How to Get Hired Without Cybersecurity Experience

Episode transcript

Transcript provided for accessibility and search. Minor transcription errors may remain.

SPEAKER_02 0:07

Trying to land your first cybersecurity job? Got the qualifications, the enthusiasm, and the willingness to learn, but nobody seems willing to give you a chance? Welcome to Hacking Your Cyber Career. Real advice, real experience. Your next move. Here's Steve.

SPEAKER_01 0:29

So, you've decided you want to work in cybersecurity. Excellent. You've done your research. Perhaps you've completed a degree. Maybe you've earned a certification. You've watched the videos, read the articles, and learned enough cybersecurity acronyms to make a perfectly normal conversation sound like a technical malfunction. And now you're ready to get a job. Wonderful! You open LinkedIn, find an entry-level cybersecurity position, and discover that the employer wants three years of experience. Excellent! Three years of experience for an entry-level job. Presumably you were supposed to begin your career while you were still at school. So you apply anyway. And nothing happens. No response, no interview, not even a polite rejection, just silence. You apply for another, and another, and another. Eventually you start wondering whether anyone is actually hiring, or whether all these job advertisements are simply there to provide LinkedIn with something to display between motivational posts. Now, we've already discussed the experience trap in episode 2, and I explained something important. Job descriptions are often wish lists. They're written by people who would ideally like a candidate who already knows everything, can start immediately, requires no training, and preferably doesn't need paying very much, naturally. But today I want to approach the problem from a different direction. Because complaining about unrealistic job descriptions isn't going to get you hired. What we need to work out is how to convince an employer that you're worth taking a chance on. And to do that, you need to understand something about recruitment. When I was hiring cybersecurity professionals, I wasn't simply looking for someone who had collected the correct qualifications. I was looking for someone who could contribute to my team, someone who could learn, someone who could solve problems, someone who could communicate, someone who would take responsibility, and importantly, someone I believed I could trust. Now, experience certainly helped demonstrate those qualities, but it wasn't the only way. I've hired people with very little direct cybersecurity experience. I've hired people who came from other parts of IT, and I've even hired someone into cybersecurity who had been working in the company mailroom. So the idea that nobody will hire you without direct cybersecurity experience simply isn't true. It happens. I've done it. But you have to give the hiring manager a reason to believe in you. And that's what we're going to work through today. How to make your existing experience relevant, how to demonstrate your abilities, how to approach applications, and how to stand out without pretending to be something you're not. Because here's the reality: you don't need to convince an employer that you know everything. You need to convince them that you're someone worth investing in. I'm Steve, and this is Hacking Your Cyber Career. Let's get into it. Here's the first thing I want you to understand. When you're applying for a job, you're naturally thinking about yourself, your qualifications, your experience, your ambitions, your need for somebody to give you an opportunity. And that's perfectly understandable. But the hiring manager is thinking about something rather different. They have a problem. Perhaps their security operations team is overwhelmed with alerts. Perhaps they need help managing vulnerabilities. Perhaps the organization is expanding its identity and access management program. Or perhaps they simply have more work than their existing team can reasonably handle. Whatever the reason, they're recruiting because they need something accomplished. They're not recruiting because they woke up that morning and thought, wouldn't it be lovely to give a complete stranger their first opportunity in cybersecurity? Although, admittedly, that would make recruitment rather easier. So, if you want to stand out, start thinking about what the employer needs. Look at the job description, not just the qualifications. Look at the responsibilities. What problems is this person expected to solve? What activities will they be doing? What would success look like? Then ask yourself, what evidence can I provide that I'm capable of learning to do those things? That's a much more useful question than simply asking whether you meet every requirement. Because it changes the conversation. Instead of saying, I don't have three years of experience, you're saying, here's what I understand about the work, here's what I've already done that's relevant, and here's how I would approach learning the rest. And from a hiring manager's perspective, that's considerably more interesting. Now, I'm not suggesting you should ignore genuine requirements. Some roles require specific qualifications, clearances, or substantial practical expertise. And there are jobs where putting a completely inexperienced person in charge would be a spectacularly bad idea. But for appropriate junior positions, demonstrating potential can be extremely valuable. When I was hiring for a junior role, I knew I was hiring someone early in their career. I wasn't expecting 20 years of experience. I was looking for evidence of interest. Perhaps they'd chosen a relevant subject at university. Perhaps they'd taken a course or completed a placement. Perhaps they'd developed an interest in networking, infrastructure, or another area closely connected to cybersecurity. Something that suggested they were genuinely curious about the discipline. It didn't need to be extraordinary, it just needed to give me a reason to think they might be worth meeting. And that distinction matters. You don't have to be the most qualified candidate in the world. You have to demonstrate why you're a credible candidate for the particular