Do You Really Need a Degree?

Episode transcript

Transcript provided for accessibility and search. Minor transcription errors may remain.

SPEAKER_00 0:14

Do you need a university degree to work in cybersecurity? Or can certifications, practical experience, and a willingness to learn get you just as far? Welcome to Hackin' Your Cyber Career. Real advice, real experience. Your next move. Here's Steve.

SPEAKER_01 0:34

So, do you really need a degree to work in cybersecurity? Well, depending on who you ask, the answer is either absolutely yes, absolutely not, or something involving a six-week online boot camp and a rather suspicious promise of a six-figure salary. Welcome to the wonderful world of cybersecurity career advice, where everybody has an opinion, and quite a few people are trying to sell you something. If you're at school, perhaps getting ready to go to university, you've probably been told that a degree is essential if you want a successful professional career. Then you go online, and somebody with an expensive microphone and an impressive collection of LED lights tells you that university is a complete waste of time. Apparently, all you need is a laptop, three certifications, a home lab, and a willingness to hustle. Whatever that means. Meanwhile, university tuition isn't exactly getting cheaper. Certifications aren't free, and you're left trying to make a decision that could affect the next several years of your life. So who's right? Well, here's my answer. It depends. I know, not particularly satisfying, but it's a much more useful answer than pretending there's one perfect route into cybersecurity. Because there isn't. I'm Steve, and this is Hacking Your Cyber Career. I've spent more than 30 years working in IT, including many years leading cybersecurity organizations. I've hired people with degrees, I've hired people without degrees. I've worked with professionals who had an extraordinary collection of certifications, and I've worked with people whose formal qualifications were rather modest, but whose practical abilities were exceptional. I've also spent an enormous amount of my own career studying. University, Microsoft certifications, Novell, Cisco, Security Certifications, Management and Leadership Development, and plenty of learning that didn't come with a certificate at the end. So I have some fairly strong opinions about education, but they're not quite what you might expect. Today we're going to look at what a degree actually gives you, what certifications are worth, how people succeed without university, and how to make sensible decisions about investing in your education. And I'll tell you about someone I hired into cybersecurity whose previous job was in the mailroom. Yes, the mailroom. No cybersecurity degree, no grand technical career history, just a set of personal qualities that made me think they could be very good at the job. We'll get to that. But first, let's talk about what university actually taught me, because it was considerably more than how to program a computer. I started my career in Britain. I studied computer engineering in the Midlands of England. It was a fairly broad program. We covered software development, electronics, circuit board design, mathematics, project management, communication, and a range of other subjects. There was aptitude testing to get into the program, and importantly, there were work placements. So we weren't simply sitting in classrooms learning theory, we were getting opportunities to apply that knowledge in actual businesses. Which is where you discover that technology doesn't always behave quite as elegantly as the lecturer suggested, and that users have an extraordinary ability to do things nobody anticipated. Now, looking back, did I use everything I learned? No, of course not. I haven't spent every day of my career designing circuit boards, and I certainly haven't found much demand for some of the mathematics I struggled through at university. Although I suppose there's still time. But that's not really the point. The value of my education wasn't simply the collection of technical facts I learned. It was learning how to learn. And I know that sounds like one of those phrases people put on inspirational posters, but bear with me. When you start studying something difficult, you don't understand it. That's rather the point. You're confused, you make mistakes, you read something three times and still wonder what on earth the author is talking about. Then you try it, you fail, you try again, and gradually something starts to make sense. University gave me repeated experience of going through that process, of being uncomfortable, of not knowing the answer, of having to work something out, and eventually developing confidence that I could learn something new. That's incredibly valuable in technology. Because if you're planning to work in cybersecurity, I can make you one promise. You will spend a significant portion of your career not knowing what you're doing. Not because you're incompetent, but because the technology keeps changing. New systems, new threats, new architectures, new tools, and new ways for people to do something spectacularly foolish with perfectly good technology. If you need to feel completely comfortable and knowledgeable all the time, cybersecurity might be a rather frustrating career choice. The ability to be uncomfortable while learning something new is a genuine professional skill, and my education helped me develop it. It also taught me independence. You couldn't simply wait for someone to tell you exactly what to do. You had assignments, projects, deadlines, problems to solve. You had to organize yourself, take responsibility, and get on with it. That mindset followed me throughout my career. Don't wait for somebody to drive your development. Don't sit there hoping your manager will eventually notice that you might benefit from learning something. Take the initiative. Ask questions, find opportunities, work out what you need to know and start learning it. Now, university isn't the only place you can develop those habits. Absolutely not. But for me, it was a valuable environment in which to develop them. And I think that matters much more than whether I can still remember every formula from my engineering classes, which, for the record, I most certainly cannot. Let's look at this from the employer's