Guide to Cyber Security Careers
By: Jon Good
https://www.jongood.com
Table of Contents
Introduction .................................................................................................................................................. 3
Certifications ................................................................................................................................................. 4
Vendors ..................................................................................................................................................... 4
Education ...................................................................................................................................................... 6
Certifications vs Degrees............................................................................................................................... 7
Building a Home Lab ..................................................................................................................................... 7
Computer .................................................................................................................................................. 7
Desktop vs Laptop ................................................................................................................................. 7
Build vs Prebuilt .................................................................................................................................... 7
Components .......................................................................................................................................... 7
Virtualization Software ............................................................................................................................. 8
Soft Skills ....................................................................................................................................................... 9
Job Descriptions .......................................................................................................................................... 10
Blue Team (Defensive) ............................................................................................................................ 10
Red Team (Offensive).............................................................................................................................. 10
Career Roadmap ......................................................................................................................................... 11
Timeline................................................................................................................................................... 11
Additional Resources .................................................................................................................................. 14
Career Coaching ...................................................................................................................................... 14
News & Threat Intelligence..................................................................................................................... 14
Professional Associations ........................................................................................................................ 14
Training ................................................................................................................................................... 14
Final Thoughts ............................................................................................................................................. 15
Guide to Cyber Security Careers
2
https://www.jongood.com
Introduction
Hello and welcome to my FREE eBook, Guide to Cyber Security Careers. Navigating any career field, and
in this case Cyber Security, can be particularly challenging for those who are either brand new to the
industry or those starting to gain experience in the field. The challenge is not necessarily because there
is always a lack of information available, but it is because there can be implied knowledge and usually
the advice is not easily adjustable for situations different from the writer. With this eBook my goal is to
provide a foundational way of objectively looking at the industry and ways that I approach career
progression.
This eBook will cover a variety of topics critical to the Cyber Security field to include:
•
Certifications (Microsoft, Cisco, GIAC, CompTIA…)
•
Education (college, vocational training, online training…)
•
Building a Home Lab
•
Soft Skills (communication, project planning…)
•
Job Descriptions (Blue Team and Red Team)
•
Career Roadmap
•
Final Wrap Up
If you have any questions, send me a message on social media found on my website
(https://www.jongood.com/). You should also consider signing up for the Cyber Training Pro platform
(https://www.cybertrainingpro.com/) where you can get the training that you need and career services
(i.e., career coaching, mock interviews, resume and cover letter reviews, etc.). Additionally Cyber
Training Pro has a private community for students to interact with each other, CTP staff, and other
industry professionals.
Guide to Cyber Security Careers
3
https://www.jongood.com
Certifications
What is a certification for Cyber Security? Unlike professions such as Engineering, Accounting, and
Medicine…Cyber Security does not have a Professional Certification or Professional License requirement
to become employed in the industry. Instead, we have certifications for many different skills, and each
can be beneficial given the right job. When it comes to the overall “value” of certifications for a Cyber
Security career, I highly recommend learning about “The Cyber Security Career Continuum”
(https://jongood.com/the-cyber-security-career-continuum/).
I also encourage you to watch my video on Cyber Security certifications (https://jongood.com/topcyber-security-certifications-for-coolest-jobs-2023/) where I will walk you through the best options to
help get you into a Cyber Security job. Below, I have also provided a short summary on the major
certification providers including when you should consider looking at each.
Remember, the hardest certification is not always the best or most valuable when it comes to getting a
job.
Suggested Resources:
•
•
•
CompTIA Roadmap: https://www.comptia.org/content/it-careers-path-roadmap/cybersecurityspecialist
DoD 8410 Mandate: https://www.sans.org/dodd-8140/
Guide to Cyber Security Careers eBook (You are reading this now)
Vendors
CompTIA (https://www.comptia.org/):
CompTIA is known as the entry level certification vendor of choice. They provide certifications on a
variety of different skillsets from repair technician (A+) to networking (Network+), to security
(Security+). The certifications from CompTIA are vendor neutral, meaning they focus on the concepts
but not necessarily the technology.
eLearnSecurity (https://www.elearnsecurity.com/):
Primarily focused on penetration testing certifications, eLearnSecurity uses practical exams to make sure
you can walk-the-walk and create a final report to show your findings. eLearnSecurity is less known
when compared to other vendors but there is value to be had here.
GIAC (https://www.giac.org/):
GIAC has certifications covering just about anything you can think of such as reverse engineering,
incident response, and penetration testing. These certifications are highly sought after, but without the
SANS training, you should not even look at these. (See SANS)
Guide to Cyber Security Careers
4
https://www.jongood.com
ISACA (https://www.isaca.org/):
ISACA focuses on global adoption for the audit, governance, risk, and privacy areas of Cyber Security.
