Which Cybersecurity Job Is Right for You?

Episode transcript

Transcript provided for accessibility and search. Minor transcription errors may remain.

SPEAKER_00 0:06

Thinking about a career in cybersecurity? Excellent! But do you actually know what sort of cybersecurity job you want? Because there's rather more to this industry than hacking computers and staring at screens. Welcome to Hacking Your Cyber Career. Real advice, real experience. Your next move. Here's Steve.

SPEAKER_01 0:32

So, you want to work in cybersecurity? Brilliant! What do you want to do? Well, I want to be a hacker. Of course you do. Because apparently everybody entering cybersecurity wants to sit in a dark room wearing a hoodie, surrounded by six monitors, typing furiously while green text scrolls down the screen, preferably with some dramatic music playing in the background. And at some point, somebody shouts, We're in! Which is impressive considering nobody appears to have explained what they're trying to get into. Now, don't get me wrong, ethical hacking and penetration testing are fascinating disciplines. They require genuine technical expertise, creativity, persistence, and a willingness to spend a remarkable amount of time discovering why something doesn't work. But here's something that might surprise you. A huge amount of cybersecurity has absolutely nothing to do with hacking. In fact, some of the most important people I've worked with in cybersecurity organizations wouldn't describe themselves as hackers at all. They were engineers, analysts, architects, risk specialists, investigators, project managers, communicators, educators, and leaders. Some loved technology. Others were much more interested in people, processes, business decisions, and organizational risk. And they all had an important role to play. So if you're interested in cybersecurity but don't particularly fancy spending your evenings learning how to exploit a vulnerable web server, don't worry, there are plenty of other opportunities. Equally, if you absolutely love taking things apart, understanding how they work, and discovering weaknesses, there are roles that might suit you beautifully. The trick is finding the right one. Because cybersecurity isn't a single career, it's an enormous collection of different careers that happen to share a common purpose: protecting systems, information, organizations, and ultimately people. I'm Steve, and this is Hacking Your Cyber Career. Over the past 30 years, I've worked across infrastructure, networking, operations, cybersecurity, and executive leadership. I've worked with some extraordinary technical specialists. I've worked with people who could explain complex business risks better than anyone I've ever met. And I've seen what happens when someone ends up in a role that doesn't really suit them. Sometimes they struggle, sometimes they become frustrated, and sometimes they decide cybersecurity simply isn't for them. When actually they may have been in the wrong part of cybersecurity. That's what we're going to explore today. We'll look at the different career paths available, the skills and personalities that tend to fit them, and how to work out where you might be happiest. And I'll share a few experiences from the hiring side of the table, because after years of building and managing teams, I've learned that finding the right person isn't simply about whether they can do the job, it's also about whether the job is right for them. Let's start by looking at what cybersecurity professionals actually do all day. And no, the answer isn't simply drink coffee and stare at dashboards. Although, admittedly, there's a fair bit of that too. Let's start with security operations. These are the people monitoring what's happening across an organization's technology environment. They investigate suspicious activity, respond to alerts, and help identify potential attacks. A security operations analyst might spend part of their day investigating an unusual login. Perhaps somebody's account has suddenly started accessing systems in another country, or an endpoint is behaving strangely, or a security tool has generated an alert that needs investigating. Now, sometimes that alert represents something genuinely dangerous, and sometimes it's simply somebody doing something unusual but perfectly legitimate. The challenge is working out which. If you enjoy solving puzzles, investigating problems, and asking questions, security operations might appeal to you. But there's a reality worth understanding. Some security operations environments operate around the clock. That can mean shifts, it can mean repetitive investigations, and during a genuine incident, it can mean pressure. So if your idea of a perfect working day involves predictable hours and absolutely no surprises, you might want to explore the working arrangements before accepting the job. Next, security engineering. These are the people designing, implementing, maintaining, and improving security technologies. Firewalls, endpoint detection and response, identity systems, cloud security controls, data loss prevention, and plenty more. If you enjoy building things, understanding how technology works, and solving complicated technical problems, this could be a good fit. But don't confuse using a security tool with understanding the environment it protects. Good security engineers need to understand networks, operating systems, applications, and how technology supports the business. Then there's penetration testing and offensive security. This is the area that attracts an enormous amount of attention, and rightly so, it's interesting work. You're trying to identify weaknesses before somebody malicious finds them. But professional penetration testing isn't simply breaking into things. There's planning, authorization, documentation, evidence collection, reporting, and explaining findings to people who may not understand the technical details. If you discover a vulnerability but can't explain what it means or how to address it, you've only completed part of the job. Then we