies in sectors with additional cybersecurity needs, you’ll find companies that are likely hiring. Let’s take a look at some key sectors with greater needs for cybersecurity talent. Some of them may surprise you.

Most Vulnerable Sectors

Generally speaking, companies which have suffered cyberattacks will invest to improve their defenses. So which sectors have suffered the most cyberattacks as of late? The publication IT Governance analyzed over 1,000 publicly disclosed security incidents that occurred in 2020. Their analysis revealed five sectors, which were most attacked.

• Healthcare and health sciences sector - 21% of all recorded breaches

• Public sector - 18% of all reported incidents

• Technology and media sector - 14% of all incidents

• Education sector - 14% of all incidents

• Retail and leisure sector - 9% of all incidents

Winston Churchill once said, “Never let a good crisis go to waste.” The coronavirus is that crisis for cybersecurity. The COVID-19 crisis has created a lot of new opportunities for cybercriminals. As a result of that additional cybercriminal activity, 70% of organizations plan to increase their cybersecurity spending following the pandemic.

These five sectors should provide good opportunities for cybersecurity employment. After all, nothing stimulates cybersecurity spending (and hiring) like a successful cyberattack. Especially one that you had to publicly disclose. As a result of the volume of cyberattacks they suffered in 2020, companies in these sectors need to invest in cybersecurity, which already has a talent shortage. This could be a good opportunity for new talent to get a chance.

Critical Infrastructure Sectors

In 2013 the United States introduced the National Infrastructure Protection Plan (NIPP) with the mission to “Strengthen the security and resilience of the Nation’s critical infrastructure, by managing physical and cyber risks through the collaborative and integrated efforts of the critical infrastructure community.” The NIPP designated 16 Critical Infrastructure Sectors, which were deemed to be vital to national security.

Given that the US government declared the cybersecurity in these sectors is strategically important to national security, you can safely assume that companies in these sectors appreciate the importance of investing in cybersecurity.

1. Chemical Sector

2. Commercial Facilities Sector

3. Communications Sector

4. Critical Manufacturing Sector

5. Dams Sector

6. Defense Industrial Base Sector

7. Emergency Services Sector

8. Energy Sector

9. Financial Services Sector

10. Food and Agriculture Sector

11. Government Facilities Sector

12. Healthcare and Public Health Sector

13. Information Technology Sector

14. Nuclear Reactors, Materials, and Waste Sector

15. Transportation Systems Sector

16. Water and Wastewater Systems Sector

The list of US Critical Infrastructure Sectors can be useful to aspiring cybersecurity professionals. Some sectors are less obvious than others. Naturally, organizations in these sectors are not evenly distributed around the country. Which of these sectors may be bigger where you live?

Knowing which sectors are deemed critical infrastructure is especially useful for anyone looking to get into cyber threat intelligence (CTI). After all, the “collaborative and integrated efforts” that the NIPP’s mission statement refers to includes intelligence sharing.

Find Organizations with Extraordinary Needs

In your cybersecurity job hunt, it can be helpful to identify sectors and organizations with an extraordinary need for talent. Some organizations come to appreciate their need for additional cybersecurity investment due to recent cyberattack. Other organizations have a constant recruiting need, which is highlighted by their critical infrastructure status.

You can find hidden gems of organizations by analyzing less obvious sectors with extraordinary needs. I’ll bet you wouldn't have thought of the retail and leisure sector or the food and agriculture sector. Use this knowledge of sectors with extraordinary cybersecurity requirements to be strategic about which companies you pursue, network with, and apply to. After all, these things take time (which is the ultimate finite resource). So be focused and approach companies in a targeted manner.

Recommended Posts

Becoming Cyber Newsletter

What Makes Cybersecurity a ‘Future-Proof’ Career?

In a world in which workers—both blue- and white-collar—increasingly see their livelihoods automated away, cybersecurity remains a future-proof career. That’s great for cybersecurity professionals. It can be motivating for aspiring entrants. While technology continues to disrupt seemingly every career field, this on…

Read more

5 years ago · Anonymous

Becoming Cyber Newsletter

Cybersecurity Is A Relationship Business

When people think of the cybersecurity profession, many naturally think of the technical aspect. You certainly need technical proficiency. Many would be surprised to hear, however, that cybersecurity is really a relationship business. Whether you look at the protected or the protectors, people are the lynchpin. The systems and applications, which cyberse…

Read more

5 years ago · Anonymous

One great thing about the cybersecurity industry is that it offers people economic security, when the middle class is under pressure. Experienced cybersecurity professionals enjoy a 0% unemployment rate. Many potential career changers really want to know, “How much can I make in cybersecurity?” I’ll spare you the standard explanation that it depends.

In 2020, the median income for an information security analyst was $103,590 per year (with less than 5 years experience) according to the US Bureau of Labor Statistics (BLS). (That’s a 3.9% increase from 2019.) Meanwhile, the US median household income was $68,400 in that same year. You read that right. In the US, the individual median information security analyst earned 51% more than the entire median household in 2020!

Where are all these jobs? All over the United States, but the highest numbers are in Virginia, Texas, California, New York and Florida.  The highest paying states however are California, New York, New Jersey, District of Columbia, and Virginia.

Cybersecurity is an exciting, future-proof career field, which offers a lot of opportunities. The BLS states, “Employment of information security analysts is projected to grow 31 percent from 2019 to 2029, much faster than the average for all occupations.” That’s at least a solid decade of cybersecurity job growth ahead of us.

In the US, the individual median information security analyst earned 51% more than the entire median household in 2020!

But we know it can be daunting to try something new. This is especially true for career changers. However, the economic security, which the field offers, may be tempting enough to get you to make the leap. Go ahead and take a bet on yourself!

