How do you progress as a cybersecurity professional?

It is also very important to understand what sectors of cybersecurity you are aiming for as a future career. Cybersecurity boasts a very wide array of concepts and technologies that often require completely different skillsets and career planning. Are you aiming for an offensive role requiring penetration testing and security assessment skills ? Are you looking to be part of a blue team requiring incident response and management skills ? Are you more interested in the GRC side of things requiring a more consulting-based and compliance-based skillset ? Understanding your aims will help you understand your current level relevant to your target goal and the next steps to take to make it there efficiently.

It is essential to ask yourself these 3 questions: 1 - What is my current skill level 2 - Where do I want to be in cybersecurity in the next 5 years 3 - How do I get there A lot of time professionals simply focus on landing that next cybersecurity cert instead of building their skills. I often recommend finding your dream job posting on LinkedIn and gapping yourself against it . Do an honest assessment and see what skills you are missing and how can you get them

The growth is an ongoing journey. Expand your knowledge. Stay ahead of evolving cyber security threats and learn the new technologies. Gain exposure to different domains of cybersecurity. Consider getting a lead role so you can see the environment from a broader perspective.

I can’t say enough about networking and mentoring for prospective cybersecurity professionals- find out what seasoned professionals in the varying fields are doing- learn how they started, understand the nuances of the more than 50+ areas in Cybersecurity to see where you have interest or passion- understand that there are layers of cybersecurity expertise I.e going from a junior analyst to a seasoned forensics expert doesn’t happen overnight- training, knowledge, experience for each area - get exposure in the many domains to build your expertise. ISACA and ISC2 has great materials for their different certification programs that I would suggest reading through again and again- this helps to lay out many cyber domains and to stay current.

Consume as much knowledge as you can. For me, I learned a little about a lot instead of a lot about a little. I tried to stay broad. I worked in IT, Defense, Offense, GRC (PCI), and then started working as a vCISO on contracts. It was only because of the broad knowledge that I was able to do this. Keep your eyes wide open and consume as much knowledge as you can. If you want to be an expert at one thing, dive deep. If you want to be more broad, stay shallow.

The cybersecurity industry is about continuous learning but then you get to choose where you want to go. For example from the get go in this time of my life I chose not to work in SOC path with a possible after hour in call duties as a mom of 4. I wanted a fully remote etc so there is a path and speciality for everyone. I also learn best fro. People conversations like podcasts, shorter news update, club house room conversations, talk with a colleague, LinkedIn audio events, LinkedIn posts/ comments etc versus a long video tutorial (I will fall asleep guaranteed!). Learn how you best learn and find the right network for you!

Continuous Learning: Stay updated with the latest threats and technologies, and pursue certifications like CISSP or CEH. Hands-On Experience: Gain practical experience through projects, lab work, and real-world challenges. Networking: Build a strong professional network by attending conferences and joining industry associations. Specialization: Consider focusing on a specific area, such as cloud security, penetration testing, or incident response. You can also refer my book 'Fundamentals of Information Security " Discover essential insights and strategies to navigate the cybersecurity field, develop your skills, and achieve your career goals.

As someone who has been in InfoSec/IT for 15 years, I can honestly say I benefited from accepting tasks others didn’t want to take, as in IT audits, or specialized IT projects. That’s essentially how I found my niche in GRC. Sometimes taking a job you aren’t necessarily crazy about takes you down a path to other jobs you might really enjoy! Also, never ever stop learning! Attend as many webinars as you can, join security groups and network, network, network!

Personally, I prefer online courses and certifications as they offer structured learning, but I'll also supplement with blogs, webinars, and conferences for broader insights. Budget and time constraints will play a significant role in my choices, so it's important to balance these factors while planning my path.

I’m going to provide an alternative viewpoint on the CISSP. I’ve stated this before, but you have to determine why this is important to you, and why you’re going to put in the time and effort. Your why MUST be bigger than the struggle to get there. If you’re young: I went from scratch to 150 pages of notes over 30 days to study for and demolish the CISSP. I *may* have missed two questions. How did I do this? I made the decision that I had no fall back. This was my one shot, my one opportunity, and I was going to pour everything I had into this. This was going to be a big career change. I was 27 coming from Nuclear Power. I wanted a different future. No diversions. Pure focus. 10-12 hours a day. Five weeks. What do you want? And why?

The CISSP is likely the most widely recognized cybersecurity certification but requires years of experience working in the field plus passing the certification exam. SANS/GIAC certifications are also highly regarded due to their deep and specialized outcomes. For entry level certifications, I usually recommend CompTIA’s Security+, which will provide a lot of foundational knowledge. It also signals to potential employers your commitment to develop your skills in cybersecurity.

Certificates are usually like a varnish, usually necessary, sometimes of high quality and good coverage, almost always thin, and sometimes opaque. They are usefull and required in a world where there is not much time and where baselining individuals against a certain level is common practice but let's not be fooled by them.

Im am currently studying and preparing to take the CompTIA Security+ certification exam. I’ve learned this Cert is basically required by most government jobs. These Jobs making up about a third of jobs in Cybersecurity. Don’t miss your chance because you don’t have the right Cert for the job your seeking!

Certifications like CISM or CISSP are a great approach for progressing a cybersecurity profession. But if you're not good at testing like myself, just taking these courses themselves can do wonders for you but only if you take the following approach. Look for ways in your current profession where you can "apply" your newfound cybersecurity knowledge. Yes, cybersecurity courses and certifications are great, but they aren't everything. Get yourself entrenched in cybersecurity challenges. Then figure out how you're going to solve and navigate the situation. Not much can beat On-the-job training.