perspective. You're recruiting someone for an early career cybersecurity position. They've recently graduated, they don't have much practical experience. So what does their degree tell you? Well, first, it suggests they have a genuine interest in a particular field. They've chosen to spend several years studying it. Second, it demonstrates some ability to commit to something, to turn up, complete assignments, meet deadlines, and work toward a longer-term goal. Third, it suggests they're willing to invest in their future without knowing exactly how everything will turn out. And that's something I respect, because choosing a degree is a bit of a gamble. You're investing time, often a considerable amount of money, and hoping that what you learn will help you build the career you want. Of course, none of those things guarantees someone will be a good employee. A degree doesn't automatically make someone curious, it doesn't make them honest, it doesn't mean they can communicate effectively, and it certainly doesn't guarantee that they know how to apply what they've learned. But it can provide useful evidence, particularly when the employer doesn't know anything else about the candidate. Now, here's the important part. Those same qualities can be demonstrated in other ways. Someone who started working straight after school, developed expertise, took responsibility, and continued educating themselves has also demonstrated commitment. Someone who completed an apprenticeship has demonstrated the ability to learn and work. Someone who started on a help desk and progressively took on more difficult responsibilities has demonstrated growth. And someone who has been studying independently, completing practical projects and building relevant skills may have a compelling story to tell. The route is different, but the qualities we're looking for can be very similar. And this is where I think people sometimes get the degree debate wrong. They treat it as a competition. Degree versus no degree, university versus certifications, academic learning versus practical experience. As if you have to pick a side. You don't. Education and experience complement each other, and the strongest candidates often have a combination of both. That combination doesn't necessarily have to include a traditional four-year university degree, but it should include evidence that you can learn, apply knowledge, and keep developing. So if you already have a degree, great! Make the most of it. If you're working toward one, look for ways to gain practical experience alongside it. And if you don't have a degree, don't assume the door is closed. You may simply need to demonstrate those qualities through a different route. Which brings me to a hiring experience I've never forgotten. Welcome to From the Hiring Desk. This is where I share some of the things I've learned from years of recruiting and developing people. And today I want to tell you about someone I hired into cybersecurity. Their previous job was in the mailroom. Now, I want you to think about that for a moment. Imagine you're looking at a cybersecurity job description. You're reading about security analysis, systems, controls, threats, and technical skills, and you're thinking that your background isn't good enough. Perhaps you've been working in retail, or administration, or customer service, or doing something else that doesn't seem remotely connected to cybersecurity. Well, this person was working in the mailroom, and I saw qualities in them that I believed could make them a good cybersecurity analyst. They were dedicated, diligent, focused. They took their responsibilities seriously, and they demonstrated those qualities consistently. Now, none of that meant they already knew how to analyze a security incident. They didn't suddenly become a cybersecurity expert because I thought they had potential. They needed education, they needed coaching, they needed time, and they needed the opportunity to develop the relevant domain knowledge. But the underlying personal qualities were already there, and those qualities are valuable. Think about what makes a good analyst. Someone who pays attention, someone who's methodical, someone who follows through, someone who doesn't simply shrug when something looks unusual, someone who's willing to investigate, someone who takes responsibility for doing the job properly. You can teach someone how to use a security tool, you can teach processes, you can teach technical concepts, but those underlying habits and attitudes are much harder to develop if someone has no interest in them. So I was prepared to invest in the technical development because I had confidence in the person. Now, there's an important detail here. I knew their work. They had already demonstrated their value within the organization. That gave them an advantage, and it's something worth understanding. If you're already working for a company, even in a role that has nothing to do with cybersecurity, you may have an opportunity that an external candidate doesn't. People can see how you work. They know whether you're reliable, they know how you communicate, they know whether you take responsibility, and they may be willing to help you move into a new discipline because you've already earned their trust. That's one reason internal career moves can be so valuable. You don't always have to leave your employer to change your career. Sometimes the opportunity is in another department. But you have to make your interest known. Talk to people, ask questions, look for projects, find out what skills you'd need, and demonstrate that you're prepared to put in the effort. Now, I don't want to suggest that every employer will happily move someone from the mailroom into cybersecurity. Some organizations are more flexible than others, and not every team has the resources to train someone from the beginning. But the example illustrates something I firmly believe. Potential matters. Attitude matters, and a person's current job title doesn't necessarily tell you what they're capable of becoming. So if you're listening to this and you're worried that your background isn't impressive enough, remember that. Don't underestimate the value of the qualities you've already developed. Your job is to demonstrate them, and then build the knowledge that allows you to apply them in cybersecurity. Now, let's talk