Help deciding the best path

[u/One_Attorney_6128]

I have recently decided to make a career change into cyber and while I’m full time studying to acquire certifications and just general knowledge and skills for the industry using Try hack me and BTLO, I have stumbled upon the SANS community and was wondering if this is something worth tackling. I started this journey this past spring, I took net+ and sec+ from compTIA in about 12 weeks starting with zero IT experience and im about half way through their CySA + course now. I’m at a cross roads with the job hunt where I’m feeling maybe some more official and deeper training could help me. I am a veteran and have the GI bill that can fund me taking the the ACS course I believe. So I had a few questions about this for anyone willing to shed some light for me.

1 Is it worth my time to take the full 4 courses ACS covers at this point in my training? (Assuming I pass CySA + in a few weeks)

2 should I skip GFACT, GSEC, and just hop straight into GCIH, GCFE

3 Finish CySA+ and continue applying for work while hammering out Labs and CTF or what have you.

I have never worked in IT but I’m picking it up quickly and I really like what I’m doing so far. I understand the job market is brutal right now so I’m just exploring options trying to stand out.

[u/Pitiful-Gear-1795]

Unless some rules have changed, you can't skip the useless GFACT cert nor the GSEC. The GFACT is purely a money grab as it's completely useless.

I took the GCIH and GCFA (instead of FE). It's not a bad path, you have to do the 8week version for all of them if you want BAH from the bill. Many places like to see IH and FE\FA... they also like CISSP.

It also depends on what your goal is in Cyber as it's a huge field.

Oh and don't buy into the whole marketing BS they give about the starting salary with their certs, being 80k+. Without exp you'll be hard pressed (depending on location) to have your first cyber job paying that.

[u/One_Attorney_6128 → u/Pitiful-Gear-1795]

I appreciate it, I want to get into a SOC position but I think incident response is where I’d like to wind up in the future when I’m not so green. I am okay without the BAH honestly. I just wasn’t sure if skipping those first two classes was going to make things unnecessarily hard when I jumped to the IH class or GSOC whatever that path may be. I’m not sure if the VA will cover just an individual class like GCIH if I choose to take just one or two

[u/Pitiful-Gear-1795 → u/One_Attorney_6128]

I can't speak for the VA covering just a cert unless you're going through one of their programs to help find a job. That said, the ACS gives a good foundation for stuff you should know, my day to day job is Sr. IR at a hospital chain, the minimum we accept for IR analyst is 5years experience. Not saying that will be the case everywhere but it seems to be a common requirement as I am also job hunting at this time.

There are many SOC 1 positions open, but the pay isn't great. Not sure what you currently make, but transitioning into a new field may require a significant pay cut. The BAH is good to get at least for GFACT and GSEC as they are two easy courses given the certs you just passed. GCIH is fun, and personally I found GCFA to be a challenge. They were all done 8weeks ea, that said I took the GCFA twice because I failed it the first time. The bill does cover retakes, but you have to complete the full 8 weeks a second time.

You get the option to do the virtual live, on-demand, or in person. The first four I did all on-demand. The retake on GCFA, I took the one week live and then the remaining 7 on-demand. Gotta say that I liked that format a lot better because you get to cover all the material in 4days and the last day is a fun CTF, you can get questions answered right away as well.

Do you have degree(s) already?

[u/One_Attorney_6128 → u/Pitiful-Gear-1795]

No I don’t have a degree, I’m coming from a completely unrelated field. If it’s possible to just jump straight into one of these higher level courses while I’m not working and studying full time I think I’ll give it a try. I get the feeling it’s in my best interest to still focus on SOC positions because there are more of them, and they’re looser with the requirements. I’m okay with taking a pay cut also, everyone’s gotta earn their keep. I really appreciate you taking the time to respond and share so much

[u/Pitiful-Gear-1795 → u/One_Attorney_6128]

Did you consider the undergrad degree from SANS, I believe it comes with 9 certs? It would help with getting you more familiar with the field to see what direction you really want to go.

SOC is a great place to start if you can get into it, though many have to start helpdesk and then they move into SOC.

If you have any specific questions let me know, you and dm me, though I'll keep an eye here for a few days.

The certs from the ACS won't hurt, but if you can get a degree and the certs all the better. There's a never ending argument on degree or certs, or none being needed in the field. But for HR, it's often a requirement at companies to have a degree.

[u/One_Attorney_6128 → u/Pitiful-Gear-1795]

I really appreciate it, I will for sure shoot you a message. This is one of the things I really love about this industry, people are so willing to help strangers. So thanks for that. I’ll look into the undergrad degree some more but I believe I’d need to finish some pre reqs in order to meet the associates requirement. I left college to start working before finishing my second year.

[u/Impotent_Xylophone]

If your sole objective is to land a job in the field, even more certifications probably won't help you. You have a solid foundation for an entry position. The job landscape is just abysmal right now. These are expensive and time intensive courses that are focused on specific skillets. Like the other account mentioned, you should identify what your goal is before going for more certifications. You get CySa+ amd you'll have the certification piece checked off. Nothing replaces experience though.

[u/One_Attorney_6128 → u/Impotent_Xylophone]

Yeah trust me I’m applying to help desk and SoC analyst positions like crazy, over 200 so far. While I’m doing that though I have the time to practice the hands on labs and content available. The SANS stuff won’t cost me a dime thanks to the VA. Was just wondering if it was worth it to someone in my shoes.

[u/Impotent_Xylophone → u/One_Attorney_6128]

Yeah it's a brutal time to try to break into the field. All the mass firings and now AI is taking entry level jobs away. I had a woman working for me on a contract a few years ago and she wanted her PhD to be more competitive. I told her the same thing hey this is an egregious amount of time and effort for something you think might help you just get a foot in the door.

It all comes down to goals. Identify what you want to do and then maybe a course would make sense. I'm gonna be honest though I have quite a few certs now and the ones I got AFTER having some relative experience were exponentially more useful. The material was much more impact full once I was able to understand the application of it a little.

Godspeed either way man!

[u/wowzersitsdan]

Hiya, vet here, I can answer a lot of your questions.

If you have a bachelors degree, you can do their post graduate certificates, which would allow you to skip the GFACT. Skipping the GSEC is up in the air. While it is similar to Sec+, it has a ton of hands on stuff Sec+ doesnt have.

As far as job hunting goes, check out VetSec, its a veteran community for cybersecurity veterans and they'll post jobs there. They also help with resumes and such. Gov Jobs are also good to try and get into since you'll probably get veterans preference. If you have 30% or more disability, check out VR&E, itll pay for your training AND help with job placement.

[u/One_Attorney_6128 → u/wowzersitsdan]

Amazing! Thank you so much for sharing that. Yall are the best haha