The CISA and CISM are two widely known certifications produced by ISACA, but all of these have an
experience requirement more suited to 3+ years into your career.
ISC2 (https://www.isc2.org/):
ISC2 (ISC squared), is most known for their CISSP certification, which is the “gold standard” when it
comes to Information Security & Cyber Security certifications. This vendor is not necessarily as useful for
those trying to break into the field from zero knowledge because most of their certifications require at
least a few years of experience. Do not get me wrong though, most if not everybody should be aiming
for the CISSP later in their career.
Offensive Security (https://www.offensive-security.com/):
Offensive Security is known for their penetration testing certifications. There is an extensive lab
environment, where you can break into simulated systems and hone your ethical hacking skills. The
courses and exams are challenging but if you really want to be a penetration tester, you need to get at
least the OSCP to have some real credibility.
SANS (https://www.sans.org/):
SANS offers the highest quality training available for Cyber Security. Typically, the best value comes from
going to a physical conference to not only learn but also to network with highly motivated professionals
and experts in the field. The course material is developed to prepare you for the GIAC certification exam,
but do not kid yourself…these courses are quite expensive. I would not look at these until you have at
least a few years of experience, or if your employer is willing to foot the bill.
Security Blue Team (https://securityblue.team/):
Security Blue Team is a newer certification vendor that launched their certification program in mid2020. The thing that differentiates this program is that the skills you will learn are specifically focused on
security operations and therefore they are highly technical with hands-on skill development. Although
these certifications are still relatively new, they are gaining traction quickly in the industry.
Guide to Cyber Security Careers
5
https://www.jongood.com
Education
Within the last ten years, the amount of college and university Cyber Security programs offered has
increased dramatically. Prior to that you typically had the option of getting a Computer Science degree
or going straight for certifications. The National Security Agency (NSA) came up with a program several
years ago called the National Centers of Academic Excellence (https://www.nsa.gov/resources/studentseducators/centers-academic-excellence/) to develop curriculum for Cyber Defense and Cyber
Operations. I would highly encourage you to research these schools and be careful if you decide to go
with somebody else.
With degrees, you are basically going to find three different categories of programs: certification-based,
technical, and non-technical.
Certification-Based:
The major players in this type of degree are Western Governors University (https://www.wgu.edu/) and
SANS (https://www.sans.edu/). The general idea is that all your coursework is based around
certifications. When it comes down to it, the major benefit for this type of program is focused learning
without a lot of “extra” or general education classes. With WGU, they have a large student population
so you can benefit from all those students going through the program. With SANS on the other hand,
you can have some additional networking opportunities and frankly you get the best certifications
possible. Keep in mind though that the SANS program is significantly more expensive. The final point
with this program type is that all these certifications can be achieved without going through these
programs.
Technical:
The technical programs that exist are generally from more traditional universities and colleges. From the
variety that I have seen, the programs are typically linked to Computer Science or Engineering schools
(departments) at colleges or universities and have some sort of programming requirement. If you are
looking into a master’s degree program, this can be challenging if you do not have a technical
undergraduate degree because you are likely going to need additional classes to qualify.
Non-Technical:
“Non-technical” programs honestly can range in a variety of topics that can also include technical
components. Expect to learn about policy and there is a good chance that you will be geared for a more
managerial or Governance, Risk and Compliance (GRC) role. These programs can link to Business,
Engineering, Computer Science, Computer Information Systems, or really any other school (department)
at a college or university.
Guide to Cyber Security Careers
6
https://www.jongood.com
Certifications vs Degrees
This really depends a lot on you. Obvious factors include ability to focus, cost, time commitment and
many others. People have been successful go either way. Ultimately, if you go for a degree then you
MUST get certifications because it is a natural part of our industry. If you go for certifications, you do not
necessarily need a degree. If you already have a degree (in anything), you might only need to get
certifications. In a perfect world you would have a Cyber Security degree and certifications, but the most
important thing is that you keep learning and pushing forward.
Building a Home Lab
In Cyber Security, some of the tools that we use can be extremely dangerous to a company’s network if
we do not know what we are doing. Some types of testing we might do is even illegal to perform
without written permission from somebody of authority. For those reasons just mentioned, a home lab
is an essential component to improving your Cyber Security skills. In addition to the information below,
make sure to visit my playlist on building a home lab for cyber security
(https://youtube.com/playlist?list=PLErQ2qAXz3rp1rqHIdSx8QmW3n7Zqi9UL).
Computer
When it comes to computers, there are so many different options that will work.
