So You Want to Work in Cybersecurity?

Episode transcript

Transcript provided for accessibility and search. Minor transcription errors may remain.

SPEAKER_00 0:08

Thinking about a career in cybersecurity? Trying to land your first job? Or wondering how to turn your interest in technology into a career that actually goes somewhere? Welcome to Hacking Your Cyber Career. Real advice, real experience. Your next move. Here's Steve.

SPEAKER_01 0:27

So, you want to work in cybersecurity? Excellent! Welcome to an industry where the technology changes constantly, the threats never stop, and apparently every entry-level job requires five years of experience. Quite how you're supposed to get five years of experience before getting your first job is something nobody seems particularly keen to explain, but we'll get to that. If you're listening, perhaps you're at university, studying computer science or cybersecurity. Maybe you've recently graduated, or perhaps you're working in IT and wondering whether cyber might be your next move. Whatever brought you here, welcome. I'm Steve, and this is Hacking Your Cyber Career. This podcast is about helping you get into cybersecurity, understand how the industry really works, and build a successful career once you're there. Not just landing that first job, actually building a career. I've spent more than 30 years in IT, much of that leading cybersecurity organizations. I've been a chief information security officer, hired people, built teams, developed careers, and occasionally made a complete mess of things. I won't tell you that success means getting up at 4 in the morning. I've never considered that a particularly attractive career strategy. Instead, I'll share what worked, what didn't, and what I wish someone had told me. I didn't start in cybersecurity. I started on a help desk, answering calls, fixing printers, installing software, and trying to work out why someone's floppy disk wouldn't work. Decades later, I was responsible for cybersecurity in a global organization facing threats including nation-state actors. Not exactly a career path I'd mapped out at 18. You don't need to know exactly where you're going, but you do need to keep moving. I grew up in Britain, and my career started in the Midlands of England. I studied computer engineering, covering circuit boards, programming, mathematics, project management, and communication. The programme included aptitude testing and work placements. That last part was incredibly valuable. Understanding something in a classroom is one thing. Seeing how it behaves in the real world, particularly when people get involved, is quite another. I joined an engineering company in the automotive industry straight out of college. We had PCs, Novell Netware, IBM mid-range systems, digital computing environments, Lotus 123, WordPerfect, and floppy disks. For younger listeners, floppy disks were little plastic squares holding an astonishing amount of information, assuming your definition of astonishing is about 1 MB. My early days involved answering help desk calls, installing software, fixing printers, and helping people whose computers wouldn't cooperate. Not glamorous. It's difficult to look heroic while replacing toner. But it taught me how systems worked, how networks communicated, and how businesses actually used technology. More importantly, it taught me how to work with frustrated people. That skill comes in handy when you're explaining cybersecurity risks to executives. Even then, we encountered computer viruses spreading through disks and shared software. There wasn't a dashboard with 17 threat intelligence feeds and a beautiful risk score. You discovered a problem when something stopped working and you had to investigate. I wasn't in a dedicated cybersecurity role, but I was already learning security. That's my point. You don't necessarily have to start in a job with cybersecurity in its title. Networking, support, development, and systems administration can all provide excellent foundations. Sometimes the best way into a profession is to understand how everything works first. One thing I'm particularly grateful for is that my first employer strongly encouraged continuing education. Supportive might be understating it. They were pretty pushy. And thank goodness. Technology was changing rapidly, so I studied Microsoft, Novelle, Cisco, and other technologies. Lots of certifications, exams, and evenings discovering that a system was rather harder to configure than the textbook suggested. But I don't want you to confuse learning with collecting certificates. Degrees, certifications, and courses are useful when they help you develop skills you can actually apply. The most important thing I developed was a habit of learning. After seven or eight years, I moved to AT ⁇ T in IT outsourcing. For another seven years, I worked across Europe with larger networks, different customers, new operating systems, firewalls, and increasingly complex environments. Every time you mastered something, someone released a new version. Usually with a completely different interface and the one useful setting hidden somewhere absurd. I discovered that learning a new technology early could make you valuable. You became the person people approached when they wanted to understand it. I loved that. Partly because it was interesting, partly because it opened doors, and partly because, if we're being fair, it was a rather enjoyable ego trip. But there is a practical lesson. Don't only learn what today's job requires. Look at what is coming next. Today that might be artificial intelligence, cloud security, identity, automation, or autonomous systems. The tools will change, but curiosity and continuous learning will serve you throughout your career. While I was working for AT ⁇ T, I was offered a temporary assignment in Dubai. Two months, they said. Go over, support a customer, and come home. Well, that didn't quite happen. The two-month assignment turned into seven years. Somewhere along the way, I changed employers, moving from the supplier to the customer, McDermott, an international engineering and construction company building offshore oil and gas platforms. Suddenly I had responsibility for international infrastructure, networks, compute, storage, modernization, and increasingly cybersecurity. I worked across the Middle East and Asia, supporting and transforming complex technology environments. And I loved it. Interesting work, different countries, different cultures, and I must admit, the business class flights weren't an entirely unpleasant benefit. I was prepared to suffer through that hardship. The lesson here is opportunity. None of this was in a carefully prepared career plan. I didn't have a spreadsheet showing when I'd move to Dubai and eventually America. Someone offered an opportunity and I took it. That doesn't mean you should accept every overseas assignment without thinking. Family, finances, and personal circumstances matter, but don't underestimate the power of stepping outside what's familiar. A project outside your job description, a chance to work with another team, or