Recommended Posts:

Becoming Cyber Newsletter

Life is Short, Take a Chance and Bet on Yourself

By one estimate the average American will spend 109,980 hours at work in their lifetime. That’s one third of your life.This is a number that I think about, when I hear people talking themselves out of pursuing new opportunities. Not that we should all quit our careers and pursue passion projects, like opening a pottery center. (Admittedly, that’s pretty…

Read more

5 years ago · Anonymous

Becoming Cyber Newsletter

Your First Cybersecurity Job May Be Closer Than You Think

Finding your first cybersecurity job is challenging, even after the certifications and the networking. For many people an opportunity exists a little closer to home. You can find opportunities to transition to a cybersecurity role at your current employer. That first cybersecurity role is always going to involve someone taking a chance on you. However, …

Read more

5 years ago · Anonymous

If you’ve spent any time on LinkedIn, you’ve undoubtedly seen people with little golden LinkedIn logos on their profiles. Those are people with LinkedIn Premium accounts. Sure they may look cool, but are LinkedIn Premium accounts worth the money for aspiring cybersecurity professionals?

LinkedIn already offers a lot of resources with basic accounts for free. When considering paying for a premium account, it’s important to recognize what you’re trying to achieve. Then you can weigh the cost and benefits.

Networking is a key function in discovering opportunities for your first cybersecurity job. Basic LinkedIn resources are generally adequate. However, a LinkedIn Premium account will provide you with benefits which are largely worth the cost.

LinkedIn Premium Costs

There are four types of LinkedIn Premium subscriptions. Fortunately, the subscription intended for job hunters—Premium Career—is the most affordable of them. In the United States the Premium Career subscription will run you $29.99 per month. Admittedly, that’s not cheap, but is half the price of the next most inexpensive subscription, Premium Business.

When considering paying for a premium account, it’s important to recognize what you’re trying to achieve.

LinkedIn offers a complimentary month, so that monthly Premium Career subscription can be a good way to get a feel for LinkedIn Premium and determine if it's worth the cost for you. You can save 33% by paying annually, but you can switch to annual payment at any given time. The monthly subscription is therefore still a good place to start.

Benefits of LinkedIn Premium Career

Networking and building relationships among cybersecurity professionals is vital to your transition to a cybersecurity career. By definition this involves reaching out to people you don’t know. It leaves you with the question of how to contact people you don’t know on LinkedIn? After all, the platform put restrictions on that for basic accounts.

Networking is a key function in discovering opportunities for your first cybersecurity job.

Some people opt to simply send connection requests to strangers hoping they’ll be accepted. There’s certainly a population of people, who will accept any connection request sent their way. For many people though, it’s considered poor etiquette.

LinkedIn Premium allows you to use InMail to message people outside of your network. This is huge, because it allows you to intentionally engage with people outside of your personal network. A thoughtfully written message is preferred to a random LinkedIn connection request. If you do it right, today’s LinkedIn message will be tomorrow’s LinkedIn connection.

Additional benefits to the Premium Career subscription are Job Insights to LinkedIn job posts, interview preparation, access to LinkedIn Learning courses, a Resume Builder, and greater transparency on who’s viewed your profile in the last 90 days. These are all bonuses. The ability to message people outside of your network will be the single greatest benefit for aspiring cybersecurity professionals building their networks in the community. It can have tangible benefits for aspiring professionals.

• LinkedIn offers U.S. service members and veterans a free 1-year Premium Career subscription in collaboration with ID.me.

Way Forward

Networking is an important part of finding your first cybersecurity job and LinkedIn is the premier social media site upon which to do so. You can certainly network using a basic LinkedIn account. This may be adequate, if your network includes a number of people already working in cybersecurity. Otherwise, a LinkedIn Premium Career account can be a good, near-term investment to start making cybersecurity connections outside of your network. Step up your online networking to help find your first cybersecurity job.

Recommended Posts:

Becoming Cyber Newsletter

Expanding Your Cyber Network on LinkedIn Improves Your Job Search

LinkedIn is an important professional social network, which is valuable to your cybersecurity job search. This builds up the Build Your Network phase of our six-phase Roadmap to a Cybersecurity Career. Connecting with fellow cybersecurity aspirants, industry professionals, and cybersecurity mentors expands your likelihood of learning about open cybersec…

Read more

5 years ago · Anonymous

Becoming Cyber Newsletter

Follow Cybersecurity Leaders on LinkedIn

Social media offers a great opportunity for aspiring cybersecurity professionals. It provides a chance for you to learn from cybersecurity leaders, who you don’t personally know. On LinkedIn—the social media platform of professionals—you can “follow” people, who you don’t know, which is huge…

Read more

5 years ago · Anonymous

A common mistake persists among aspiring cybersecurity professionals, when it comes to resume writing. Some continue to believe their resume’s content is the only thing that matters. It’s understandable.

You spend so much time trying to develop the right resume bullets to capture all your relevant experience. With such limited space, it’s tempting to use it all. After you’ve spent hours writing and rewriting your resume, it is easy to expect that someone will dutifully read it all.

In reality style matters just as much as substance. A well designed resume is going to get more attention. It makes it easier for recruiters and hiring managers to find the information they’re looking for. Conversely a well written resume—which is hard on the eyes—will do you a disservice.

Myth That Someone Is ‘Reading’ Your Resume

When people think of their resume being read, many have this image of someone sitting at a desk and reading their resume top-to-bottom like the latest suspense novel. Sounds cool, but that's fiction. No one is reading your resume top-to-bottom. You’re lucky if someone spends 30 seconds reviewing your resume.

What does a resume review really look like? One common scenario is that someone reviews your application directly in an Applicant Tracking System (ATS) or similar recruiting software. When this occurs, your application is literally a line item amongst the dozens or hundreds of applicants. The recruiter may view your resume within the ATS to determine which resumes to send to the hiring manager. The recruiter has plenty of applications to choose from. If she chose to view your resume, she won’t linger on it. The recruiter will make a decision and move on.

You’re lucky if someone spends 30 seconds reviewing your resume.

The second scenario is really a continuation of the first one. The hiring manager receives a batch of resumes—via email or through an HR software tool—from the recruiter to review. Even if the hiring manager spends more time reviewing it, your resume is being compared against the others resumes. (When was the last time you compared your resume to someone else’s?) The hiring manager is a busy person, so she makes a decision of who should be interviewed, informs the recruiter, then moves on with her day.

