1

I have been working in the IT field for about 6 years. I am very happy in the IT field but I am fascinated by the Cyber Security Arena. I do a lot of reading on my own, and I also set up Virtual Labs with Linux Kali and various other Operating System. I would love to get into this field, I have looked into the Certifications that might help get my foot in the door, such as OSCP, CSISSP, Security +, and CEH. After looking at the job posting in the Cyber Security field it would seem that a Bachelors Degree is almost required. Are their any Penetration Testers or Security Analyst that can provide me with some advice on how to break into this area of the field?

4 Spice ups
2

Have a read:

2 Spice ups
3

First of all, aim high, but realize which certs are entry level and easily obtainable vs. those that probably require years of hands on experience. OSCP and CISSP are the latter. Security+ is the former, but still a very good and widely recognized foundational cert. CEH and the new-ish CySA+ fall somewhere in the middle.

Asked for advice like this, I can only recommend what worked for me (and my job now is mostly security related). Take a job at a good company that’s going to invest in your training, let you grow outside the role you were hired for, and ideally, has you working with a team of more experienced colleagues that will serve as mentors and educators.

I began my work in security after being hired as a Windows administrator at a company that contracted out their security and firewall configuration tasks. I started reading and studying on security, got Security+ and Cisco certified. I bought some used equipment and built a home practice lab. Once I was confident enough that I knew what I was doing, I offered to step up and take over the security role and saved the company big money by ditching the security contractors. My security career has grown exponentially from there.

2 Spice ups
4

In the US there are quite a few DoD contractor jobs that come up if you have or can get a Security Clearance. For those Security+, CFR, CySA+, CEH, GIAC, CISSP will allow you to qualify for different roles. See the 8570 approved certs: https://iase.disa.mil/iawip/pages/iabaseline.aspx

I know from experience that there are many working in those roles that have very little experience - if you can check the boxes above they usually will train you in a very specific vertical role. If there isn’t a post or base near you, you may have to relocate.

A degree is good but usually only required to move into higher level positions.

For a comparison of some of the security certs and their usefulness see my video: https://cdn.articulate.com/rise/courses/98WrQbXmM3OiQwGA-u6wQVEUcBlZQHVg/transcoded--DreqSRjLeNmXrhA-080317-it-security-certifications-sd-16.mp4

1 Spice up
5

Don’t get caught up in chasing certs. Get them because they further a goal, not because they look cool next to your name or feed your ego. Break stuff. Set up a lab and learn how to use NMap, Wireshark and Nessus. Know the OSI model like the back of your hand and absolutely learn Linux. Windows may be the O/S that powers most of the business world, but Linux powers the web and a whole slew of security tools…

3 Spice ups
6

I’d say you’re just seeing the “HR” wall. It’s common practice for them to post way over-the-top requirements in hopes of being able to underpay an overqualified candidate (“maximizing their value” or whatever).

You just have to be able to prove your salt one way or another. If you have a legitimate person who is willing to vouch for your abilities and/or eagerness to learn most companies will take that (like former employer).

I could be wrong but I think most companies only truly require a degree for their managerial positions, not typically the technical roles.

1 Spice up