Your First 90 Days in Cybersecurity — Don't Blow It

Episode transcript

Transcript provided for accessibility and search. Minor transcription errors may remain.

SPEAKER_00 0:02

Welcome to Hacking Your Cyber Career. Episode 7. Your first 90 days in cybersecurity. Don't blow it. You've landed the job. Now, how do you prove they made the right decision? Here's Steve.

SPEAKER_01 0:22

You've got the job. Brilliant! After all the applications, interviews, training courses, and moments of wondering whether professional dog walking might be a more sensible career, somebody has offered you a cybersecurity role. Congratulations! Now comes the slightly awkward bit. You actually have to do it. Welcome to Hacking Your Cyber Career. I'm Steve. Today we're talking about your first 90 days in cybersecurity and how not to blow them. I've spent years hiring and leading technology and security teams. Some of the most impressive people I've hired had relatively little direct cybersecurity experience. In fact, they sometimes understated what they could do. What they brought was curiosity, a willingness to learn, and a genuine excitement about getting involved. They couldn't wait to start. I love that energy. But I've also seen the opposite. People who were considerably more impressed by their own abilities than anybody else was. People who expected recognition, rewards, and promotion almost immediately before they'd really contributed anything. Ambition is fine. Expecting the organization to rearrange itself around your career plan by Thursday is a different matter. So here's the balance we're aiming for. Confidence without arrogance. Enthusiasm without impatience. Curiosity without pretending you already know everything. And there's another thing. Nobody sensible expects you to transform the security program in your first week. They want to know that you're learning, that you can work with people, and that you're becoming somebody they can trust. Over the next few minutes, we'll look at the first 30 days, the next 30, and what you should be contributing by day 90. I'll also tell you what I actually watch for from the hiring manager's chair, because getting through the interview opens the door. What you do next is what builds a career. Let's start with the first 30 days. Your mission isn't to prove you're the smartest person in the building. It's to understand the lay of the land. You'll meet your manager, your team, the people who run the infrastructure, and probably somebody who knows why a critical server must never be rebooted on a Thursday. Every organization has that person. Find them. Be nice to them. Learn who does what. Who handles incidents? Who approves changes? Where do you escalate a concern? Which processes are formal and which depend on somebody remembering how things worked in 2017. Most importantly, build relationships with your immediate team. These are the people who will teach you the environment. Answer the questions you don't yet know how to ask, and have your back when something goes sideways. You don't have to become everyone's best friend. You do have to become someone people are comfortable working with. Ask questions. Take notes. And please don't ask the same question five times because you couldn't be bothered to write down the answer the first four. Get clear expectations from your manager. What should you understand after the first month? Which systems should you learn? What are you allowed to do independently? What must be reviewed or approved? Also learn the organization's culture. Some companies expect frequent updates and lots of consultation. Others want you to figure things out and report back. Neither approach is automatically right, but if you assume one while your employer expects the other, you're going to have a frustrating time. The first month is about listening, observing, understanding, and connecting. You are not wasting time because you aren't yet changing the world. You're building the foundation that lets you contribute without accidentally bringing the world to a halt. Now, a word about enthusiasm. I like enthusiastic new hires. The ones who turn up ready to learn and get involved are often the ones who develop fastest. But enthusiasm can come with impatience. You might join a large corporation and discover that getting access to a tool requires three approvals, a training course, and what feels like a letter from the king. Meanwhile, you've watched a tutorial, built a home lab, and you're desperate to get going. It's tempting to think, why is everybody moving so slowly? Don't they realize how motivated I am? Well, large organizations have dependencies, competing priorities, change controls, operational risks, and other people with their own work to do. They're not necessarily moving slowly to annoy you, although I appreciate it can feel that way. Here's the advice I give. Keep the enthusiasm, but calibrate how you express it. Learn the organization's pace. If everyone around you is operating at 10% energy and you arrive at a thousand percent, you're likely to drive them absolutely mad. That doesn't mean becoming somebody else. It means recognizing the people and systems around you. Be true to yourself, but learn to work effectively with others. And if your employer can't give you new challenges as quickly as you'd like, don't let frustration turn into disengagement. Find productive ways to keep learning. Take an online course, read the relevant standards, practice in an authorised lab. Explore the theory behind the systems you encounter. Ask your manager which skills would be most useful to develop next. Just don't take company information home to practice on or experiment with production systems because you're bored. The best new hires aren't the ones who make the most noise about wanting opportunities. They're the ones who remain engaged, patient, and ready when opportunities arrive. There's something else you should learn early, and it has nothing to do with memorizing security acronyms. Understand the business you're protecting. Cybersecurity doesn't exist for the entertainment of cybersecurity professionals. It exists to help an organization operate while managing risk. That means understanding where the organization's risks come from and how it actually gets work done. If you work in manufacturing, availability may be essential. A server that looks overdue for patching could support a production line that cannot simply be shut down at lunchtime. If you work in healthcare, a system