Purpose In Style 

Writing and designing your resume thoughtfully so that it is readable and well-organized is important. Not just because it makes the document easier to read. Consider resume writing to be a demonstration of your ability to synthesize big concepts into a digestible, readable product.

When a candidate sends a three-page resume representing their six years of work experience, they’ve just demonstrated an inability to be concise. When a student drafts a single-space, densely packed resume that looks like a wall of text, they demonstrate an inability to be creative and engaging in their writing. When a career changer provides a resume full of work experience bullets that don’t actually say anything of substance, they demonstrate suboptimal deductive reasoning. These are all negative indicators.

An attractive looking resume allows the reader to make positive inferences about your professionalism and attitude.

Is it unfair to make conclusions about a candidate’s aptitude in brevity, creativity, or deductive reasoning, based on a one- to two-page resume? Maybe. But what else does the hiring manager have to go off of? Furthermore, some candidates will succeed in doing so.

Design Your Masterpiece

Your resume is about your experience and how you present it to the world. How to present your experience can certainly be daunting, especially when venturing into a new career field, like cybersecurity. You can’t control your past experience. (Given the luxury of 20-20 hindsight it’s easy to dwell on what you should have majored in school or what past jobs you should have taken.) You do control how you present that past and current experience.

Every candidate has the same canvas to work with in crafting their resumes. The most experienced candidates do not necessarily have the best looking resumes. The goal of your resume is to make a hiring manager say, I want to talk to that candidate.

A well designed resume allows the reader to easily find the relevant information to come to that conclusion. An attractive looking resume allows the reader to make positive inferences about your professionalism and attitude.

Even if you're not the best fit for the job you are applying for, they may refer you to another role. You have the same one- to two-pages to design your resume as everyone else. Be thoughtful about it. Go forth and design your resume masterpiece.

Recommended Posts:

Becoming Cyber Newsletter

You Should Probably Have More Than One Resume… Here’s Why

As you seek your first cybersecurity job you’re probably open to different types of roles in several industries. That’s okay. If you’re trying to apply to all of those positions with the same resume, you may write an increasingly bloated resume. That’s not okay…

Read more

5 years ago · Anonymous

Becoming Cyber Newsletter

The Best Way to Get Your Resume in the Hands of a Hiring Manager

The average online job posting will receive up to 250 applications. As you can imagine no one is actually reading all 250 resumes. Instead each resume will be reviewed by an applicant tracking system (ATS). A recruiter will review the resumes, which passed the ATS review, then the recruiter sends the (perceived) most viable candidates to the hiring mana…

Read more

5 years ago · Anonymous

Time Is Of The Essence

When it comes to landing their first cybersecurity jobs, students typically have a distinct advantage over career changers. Students have time on their side. Career changers are either working full-time (studying cybersecurity on nights and weekends) or they’re between jobs (trying to get a cybersecurity job before their savings and/or benefits run out).

Sure, days can be long for undergraduate students and longer for graduate students. However, with a global shortage of 3.12 million cybersecurity professionals, rest assured that days are even longer for cybersecurity teams. The underlying question is, How much do you really want to get into cybersecurity?

If most students will opt not to pursue the Security+ certification, then those who do will stand out.

Ask any cybersecurity professional and they’ll tell you stories about working 12 or 16 hour days, tales of working on holidays, or having to cancel personal plans at the last minute. That’s security work. By definition the schedule for cybersecurity is threat-driven. Despite this, cybersecurity professionals still prioritize and make the time to study, learn new skills, and earn new certifications. All this without the generous vacation schedule that students enjoy.

Why CompTIA Security+?

Students pursuing cybersecurity careers come from numerous fields of study. There’s no one path to a cybersecurity career though. That can make it difficult to stand out amongst all the applicants for entry-level positions. One needs to do just that to make it to the hiring manager for her to consider for potential interviews.

A CompTIA Security+ certification allows students to rise above their peers in the application process. Hiring managers have a reasonable understanding of the knowledge level they can expect from Security+ certification holders. If most students will opt not to pursue the Security+ certification, then those who do will stand out. This is advantageous for making it through early resume screening.

Certifications aren't just about having a pretty piece of paper with a seal and your name. It’s about the knowledge that you gain along the way. The knowledge that you gain while studying for the CompTIA Security+ will prepare you with the knowledge to excel during cybersecurity interviews (and on the job). Some interviewers may even skip interview questions regarding material covered in the certification exam all together.

Way Forward

I’ve advised plenty of students over the years to get their CompTIA Security+ while still in school. It’s additional work, but it’s a manageable amount of work and will contribute directly to their earning potential upon graduation. Most don’t do it. They give the excuse that they don’t have enough time.

Students can certainly land their first cybersecurity job without a Security+ certification. Having the certification—any cybersecurity certification, really—will simply increase your chances of being selected for interviews and help prepare them with requisite knowledge. Certifications provide recruiters a standardized measure to use in your favor during resume screening and provides hiring managers with an apples-to-apples measure, when selecting candidates to interview. (Hint: If two candidates have similar educational backgrounds and experience, or lack thereof, the candidate with a cybersecurity certification is more likely to get the interview.)

If you do get an interview without pursuing CompTIA Security+ or some other cybersecurity certification, whatever you do, don’t tell the interviewer that you were thinking about pursuing certification, but didn’t have the time. It won’t impress.

In 2016, a seventeen year old became the youngest person ever to pass the CompTIA Security+. I have confidence that this is a manageable feat for ambitious university students pursuing cybersecurity careers.

Recommended Posts:

Becoming Cyber Newsletter

Do Cybersecurity Certifications Even Matter?