about certifications. Because cybersecurity does love a certification. And I say that as someone who spent a considerable amount of his career earning them. Microsoft, Novelle, Cisco, Security Certifications, and plenty of other professional development along the way. So you'd probably expect me to be a huge advocate. And I am, mostly. I have something of a love-hate relationship with certifications. On the positive side, they can be extremely valuable. They provide structured learning, they help you develop knowledge in a particular area, they can demonstrate that you've met an established standard, and in some roles, certain certifications are genuinely required. They can also help you move into a new discipline. For example, if you've been working in networking and want to move toward network security, a relevant security certification might help bridge that gap. It gives you a framework for learning, and it gives an employer some evidence of your interest and knowledge. That's all good. But here's where I become slightly less enthusiastic. I've seen candidates with an extraordinary number of certifications. Pages of them. An impressive collection of acronyms. Enough letters after their names to make you wonder whether there's any room left on the business card. And sometimes, when you start asking questions, the depth of understanding isn't quite what the qualifications suggest. Because there's a difference between studying to pass an exam and studying to understand a subject. A very big difference. If your entire learning strategy is memorizing enough information to answer multiple choice questions, you may pass the test. Congratulations! But what happens when you're sitting in front of a real problem that doesn't have four conveniently labelled answers? What happens when the answer isn't A, B, C, or D? What happens when the system behaves in a way that wasn't covered in the study guide? That's when actual understanding matters. And that's what I'd encourage you to develop. Use certifications as a way to learn, not simply as trophies. Ask yourself why you're pursuing one. Does it help you qualify for a role? Does it develop knowledge you genuinely need? Does it support a career move? Will it help you become better at the work you're doing? If the answer is yes, fantastic! If the answer is simply that someone on LinkedIn has it and you'd quite like another badge, perhaps reconsider. Because certifications cost money. They take time. And that time could be spent building practical experience or developing deeper expertise. I'm not against having multiple certifications, not at all, but I am against collecting them without purpose. And here's another thing. The right certification changes as your career develops. Early on, you might need to establish your understanding of networking, operating systems, and basic security concepts. Later, you might specialize in cloud security, identity, architecture, or another discipline. And eventually, if you move into management, your development needs may become less about technical configuration and more about governance, leadership, risk, communication, and business strategy. Education should follow your career, not the other way around. Now I want to address something important. University can be expensive, and for some people it simply isn't a realistic option. Perhaps your family can't afford it. Perhaps you need to start earning money. Perhaps you have responsibilities that make full-time study difficult. Or perhaps university just isn't the right environment for you. None of those things should automatically rule out a cybersecurity career. There are other routes, and some can be very effective. One option is an apprenticeship. Depending on where you live, there may be programs that combine paid employment with structured education. That's a powerful combination. You're learning, you're gaining experience, and you're earning money. Not a bad arrangement. Another option is to start in an entry-level technology role, technical support, help desk, junior systems administration, networking support, or another position where you can develop practical IT skills. And I pay particular attention to employers that support continuing education. That was enormously valuable in my own career. My early employer encouraged me to keep learning and supported professional development. It helped me develop expertise that opened doors later. So when you're considering a job, don't look only at the salary. Ask what the company does to develop its people. Does it provide training? Does it support certifications? Are there opportunities to move between departments? Does it have internships or mentoring? Can employees grow into more specialized roles? Those things can be worth a great deal over time. Another route is lower cost education. Community colleges, technical colleges, online courses, industry training, self-directed learning. Some resources are free. Others are relatively inexpensive compared with a traditional university program. But be selective. There are excellent training providers, and there are also people selling expensive dreams. If someone promises that you'll complete a short course and walk straight into a highly paid cybersecurity job, I'd be cautious. Very cautious. Because cybersecurity isn't a profession where you can replace genuine understanding with a certificate and a confident smile. You need knowledge, you need practical ability, and you need to keep learning. Now, if you're taking a non-traditional route, there's one thing I'd encourage you to do. Document your progress. Build a portfolio of practical work. It doesn't have to be elaborate. A small home lab. A network configuration exercise. An authorized security training challenge. A project exploring identity and access controls. A short explanation of a security concept. What matters is being able to demonstrate what you've learned. And explain it. Because when you don't have a traditional qualification, you may need to work a little harder to get that first interview. That's a reality. But once you're in the room, practical evidence and a credible story can make a difference. And remember the mailroom example. Sometimes the best first step isn't getting directly into cybersecurity. It's getting into an organization where you can demonstrate your value, develop relationships, and