Desktop vs Laptop
The first decision you will need to make is based on form factor and mobility. If you decide you want a
laptop either for class or to be mobile in general, then you will have to buy it from a vendor (Apple,
Microsoft, Dell, etc.). Both choices have their pros and cons, for example desktop components can be
upgraded very easily.
Build vs Prebuilt
The second decision you will have to make is if you want to build your own computer (you assemble the
parts) or buy a prebuilt computer (Apple, Microsoft, Dell, etc.). This really depends on how much time
you have on your hands and your experience level. Building a computer takes research and making sure
all the parts are compatible, which frankly for a beginner or new person to technology jobs can cause
frustration and potentially not be worth it. On the other hand, if you build a computer correctly then
you can get a lot more bang for your buck. A website extremely helpful in picking parts is PCPartPicker
(https://pcpartpicker.com/).
Components
CPU Processor
I would highly recommend you go with at least a Quad-Core processor. You do not necessarily need the
latest and greatest but if you want to run several virtual machines at once (and you probably will), then
anything less will cause performance issues. You might run into issues with software and operating
systems if you use the Apple M chips (M1, M2, etc.) because not everything is compatible.
Guide to Cyber Security Careers
7
https://www.jongood.com
RAM
These days 16GB of RAM is common among all computers Similar to the recommendation for processor,
more RAM is always better. Each virtual machine that you run, will most likely perform best if it has 48GB of RAM, especially if it is a Windows virtual machine as they tend to be resource hogs. If you get a
laptop, 16GB is probably going to be the most common option with the ability of up to 64GB with some
models, however with desktops you could get 32GB, 64GB, or more with ease. Desktops also allow you
to upgrade your memory over time, however some laptops (especially Apple) cannot be upgraded.
Internal Storage
For internal storage (hard drive), you want to try at all costs to get a solid-state drive for the
performance and reliability that they provide. I would recommend at least 500GB but 1TB (or more)
provides more room for storing virtual machines, files, and anything else you want to store. Like RAM,
desktops are easy to upgrade but whatever you do, do not try to run these on an external USB drive.
Operating System
If you choose Windows, I highly recommend getting the professional version for additional features not
found in the other versions. Other than Windows, you have the option of Mac OS or any version of
Linux. I typically do not recommend using Linux as your main operating system, especially for beginners,
because most tasks are going to require a good amount of tinkering (leave that to virtual machines and
avoid the frustration).
Other Components
Everything else is personal preference, such as graphics cards, screen size, etc. and will not have much of
an impact on the Cyber Security aspects.
Virtualization Software
Today, we no longer need racks and racks of equipment in our home lab to perform experiments.
Virtualization allows us to create networks and perform testing in a controlled environment that we own
and destroy without fear of legal jeopardy. When it comes to Virtualization software, there are three
main players that you can decide from:
VirtualBox (https://www.virtualbox.org/)
Virtual Box is developed by Oracle and is a very well-known and free virtualization software.
Hyper-V (https://docs.microsoft.com/en-us/virtualization/hyper-v-on-windows/about/)
Hyper-V is the virtualization software from Microsoft. If you are using Windows 10 Professional, you can
enable the software using Microsoft’s instructions to deploy virtual machines.
VMware Workstation Player (https://www.vmware.com/products/workstation-player.html)
VMware is the third virtualization software choice. All the virtualization software options generally
function the same, however if you are getting prebuilt virtual machines from somebody then they will
typically have less issues with VMware. I personally prefer the Professional version because you get a lot
more features and customizability.
Guide to Cyber Security Careers
8
https://www.jongood.com
Soft Skills
When it comes to soft skills for Cyber Security careers, or even for technology jobs in general, there are
many different areas you want to improve. This list is not going to cover all the soft skills required but
this list is extremely important for you to develop.
Problem Solving
When it comes to technology related jobs, one of our primary purposes is to solve problems. In Cyber
Security specifically, you will start to realize that many ideal security solutions can cause significant
roadblocks for the business if implemented to the extreme. If people come to you with a request that
has security issues, it is important that you analyze the situation and if it is legitimate for the business,
we need to try to find the path to “YES.”
Creativity
Along with problem solving, sometimes we need to get creative with solutions and think outside of the
box. Perhaps another software solution does the same thing but is more secure, or maybe there is a way
to automate things securely? Do not be afraid to experiment and think outside of the box because after
all, that is what attackers are doing.
Teamwork
Face it, you are going to be working in teams in Cyber Security. Whether that means your department
team or a team with other areas of the business, you must be capable of working together.