opportunity. Now, here's something I want you to consider. When people say they have no experience, what do they actually mean? Usually they mean they haven't held a job with cybersecurity and the title. And those are not necessarily the same thing. Perhaps you've worked on a help desk, you've supported users, you've troubleshot problems, you've managed accounts, you've dealt with systems that aren't working properly. You've probably also learned how to remain reasonably polite when someone tells you their computer has stopped working only to discover they've unplugged it. That's valuable experience, especially the remaining polite part. Perhaps you've worked in retail or hospitality, you've dealt with difficult customers, you've handled pressure, you've worked in a team, you've learned to communicate clearly and solve problems. Those skills are transferable. Perhaps you've completed a university project, you've had to research something unfamiliar, organize your work, meet a deadline, and explain the result. Again, useful. Or perhaps you've been learning independently, building a home lab, exploring operating systems, studying networking, working through cybersecurity exercises. All of those things can help demonstrate interest and capability. But here's where I want to introduce a word of caution. Don't exaggerate what you've done. Please. I've interviewed candidates whose CVs suggested they personally designed, implemented, and transformed entire technology environments. Quite extraordinary achievements, particularly for someone who'd only recently left university. Then you start asking questions. What was your actual role? What did you design? What decisions did you make? What problems did you solve? And suddenly the story changes. It turns out they were one member of a much larger project. Perhaps they attended some meetings. Perhaps they completed a small piece of work. And there's absolutely nothing wrong with that. That's how people learn. But don't describe a supporting role as though you personally led the entire initiative. Because when the hiring manager starts asking questions, the gaps become obvious. And once I start doubting whether someone is being honest, the interview becomes considerably less interesting. Not in a good way. So describe your experience accurately. If you helped configure something, say you helped configure it. If you observed a project, say you observed it. If you built a home lab, explain what you actually built. What did you learn? What went wrong? What did you have to troubleshoot? And what would you do differently next time? That's a much more convincing conversation than claiming to have single-handedly revolutionized cybersecurity. At 21, between lectures, and a part-time job at Tesco. Welcome to From the Hiring Desk. And today I want to explain something that might surprise you. The most experienced candidate doesn't always get the job. Now, experience matters, of course it does, but years of experience tell you how long someone has been doing something. They don't necessarily tell you how well they've been doing it, and they certainly don't tell you everything about how that person will perform in your organization. I've interviewed people with impressive employment histories. Plenty of years in the industry, lots of technologies listed, lots of qualifications. But when you start talking to them, you discover other things. Perhaps they struggle to explain what they've done. Perhaps they can't articulate why they made particular decisions. Perhaps they don't seem especially interested in learning anything new. Or perhaps they simply don't demonstrate much initiative. Now, compare that with someone who's earlier in their career. They don't have the same depth of experience. They haven't worked with every technology, but they're engaged, they're curious, they ask good questions, they can explain what they've learned, they're honest about what they don't know, and they demonstrate a genuine willingness to take responsibility. Which candidate would I prefer? Well, for an appropriate junior position, I'd often lean toward the second. Because I can teach technology, I can teach processes, I can help someone develop technical expertise. And frankly, in cybersecurity, we're going to have to keep teaching and learning anyway. The technology changes, the threats change, the business changes. So continuous learning isn't an optional extra, it's part of the job. But some of the personal qualities that make someone valuable are much harder to develop. Curiosity, initiative, integrity, communication, a willingness to challenge themselves, the ability to work with other people. Those things matter enormously. Now, that doesn't mean I expect every candidate to be an extrovert. Absolutely not. Some of the best technical professionals I've worked with have been quiet, thoughtful people. But I do want to see engagement. I want to see that someone cares about what they're doing. And I want to believe that if I invest time and money in developing them, they're going to make the most of that opportunity. That's what taking a chance on someone really means. It's not charity, it's an investment. And your job as a candidate is to demonstrate why that investment makes sense. Let's talk about your CV, or resume, if you're listening in America. Same basic idea, different spelling. And apparently we've decided the word needs little accents to make it look more sophisticated. Now I've reviewed an enormous number of CVs over the years, and one of the most common problems is that people put far too much information into them. Pages and pages, every technology they've ever encountered, every course they've ever taken, every responsibility they've ever had. Sometimes I feel as though I'm reading the director's cut of someone's entire life, and I haven't even met them yet. My preference is to keep things concise. For an early career candidate, something in the region of two or three pages can work well, provided the content genuinely earns its place. But don't treat that as a universal rule. Different countries and employers have different expectations, and if you can present your experience effectively in one page, that's absolutely fine too. The objective