work toward an internal opportunity. It might take longer than you'd like, but it's a genuine route, and there is absolutely nothing wrong with it. There's one question I was asked while preparing this episode. Has my attitude toward education changed as I've become more senior? And the answer is no, not really. I've always believed in continuous education, and I still do. What has changed is the type of education I've needed. Early in my career, I was focused heavily on technology. Networking, operating systems, infrastructure, new platforms, security devices. I wanted to understand how things worked, and I wanted to become good at them, really good. As my career progressed, the challenges changed. I was managing teams, running international operations, making investment decisions, working with executives, and eventually leading cybersecurity as a business discipline. At that point, technical expertise was still important, but it wasn't enough. I needed to understand leadership, strategy, governance, finance, risk, communication, organizational behavior, and how to influence decisions when the people making them didn't necessarily understand the technology, which, as you might imagine, creates some interesting conversations. You can be absolutely correct about a technical risk and still fail to persuade anyone to do anything about it. That's not necessarily a technology problem, it's a communication and leadership problem, and those skills have to be learned too. Sometimes through formal education, sometimes through coaching, sometimes by watching good leaders, and sometimes by making a rather spectacular mistake and deciding not to repeat it. But the underlying principle is exactly the same as when I was studying computer engineering. Keep learning. Get comfortable being uncomfortable. Don't wait for someone to tell you what you need to know, and keep looking ahead. Because one of the most important lessons of my career is that your value isn't simply what you know today, it's your ability to develop the knowledge and skills that will matter tomorrow. Think about how much technology has changed. When I started, we were dealing with floppy disks, early PC networks, and systems that would look positively prehistoric to many young professionals today. Then came increasingly sophisticated networking, the internet, cloud computing, mobile technology, and now artificial intelligence. Every generation of technology creates new opportunities and new problems. The people who succeed over the long term are often those who keep adapting. They don't assume that because they've mastered today's technology, their education is finished. They look at what's coming. They ask what new skills will be needed, and they start developing them. Now, that doesn't mean chasing every trend. You don't need to become an expert in every new technology announced at a conference. Goodness knows there are enough conferences announcing the future of everything. But you should remain curious. And you should regularly ask yourself a simple question. What am I learning now that will make me more valuable in three years? Not just next week, not just for the next exam, three years. Because that's how you start building a career rather than simply maintaining a job. Right, time for your next move. And this week, I'd like you to think carefully about your education. Not simply whether you should go to university, but what you actually need to learn to get where you want to go. Here's the exercise. First, identify a cybersecurity role that interests you. It might be security analyst, cloud security engineer, identity specialist, penetration tester, security architect, or something else entirely. Then look at several job descriptions for that role. Pay attention to the qualifications employers mention degrees, certifications, practical experience, technical skills, and communication or business skills. Now, divide what you find into three categories. Things you already know, things you need to learn, and things you need practical experience doing. Next, identify three possible ways to close those gaps. One formal education option, that might be a university course, community college program, apprenticeship, or structured training. One practical experience option, an internship, a project, a home lab, or a relevant opportunity in your current job. And one self-directed learning option, something you can begin studying without waiting for anyone's permission. Then compare them. What will each cost? How much time will it take? What will you actually learn? And how will you demonstrate that learning to an employer? Don't assume the most expensive option is automatically the best, and don't assume the cheapest option is automatically sufficient. Look for the combination that makes sense for your circumstances and career goals. Because the objective isn't to collect the greatest number of qualifications, it's to develop the knowledge, experience, and confidence to do the work. And if there's one thing I'd like you to remember from today's episode, it's this. A degree can be valuable. Certifications can be valuable. Practical experience is valuable, but none of them replaces the willingness to keep learning. I've seen people succeed through traditional education. I've seen people build excellent careers through alternative routes, and I've hired someone into cybersecurity from the mailroom because I believed they had the personal qualities to become a good analyst. Your starting point matters less than what you do with the opportunities available to you. So don't spend all your time worrying about whether you've followed the perfect route. There isn't one. Choose a sensible path. Keep developing. And don't be afraid to start somewhere that doesn't look particularly glamorous. After all, I started out fixing printers, and somehow that worked out reasonably well. Next time, we're going to explore another question that comes up constantly. Which cybersecurity job is actually right for you? Because cybersecurity isn't one job, it's an enormous collection of different disciplines, requiring different skills, personalities, and interests. And choosing the right direction can make an enormous difference to how much you enjoy your career. I'm Steve. Thanks for listening to Hacking Your Cyber Career. And remember, getting in is just the beginning.