an unfamiliar technology could become a turning point. Not every opportunity works out, but new experiences bring new people, problems, and possibilities. In my case, two months became seven years, which suggests the original planning department may have been slightly optimistic. After about seven years in Dubai, I relocated to McDermott's headquarters in Houston, Texas. I continued growing my responsibilities across infrastructure, networks, operations, and security. Cybersecurity itself was changing. Early in my career, security often meant antivirus, firewalls, access controls, and a few policies. Over time, threats became more sophisticated, organizations became more connected, and the consequences of failure grew. Cybersecurity became a specialized discipline, and, crucially, a business risk. Protecting an organization isn't simply installing tools. It's understanding what the business does, what it depends upon, what could go wrong, and which risks it can accept. In international oil and gas construction, those risks were fascinating. We dealt not only with financially motivated attacks, but also threats associated with nation-state actors. Some adversaries weren't even interested in us directly. They were interested in our customers and potentially using us as a way in. That's rather different from worrying about someone's antivirus definitions. It means thinking about sophisticated adversaries, sensitive information, international operations, and business continuity. As the field matured, my responsibilities evolved, and I became what I'd describe as a true CISO. I'm not telling you this because everyone should want to become a CISO. There are wonderful technical careers that don't involve executive management, and some days a deeply technical job sounds considerably more attractive than another executive budget meeting. The point is that I started by answering help desk calls, kept learning, took opportunities, and gradually earned larger responsibilities. Your destination might be entirely different, and that's absolutely fine. Let's talk about getting hired. After years of recruiting and developing people, one of the first things I look for in someone early in their career is personality. Not that technical skills don't matter, they do, but I'm looking for curiosity, enthusiasm, communication, a willingness to learn and the ability to work with other people. I can teach someone a technology or process. It's harder to teach them to care, take responsibility, or treat colleagues well. And when I say cultural fit, I don't mean hiring people who all look and think alike. That would be a terrible team. Different backgrounds and perspectives make teams stronger. I mean an attitude of contribution, respect, and openness to feedback. Can you ask for help? Can you admit when you're wrong? Because one of the more dangerous people in cybersecurity is someone absolutely convinced they're right without having understood the problem. Confidence is useful, but arrogance rather less so. Imagine two junior applicants. One has an impressive list of certificates but can't explain what they've done. The other has fewer qualifications, but talks enthusiastically about a project, the problems they encountered, and what they learned. I'm going to be very interested in the second candidate. That doesn't guarantee a job, but it tells me how they think. So don't just tell an interviewer you're passionate about cybersecurity. Show them. Explain a lab you built, a problem you investigated, or a project that failed and what you changed. You don't have to pretend everything was a spectacular success. In cybersecurity, things rarely go perfectly. If they did, we'd all have considerably quieter jobs. If I were 21 today, knowing what I know now, how would I start? I still believe strongly in education. If university is realistic, I'd seriously consider it, but I'd look for a course that combines academic learning with internships, work placements, and real projects. My computer engineering education gave me a broad foundation, and practical experience showed me how technology works in business. University isn't the only route, of course. Apprenticeships, military experience, career changes, and independent study can all work, and taking on huge debts deserves careful thought. Whatever your route, learn the fundamentals. Networking, operating systems, scripting, identity, applications, and how organizations use technology. Cybersecurity isn't separate from IT. You're protecting real systems and business processes. Then get hands-on experience. Join a student cyber club, build a home lab, participate in a competition, get an internship, or take a part-time support job. And don't be afraid to start at the bottom. My help desk experience was enormously useful. But don't get comfortable doing the same thing forever. One mistake I made was staying with one company too long and becoming emotionally attached to everything we'd built. I sometimes struggled to delegate because I didn't trust others to manage things the way I would, which isn't a particularly brilliant leadership strategy. You can become a bottleneck while convincing yourself you're indispensable. Learn, contribute, build relationships, but don't confuse loyalty with standing still. And don't obsess about a perfect career path. You may start interested in penetration testing and discover you love architecture or risk. Technology and your interests will change. Keep learning, work well with people, take opportunities and allow your career to evolve. Before we finish, I want to introduce something we'll do at the end of every episode. Your next move. I don't want you to listen to 20 minutes of advice and then forget it all. I want you to take one practical step. For this first episode, find three cybersecurity roles that genuinely interest you. They don't need to be jobs you're qualified for today, perhaps one in security operations, one in engineering, and one in governance or risk. Read real job descriptions. Find out what people actually do, which skills they use, and what qualifications employers request. Then make three lists things you already know, things you need to learn, and things you can start doing now to build experience. You don't need to spend money or sign up for another certification, and you certainly don't need to announce on LinkedIn that you're beginning an exciting transformational journey. Please don't. Just understand your options and take one sensible step. I started on a help desk dealing with floppy disks, printers, and everyday problems. I didn't have a grand plan to become a CISO. I kept learning, took opportunities, made mistakes, and developed new skills. Your career won't look like mine, and it shouldn't, but the fundamentals remain. Stay curious, keep learning, treat people well, and take opportunities. Next time, we'll tackle the experience trap. How do you get your first cybersecurity job when employers seem to want people who already have one? I'm Steve. Thanks for listening to Hacking Your Cyber Career. And remember, getting in is just the beginning of the MUSE.