Develop a pet project, communicate about it, grow it like a baby. Participate in the larger cybersecurity community. Learn/ learn and be humble, there will always be someone more knowledgeable than you.

Hands on is critical to succeed in cyber. There are free and easy ways to do this using a variety of projects available on YouTube or Github that can be done as part of a home lab. One recommendation is Josh Madakor's YouTube channel, on that, he has a video of a homelab for SIEM (Sentinel) and even includes how to represent what you learn on the CV. Hands on projects are a great way to demonstrate your skill to potential employers. One other way to get hands on for Microsoft Security is their recent Applied Skills credential. This is a 2 hour lab with specific tasks and you get a certificate at the end to validate your skills.

Becoming a contributor to a GitHub project is often the easiest way to gain recognition and hands-on experience without any current role familiarity. Another big factor is spinning every day tasks of other roles - like patching and antivirus - into security tasks like vulnerability management and EDR on a resumé.

Something I’ve learned from my mentor: “Master where you are.” Before going out and adding certs to your name, take inventory of what you already do. Most of what cybersecurity is can be found in every day actions. In other words “Transferable Skills”. Figure out how what you are already doing can be translated into cybersecurity best practices and build from there. Simplify your approach. For example we look both ways before we cross the street. In the cybersecurity world we call that “risk management” and the pedestrian signal would be “risk mitigation”. So you see the certs mostly teach you what things are (vocabulary)but your experiences teach you why things are (application). And there’s a big difference. 👊🏾😉

From my experience, I believe that hands-on skills earned via practical experience, especially in Capture The Flag (CTF) challenges, are often more valuable than certifications in the cybersecurity field. While certifications provide a strong foundation, hands-on skills/CTFs offer a unique opportunity to apply your knowledge to real-world scenarios and develop problem-solving skills that are required in cybersecurity. They allow you to work through actual security challenges, which can be more rewarding and relevant. Combining practical experience from CTFs with certifications can be a powerful way to progress as a cybersecurity professional and advance your career.

I love the "reading one hour a day" rule (you can do this in chunks, it doesn't have to be all at once) when staying up to date with the industry. It can be challenging to know what exactly to stay up to date with so you can start with having google alerts for all things cybersecurity and then slowly hone it down to the subjects you're more interested in as time goes on.

In the dynamic world of cybersecurity, keeping pace with advancements is a must. I've ingrained the habit of consistently immersing myself in industry-related content, participating in discussions, and staying adaptable to emerging technologies. As someone passionate about cybersecurity, I've discovered that weaving everyday learning into my daily routines isn't just a strategy—it's a key method to stay attuned to the heartbeat of the industry. This approach ensures that I not only stay informed but also actively contribute to the ongoing dialogue and innovation in the cybersecurity landscape.

Cybersecurity is an ever-living domain. the more technology grows, the more risks materialize and the more need to protect and defend. Every year tons of new acronyms are created, and new solutions emerge. But the core root of the security and risk management domain remains unchanged i.e. Measure the risk, Manage the risk. As cybersecurity professionals we don't have solutions to solve everything, to stop all the threats. But our single most purpose is to measure the risks and manage them to the level of acceptance by the organization or entity we protect.

A great easy way to keep up with the industry is by listening to the SANS Internet Stormcenter podcast podcast every day, it's usually around 5 minutes long and can make for an easy listen during a commute to work. Through this podcast, you're aware of the latest cyber happenings, it helped me a lot when I was doing vulnerability management.

Cybersecurity is an ever evolving domain and you need to be updated regularly to keep yourself relevant. Podcasts and blogs are defenitely helping me. Also online communities and forums have a wealth of information, but need to make sure these are reputed sources.

Learn how to listen to those you interact with every day of your career. Listen to what they are saying about a situation and then try to understand why they are saying it. Is it a point of view? Are they missing information? Are you missing information? Is there a larger issue? You'll need to learn the tools and tech, but your understanding of security concerns will come from people. Those conversations will give you insight into how a problem occurred, but more importantly, how to prevent it in the future.

To really make sure you understand current trends and issues in cybersecurity, always make sure you can succinctly describe why executives and business leadership should care. While we can study how to emulate adversarial activities all day, being able to illuminate “why” defending against the threat is a business imperative is far more powerful and reinforces your expertise as a cybersecurity professional.

There are two sides to cybersecurity. There is the technical side, like learning all the things that you need to learn to manage and respond to controls. But security is deeply rooted in people. Their behaviors as threat actors, victims, and/or partners, is the single most important aspect in security. Learning how to influence all of those people in a way that reduces risk to your organization is at the root of security. Even a level 1 analyst needs to partner well with the O365 team, or the desktop team, or even how to kindly educate an executive to no click the email that says "Your amazon account has been suspended:. Lean into influence and relationships. it is the security force multiplier.

Never stop learning. Always stay updated on current trends. I do this by reading weekly newsletters from Bloomberg Technology. Network every day. Try and get to know someone new every day. It will pay off. Cheers 🥂

Don't do cybersecurity for security sake or just for compliance. It's about securely enabling your company business/ transformation. Thus, you need to learn soft skills to partner/ work with your bosses and business owners to help them understand the importance of security when developing their lines of businesses. Security-by-design also applies to digital transformation and not just systems.