Communication
With teamwork comes the need to be able to communicate effectively both verbally and written. Cyber
Security deals with a lot of documentation so being able to clearly put words on paper will help in
reports, procedure documentation, and frequent email communication. Cyber Security also must
interact with auditors and employees of all levels, therefore speaking ability is extremely important. I am
not saying you must be as captivating as Steve Jobs, but you should be able to explain things verbally.
One last point that is frequently lost in communication is that you need to cater your communication to
the audience. If you are speaking to executives, do not start telling them about the methods within your
code because you will lose them quickly.
Flexibility
Priorities are always changing because both technologies and the business you work for are always
evolving. Although it can be easy to get caught up in a routine of doing things a certain way, you should
understand that the only thing guaranteed is change. Business, technology, compliance and legal
requirements are some of the things that can drive change and you need to be flexible.
Guide to Cyber Security Careers
9
https://www.jongood.com
Job Descriptions
This list is not going to encompass all the potential jobs that exist, but these are the most likely roles
that you could find yourself performing when you first get into Cyber Security. I also want to make the
point that many companies will use these titles interchangeably (possibly even incorrectly), so you must
read the job description and ask questions to determine the real responsibilities.
Blue Team (Defensive)
Risk & Compliance Analyst
This role is heavily focused on making sure the company is compliant. Of the roles listed in this section,
the Risk & Compliance Analyst role will have the most amount of documentation requirements.
Depending on the industry, the documentation requirements will vary but expect highly regulated
environments to have plenty of documentation. Also, this role is typically not as hands-on with
technology and relies on subject matter experts and process audits.
Security Analyst
As a Security Analyst you should expect to deal heavily with log analysis of various tools. This could
include SIEM (Security Information and Event Management) tools and vulnerability management tools
to name a few. You will find that a lot of Security Analysts work in Security Operation Centers (SOC) and
depending on the industry/company you would find yourself working on shifts.
Security Administrator
It is possible that a Security Administrator role could have analyst or engineer duties as well, however
typically administrators will administer various applications and make sure they function correctly. You
could configure vulnerability management tools to configure scans or configure some type of reporting
and alerting capabilities.
Security Engineer
A Security Engineer is typically the person who will configure new systems and possibly develop the
architecture. This position requires the ability to determine requirements and understand how all the
components work together.
Red Team (Offensive)
Penetration Tester
Penetration Testers (Pen testers, Ethical Hackers, Red Teamer, etc.) are the people who test the security
of a company. Depending on the engagement rules, this role typically is imitating an attacker to
determine vulnerabilities that exist. Typically, these roles work for consulting companies, but their work
can be exciting.
Guide to Cyber Security Careers
10
https://www.jongood.com
Career Roadmap
Essentially there are three types of people trying to break into Cyber Security careers:
•
•
•
Currently in College for IT or Cyber Security Degree
Not interested in College or Changing Careers
Currently working in IT but not Cyber
Regardless of which type that you associate with, the advice below will still be consistent. One possible
scenario that might come up is your college degree plan requires certifications earlier than listed below,
in which you should adjust accordingly. Another example is if you already have a certain level of
knowledge then you could expediate the program.
Although the following roadmap focuses on certifications and technical abilities, there are a few things
that I want you to understand before diving in.
1. You will notice that initially the focus is less on Cyber Security and more on general knowledge
of Information Technology (IT). Building a foundation of knowledge is important because Cyber
Security relies on knowing the underlying technology and how it operates. Cyber Security
certifications should never be your first certifications for several reasons including the fact that
it usually leads to an overconfidence in what you think you know, what you expect for a job, and
what you expect for a salary.
2. If you follow the below roadmap, spend time improving your resume, and practice interview
questions, you will have a dramatically higher chance of landing an entry level job at a help desk,
in IT, or even in Cyber Security.
Timeline
All the time periods given below are the estimated time it will take you to complete that section. For
example, the first section will take approximately 6 months in total to complete both the Network+ and
Security+ certifications.
~6 months
This year is all about building up a solid foundation of knowledge and skills. These certification exams
can be expensive so starting out you want to pace yourself, especially as you become comfortable with
studying for the exams. My advice is to start out with conceptual certifications because as you start
mixing in technology, things can get exponentially more complex and confusing without a foundation.
•
•
Objectives:
o Learn concepts and begin following news from the industry.
o Do not be afraid to download virtual machines and just break things…be curious.
Potential Certifications:
1. CompTIA: Network+ (Study Resources)
2. CompTIA: Security+ (Study Resources)
Guide to Cyber Security Careers
11
https://www.jongood.com
9-12 months
This step is a continuation of the first step where we are trying to build a more solid foundation.
Networking is the backbone of Information Technology and Security so having strong knowledge is
important. Linux is in this step because many security tools and server operations tend to be in the Linux
or Unix environments so it is a must.