have governance, risk, and compliance, often shortened to GRC. Not the most exciting collection of letters, I'll grant you, but an incredibly important discipline. These are the people helping organizations understand their risks, establish appropriate controls, assess compliance obligations, and make informed decisions. They might be evaluating a supplier, reviewing a business process, assessing the impact of a new technology, or helping executives understand why a particular cybersecurity investment matters. If you enjoy analysis, business processes, structured thinking, and working with people, GRC can be an excellent career, and you don't necessarily need to be the person who can configure every firewall in the building. There are also identity specialists, security architects, application security professionals, incident responders, forensic investigators, security awareness specialists, and many more. Some roles are deeply technical. Others are heavily focused on people and business decisions. Many sit somewhere between the two. And that's what makes cybersecurity such an interesting profession. There isn't one personality type that succeeds. There isn't one set of skills that everybody needs to master, and there certainly isn't one career ladder that everybody has to climb. The challenge is finding the area where your interests and abilities overlap. Here's a question I'd like you to think about. What sort of work do you actually enjoy? Not what sounds impressive, not what your friends think sounds exciting, and certainly not what some influencer says will make you rich by next Thursday. What do you enjoy? Do you like taking things apart to understand how they work? Do you enjoy solving complicated technical problems? Are you naturally curious about why something happened? Or perhaps you're more interested in understanding the bigger picture, how organizations operate, how decisions are made, how risks affect the business. Maybe you're good at explaining things. You enjoy working with people. You can take a complicated subject and make it understandable. That's a valuable skill in cybersecurity, and one that doesn't always receive the attention it deserves. I've worked with some technically brilliant people who could explain an extraordinarily complex problem to another engineer, but put them in front of a business executive and ask them to explain why it matters? Suddenly things became rather more difficult. And that's not a criticism. Different people have different strengths. The important thing is recognizing yours. Now, I don't want you to take this as an invitation to label yourself permanently. I'm a technical person, I'm a people person, I'm not good at presentations, I'm not a manager. Be careful with those statements, because abilities develop, and sometimes you discover strengths you didn't know you had. I certainly wasn't born comfortable speaking in front of large groups. Early in my career that was something I struggled with. But as I progressed, I realized communication was becoming increasingly important. I needed to explain ideas, persuade people, present information, and eventually communicate with executives and large groups. So I had to develop those skills. It didn't happen overnight, and I wouldn't claim every presentation I've ever delivered was a masterpiece. But the more you practice, the more comfortable you become. So when you're thinking about your ideal cybersecurity role, consider two things. What are you naturally interested in, and what skills are you prepared to develop? Because your current abilities shouldn't define the limits of your career, but your interests can provide a useful starting point. These are important security controls. They're also technically involved. There's configuration, policy management, troubleshooting, understanding how systems behave, and working through problems that don't always have particularly obvious answers. Now this person was having a difficult time. And I don't mean they needed a couple of extra days to get comfortable. We invested in formal training. We had the vendor come in and work with them. We provided coaching. We gave them time. We tried to help them develop the expertise they needed, but it simply wasn't clicking. And I could see they were struggling. Not just professionally, personally. They were frustrated. The work wasn't progressing as it needed to, and the situation wasn't doing anybody much good. So we had a conversation, and it was an important one. We recognized that the role wasn't the right fit. Now, that can be difficult to hear. Nobody particularly enjoys being told that something isn't working. But here's what I had also noticed. This person was very good with people. They communicated well, they engaged with others, they could explain things, they could build relationships, and those are valuable cybersecurity skills. So rather than continuing to push them into a technical role that wasn't working, we explored a different direction. Cybersecurity awareness. And what a difference. They went on to run an excellent awareness program, one that engaged people across the organization and delivered genuine value. Because educating employees about cybersecurity can help prevent incidents before they happen. It's not simply sending out an annual training presentation and hoping somebody reads it, it's helping people understand risks, recognize suspicious activity, make better decisions, and develop safer habits. Done well, security awareness can be a powerful part of an organization's defenses, and this person was good at it. Really good. So think about what happened there. Someone was struggling in one cybersecurity discipline. We identified a different set of strengths. We changed direction and they became far more successful. The organization benefited, and the employee found work that better suited their abilities. That's the lesson I want you to take away. If you find yourself struggling in a cybersecurity role, don't immediately conclude that cybersecurity isn't for you. Ask whether you're in the right