outage might affect patient care. If you work in financial services, integrity, privacy, and regulatory requirements may drive important decisions. None of that means ignoring security weaknesses. It means understanding consequences before recommending action. Learn who the key players are. Learn how new technology is introduced. Learn the change management process. Learn how decisions are made and how much communication the organization expects before anything changes. I've seen technically capable people struggle because they understood the technology but not the organization around it. They could identify a risk, but couldn't explain it in terms that mattered to the people responsible for the business. So when you spot something that seems wrong, start with curiosity. Why do we do it this way? What would happen if we changed it? Who depends on this system? What are the constraints? You may discover a perfectly good reason for the existing approach. You may discover an opportunity for improvement. Either way, you've learned something. By the end of your first 30 days, you should be able to explain what your organization does, which services matter most, who you work with, and how security fits into that picture. That's a far more useful achievement than simply knowing where every button is in the security dashboard. Let's move into days 30 to 60. By now, the office isn't quite so unfamiliar. You've learned a few systems, met some people, and probably discovered that the documentation is not entirely as up to date as the documentation claims. This is when I want you to start identifying your skills gaps. And yes, you'll have gaps. Quite a few probably. That's normal. Cybersecurity is a very large field, and even people who've worked in it for decades are still learning. The trick is not to panic and try to learn everything at once. Ask yourself, what knowledge or skill would make me more useful in this role right now? If you're working in a security operations center, perhaps you need to understand the organization's alert workflow, basic log analysis, or how identity events are investigated. If you're supporting governance and risk, perhaps you need to learn the control framework, evidence collection, or how exceptions are approved. If you're in vulnerability management, perhaps it's asset context and remediation prioritization. Talk to your manager and teammates. Compare what the role requires with what you can confidently do today. Pick two or three important gaps. Then make a plan. Some learning will come from supervised work, some from documentation, some from asking colleagues to walk you through a process, and some may come from courses or your own study outside work. Don't mistake collecting certificates for closing a skills gap. A certificate can be useful, but being able to apply what you've learned is what makes you valuable. And start looking for small contributions. Maybe you can improve a checklist, document a recurring task, or help make a report clearer. Don't launch a revolutionary automation project without permission. A simple, reliable improvement that actually helps the team is a much better first win. By day 60, I don't expect you to know everything. I do want you to understand what you don't know and to be actively doing something about it. Let's talk mistakes, because you're going to make some. I certainly have. Everyone does. From the newest analyst to the most senior executive. Experience doesn't eliminate mistakes. It just gives you a wider selection of mistakes to remember. What matters is how you handle them. Suppose you misunderstand an instruction, make an incorrect change, or miss an important step. Your instinct might be to fix it quietly before anyone notices. Resist that instinct if the issue could affect security, operations, or other people. Surface the problem through the right channels. Explain what happened. Help contain or correct it. Document the facts and learn from it. I've never expected a new employee to be perfect. What I do expect is honesty and ownership. A genuine mistake, openly acknowledged and handled responsibly, is something a team can work through. A hidden mistake is much more worrying. So is the same mistake repeated again and again without any effort to learn. Another trap is pretending to understand something you don't. If somebody explains a complicated process and you haven't followed it, say so. You don't win credibility by nodding confidently and then making a spectacular mess of it later. And remember, having access isn't the same as having authority. Follow change control, check approvals, ask before touching systems you don't understand. The sentence, I thought it would probably be fine, has appeared at the beginning of rather too many unfortunate technology stories. Be careful, but don't become paralyzed. The aim is thoughtful action, not fear. Good managers want people who take responsibility, communicate early, and improve after setbacks. If you can demonstrate that, a mistake doesn't have to define your first 90 days. Sometimes the way you recover tells people more about your character than a month of things going perfectly. From the hiring desk. Let me tell you what actually stands out to me when someone joins a team. First, the person who's curious, engaged, and willing to learn. Some of my strongest hires came in with less cybersecurity experience than other candidates. They didn't oversell themselves. They showed up, listened, asked questions, and got involved. That combination is enormously valuable. But there's another type I've encountered, fortunately not too often. The person who arrives convinced they're already operating several levels above the role they were hired to do. They want rapid promotion, exceptional recognition, and special treatment, sometimes within weeks. Their expectations can be wildly disproportionate to what they've contributed and to how the rest of the team operates. Let me be clear, don't undervalue yourself. Ambition is healthy, but an organization needs evidence of contribution before it can reasonably reward it. Being impatient for the next job before you've started delivering in this one is not a particularly convincing career strategy. I also notice when somebody becomes detached. Sometimes a new hire is overwhelmed by all the opportunities and gets distracted by everything. A bit of squirrel syndrome. One day they're interested in incident response, the next in penetration testing, then cloud security, then a new role