There’s a school of thought in cybersecurity—and in technology, in general—that certifications don’t matter. That experience is the only thing that matters. The thought goes that certification issuing organizations are just in the business of making money. Experience matters more than certifications and certifications are an ineffective measure of one’s…

Read more

5 years ago · Anonymous

Becoming Cyber Newsletter

Best Certifications for Breaking into Cybersecurity

Education has become increasingly democratized in recent years. There are a lot of paths available for your cybersecurity self-education: college/graduate school, bootcamps, online courses, YouTube videos, books, etc. This variety of learning pathways make the Credentialization phase of your…

Read more

5 years ago · Anonymous

This represents a once-in-a-generation opportunity for attorneys. After all, in every other legal specialty there is a line of much older lawyers, who have been practicing for decades. However, there is no old guard of attorneys in cybersecurity and data privacy. There are green pastures and a lot of room for ambitious attorneys—who are willing to do some learning—to make a name for themselves.

Cybersecurity Legal

Cybersecurity teams have plenty of legal concerns for which they need trusted legal advisors. Cyber lawyers don’t need to be technical experts, but they need to be able to keep up with cybersecurity situations and know the common legal concerns. They need to understand the basics of cybersecurity or popular frameworks to be successful as legal advisors.

Lawyers may be able to find cybersecurity opportunities without need for additional certifications. That being said, passing the CompTIA Security+ or GIAC Security Essentials (GSEC) certification would provide all the information needed to hit the ground running and would give attorneys credibility with cybersecurity teams. A lawyer who achieved a Certified Information Systems Security Professional (CISSP) or Certified Information Security Manager (CISM) certification would be considered exceptional and would make quite a name for themselves in the cybersecurity community.

Data Privacy Legal

Much like cybersecurity, data privacy provides a unique opportunity for ambitious attorneys. Privacy regulation is still very new—if it exists at all—in many jurisdictions. Rest assured though that privacy regulation is coming. It’s a pressing issue that is likely to be legislated in various jurisdictions in the coming years. At a minimum any company which does business with the European Union (EU) needs legal advice on the intricacies and implications of the EU’s General Data Protection Regulation (GDPR).

The International Association of Privacy Professionals (IAPP) provides the go-to certifications for data privacy. Lawyers diving into the space should consider the Certified Information Privacy Professional (CIPP) certification. There are four CIPP concentrations, each focused on a specific region: Asia, Canada, Europe, and the U.S. private-sector. These certifications are designed for lawyers and highly recommended for those exploring the space.

Intersection of Cybersecurity and Privacy

While cybersecurity and data privacy are generally related fields, they intersect in moments of crisis. Cyberattacks resulting in the breach of client data represent moments in which a trained, experienced cybersecurity and privacy attorney is worth her weight in gold. These are fast-paced situations, in which the cyber legal advisor is an active participant.

Expertise in the legal responsibility, implications, and pitfalls related to data breaches will be highly valuable. This isn’t the time for on-the-job training. This is the time to display the knowledge and creativity, which sets you apart from your peers. If you can advise both the cybersecurity teams and business executives in a language they understand, you have a good chance of being a trusted cyber legal advisor.

Future of Cyber Legal

Cybersecurity has become a hot career field in the last few years. According to the 2020 (ISC)² Cybersecurity Workforce Study there’s a global shortage of 3.12 million cybersecurity professionals. Between the skills shortage and the constant barrage of cyberattacks we see in the news, the demand for cybersecurity professionals isn’t likely to abate anytime soon.

Cybersecurity and data privacy is emerging as a growth specialization in the legal field with significant opportunity. It seems unlikely that many senior attorneys will specialize in this niche in the latter stages of their careers. That creates opportunity for industrious attorneys willing to put the work in to learn the technology.

The legal blog Lawfare noted that according to a survey “published in the fall of 2020, almost 50 percent of chief legal officers expect their (already substantial) role in cybersecurity to continue to increase.” Attorneys specializing in cybersecurity and data privacy—who establish themselves as experts—will undoubtedly be in high demand for the foreseeable future.

Recommended Posts:

Becoming Cyber Newsletter

Women Pursuing Cybersecurity Careers Can Get Additional Resources

Despite recent improvements women continue to be underrepresented in cybersecurity. Currently, they represent only 24% of cybersecurity professionals. While that’s better than five or ten years ago, the industry still has a ways to go. Fortunately, there are some great resources to support women getting into and excelling in cybersecurity…

Read more

5 years ago · Anonymous

Becoming Cyber Newsletter

Podcasts to Expand Your Cybersecurity Awareness

It’s beneficial in making your transition to a cybersecurity career to become a student of the game. Have your finger on the pulse of what’s happening in cybersecurity current events. There is plenty of cybersecurity news out there. You just have to know where to look. (Hint: Most cybersecurity incidents aren’t in the New York Times or Wall Street Journ…

Read more

5 years ago · Anonymous

Podcasts are a great way to keep up with cybersecurity current events. What’s your favorite cyber podcast?

It’s easy to suppose that your resume refers to a single item. In reality, you should probably have multiple resumes. This allows you to apply for positions in a targeted manner, rather than using a “one resume to rule them all” method.

Benefits of Multiple Resumes

You want your resume to effectively respond to the job listing that you are applying to. Your aim is to convince the hiring manager and/or recruiter that you meet enough of their stated requirements to warrant an interview. As each cybersecurity job will have different stated requirements—especially between roles and industries—multiple resumes allow you to respond to the specific job to which you are applying.

This allows you to maintain an array of resume bullets and utilize only those which are most relevant on any given resume. This can help you avoid a situation where you have five, six, or seven resume bullets for a single position. You can craft less bloated resumes, targeted for specific applications.

Remember, your resume is not an auto-biography. Resume writing is a demonstration that you can effectively and concisely represent your professional and educational experience in one to two pages. You want to give the reader enough information to convince them they should interview you to get to know more about you.

How to Develop Multiple Resumes

It’s important to have a system to develop and maintain multiple resumes. You invite confusion and chaos, if you have 20 different files named resume.docx on your computer. Your first step is to develop what you think is your baseline resume. This will undoubtedly evolve over time as you continually update and refine your resume during your cybersecurity career. It’s a good starting point though.

