Entry-Level Positions for Aspiring Cybersecurity Professionals
Malia, a Head of Cybersecurity & Engineering, explains that while entry-level cybersecurity roles exist, a "basic level knowledge of computers" and understanding of network infrastructure is crucial; a Security Operations Center (SOC) analyst role, involving incident response and threat analysis, is a common entry point, with a year of experience often opening doors to other areas like GRC (governance, risk, and compliance), application security, or cloud security.
Network Security, Cybersecurity Operations, Compliance and Risk Management, Technical Skills, Entry-Level Career Paths
Advizer Information
Name
Job Title
Company
Undergrad
Grad Programs
Majors
Industries
Job Functions
Traits
Malia Mason
Head of Cybersecurity & Engineering
Commercial Insurance Company
University of Pittsburgh class of 2011
EMBA UCLA class of 2023
International Relations & Affairs
Insurance
Product / Service / Software Development and Management
Disabled, Took Out Loans, Worked 20+ Hours in School, Veteran, LGBTQ, First Generation College Student
Video Highlights
1. Entry-level cybersecurity roles exist, but require a basic understanding of technology, such as how the internet works and basic computer knowledge.
2. A Security Operations Center (SOC) analyst is a common entry-level position, involving incident response, threat analysis, and working with IT support.
3. Governance, Risk, and Compliance (GRC) is another entry-level path, focusing on regulations and compliance; it requires less technical expertise but still necessitates understanding cybersecurity terminology.
Transcript
So, do you understand how the internet works?
"And that seems like a trick question, a very simple question. Can you describe to me how the signal flows from the internet service provider throughout the network? How does it get to your laptop? Because that's how an attacker is going to get in.
So, do you understand the different roadblocks you can put along the pathway in order to protect your own laptop? Understanding network infrastructure at a basic level, or firewalls, or basic computers is a requirement. You don't necessarily have to be a developer, or know how to code for every single role.
It can be helpful, but having at least a basic level of knowledge of computers and a moderate understanding of how they work and how you can edit things, that's really required. So, that is where you would have what's called a SOC analyst: a Security Operations Center analyst. There are a lot of entry-level roles there.
That's where you're going to do incident response. You might review a phishing email, or respond to a suspicion like, 'I think my computer's acting funny.' You might work closely with IT support. When IT feels something is more like a security concern, they can advise and see what's going on, do research and threat analysis to figure out what's happening.
Is it the bad guy? Is it just a user who doesn't know what they're doing? Is it a computer messing up? That can be you. That can lead to incident response, vulnerability management, patch management, secure architecture, DevSecOps, application security, Cloud SecOps, all that sort of stuff.
So, all the engineering track. There's also GRC: Governance, Risk, and Compliance. I talked about that a little bit earlier. I wish I had learned a lot of the different regulations. We need a lot of help in the industry with the ton of different privacy laws and regulations popping up all the time.
I had to quickly learn the new SEC security regulations a couple of years ago. I built an entire program around that when I was at a major consulting firm to help prep companies for their SEC filing. Understanding how to dig into these regulations can be learned in an entry-level role.
You don't have to be as technical. You still have to understand the words and terminology, like what is encryption, but you don't have to be as technical. That can be a way I've seen a lot of folks gain entry into this field: through Governance, Risk, and Compliance.
Once you're in, I found that once you have about a year's worth of experience in cybersecurity, that's the magical number. You can kind of go wherever you want and move around within the field. So, don't feel like you're stuck; you can always shift and go to different roles even within the industry.
The biggest pain point is just getting that first step in the door. That's the hardest part of this industry. And the one thing that frustrates me most about this industry is the pathway for an entry-level person can be really challenging. Hopefully, that helps."