at another company before they finish their onboarding. Curiosity is good. Constantly abandoning the thing you've committed to is not. And then there's teamwork. Personality fit matters enormously, particularly in technology teams. You don't need to be identical to your colleagues. In fact, different perspectives make teams stronger, but you do need to understand how to work with them. If you're the loudest, fastest, most enthusiastic person in the room, perhaps adjust the volume occasionally. Not because your personality is wrong, but because cooperation requires awareness of other people. What I watch for in the first 90 days is quite straightforward. Relationships, communication, learning, reliability, and judgment. Is this person becoming easier to trust? Are they taking feedback? Are they finding ways to contribute? Those qualities matter much more to me than somebody arriving with a grand speech about how they'll transform the department. Now we're approaching days 60 to 90. This is where I want to see a shift. In the first 30 days, you were learning the environment and building relationships. In the next 30, you identified skills gaps and started closing them. By day 90, you should ideally be contributing something tangible. Not running the entire security program, not single-handedly defending the organization against every threat on the internet, just owning an appropriate piece of the puzzle. Maybe you're responsible for reviewing a defined category of alerts under an established process. Maybe you're helping maintain vulnerability records, producing a useful report, supporting access reviews, or keeping a procedure accurate. The work will depend on your role and how your employer operates, but there should be something your manager can point to and say, yes, this person is adding value. Ownership doesn't mean working without supervision. It means knowing what you're responsible for, doing it consistently, communicating progress, and escalating when you need help. Ask for feedback before day 90. Don't wait for a formal review to discover that your manager thought you were focusing on the wrong priorities. Ask, what's going well? What should I improve? What could I take responsibility for next? And when you get an answer, listen. Feedback is not a personal attack, it's information you can use. Some organizations have long onboarding periods, background checks, or tightly controlled access. In those environments, the timeline may look different. That's fine. The principle still applies. Move steadily from understanding to developing capability to useful contribution. You don't have to be extraordinary by day 90. You do want to be dependable. In my experience, that's the foundation on which bigger opportunities are built. There's one more thing we need to discuss before we finish. Finding your place in the team without losing yourself. Every team has a personality. Some are quiet and methodical, others are noisy and collaborative. Some managers want frequent updates, others give you a goal and expect you to find your own route. Pay attention to that. If you constantly communicate in a way that irritates everyone around you, your message may be lost, even when the idea is good. But don't misunderstand me. I'm not telling you to suppress who you are or accept poor treatment. I'm saying that professional maturity includes understanding the people you work with and adapting your approach when it's useful. You can be enthusiastic without dominating every meeting. You can be ambitious without demanding promotion before you've earned trust. You can challenge a decision without making the person who made it feel foolish. And you can be honest about wanting to grow without acting as though your current role is merely an inconvenience on the way to something more important. When I've seen people struggle early, impatience is often part of the story. They discover that the company isn't exactly what they imagined, or that the work is more routine than they hoped, and mentally check out before they've given it a fair chance. Of course, some jobs genuinely aren't a good fit. Sometimes there are real problems, and leaving is the right decision. But don't confuse the normal discomfort of being new with proof that you've made a terrible mistake. Give yourself time to learn. Give the team time to know you. And remember that relationships are not a distraction from technical work. They're part of how technical work gets done. Your first 90 days aren't about fitting into a mold. They're about becoming an effective member of a real team. Your next move. Meet your teammates. Understand the culture, the key processes, and the business risks. Ask your manager what success looks like, and write down what you're learning. Between days 30 and 60, identify the two or three skills gaps that matter most to your role. Make a plan to close them. Use approved work opportunities, training, and your own study. And look for one small improvement you can make with your team's agreement. By day 90, aim to own something tangible. A recurring process, a report, a defined set of tasks, or another contribution that helps the team. Ask for feedback and agree on what comes next. And remember the balancing act. Be eager but patient. Be confident but humble. Be yourself, but understand the people around you. I want to finish with something personal. If I could speak to myself at the start of my own career, I'd give myself two pieces of advice that might sound contradictory. First, don't undervalue yourself. When you're new, it's easy to assume you have little to offer. I think I did that early in my career. But fresh ideas, energy, curiosity, and a willingness to work hard all have real value. Second, don't underestimate how much you still have to learn. College teaches fundamentals and theory, but corporate life is different. A multinational company operates differently from a non-profit. A hospital operates differently from a technology business, and none of them necessarily behaves the way the textbook suggested. So expect the unexpected. Bring what you know, respect what you don't, and give yourself permission to grow. Your first 90 days aren't about proving you've already made it, they're about showing what you're capable of becoming. I'm Steve, and this has been Hacking Your Cyber Career. Thanks for listening. Keep learning, keep asking questions, and remember, getting the job opens the door. What you do next is what builds the career. See you next time.