In two previous blog posts, I shared the non-traditional cybersecurity career paths of more than a dozen professionals and how their previous life experiences shaped their security work. It’s been an honor helping to tell these individuals’ stories. We conclude this blog series with a final installment in which these same cybersecurity professionals share advice on how people can find their own way into the industry.
David Hoyt | Security Researcher
“Quality and security assurance is a wide open, full throttle industry that needs educated people to help identify potential risks to consumers. If you like to read, learn and experiment with a computer, quality and security assurance may be the right industry for a career.”
Caitlin Kiska | Information Security Engineer (Threat Intelligence)
“Cybersecurity is a HUGE tent and there are multiple areas in it for people from related fields. Risk, sales engineering and even threat intelligence have lots of crossover with non-traditional-entryway-to-tech fields. That being said, the gatekeepers who think everyone needs to meet an almost impossible bar of technical knowledge for entry tend to be unabashedly loud. Be prepared to need to prove them wrong.
“Lastly, look into the turnover numbers for multiple positions in cybersecurity. Incident response and security operations center work are known for being very high-stress niches. Be honest with yourself about how much stress you can handle — and whether you enjoy positions that require a sense of urgency, like in my case.”
“For people with a non-traditional background, my first advice is to look at which transversal skills they can use. They know “the business,” i.e., what to protect. They know what works and what doesn’t. They know what is doable, too, in terms of budget and compatibility with their constraints.
“I would also recommend that they do not pursue certifications before finding a job. If this is needed, their employer would gladly pay for it. On a side note, I’m creating an academy to train senior professionals to non-IT security. I’m doing this because you don’t learn about many aspects of cybersecurity at school, especially in the U.K. where most of it is focusing on offensive security.”
“My recommendation to enter the cybersecurity field from a non-traditional background is just to get your hands dirty and go do it. It takes some serious hard work and time invested, and there may be a steep learning curve depending on your background, but it can certainly be done.
“There are key points of what an entire career in cybersecurity will involve, so it’s important to take the time to familiarize yourself with them. If resources aren’t an option, you can also get more hands-on and build a lab where you can mess around with different aspects of cybersecurity. After you get a good handle on the basics, the next step is to get a certification under your belt, in my opinion, which can help you land a technical internship and then a full-time position.”
Matt Gimovsky | Contracts Manager and Supply Chain Advisor
“The best advice I can give is to honor your interests. Take a chance by fully embracing the prospect of change and really committing to it. (It grows more daunting the closer you get, but it is made easier if you ask and answer the hard questions. “What do I want? How do I get it? What do I want to move towards and away from?”)
“Carefully listen to that internal voice driving your desire for whatever technical career you’re interested in. A few certs help, says CompTIA, but they are not more important than putting yourself out there to network. Be earnest and honest with yourself and others, and you’ll get where you want to be. Keep at the front of your mind a fundamental truth — everyone’s career path goes upwards and down, sideways and back. Hardly anyone enjoys the type of linear, breezy success. It’s too easy to pretend everyone does but us.”
Justin Kinney | Information Security Analyst
“My biggest piece of advice is to never stop learning. You don’t need a degree to get your foot in the door. You just need YouTube, TryHackMe and the willingness to learn.
“I landed a Security Analyst role at a nice managed services provider that is paying for me to get my certs. The second piece of advice is always try to give back. You will retain way more information if you understand it enough to teach someone else. Plus, this industry will need great mentors to teach the next generation of cyber operators.”
Damon Small | Technical Director of Security Consulting
“As our industry continues to mature, the paths to entry will also continue to become more formal and codified. That said, ours is still a very young industry, comparatively speaking. I am no longer a gigging musician, but my desire to “perform” has given me many opportunities to advocate for my fellow practitioners through public speaking.
“In one of my career development slide decks, I comment that there is no “right way” to get into infosec. In many ways, we are still making this up as we go along, and that is OK. It takes a multitude of skills to be successful, and there is plenty of work to be done for all of us to stay busy regardless of what path we chose to get here.”
Garima Tyagi | Cyber Security Analyst
“I strongly advise people coming from non-traditional backgrounds to pursue a good interactive course that gives you all the insights into cybersecurity. Above all, one also requires curiosity to learn new technology and tools which will lead you to this ever-growing field that still needs more people.”