Next, you want to name your resume files in a manner that helps you distinguish between them. One effective technique is to include the date in the filename. This provides the dual benefit to differentiating between versions and letting you know how long ago you last updated your resume.

Including a version number in the filename is less useful than you would think. It gives the impression that the highest version number is the best version. In reality, for a given job application a slightly older version may be more relevant. The more recent version may have been very targeted to a specific role or industry. Including a date in the filename is more useful than a version number to remind you, when you wrote each copy of your resume.

For each job you apply to you can use a recent resume version as a starting point. Do you have particular experience in that industry aside from cybersecurity? You can make sure to expand upon that. Do you have a resume bullet from several versions ago, which would be useful for this application? You can add it back in. Does the job description phrase requirements in a particular manner? You can adjust the language to match the description. You can also simply refine your resume over time without losing track of which iteration of your resume you used where.

What’s In A Filename?

In order to keep things straight, you’ll want to keep the same filename when you PDF your resume to send to potential employers. [Note: Always send a PDF of your resume.] That means the recruiter and hiring manager will also be able to see the naming convention you’ve used. Keep it clean and neat.

Make sure the filename includes your name. It’s common for the recruiter to email the hiring manager several resumes at once. Don’t make people work to figure out which resume is yours.

Your resume is not a one-time document that is ever “done.” It’s an evolving document that you’ll revise over time. Maintaining multiple versions of your resume will actually support the evolution of your resume and it encourages you to actively update it over the course of your career.

Recommended Posts:

• Cybersecurity Resume Advice for Veterans… and Those Who Support Them

• The Best Way to Get Your Resume in the Hands of a Hiring Manager

• Write a Resume That Makes Cybersecurity Recruiters Actually Want to Talk to You

Change can be hard. What’s the best advice you’ve received about changing careers?

Ransomware is not new. Cybercriminals have been encrypting people’s and business’s computers to extort ransom payments since 2012. You probably know a few people, who have been victims. Prior to the COVID-19 pandemic it seemed that only cybersecurity professionals were paying attention to the numerous waves of ransomware attacks. While cyber- and IT-focused media would report on these attacks regularly, rarely did they break into the media stream media’s reporting.

Cybercrime Pays

Then the cybercriminals got clever. They started using “shaming sites”. Previously, many companies were incentivized not to publicly admit to being victims of ransomware. Cybercriminal altered those incentives by threatening to upload companies’ names and proof of compromise to “shaming sites,” if those companies didn’t pay their ransoms. That way the whole world could learn of the breach. To avoid the shame of that public outing, companies would in theory be more likely to pay the ransom. The result is that ransomware attacks are now much more public. The sheer volume of attacks, which is reported on, ensured that ransomware made it into mainstream media.

Contrary to what we tell children, cybercrime pays. Cybersecurity Ventures forecasts that the global cost of cybersecurity will increase to “$10.5 trillion USD annually by 2025, up from $3 trillion USD in 2015.” Considering that global GDP is forecast to reach $116.4 trillion USD by 2025, that’s a staggering cost of cybercrime. This cost impacts all of us. The cost of cybercrime will be baked into everything we consume.

Cybersecurity Is Hiring

Between the volume of public reports and a handful of high-profile ransomware attacks, like the Colonial Pipeline attack—which captured global attention and impacted everyday people—ransomware has truly entered the zeitgeist. As people become more and more aware of the global impact of cyberattacks, they also become aware of the opportunity of cybersecurity careers. That increased awareness is exactly what we need to turn the tide of cybercrime.

Contrary to what we tell children, cybercrime pays.

The good news is that cybersecurity is hiring. Increased awareness of cybersecurity careers—as a result of increased public awareness of ransomware—can be met with plenty of opportunities. (ISC)2’s 2020 Cybersecurity Workforce Study showed there were approximately 3.12 million unfilled cybersecurity jobs globally last year.

Despite what's shown in movies and TV shows, being a cybersecurity professional doesn’t require you to be a technology wunderkind, who’s been taking computers apart since she was 12 years old. It just requires curiosity, dedication, and a willingness to learn new things. If we want to avoid living in the dystopian world of cybercrime that Marc Goodman describes in Future Crimes, we need to funnel more professionals to cybersecurity.

This is a good opportunity to spread the awareness of the future-proof career opportunities, which cybersecurity offers. Not only does the profession need more good people, but society needs more good cybersecurity professionals. Spread the word. Cybersecurity is hiring!

Recommended Posts:

• Future Trends: Drone Security

• Women Pursuing Cybersecurity Careers Can Get Additional Resources

• Life is Short, Take a Chance and Bet on Yourself

The average online job posting will receive up to 250 applications. As you can imagine no one is actually reading all 250 resumes. Instead each resume will be reviewed by an applicant tracking system (ATS). A recruiter will review the resumes, which passed the ATS review, then the recruiter sends the (perceived) most viable candidates to the hiring manager.

That means your resume goes through two levels of screening before it gets to the person, who will actually make a decision to interview you or not. There’s a better way. The most effective way to skip the queue is to get a job referral.

Loose connections are very useful in the referral process. In a sense they’re more important than close connections.

However, not all job referrals are created equal. The most effective job referrals reflect someone sending your resume directly to the hiring manager. This allows you to skip the ATS and the recruiter. The hiring manager can simply tell the recruiter to add you to the interview group. You may be asked to apply online for administrative purposes, but if you’re pre-selected by the hiring manager you avoid being assessed by the ATS. If the hiring manager wants to interview you, the rest of the hiring gatekeepers are there to support.

Not All Referrals Are Created Equal

Many companies have job referral programs—and even referral incentive programs—which allow employees to refer friends and acquaintances for open job postings. These programs are very useful as employee referrals account for 40% of all hires. A referral via these programs can effectively get you past the ATS. You’re still likely subject to a recruiter review before getting to the hiring manager.

Employee referrals are most effective, when you have interest in a role and have a friend, family member, or acquaintance, who works at the company. They don’t need to be in cybersecurity or know anyone on the cybersecurity team. Your referrer just needs to be able to submit your information in the corporate employee referral system. This can be quite helpful as most of your contacts likely don’t work in cybersecurity—especially, if you’re a career changer—and thus may not personally know the cybersecurity hiring manager.