part of cybersecurity. Perhaps you're a security analyst who would be happier in engineering. Perhaps you're a technical specialist who would excel in risk management. Perhaps you're brilliant at communicating and would enjoy awareness or consulting. Or perhaps you simply need more training and experience in your current role. The important thing is being honest with yourself. And having conversations. Because there's no prize for spending 10 years being miserable in a job that doesn't suit you, other than perhaps becoming exceptionally good at complaining about it. And believe me, corporate life already has plenty of people who specialise in that. Let's talk about money, because we all need it, and there's absolutely nothing wrong with wanting to earn more. A good salary creates opportunities. A home, a car, travel, financial security, perhaps even the occasional holiday somewhere that doesn't involve checking your work email every 15 minutes. All perfectly reasonable ambitions. But I think there's a mistake people sometimes make early in their careers. They look at cybersecurity job titles, they look at salary surveys, and they decide which role they want based entirely on which one pays the most. Now, I understand the temptation, especially if you're starting out and looking at what your future might look like financially, but salary shouldn't be your only consideration. Because there's a big difference between being well paid and being happy, and an even bigger difference between having an impressive job title and actually enjoying what you do every day. I've seen people pursue opportunities primarily because of the money, and sometimes they discover that the work isn't what they expected. They don't enjoy it, they struggle with the responsibilities, or they find the pressure and working arrangements don't suit them. And that can become a problem. Because when you don't enjoy the work, it can be harder to develop the expertise needed to become genuinely excellent at it. And excellence matters. My advice is to focus on becoming really good at something you enjoy. Develop expertise, build a reputation, become someone people trust, someone who solves problems, someone who contributes, someone who keeps learning. The financial opportunities often improve as your capabilities and experience grow. Now, I want to be careful here. I'm not suggesting you should accept poor pay indefinitely because you're passionate about cybersecurity. Absolutely not. Know your value, understand the market, and make sensible financial decisions. But don't choose a career path solely because one job title appears at the top of a salary survey. Think about the work itself, the hours, the stress, the opportunities to learn, the people you'll work with, and whether you can imagine doing that kind of work for several years. Because a high salary doesn't make a miserable Monday morning particularly enjoyable, it just makes it a more expensive miserable Monday morning. Over the years, I've worked with some exceptionally talented cybersecurity professionals, and one thing I've learned is that the most valuable people aren't necessarily those with the greatest technical knowledge. Technical expertise matters, of course it does, but there's another quality I value enormously: initiative. The ability to take responsibility and get on with things. Now, I'll admit something about myself. I'm naturally a hands-on manager. I like to understand what's happening, I like being involved, and at times I'm sure some of the people who've worked for me would describe me as a bit of a micromanager, possibly more than a bit, which isn't always a particularly attractive quality in a boss. Nobody wants someone constantly looking over their shoulder, and I've had to recognize that in myself. But the people who really stood out were those who could take a direction and drive forward. They understood what we were trying to achieve. They took responsibility for their part of it. They developed the skills they needed, they identified problems, and they worked out how to move things forward. They didn't need somebody like me constantly telling them what to do next, and that was enormously valuable. Because when you're leading a large cybersecurity organization, you simply can't be the expert in every technology, process, and discipline, nor should you try to be. You need people who understand their responsibilities and can make progress. People who are curious, people who are reliable, people who communicate when something isn't working, and people who take ownership. That's what I'd encourage you to develop, regardless of which cybersecurity career you choose. Be someone who can be trusted to follow through. If you're given a task, understand what success looks like. Ask questions when you need to, identify what you don't know, learn, and keep people informed. Don't confuse independence with refusing help. Good professionals know when to ask for support, but they also don't wait for somebody to provide detailed instructions for every little thing. That ability to take initiative is useful in almost every cybersecurity role, whether you're investigating alerts, building security controls, managing risk, or educating employees. And it becomes even more valuable as you progress, because eventually the people who advance are often those who can take a problem, understand the objective, and deliver a result. Without requiring their manager to become a full-time navigation system. Turn left at the next firewall. Continue straight for 300 yards. Recalculating. Here's another thing I want younger listeners to understand. Your first cybersecurity job doesn't have to define the rest of your career. In fact, I'd encourage you not to become too attached to the idea that it should. When I look back at my own career, I've worked across a wide range of technologies and responsibilities: help desk, infrastructure, networking, international IT operations, security, leadership. And I didn't get there by deciding at the age of 21 exactly what my final job title would