Starting in Cybersecurity
You know, its almost comical how many people hear about the pay in cybersecurity and want to fast track it. Then they show up in reddit’s r/cybersecurity asking questions about getting into the field. The comical part is that it feels like many of them believe that they just have to be good at hack the box or similar.
Having lived in cybersecurity/IT for 30 years, I can tell you with strong conviction that penetration testing is, depending on size of company, budget, and compliance requirements, at the most, a quarterly requirement for most of the companies that I’ve seen. I’m sure its different at FAANG companies and some of the larger banks, which are exception to many rules.
I’ve gone to many conferences and networked with peers and have found that many CISOs have very small teams and many people wear many hats.
I’ve been lucky in my career that I’ve started with companies and got the chance to see their Cybersecurity teams grow. I’ve also been lucky to see them shrink. Let me explain that. All experience is good experience and having had to reduce teams requires creative thinking and stress and pressure. It sucks, but knowing how to approach it and to actually navigate it is good experience.
If people want to get into cybersecurity, here’s a couple of options. My first one, I really love to give.
- Join the military. Yeah, its a commitment and you may or may not like the political leader. But in the right conditions, you can get an MOS that is IT technical or cyber-related. You might even get promoted in that field.
If you get out of the military after your contract is done. You already have that many years of experience that can be put into your resume. You also have the added benefit of moving out of your parents house. You get education benefits. You might travel the world. You might also have fallen in love! You might also learn the world sucks and is unfair and you might get cheated on. You are now an experienced adult! - Get into IT at the help desk. Start with basic understanding of computers and networks. If you are about IT certifications, study for A+ and Network+. They cover the basics.
Get experience at the help desk because when you work there, you learn what problems people commonly run into and you learn how to solve those problems. You also get to experience new problems and learn to deal with people. Having people problem solving skills is HUGE! Being customer service friendly is such an important skill. As a senior level executive, I don’t run into problems I can’t fix myself often, but when I do, if I get treated professionally and the problem gets fixed ASAP, I will rain praise down on that person who helped me. Because I know what its like and I started there.
Grow out of the help desk. Find a path and get really good at it. Once you get really good at it, learn to secure it. Whatever it is. desktops, email, applications, networks, database, servers, cloud, phones… whatever!
Become the person to go to when there’s an audit or assessment. Learn how to give a proper narrative to a compliance person, auditor, or assessor. Learn exactly the intent of the control and how to explain a narrative so that it satisfies that intent!
Once you start building that reputation about securing whatever it is you secure and that you are the person to go to for audits and assessments, then you are ready to join cybersecurity. Find roles that are cyber-adjacent to your IT role.
I know that there are exceptions to my recommendations. There are people who can start straight into GRC coming from a financial background and doing financial controls. I also know that there are schools that crank out degrees that should “make you hirable” on graduation. But the truth is that as a hiring manager, I’m more likely to hire someone who has experience than just education. I know there are people who can get hired without any of this into cybersecurity.
Having a strong background in GRC, I’ve created this list based off the NIST 800-53 and broken down into the CSF, of analyst position. They might be a great place to start thinking of your next role after you get into IT.
Govern (GV)
- GRC Analyst (Governance, Risk, & Compliance)
- Cyber Risk Analyst
- Third-Party / Supply Chain Risk Analyst
- Cyber Policy & Standards Analyst
- Cyber Legal & Regulatory Analyst
Identify (ID)
- Cyber Threat Intelligence (CTI) Analyst
- Asset & Data Discovery Analyst
- Vulnerability Assessment Analyst
- Business Impact Analyst
Protect (PR)
- Identity & Access Management (IAM) Analyst
- Security Awareness & Training Analyst
- Data Loss Prevention (DLP) Analyst
- Cloud Security Analyst
- Cryptography / Key Management Analyst
Detect (DE)
- SOC Analyst (Tier 1 / Tier 2)
- Detection Engineer / Analyst
- Network Security Monitoring (NSM) Analyst
- Threat Hunter
Respond (RS)
- Incident Response (IR) Analyst
- Digital Forensics Analyst (DFIR)
- Malware Analyst
- Cyber Crisis Communications Analyst
Recover (RC)
- Business Continuity / Disaster Recovery (BC/DR) Analyst
- Cyber Resilience Analyst
- Lessons Learned / Post-Mortem Analyst
Paul Jerimy publishes a web page that has tons of cybersecurity certifications, first look at the IT Career Roadmap and then the Security Certification Roadmap
I can tell you from a place of experience, some tools that you will need to master are:
- Microsoft Office Suite: You better know Outlook, Excel and PowerPoint. You should know some SharePoint.
- How to be easy to work with!
Lastly. If you are looking for certifications in cybersecurity. Look to vendor certifications first. Analysts and Engineers are expected to know their tools. If you deal with email security, you can get a proofpoint certification. if you play with SIEMs, you can get a splunk certifications. If you like networking, get some cisco certifications.
If you are getting into leadership roles, then vendor certifications don’t mean as much. That’s where you want CISSP, CISM, etc… Because you will be looked at to understand technical execution risk and executive alignment.
Hope this helps!