isn't to reach a particular page count, it's to make the relevant information easy to find. Now, if you're early in your career, you may not have much employment history. That's expected, so don't try to compensate by filling your CV with nonsense. Instead, think about what else demonstrates your character and potential. Education, work placements, projects, volunteering, part-time employment, activities that required commitment, leadership roles in clubs or organizations, perhaps something you've done that shows independence or a willingness to take on a challenge. I'm interested in those things, because if you don't have much professional experience, I'm trying to understand who you are. Are you curious? Do you take initiative? Are you willing to put yourself in unfamiliar situations? Do you follow through? What motivates you? Those qualities can come through in experiences that aren't directly related to cybersecurity, but make sure they're relevant to the story you're telling. You don't need to list every hobby you've ever had, and please don't tell me you're passionate about cybersecurity if the rest of your CV contains absolutely no evidence of that interest. Show me. Now, there's another reality of recruitment. Your CV may not go directly to the hiring manager. It might first be reviewed by a recruiter or an HR professional or an automated screening system, and those systems and people may be looking for particular qualifications, skills, or keywords. So read the job description. Use the terminology that genuinely reflects your experience. If you've studied networking, say so. If you've worked with Windows or Linux, explain what you've done. If you've completed an internship, describe the responsibilities and results. But don't stuff your CV with keywords for technologies you've never used. That might get you through an initial screening, but it won't help when somebody asks you to explain them. And one final point make your CV easy to read. Clear headings, logical sections, concise descriptions, and proofread it. Then proofread it again. Because if you're applying for a role that requires attention to detail, a CV full of careless mistakes isn't the strongest opening argument. Now, let's talk about job applications. Because there's a temptation to treat the process as a numbers game. Find every cybersecurity vacancy, upload the same CV, click apply, repeat. 200 applications later, you're wondering why nobody has responded. Now, sometimes you do need to apply for a lot of jobs, especially in a competitive market. But I think there's a better approach than simply applying for everything. Be selective. Look for roles where you have a credible connection to the responsibilities. Perhaps it's a junior security analyst position. Perhaps it's an internship. Perhaps it's a technical support role in an organization with a cybersecurity team. Perhaps it's a networking or infrastructure role that could eventually lead towards security. And don't underestimate that last option. If you're struggling to get directly into cybersecurity, look at adjacent opportunities. Help desk, networking, infrastructure, cloud support, identity administration. Those roles can give you practical knowledge that's valuable in cybersecurity. And once you're working inside an organization, you may have opportunities to move horizontally, to take on projects, to meet the security team, to demonstrate your interest and to build a reputation. I've seen that happen, and it's a perfectly legitimate way to develop a cybersecurity career. Now, another important part of the job search is relationships. And yes, I'm going to use the word networking. I know. It's one of those pieces of career advice everybody gives. Network, build your personal brand, connect with people, and apparently spend half your life posting inspirational observations on LinkedIn. But professional relationships really can make a difference. Because when I'm hiring someone I don't know, there's uncertainty. I have their CV, I have an interview, but neither tells me everything about what they're like to work with. A trusted referral can help. If somebody I know and respect says, I've worked with this person, they're reliable, they're eager to learn, they're excellent with people, that gives me useful information. It doesn't guarantee them the job, they still need to demonstrate they're suitable, but it can help get them noticed. And sometimes it can help them hear about opportunities before they're widely advertised. So if you know somebody who works in technology or cybersecurity, talk to them. Ask for advice. Ask what their organization looks for. Ask whether they know of internships or junior opportunities. And if they genuinely know you and can speak to your qualities, ask whether they'd be comfortable referring you. You don't need a family member who's a chief executive, a friend, a former colleague, a lecturer, an internship supervisor, someone you've worked with who can genuinely speak about your abilities. Those relationships can be valuable. And if you don't know anybody yet, start building connections. Attend local events, join professional communities, talk to people at university, ask thoughtful questions. Don't approach every conversation as though you're trying to extract a job offer. Build genuine relationships. Because people are generally more willing to help someone who shows genuine interest than someone who appears only when they need a favor. Now, let's talk about what happens when you finally get an interview. And I'll give you one piece of advice that I learned the hard way. Research the company properly. Not just five minutes looking at the homepage. Understand what the business actually does. What products or services does it provide? Who are its customers? What industry does it operate in? What might its cybersecurity risks look like? Why would it need the role you're applying for? Because those things matter, and I know that from personal experience. Early in my career, I went for an interview. I was technically capable, I was enthusiastic, and, if I'm being fair to my younger self, perhaps just a little bit cocky. I thought my technical abilities would be enough, so I didn't spend nearly enough time