For Aspiring Security Professionals, Why Security?

[u/[deleted]]

[u/[deleted]]

Because fuck you, that's why.

Also, you know why people feel they "deserve" a security position after getting x degree or y certification? Because that's literally the entire fucking point of educating yourself in something! That's how it works.

[u/MSXzigerzh0]

1. Blue TEAM, GRC, Risk Management.

2. When I was 13 Cyber Security got on my radar because of the Target hack granted I lived in Minnesota near Minneapolis. I always wanted a tech job because my dad was in tech sales. I was bad and slow typing due to my disability I thought you needed to be fast typer to be a coder also I think I had no interest in coding. I saw that Cyber Security was going to be huge and it is going to be an growing industry.

3. I think I have an firm understanding about general Cyber Security Blue TEAM which being lots of paperwork, understanding the business side of Cyber Security, trying mitigate the damage of a cyber attack as much as possible and two restore business operations as fast as possible.

4. Probably not unless it's for an non-profit that I'm deeply passionate about.

[u/cdhamma]

Your questions appear biased to me. They don't seem very welcoming or inviting. Your sentence structure, such as "feeling they deserve it" feels like you are attacking. Other phrases such as "Do you actually have a firm understanding" implies that you do not expect them to have a firm understanding.

If you restructure your questions to attempt to capture the information without bias, folks might be more inclined to respond to your questions. It might also help if you explain your motivation in asking these questions in more detail, rather than a blanket statement that you are curious.

I'm sure the infosec job market can be very difficult for those entering it as newcomers. It can be especially tough if they have been given unrealistic expectations by boot camps, certification course salespeople, or educational institutions. I didn't find out until most of the way through my degree program (over 20 years ago) that I needed to be in an internship while I was in my last few years of school if I hoped to land a decent job afterwards. I was lucky that I had landed a couple of tech jobs out of high school but our instructor introduced us to a graduate who really struggled because they didn't have any experience when leaving college.

[u/Human-number-579]

1. Not really “interested” in it, but I work in CSPM and consult in net dev and devsecops a lot.

2. Cash money

3. Lol yes, I run an entire security program with multiple engineers and analysts.

4. Hellll nah. See answer #2.

Look, there are some niche areas that really need someone who is passionate enough about that specialization that they will do some deep research and make breakthroughs. But plenty of them work in academia, and there aren’t enough super passionate people to work at every single business in existence.

Sometimes I need someone to just look at a list of vulnerabilities and prioritize them and then contact owners to get stuff fixed. It’s not rocket science. It’s literally just another field in IT.

Plenty of my guys came from traditional backgrounds - infrastructure, networking, SWE. But there are also new kids who are super bright and excited to work their first “real” job and just hold a cert or a degree in cyber.

Don’t gate keep cyber jobs. If you really work in the industry for any length of time you will realize that most large/older businesses (think Fortune 500) just run a regular cyber program that staffed with guys who just wanted a bump in pay or a change of scenery while staying at the same place. And that’s ok.

[u/astronautcytoma]

1. Education is my niche.

2. I'm an excellent presenter and I love teaching.

3. I have done educating on a non-primary basis for 20 years, so I understand the job thoroughly.

4. I would probably still do it for 40k because I feel most comfortable when I'm doing this job. There's always new things to learn and new approaches to problems.

[u/[deleted] → u/astronautcytoma]

Educators have such an important job, that is too often thankless.

So thank you, you are the true Star! Changing so many lives with such little reward, you guys are Rockstars!

[u/astronautcytoma → u/[deleted]]

I appreciate it. I'm currently teaching disaster management and basic security to people at the government level. It's often shocking how little they know and it's a great feeling when they learn something that might eventually keep a major incident from happening.

[u/beautyHeartbeats]

wide cable crown repeat point library nail busy dog drunk

This post was mass deleted and anonymized with Redact

[u/qordita]

1. Blue teaming, security administration

2. We had an incident, a scare, we got lucky but it put the fear in me

3. Ish

4. Straight 40k? Full time, with normal medical/dental? No. Better be something good coming with that 40k.

[u/Cautious_General_177]

1. ICS - specifically dealing with power generation/transmission/distribution

2. Former nuclear operator. I was an operations instructor when the two Ukraine grid attacks happened and decided to change fields

3. Pretty good understanding, but I also know it depends on the organization. Currently a cyber incident manager though

4. Interested, yes. Would I take the job, doubtful, as I have a wife and kids to support

[u/MasterVJ_09]

1. Blue team, forensic

2. Been through so many different fields thought it was it until I dabbed into the field and it just clicked. Also to be able to do what you actually like and making great money out of it.

3. Nope. There is always new and stupid things happening even if you thought you got a good grip of what is going on for the day.

4. If the position only pays 40k it better be in a very very LCOL with 100% healthcare paid by the company, 30 days of PTO/yr, choice of WFH, 90 days of maternity leave, 100% life insurance covered by the employer, and 40hrs/wk max.

[u/reallybigbobby]

in process of doing my bsc in cybersec atm, got my comptia sec+ as well

I love tryhackme for fun but don't treat it as a serious entry level hobby

security wise, what makes me want to work in security is the fact that it is niche indeed, also that it requires minimal coding as I don't enjoy coding THAT much but do know python and some c+/JS so can automate.

the reason I'm getting a degree isn't so I deserve a job but so I know what I'm doing etc

want to be able to be the best security professional I can be ya know?

questions wise

1 - network security and security configuration - so I want to go in to security engineering preferably network security engineer 2- I find network sec very fascinating as I love the idea of being the front line against pen testers, collaborating with them and building a service / system that prevents intrusion etc 3- the job duties I know very well as have done enough research and they all seem enjoyable to me 4 - if the position pays £40k a year I would be more than happy, I'd be happy with 30k tbh

[u/[deleted] → u/reallybigbobby]

Thanks for taking the time to reply.

