- It’s mostly meetings, audits, report writing/reading, and then more meetings. Yes, there is a large technical component, but it’s often overshadowed by paper pushing. This isn’t just true for blue teams – it applies to red teams too. One pentest report could have 12–15 pages dedicated to one IDOR vulnerability.
- Cybersecurity degrees are almost never worth it. College is great, and it’s even better when you’re studying a tried and true degree like Computer Science, which will always offer value well into the future. Howevr, cybersecurity is not an entry level field, and very few people actually graduate and move directly into a JR Sec Analyst/SOC role. It just doesn’t happen. You’re better off doing a 2 year IT program that covers computer science fundamentals/programming from an accredited school, or a 4 year CS degree from a traditional university. If neither of those are an option due to cost or flexibility, then go for certificates from known and reputable vendors – not some random LinkedIn Learning module nobody has heard of..
- You’re going to need knowledge across several domains: networking, programming, OS architecture (deep familiarity with Windows, Linux, and macOS internals.. especially command line, file systems, permissions, processes, and memory), incident response, risk management, threat analysis, and much more. Most importantly, soft skills. You will not get hired if people don’t want to work with you.
Seriously, you need to be aware of this if you’re not already 🙂