researching the company. And then they asked me a perfectly reasonable question. What do you know about our business? Ah, well, that's awkward. I had a general idea, or at least I thought I did, so I started answering, and fairly quickly I realized I wasn't doing particularly well. You know that moment when you're speaking and you can see from the other person's expression that things aren't going quite as planned? Yes, one of those. I tried to recover, but I hadn't done the preparation, and I didn't get the job. Looking back, it was probably the only job interview I've had where I wasn't successful. And I think the reason was simple. I'd been lazy. I'd assumed that knowing the technology was enough, but the employer wanted somebody who had taken the time to understand their business. And that's a lesson I've remembered ever since. So before your interview, do your homework. Read the company's website. Look at what it actually does. If it's a public company, look at its annual report. Understand its industry. Think about the risks it might face. A hospital has different priorities from a manufacturing company. A bank has different concerns from an engineering business. A company building offshore oil and gas platforms has some rather different operational risks from an online retailer. Cybersecurity doesn't exist in isolation. It's there to support and protect the business. And demonstrating that you understand the business can make a real difference. Now, here's another thing. Don't panic if you don't know the answer to a technical question, especially if you're applying for a junior role. I'd much rather hear somebody say, I haven't worked with that technology yet, but here's how I'd approach learning it, than listen to them invent an answer. Be honest. Explain your thinking. Ask clarifying questions. Show curiosity. And remember that an interview is a conversation. You're evaluating the employer too. Ask what training is available. Ask how junior employees are supported. Ask what success looks like in the first six months. Ask about opportunities to develop. Because your first job should ideally give you more than a salary. It should help you build the foundation for the next stage of your career. Right, time for your next move. And this week I want you to do something practical. Not another certification, not another 10 hours watching somebody else explain cybersecurity. I want you to take seven days and improve your chances of getting hired. Day one, choose three realistic opportunities. They might be junior cybersecurity roles, internships, or adjacent IT positions that could provide a route into cybersecurity. Read the responsibilities carefully. Identify what the employer actually needs. Day two, review your CV. Make it concise, make it relevant, remove the exaggeration, and look for opportunities to demonstrate your character, initiative, and willingness to learn. Day three. Perhaps a university project, a home lab, a customer service experience, a technical problem you solved, or something you learned independently. Write down what you actually did, what you learned, and why it might matter to an employer. Day four. Research one of the organizations you're interested in. Understand its business, its industry, its customers, and the kinds of cybersecurity challenges it might face. Don't repeat my early career mistake. Day five. Make one professional connection. Reach out to somebody you know, a former lecturer, a colleague, an internship supervisor, or someone working in an area that interests you. Ask for advice. Not necessarily a job, just start a conversation. Day six, prepare for an interview. Practice explaining why you're interested in cybersecurity, what you've learned, what you can contribute, and how you'd approach something you don't yet know. And day seven, apply. Not to 50 random positions. Apply thoughtfully to opportunities that genuinely fit your current capabilities and potential. And then keep going. Because finding your first job can take time. There will be rejections, there will be applications that disappear into the void, and there may be interviews that don't go particularly well. I've had one of those myself. But don't let that convince you that you're not good enough. Learn from the experience. Improve your approach and keep moving. Now, if I were 21 today, my first preference would be an internship, because internships offer something particularly valuable. You get to experience the organization, and the organization gets to experience you. Both sides learn whether it's a good fit. And that can remove a lot of uncertainty when it comes to hiring. If an internship isn't available, I'd look for referrals and personal connections. And if direct cybersecurity opportunities weren't working out, I'd consider entering through another IT role and building toward a move into security. There's nothing wrong with taking a different route. The objective is to build a career, not to win a competition for the most impressive first job title. And here's the most important thing I want you to remember. Experience is valuable, but experience alone doesn't guarantee competence. A person with 10 years in a role isn't automatically better than someone with two. And someone with no direct cybersecurity experience isn't automatically incapable of becoming an excellent cybersecurity professional. What matters is what you know, what you can demonstrate, how you approach problems, how you communicate, and whether you're willing to keep learning. So don't pretend to have experience you haven't earned. Don't exaggerate your achievements. And don't assume that your first opportunity has to be your dream job. Be honest. Be curious. Take initiative and give employers a reason to believe in you. Next time, we're going to look at what actually happens behind the interview door. The questions hiring managers ask, what they're really trying to discover, the mistakes candidates make, and how to prepare for an interview without sounding as though you've memorized the entire internet. Which, incidentally, is not nearly as impressive as some people seem to think. I'm Steve. Thanks for listening to Hacking Your Cyber Career. And remember, getting in is just the beginning.