Referrals Direct to the Hiring Manager

Getting a referral directly to the hiring manager may be more challenging to orchestrate, but there are two distant positives. First, a referral directly to a hiring manager does not require strong relationships. Second, it does not require your referrer work for the company, which is hiring. Let’s unpack this a bit.

However, not all job referrals are created equal. The most effective job referrals reflect someone sending your resume directly to the hiring manager.

The misconception that hiring manager referrals are about good friends referring each other to other good friends is understandable. However, let’s consider the hiring manager’s perspective. Her main interest is to find the best person for the job and is happy to accept any help in identifying quality candidates. A referral doesn’t require her to be very close with the referrer, only that she knows and respects the referrer. It doesn’t require the referrer to be very close with the referred candidate either. After all, the referrer will provide some context about that relationship. It could be anything from “this is my cousin” to “this is a good friend I’ve known for 10 years” to “this is a smart person I met at an event”. The referrer doesn’t even need to work at the same company from the hiring manager, because they’re simply emailing the candidate’s resume to her.

The referrer can even be a non-cybersecurity professional. Why? Because the hiring manager is going to make her own decisions based on the candidate’s resume. But the fact that she receives that resume from someone she knows and respects generally means she’s going to read it. That allows the candidate to jump the queue and improve their chances of getting an interview.

It used to be hard to identify who in your network—if anyone—knew a hiring manager for an open cybersecurity position. LinkedIn has democratized so much of the recruitment process in this regard. If someone in your network likes or shares a LinkedIn post of someone promoting an open position, you know there’s a connection. Separately, if you’re able to identify the hiring manager for an open position, you can check their LinkedIn profile to see if you share any contacts.

The Power of Acquaintances

Loose connections are very useful in the referral process. In a sense they’re more important than close connections. You can have many more loose connections than close connections, which provides exposure to a wider number of potential opportunities. It is therefore important to foster those professional acquaintance relationships.

LinkedIn is a game-changing tool for that. If you’re new to LinkedIn or just underutilizing it, check out CIO Magazine’s The How-To Guide for LinkedIn. It can help you improve your engagement on the professional platform, which is a key resource for your job search.

Recommended Posts:

• Expanding Your Cyber Network on LinkedIn Improves Your Job Search

• Write a Resume That Makes Cybersecurity Recruiters Actually Want to Talk to You

• Celebrate the Small Victories Along the Journey to Your First Cybersecurity Job

Happy Memorial Day. Let us take a moment to remember and honor those servicemen and women, who made the ultimate sacrifice in service of their country.

— Becoming Cyber Newsletter

In May 2021, Colonial Pipeline suffered a ransomware attack, which shut down gas pipelines throughout the eastern United States. While 2020 and 2021 have seen a string of publicly reported ransomware attacks, this one was particularly high-profile, because it impacted ordinary people’s lives. Panic-buying of gasoline led to shortages in numerous states and resulting in rising gas prices nationwide.

How will the high-profile Colonial Pipeline ransomware attack impact cybersecurity hiring and you, the cybersecurity career seekers? It’s easy to say high-profile cyber attacks lead to increased investment in cybersecurity, but let’s dig a little deeper. We can infer a few things about the state of Colonial Pipeline’s cybersecurity staffing from public reporting.

Colonial Pipeline Cybersecurity Staffing

First, Colonial Pipeline does not appear to have a Chief Information Security Officer (CISO), despite being a critical infrastructure company. The 2018 results of a tech audit recommended they hire a CISO. Instead those responsibilities were reportedly given to a direct report of the Chief Information Officer (CIO).

Second, Colonial Pipeline has had a job posting listed for a Cybersecurity Manager for 30+ days. The position was posted to LinkedIn two months ago and had over 80 applicants on that platform. (At the time of this writing the position is still posted.)

Third, based on public reporting and LinkedIn searches Colonial Pipeline appears to have almost no dedicated cybersecurity staff.

What Is Different This Time?

The Colonial Pipeline ransomware attack is the latest publicly visible cyberattack on US public and private technology systems. This latest cyberattack pushed the Biden Administration to issue Executive Order on Improving the Nation’s Cybersecurity. The Executive Order is intended to:

• Remove Barriers to Threat Information Sharing Between Government and the Private Sector

• Modernize and Implement Stronger Cybersecurity Standards in the Federal Government

• Improve Software Supply Chain Security

• Establish a Cybersecurity Safety Review Board

• Create a Standard Playbook for Responding to Cyber Incidents

• Improve Detection of Cybersecurity Incidents on Federal Government Networks

• Improve Investigative and Remediation Capabilities

There is indication the cybersecurity legislation may follow this Executive Order. The landscape of US responses to cybersecurity appears to be shifting. (The White House released a helpful Fact Sheet, for anyone not inclined to read the whole Executive Order.)

How Will This Impact Cybersecurity Hiring?

The Colonial Pipeline ransomware attack has every reason to spark increased interest in cybersecurity. Corporate boards of directors across the US and the world got a well-publicized view of what can happen, when cybersecurity is treated like an additional duty for IT. Why highlight the board of directors? Because they have a fiduciary responsibility to oversee good governance practices, risk management, and to protect stakeholders.

There is an increasing school of thought that board members risk opening themselves to personal liability (i.e., they could be sued personally) over cyberattacks, which result from corporate negligence. No board member wants that, so boards will likely start asking more questions about their company’s cybersecurity program. This is particularly likely, as some view the new Executive Order as a prelude to cybersecurity federal legislation.

Colonial Pipeline’s lack of success hiring a Cybersecurity Manager demonstrates that cybersecurity hiring is hard, especially when you have no cybersecurity professionals to lead and prioritize it. When pursuing opportunities at companies with nascent cybersecurity programs, be aggressive in getting in front of them. After all, they don’t have the infrastructure in place to streamline cybersecurity hiring.