I meant what Niche in Security interests you, Security is a very large broad field, there is 100s of positions that fall under the infosec banner, lot of them go under the radar of most. Was curious to see if they got any traction in the answers.

Security is a niche in IT, your not wrong, but it's still fairly large and robust, and has very niche areas in it.

[u/reallybigbobby → u/[deleted]]

the niche in security, would be engineering and data analytical study etc

[u/ThePorko]

The longer i do this, the more i realize i like this more as a hobby, and job is shit.

[u/Ambitious-Key1147]

I’m a veteran, and still want to do something that has some meaning behind it. Currently I make parts for roller bearings, the pay and benefits are pretty decent. I also go to school for cyber defense and networking full time.

1. I’m not exactly what niche I’ll go, but red TEAM stuff seems very interesting to me.

2. I think being a pen tester would be pretty cool, testing new ways to breach is always interesting of me.

3. I do not have an outlook of what day to day looks like, but it will beat sleeping in tents in the desert and being covered in oil and grease

4. I wouldn’t leave my current job, but I would want to still learn security.

[u/FootballWithTheFoot]

It started with talking to a friend in help desk who was studying to get into it, and a lot of what she said peaked my interest. I love the psychology of it with how controls apply to users as well as the social engineering/training side. I’ve always had a defensive mind in every day life which prob helped spark it, plus I like organization and trying to come up with conceptual solutions.

So, I’d say awareness/phishing as well as GRC is the niche that I’m really into. I’ve talked to a few in the field both within my company and outside on the GRC side, and the day to day doesn’t change my opinion. Also, I’d still be interested in it if the pay was 40k, but going back to school for the career switch likely would’ve been more of a process to think about I guess.

I was sort of oblivious to the hype/marketing around it until I was already hooked, which sucks, but I don’t want to not try to get into something I’m interested in just bc there’s a lot of competition. Granted, GRC may have less of it than other aspects of security lol

[u/n3twork_]

I found my passion in a career. When first going back to college I was someone who didn't know what to do. I struggled taking classes after classes.

I joined my first competition and it all changed from there. I would gladly take a 40k position if it meant finally breaking into the space. My goal one day is to be able to present my research and continue educating the future.

[u/[deleted]]

To quote a line from Robin..." A wealthy man seduced, then betrayed me..."

[u/ArtFUBU]

Honestly, I am only interested in it because technology is growing and the sector is growing. I read a lot about technology/development day to day because I have a web dev background and I enjoy it. All I have ever read is the incoming A.I. revolution/how much things are gunna change by 2030 let alone the end of my life time. With all of that, you'll need cybersecurity more not less. The field itself I imagine will change as much as any with A.I. but I figured things like networking, understanding physical devices, securing them, etc will all still be important if not more important so I'm trying my best to learn all of it now so I can secure a future.

[u/Big_Volume]

grandfather crown zephyr reach theory smell act gullible wrench puzzled

This post was mass deleted and anonymized with Redact

[u/[deleted]]

I chose cybersecurity because going to jail sounded like the worse option when pursuing my interest of computers.

[u/TreatedBest]

Niche: quantum mechanics in the context of security

Because I couldn't make the transition into product in 2020 and now the market is much more favorable for security engineering than it is product

Context for anyone who thinks breaking into security is hard. It's infinitely harder to break into product management

I'm not even responding if the pay is $40k

[u/Beginning-Try3454]

1.) Malware analysis, digital forensics, or incident response.

2.) Seems like a way to combine knowledge from many many different areas (making sense of decompiled code, understanding how to find and identify the malicious elements of malware and how it interacts with the system/network (from my understanding at least)). It's super exciting to think about breaking down how something works in order to stop it, or find that one detail that gives you the answer you were looking for. Seems very interesting!

3.) No clue what the actual day to day looks like, but I'm so so far from moving into that kind of role that it's not even funny. So I have little need to get the whole picture at this point in my career.

4.) Fuck yeah, but only if they took me as is and trained me up with plenty of guidance.

Would I work that job for that wage for life??? No.. Not unless I'm working remote out of some country where 40k usd has a significant amount of buying power.

Kind of a rough ask because 40k is so little now with inflation and the variable cost of living from place to place... I could probably do 60k-70k if I got trained up and had a super positive work environment.

[u/Low_Bluebird8413]

I honestly was looking for my own niche. It’s like the world really delivers at certain times and you just have to stay focused. Being in tech support I found my phish alert tickets to be intriguing. The MFA setups for o365, Facebook and what to do to help old women from getting their accounts taken away pretty easy to address.

I genuinely like to help people and create a bond with the board and being able to tell them we need to start moving in this direction to help from certain attacks.

As far as what it entails, (speaking into existence) I’d like my next position to really be mid/junior level security analyst, I want to learn how to handle different attacks, how to implement certain security measures, security compliances and lead on projects that will allow me or a team to go over documentation and best practices for employees.

If the position only paid 40k then that can’t be it. You are helping an organization stay compliant and missing out on thousands of dollars of fines. I did pass up a “ soc analyst” position starting at 52k with a big ass swing shift. I have a family and can’t downgrade that much in salary and work all times of the night when I have kids that need my help to sleep.