be. I explored, I learned, I took opportunities, and I moved into areas that interested me. Sometimes because I saw a new technology emerging, sometimes because there was a skills gap, and sometimes because I simply wanted to understand something different. One of the most useful things you can do early in your career is sample different disciplines. Talk to people, ask what they do, find out what their typical day looks like, ask what they enjoy, and what frustrates them. If you're working in an organization, speak to your manager. Explain that you're interested in developing broader experience. Perhaps there's a junior networking opportunity. Perhaps the security team needs help with a project. Perhaps someone is implementing a new technology and could use another pair of hands. You don't have to pretend you're already an expert. You can simply say, I'd really like to learn more about that area. Is there an opportunity for me to get involved? Sometimes the answer will be no, that's life. But sometimes the answer will be yes, and that yes could change the direction of your career. I certainly benefited from being willing to get involved in areas outside my immediate responsibilities. And here's another point. Don't wait until you're unhappy to explore other options. If you're enjoying your current role, brilliant. Keep developing. But stay curious about what else exists. Because technology changes, organizations change, and your own interests will change. What you enjoy at 21 might be very different from what you enjoy at 35, and that's perfectly fine. You don't have to spend 40 years doing the same thing simply because you chose it as your first job. A career isn't a railway track where you pick a destination and never change direction. It's a series of opportunities, decisions, experiences, and sometimes rather unexpected diversions. Some of my most significant career opportunities were certainly not things I'd planned years in advance, and that's part of what makes it interesting. Right, time for your next move. And this week I'm going to ask you to do something slightly different. Rather than choosing a certification or applying for another job, I want you to explore three areas of cybersecurity. But I want you to approach them through three different lenses. Technology, risk, and communication. These are the three areas I'd explore if I were starting my cybersecurity career at 21 today. First, technology. Choose a technical cybersecurity discipline. Perhaps security operations, network security, cloud security, identity and access management, or security engineering. Find out what people in that discipline actually do. What technologies do they use? What problems do they solve? What skills do they need? And does the work genuinely interest you? Second, risk. Explore how cybersecurity connects to business decisions. Find out what risk analysts or governance professionals do. Look at how different organizations face different risks. A hospital has different priorities from a bank. A manufacturing company has different concerns from an online retailer. Some organizations are particularly concerned about intellectual property. Others focus heavily on personal information, financial transactions, operational availability, or safety. Understanding risk helps you understand why cybersecurity exists in the first place. And that's useful regardless of which role you eventually choose. Third, communication. Look at roles involving security awareness, consulting, program management, or leadership. Find out how cybersecurity professionals explain complex problems to people who aren't technical experts. How do they persuade people to change behavior? How do they present risks? How do they get others to support security decisions? Because here's something I've learned. You can have the best technical solution in the world, but if you can't convince anyone to adopt it, its value is rather limited. And communication is something you can start practicing now. Speak up in meetings. Volunteer to present something. Explain a technical concept to someone who isn't technical. Get comfortable using your voice. I struggled with that early in my career and I had to work at it, but it's one of the most useful skills you can develop. So here's your challenge. Pick one role from each of those three areas. Research what the job involves. Look at the skills required, and find one person, article, video, or professional community that can help you understand the reality of the work. Then ask yourself three questions. Does this interest me? Could I become good at it? And would I enjoy doing it regularly? You don't need to make a permanent decision. You're exploring, you're sampling, and you're beginning to understand where you might fit. Because that's the real message of today's episode. Cybersecurity isn't one job. It's an enormous collection of opportunities. Some technical, some focused on risk, some centered on people, and many combining all three. I've seen people struggle in one discipline and become exceptional in another. I've seen people discover talents they didn't know they had. And I've seen people build remarkable careers simply because they were willing to explore something new. So don't choose your cybersecurity career based entirely on a job title, or a salary, or what somebody on the internet tells you is the next big thing. Find something that interests you. Develop the skills, become good at it. And remember that you can change direction. Your first choice doesn't have to be your last. Next time, we're going to look at how to get hired when you don't have direct cybersecurity experience. Not just understanding the experience trap, which we covered in episode two, but actually building a job search strategy, demonstrating your capabilities and getting yourself noticed. Because having the right skills is only part of the challenge. You also need to convince somebody to give you the opportunity. I'm Steve. Thanks for listening to Hacking Your Cyber Career. And remember, getting in is just the beginning.