Skip to main content

A Guide for Breaking Into Cybersecurity

7 min read
cybersecurity
career
learning
advice
beginners

Most important thing

Do. Your. Own. Research.

You are in a different situation than me. Search for people who are already where you want to be. Ask them. Take their advice (and my advice too, you could say) with a grain of salt. Consult multiple opinions. Then find the path / roadmap (you have to form that yourself) that brings the highest expected value (essentially highest chance of success). Then lock in.

Occasionally reflect, and be constantly on the lookout for opportunities and knowledge (like immerse fully in the cybersecurity world). Pivot when you need to. You will know when to pivot and when to keep locking in - find the balance. This depends on trial and error, and on you, too, so I can’t help you here.

What I am using to learn

Try to learn multiple things at once to space out learning + not get bored

What you need to know for an internship

Note: This is gathered from what I have heard from people, so take this with a grain of salt.

Understand the market

Each market is different.

The German market, for example: you can’t even find a job that doesn’t require a bachelor’s degree (even tier 1 SOC). The US market is slightly looser, but for the most part you should still have a degree, mainly because everyone has one and cybersecurity is a field where people must have something to be trusted, like certifications and degrees (although the real moat is still the practical experience)

This is important because I find that most advice is catered to the US. So be aware of that - you do your own research.

Helpdesk or not

Many people said that the cybersecurity market needs someone with experience in IT, so “just get a helpdesk job and progress from that”. Personally, I don’t think this is necessary, because why would you waste time at a job that’s too basic and most of the time doesn’t have promotion opportunities, and if you can’t land something better than helpdesk, you’re probably not good enough (like seriously).

I get it that I haven’t even been in the job market yet, but this helpdesk advice seems to only come from US people and seems like helpdesk is only for those wanting to jump in ASAP without any prior field knowledge and for complete career changers. And you can probably get IT experience from doing better jobs than helpdesk.

Anyways, I’m focused on the German market so I can’t really say too much here - at least in my situation I would probably not have to work helpdesk (and if I have to work one, I probably just have a skill issue).

Resources

YouTube

That said, try to stay off YouTube. YouTube is just for an overall grasp of the industry - you have a lot to learn outside of just watching YouTube. Watching too much = procrastinating.

Again, I would take everybody’s advice with a grain of salt though. Just double down on what works and ignore what doesn’t.

Books

Other sources

Certifications?

You should probably not spam them (and you are probably already broke anyways).

Security+ is just very basic (universal opinion, you don’t have to argue here).

Do not think that you can do the bare minimum, pass the certification or get a degree and then immediately get a job. Each market is different and each employer has different requirements, so do your own research.

Networking (with people, not computer networking)

By far one of the most important skills.

Even if in your current area there aren’t many opportunities to network, try to network online. Or not even network - sending people polite DMs asking about their experience (important thing here, because they won’t understand your situation, and they don’t have time to think about your situation) is already great.

People can be surprisingly helpful if you actually reach out, show curiosity, be polite / know the limits (don’t be a jerk), and show that you actually have done your own research and have an overall idea of the industry (right or wrong doesn’t matter).

Reach out to people who are already at the place you want to be. I personally use Reddit multiple times and people actually gave me great advice and perspective into the daily work in the field. (I can’t share the proof here because there is private information in the DMs)

Learn in public

Share what you’re working on. Share what you have achieved. Share what you know. Share your personal view.

You can point people to other resources if you don’t want to reinvent the wheel.

Benefits:

Main platform would probably be LinkedIn.

And please don’t abuse AI. We don’t need more AI slop (matter of fact, LinkedIn has a report button for slops). Use AI to organize your thoughts, not to invent new slop.

Courses

Ignore most of them because they are probably recycling existing free content or are extremely overpriced.

Also ignore the advice from gurus on YouTube telling you to buy this course / buy this cert because most of the time they are sponsored / just following trends.

Free courses are usually BS and used either for marketing or for funneling into paid things (this even applies to TryHackMe free rooms and many other things, at least in my opinion).

Most knowledge is free and already existing on the Internet. Use websites like Anna’s Archive to access books if you’re too broke, but try to buy books directly if you can.

Soft skills

Underrated but arguably as important as technical skills (This is again universal opinion so don’t argue with me here). Teamwork and communicating to non-technical people and so on are regular parts of a cybersecurity job. As a matter of fact, I am looking into Google’s free technical writing course to improve my writing skills.

Cybersecurity is cooked…

Yeah I know, every industry is doomed (literally the headlines on every Reddit post).

The thing is, you can’t control the situation in the world right now. So just grind and know that sometimes it also depends on luck, not just your ability. But if you stick around enough, then you might make it.

Replaced by AI?

No.

It can help with basic things like triaging alerts, filtering logs, etc… But it’s still very bad at understanding the business context (which is a big part of cybersecurity, because cybersecurity is also about managing risk and tradeoffs).

Also the gaps between frontier models are closing very fast now, and I believe that they are running out of training data, so they will probably hit the ceiling soon.

Also remember that AI requires thousands of training images just to recognize a cat, while a human might just need only one. So, just know that AI is still much dumber than you :)

The massive layoffs we’ve seen seem to just offset the huge hiring boom from a few years earlier, and AI did take away some roles, but not that many. And there’s always a shortage for someone capable of doing the job.

Now, what?

Congrats. Few people make it this far. Thanks for spending time reading this.

But you still owe me a favor: like this post and comment your opinions on things I mentioned in this post. It only takes a few minutes but might save others years of struggle (like literally). I have published this post, and now you should share your experiences too.

I would appreciate any feedback and this post will be further revised in the future if needed.

Now, get back to the grind.

Newsletter

Early access to new posts, plus unfiltered notes and experiences.

Comments