Speaking of infrastructure, the Colonial Pipeline ransomware attack occurred at the intersection of information technology (IT) and operational technology (OT). This highlights opportunities for career changers with previous experience with OT. While it is important for companies with physical infrastructure (like gas pipelines), most cybersecurity professionals don’t have experience with OT. It’s a niche, which can be leveraged by career changers already in the space.

In the wake of the Colonial Pipeline ransomware attack, you’ll likely find numerous companies—which were already struggling to hire or underinvested in cybersecurity—willing to take a chance on career changers and first-time cybersecurity professionals. However, don’t expect the heavens to open and start raining cybersecurity jobs. It will be even more important to network to find these opportunities. These companies are less likely to have mature hiring processes. They can however offer some really good experience early in your cybersecurity career. Good luck!

Recommended Post:

• Get Your Foot in the Door, Find the Low Hanging Fruit

• Life is Short, Take a Chance and Bet on Yourself

• Expanding Your Cyber Network on LinkedIn Improves Your Job Search

An aspiring cybersecurity professional, considering his training options, recently asked if cybersecurity bootcamps are worth it? That’s a common question, especially considering the variety of cybersecurity training options available. The short answer is: Yes, if the bootcamp gets you the desired result—a cybersecurity job—for an acceptable cost.

Admittedly, not the most exciting answer, so let's explore the implied question. “How does a hiring manager view job candidates, who are cybersecurity bootcamp graduates?”

As a hiring manager I respect someone, who stops what they’re doing and commits months of their life to learn new skills to break into a new career field. I’ve hired a few graduates from the NPower bootcamps and have been very happy with the results. In addition to structured learning, bootcamps also provide coaching and mentoring, camaraderie with students pursuing similar goals, and potentially hiring pipelines into partner companies.

There is certainly a benefit to having the support network that comes along with bootcamps.

Pivoting into a cybersecurity career can be a lonely process. There is certainly a benefit to having the support network that comes along with bootcamps. As well, the structured format of bootcamps can ensure you’re exposed to various cybersecurity disciplines, that you weren’t aware existed. All in all, bootcamps can be a great opportunity, if you have the resources and opportunity to attend. They are shorter (and generally less expensive) than a Masters in Cybersecurity, but more structured with more available resources than self-study options.

When considering a bootcamp, compare the curriculum with other similar programs. Look at the sort of cybersecurity roles the bootcamps alumni work in now (and the companies which they work for). Check what corporate sponsors the program has. These companies likely recruit from the bootcamp as well. Review what cybersecurity certifications are part of the bootcamp’s curriculum.

Professional certifications are a key reason for the democratization of cybersecurity education.

This last point is important. Professional certifications are a key reason for the democratization of cybersecurity education. As a hiring manager it’s not necessary that I be familiar with your cybersecurity bootcamp, if you’re well credentialed upon graduation. Having completed a cybersecurity bootcamp speaks to your commitment to learning this new field. Passing industry-recognized certifications speaks to the relevant knowledge you’ve gained and supports an apples-to-apples comparison with other job applicants.

When educating yourself to pivot into a cybersecurity career, there are many good options. Bootcamps have become a mainstay of the tech industry in recent years and are growing in the cybersecurity industry. If the bootcamp route sounds right for you, shop around and find the specific bootcamp that is right for you. Don’t feel rushed by impending deadlines (i.e., “I just learned about this bootcamp today, but the application deadline for the next class is tomorrow”). You can always self-educate while you shop around to find the right bootcamp for you.

Recommended Posts:

• How to Learn Cybersecurity Skills on a Budget

• Best Certifications for Breaking into Cybersecurity

• The Myth of the Cybersecurity Archetype

In the Internet Era there is a lot more awareness about potential careers. However, there is still an inequity of awareness of amazing career opportunities in technology.

Cybersecurity Careers

There is more to the tech industry, than just becoming a software engineer or coder. As Generation Z considers their futures, let’s introduce them to opportunities in cybersecurity. As plenty of popular and lucrative 20th century jobs are being automated away, cybersecurity jobs are going the other direction.

In 2019 there was a shortage of 3.12 million cybersecurity professionals globally, including 359,236 in the United States; 27,408 in the United Kingdom; 27,192 in Australia; and 16,552 in Canada..

What about that automation? Isn’t it coming for cybersecurity jobs too? With the explosion of Internet-connected devices just over the horizon, machine learning and artificial intelligence are going to automate boring, repetitive tasks. This will support cybersecurity professionals focusing on more interesting challenges.

Interesting near-future, cybersecurity challenges will include securing self-driving cars, delivery drones, biomedical implants, next-generation aircraft and ships, space communications, and the data of billions of people. Cybersecurity careers will provide Gen Z an opportunity to positively impact an increasingly technology-driven society.

Economic Security

Millennials are the first generation to earn less than their parents in nearly 100 years in the United States. This negative trend along—with growing inequality in general—should concern us regarding the future economic security of Generation Z.

If you’re concerned about the economic security of your Zoomer, consider that the median income for an information security analyst (with less than five years of experience) in 2019 was $99,730 in the United States. The average salary of a cybersecurity architect is $130,000. Trends point to cybersecurity continuing to be a vital, well-paid profession into the coming decades. After all, the sheer volume of the devices and organizations, which need to be secured, continues to increase in the face of growing cybercrime.

In 2020 cybercrime cost the global economy more than $1 trillion. That’s a 50% increase from 2018. The explosive growth of cybercrime should certainly worry us as netizens. However, it screams career opportunity for Gen Z as they consider their options in the workforce.

Many of us didn’t know that cybersecurity was a career option when we graduated school. For some, it wasn’t yet. Today cybersecurity is a booming career field with a diversity of specialties. Cybersecurity needs smart, curious people. If you know anyone contemplating their future, suggest they consider a cybersecurity career.

Please share the Becoming Cyber Newsletter with the potential cybersecurity professionals in your life.

Recommended Posts:

Becoming Cyber Newsletter

Cybersecurity Analysts Make How Much?!