Haydn Bowers | Senior Solution Architect: Security
“Find what you’re good at. I mentor students at the University of Melbourne looking for career pathways into cyber and, more broadly, IT. All these students come from diverse backgrounds, not specifically computer science or engineering.
“My advice is search firstly within. Understand what makes you unique. Most individuals can tick off a list of required skills on a CV; however, every individual has something unique to bring to the table. That could include the way you solve problems and your thought process, or the way you drive team engagement and your capabilities in stakeholder management. My experience has taught me that it’s never the core competencies that enable you to obtain a career move but the ability to explain the benefits that you bring to the team, or organization, through your soft skills.
“That being said, I think anyone with an interest in a cybersecurity career should be abreast of cyber current affairs. Whether these [are] recent threat releases, geopolitical news or general IT and cyber news, understanding the broader landscape can help provide the reason why, the strategy how or what we should be protecting from whom. I’ve given this advice to colleagues looking to move into our cyber team; the ability to interpret cyber current affairs always goes a long way in interviews.
“Combining these two, all I can really say is this: Have a passion and let it be known. Whether it be technical engineering, governance and risk or automation and orchestration, have a passion, and you’ll find a place for it in the cybersecurity industry.”
“Generally, if anyone has an interest in computers, there are probably multiple ways to be able to combine work with [a] hobby as I have. In my case, I found out that cyber crime and security are not far from what I enjoy as hobbies.”
“For anyone looking to change careers or build one into a solid career path, cybersecurity is the way to go. The field is so broad, there is something for everyone. I run into psychologists, economists and mechanics all working in the field and getting out of it what they want.
“To start, I recommend people learn about networking and make yourself use Linux as your daily operating system. Work with the command line as much as you can. That’s how you learn. After that, spend as much time learning how different communication technologies work, because of all that matters. But you can’t go wrong just reading about anything and everything as much as you can. In security, everything matters. It might not matter to you, but it will matter to somebody, so knowing about it can only ever help.”
Nick Drage | Cyber Security Strategist
“I entered the cybersecurity industry officially at the start of the century, moving from System Administration to Security Operations. That’s not that unusual for the time, but I had no relevant technical qualifications, and my academic degree was a BA(Hons) in Combined Studies. This degree taught me the importance of taking multiple viewpoints and really analyzing the context of a situation or of a point of view. My first IT positions involved security but also general IT, system administration, network management and so on. That gave me a really broad view of how processes built around technological requirements succeed or fail.
“Don’t listen to anyone who gives you generic advice for every situation. Your own personal context might be completely different to theirs in ways they don’t understand. Also, anyone who’s been in the industry long enough to be a luminary and who only gives advice based on their own experience should be smart enough to know their experience is out of date and not relevant. Get feedback on everyone you interview with or discuss your career plans with. Be mindful of those who are skeptical of your plans. Unless they’re particularly convincing, don’t be put off. Being fobbed off by employers who aren’t open-minded will benefit you in the long run.”
Ian Parsons | Cyber Threat Intelligence Analyst
“To anyone who is not sure whether to give it a go, my advice would be that there are plenty of jobs in the industry. I am not too technically minded. I prefer to know who/what is bad and how it can be put to use. There are plenty of intro guides to the various roles online and some good basic intro courses. Have a look around and see what you like. The rest is down to your commitment and the effort you are willing to put in.”
“Cybersecurity is really a huge field with many embedded disciplines. Take a good look at the totality of the field, decide where you want to focus and attack it. It’s unfortunate that the job market is so unpredictable, but do realize that, historically, cybersecurity professionals have experienced 0% unemployment. Well, unless you are working for a company that gets [attacked]. In the past, when I was a hiring manager, I looked for those who were curious, who liked to learn new things, who dabbled on their own time as well as who practiced continuous learning and self-improvement. Look at educational programs that are skills-based if you want to work in the technical aspects. Eventually, I did earn a doctorate in information assurance, but that’s another story!”
Simon Backwell | Information Security Manager
“My advice would be that a security role is obtainable by anyone regardless of qualifications. As someone who came into security without a security background or any formal degree, I gained the confidence and skill set to switch into security, and I appreciate that my company and manager saw the potential beyond my lack of qualifications. I was afforded the time and guidance to learn the technical skills on the job, and I believe that others should be afforded that potential.”
Do You Have a Story to Tell?
The more we share stories and insights such as those above, the more we can help guide more talent into the industry. Do you have a story to tell? If so, please visit my author page for ways you can reach out.