By Ed Adams, CEO of Security Innovation
Careers in cybersecurity are often misunderstood. Pervasive myths like “You have to have a technical degree” or “There aren’t any job openings” discourage many job seekers from pursuing careers in this field. The fact is, there are hundreds of roles that require technical and nontechnical talent and according to Cybersecurity Ventures, there were more than 750,000 unfilled cybersecurity jobs in the U.S. in 2023. A recent report from ESG and ISSA shows there’s a cyber skills crisis that is projected to continue as attack surfaces grow in number and complexity.
My own research, speaking with more than 150 cybersecurity executives, revealed that the cyber skills shortage isn’t due to a lack of skilled people, it’s driven by a reluctance to consider candidates without specific certifications or credentials-based on a faulty assumption that technical and programming skills are always required.
Many of the cybersecurity executives I spoke with came from varied backgrounds in the military, finance, marketing, legal and other nontechnical fields. Marnie Wilking, a CISO and cyber executive at Booking.com, said “There are so many different facets and faces to cybersecurity. Many of the cyber roles don’t require programming. In fact, some of my best team members have been history majors, psych majors, criminal justice…a little curiosity is really all it takes.”
That makes a lot of sense. Cybersecurity exists to defend against cybercrime. Cyber criminals rely on strategy, an understanding of human nature, analysis, patience, and other nontechnical skills to achieve their goals. Defenders need those same skills, along with abilities to assess risk, understand impact to an organization, and manage the collateral aspects of cyber defense. Many roles not traditionally associated with cybersecurity can contribute to improving an organization’s security posture.
Cyber offers numerous opportunities for people with business, legal, communications, and other non-technical backgrounds to become cybersecurity practitioners. People in cyber arrive via many avenues-there’s no one exclusive path. In my book, See Yourself in Cyber: Security Careers Beyond Hacking,
I identified four practical avenues that anyone can pursue to break into-and succeed-in a cybersecurity career.
Find Your Passion. Make a Plan.
Start by researching areas of cybersecurity and see what appeals to you. There are people, process, and technology components to every cybersecurity job. Which of these aligns best with your skills and interests?
Next, consider basic training to become more fluent in cybersecurity. A good starting point is the free CC-Certified in Cybersecurity training offered by ISC2. If you’re a problem-solver, creative, analytical, or a critical thinker, you’re an ideal candidate. Scour LinkedIn to find roles and titles that interest you. Finally, as you’re looking for a position, consider creating your own project and submitting it to an industry conference for presentation.
Learn. Get Hands-On Experience.
Many organizations proactively seek security talent and offer some level of security training programs. Check out opportunities within your current company to develop cybersecurity knowledge and skills. Ask about employee security training and hands-on labs. Many CISOs I interviewed offered additional ideas:
- Get free certifications-look to Cybrary, LinkedIn, and others
- Donate time on a security team, internal or external, just to learn
- Become familiar with industry frameworks such as NIST and MITRE ATT&CK
- Set up a test or lab environment to practice as you learn
- Participate in online capture-the-flag contests
- Participate in bug bounty programs
Get Involved. Get Visible.
A good way to quickly become immersed in current cyber topics and issues is to join professional cybersecurity groups and online forums. LinkedIn groups, Reddit communities like r/netsec, and professional organizations like ISACA or the Information Systems Security Association (ISSA) are great places to start. You’ll also find opportunities like cybersecurity job fairs, regional conferences, and trade shows where you can learn and meet people.
Update your online presence by adding cybersecurity certifications to your LinkedIn profile and boost your activity by posting observations and insights about cyber topics. Follow authoritative organizations on cybersecurity. Share relevant articles with followers. If you have a personal website, blog about what you’re seeing and learning. Make it a habit to stay current on the latest trends, threats, and technologies and write about what you learn.
Survey insights reveal that more than 80 percent of professionals had a mentor. LinkedIn can help you get started in finding a mentor. The National Cybersecurity Alliance also offers advice: “If you don’t know anyone who works in cybersecurity, look online. Search for executives at companies you respect-you can probably find some contact information online. Also, leverage social media. Don’t just friend or follow randomly. Start conversations and engage with posts. When you find someone you think will be a great mentor, shoot an instant message, or email. All they can do is refuse or not respond.”
Finally, create and contribute. Create personal projects or participate in cybersecurity competitions and hackathons. Consider promoting those projects on your profile or blog. Contribute to open-source cybersecurity projects or publish your own. The more you do, the more you will bring to a job opportunity.
Network.
Finally, networking boosts your chances of being directly considered for a role while you build skills. Connect, follow up, and establish relationships with key influencers. If possible, donate time or do an internship with one of their organizations. Choose a cyber standard, learn it or a portion of it, and go to your mentor or experienced contacts for advice on applying that knowledge in a career role. Connections can open doors and suggest novel options.
Finally…
There is no typical path to a career in cyber. If you’re a job seeker in cybersecurity, these practical tips will accelerate-and enrich-your journey. Curiosity is an asset, learning is immensely helpful, making connections and networking will build a strong foundation.
If you’re an organization looking for security talent, remember that security awareness and skills are important across every job function. Cybercrime and cyber defense challenges require creative people to solve them. Look for problem-solvers, creative thinkers, people with analytical and critical thinking skills. They can always learn security-specific knowledge. Diversity and inclusion bring richer insight and capabilities to the table that ultimately benefit the organization with stronger defenses.
##
ABOUT THE AUTHOR
Ed Adams is a software quality and security expert with more than 20 years of experience in the field. He served as a member of the Security Innovation Board of Directors since its inception in 2002 and took over as CEO in 2003. Before his work at Security Innovation, Adams held senior management positions at Rational Software, Lionbridge, Ipswitch, and MathSoft. He was also an engineer for the US Army and Foster-Miller earlier in his career. Adams is a Ponemon Institute Research Fellow and Privacy by Design Ambassador by the Information & Privacy Commissioner of Canada. He sits on the board of Cyversity, a non-profit committed to advancing minorities in the field of cyber security and is a BoSTEM Advisory Committee member. Adams graduated from UMass Lowell with Mechanical Engineering and English Literature degrees and earned his MBA with honors from Boston College.