One great thing about the cybersecurity industry is that it offers people economic security, when the middle class is under pressure. Experienced cybersecurity professionals enjoy a 0% unemployment rate. Many potential career changers really want to know, “How much can I make in cybersecurity?” I’ll spare you the standard…

Read more

5 years ago · Anonymous

Becoming Cyber Newsletter

Future Trends: Drone Security

Future Trends Everything that can go online is being put online. Thus the global attack surface is continually increasing, both in the number and diversity of devices online. However, the future trends also represent an opportunity. You can develop specialty knowledge about new cybersecurity niches, which will allow you to stand out in the job market and…

Read more

5 years ago · Anonymous

Writing a resume for your first cybersecurity job can be a daunting task. People don't love writing resumes in general. Writing one for a new career field can be understandably intimidating. Here’s a few tips to clean up your resume before sending it to prospective employers.

Get an Experienced Reviewer

Find someone to review your resume and give you feedback. Preferably someone who has experience hiring people. They don’t need to work in cybersecurity (though it wouldn’t hurt). Early in our careers we’ve seen very few resumes. Some people have only seen their own.

Thus we have limited perspective of how our resumes come across to a recruiter or hiring manager. Professionals, who are regularly involved with hiring, have likely seen hundreds of resumes (or more). Basic problems with your resume will stand out to them, even if they know nothing about cybersecurity.

Format and Readability

We like to imagine a recruiter or hiring manager with a printed copy of our resume in hand, reading through every line of our experience and qualifications, giving ample consideration to our candidacy. In reality they’re reviewing your resume on a computer screen (maybe even a smartphone screen) along with resumes for a few other candidates they’re considering.

If you’re lucky, they’ll spend 30 seconds reviewing your resume. That means your resume needs to be written in a readable format. Key details need to jump out and be easy to find. Fifty percent of resume writing is about content. The other 50% is about displaying that you can concisely describe your experience in a manner that makes the recruiter want to know more about in just one to two pages.

Maximum Length

Conventional wisdom is that you get one page of resume for each decade of work experience that you have. If you’re 23 years old with a three page resume, you risk being rejected on principle. You don’t need to write your life story or every internship. Presenting your best self requires conciseness.

Choose the Right Bullets

If you’re recrafting your resume for a new career field, you’ll want to revisit your resume bullets. Develop or recycle bullets that highlight any experience you have with technology, process development, or simply that you’re a fast learner. If you followed the Roadmap to a Cybersecurity Career, then you completed Self-Education and Credentialization. Highlight relevant training, certifications, and experience (even volunteer experience) that support your new career ambitions.

Education

If you’re hurting for space and you have educational bullets that don’t align with your cybersecurity career goals, consider removing portions of them. The Education section is a good place to highlight classes and/or projects, which do align with your cybersecurity career goals (even if they weren’t part of your major).

Skills

Consider your skills section carefully, You’re not going to impress cybersecurity professionals stating you are proficient in Microsoft Office. That’s table stakes. Highlight skills that are at least cybersecurity adjacent. You have limited space. Focus on skills which align with your career goals.

Interests

This unassuming section at the bottom of your resume is underappreciated. The Interests section is a freebie! You can put anything you want without a requirement that you be good at it. If you’re transitioning to cybersecurity, you should have at least 2-3 technology- or cyber-related interests listed. (Note: Writing something like penetration testing, cyber threat intelligence, or cryptocurrencies is potentially useful. Writing cybersecurity is not.) Be prepared to discuss whatever interests you write though.

PDF

Unless specifically told otherwise, always send a PDF of your resume. It allows you to control how your resume appears on the reader’s screen. If you send a Word document, it might look messed up on the reader’s computer (and it usually will on their smartphone). You don’t want that… especially, if they’re likely to spend less than 30 seconds reading your resume.

LinkedIn Info

Nowadays, if recruiters or hiring managers find your resume interesting, they often will want to check out your LinkedIn profile. Include an HTTPS hyperlink to your LinkedIn profile in the header to make yourself easy to find.

This is not an exhaustive list of resume tips. Make sure to read more advice online. Your resume acts as your avatar in the job search process. Prepare it to represent you well!

LinkedIn is an amazing platform to contact and connect with industry leaders. You can utilize the platform to expand your cybersecurity professional network and help with your job search. It can be challenging though. Cybersecurity professionals are notoriously busy. Crafting a targeted message that sparks engagement can be tough.

It really comes down to your questions to them. We know that questions like, “Do you have any job openings?” aren’t likely to go well. So what question is likely to inspire a reply?

Try asking:

What book would you recommend to a new cybersecurity professional?

Let’s break down what makes this an effective question.

First, the answer requests a limited time commitment. Cybersecurity leaders are busy, but it takes just a minute to reply with a book title. Asking a question that requires a low effort response increases the likelihood that you get a response.

Second, cybersecurity leaders have read a decent amount about the industry. They are lifelong learners, who have done a good amount of professional reading. That means this is a question to which they likely have interesting answers.

Third, lifelong learners likely have a number of technology and cybersecurity books to recommend. However, most people’s friends and family have little interest in hearing about their cybersecurity reading list unless those individuals also work in cybersecurity (or an adjacent industry). Thus your question provides the recipient an opportunity to share reading they’ve found interesting.

The question is more likely to illicit a response than more mundane questions. For example, answering how one got into cybersecurity can require the recipient to type a lot and gets tiresome. You’ll get more benefit from asking for book recommendations as well. Your question may spark a dialogue which leads to further conversation and connection.

Even if the answer doesn’t spark further dialogue, you still walk away with a professional reading recommendation from an industry leader. That is incremental knowledge, which benefits you. Reading the recommended book provides you with an opportunity to follow up.

You can thank her or him for the recommendation and let them know what you thought of the book. That’s another opportunity to spark dialogue.

People ask a lot of questions during professional networking. They get little benefit from many of the answers. Book recommendations always provide insight; either insight into the cybersecurity industry or insight into the cybersecurity leader you’re corresponding with. Both are valuable.