•
•
Objectives:
o Continue to build your level of knowledge.
o Consider learning basic scripting or programming (Bash, PowerShell, and Python).
Potential Certifications:
1. Cisco CCNA (Study Resources)
2. CompTIA: Linux+ (Study Resources)
12 months
With everybody trying to move to the cloud, now is the time to start looking at cloud certifications to
make sure you stay relevant. If you are currently employed and looking to go into Cyber Security in your
company, you should go for the vendor that the company uses. Otherwise, the vendor does not matter
too much, but ideally you want a really strong foundation in the type of technology.
•
•
Objectives:
o Aggressively learn about the cloud and how to secure it
o Continue to improve your development skills (Bash, PowerShell, and Python)
Potential Certifications (pick one vendor and do all):
1. Amazon AWS Cloud Practitioner (Study Resources
2. Amazon AWS Solutions Architect Associate (Study Resources)
3. Amazon AWS Security Specialty (Study Resources)
OR
1. Google GCP Cloud Digital Leader – Foundational
2. Google GCP Cloud Engineer – Associate
3. Google GCP Cloud Security Engineer – Professional
OR
1. Microsoft Certified Azure Fundamentals
2. Microsoft Certified: Azure Administrator Associate
3. Microsoft Certified: Azure Security Engineer Associate
Unlimited+ Months
The reason we have focused so much on foundational knowledge such as Networking and Cloud is
because the greatest number of jobs will always be on the defensive side. Getting your first job in
Security will probably be one of the most challenging and frustrating things about the industry, however
once you get that first job things become easier to navigate.
Guide to Cyber Security Careers
12
https://www.jongood.com
At this point you have a solid amount of knowledge of the core technologies that are going to be used in
any company and a fantastic resume if you have not already landed a job.
Now you should begin to research other subjects in Cyber Security to not only expand your knowledge,
but also to see if something interests you enough to specialize in. Those who can specialize and become
experts in a certain area can make A LOT of money, but they can also have a lot of choice about where
they work.
Objectives: Explore and find a specialization
Potential Certifications: TBD based on specialization, but at minimum you should aim for the CISSP from
ISC2 (at around 4 years of experience)
Guide to Cyber Security Careers
13
https://www.jongood.com
Additional Resources
As somebody who once was a beginner in Cyber Security and walked in your shoes, I know that it can be
challenging to find high-quality career resources. Although I have given you a wealth of knowledge in
this eBook, below you will find other resources that I highly encourage you to take advantage of in your
career.
Career Coaching
Some of my students prefer to receive 1-on-1 attention (https://www.jongood.com/services/) where we
can review your resume, perform mock interviews, or answer any specific questions that might arise.
Although I offer a lot of free advice and information, it can be extremely helpful to get dedicated
attention. As the community grows, it becomes challenging to give individual advice and Career
Coaching sessions help resolve that issue.
News & Threat Intelligence
Professionals who are aware of cyber events occurring in the world and threats that exist can instantly
build professional credibility. It is that kind of information that helps you think about future issues so
that you not only develop solutions that work today but that will also work tomorrow. Fortunately, you
do not have to sort through all the current events because I will not only discuss relevant topics, but I
will also provide you with an expert analysis with critical thinking about why the topic matters. Visit my
website (https://www.jongood.com/threat-intel/) where you can stay current.
Professional Associations
Within the Cyber Security career field there are several associations that you can join for low cost, and
usually even lower if you are a student. Associations will meet for training, and they also provide a great
opportunity to network with professionals. Sometimes meeting the right person or hiring manager can
be the most effective way to land your dream job. I have listed some popular options below, but you will
want to research which of these associations have Chapters in your local area.
•
•
•
IEEE (https://www.ieee.org/)
ISACA (https://www.isaca.org/)
ISC2 (https://www.isc2.org/)
•
•
•
ISSA (https://www.issa.org/)
OWASP (https://owasp.org/)
PMI (https://www.pmi.org/)
Training
On Cyber Training Pro (https://www.cybertrainingpro.com/), you can find an extensive library of
training, career services and resources. Topics include anything from beginner advice up to advanced
Cyber Security and we are constantly adding content. Students also get exclusive access to our private
community.
Guide to Cyber Security Careers
14
https://www.jongood.com
Final Thoughts
Cyber Security is an exciting field to work in and it has way more jobs than there are professionals to fill
them. With new regulations and compliance requirements being enforced every year, you can expect
the demand to only increase. Do not kid yourself, you will need to work to improve your skills if you
want to get the six figure salaries, but there are a lot of them out there for you to achieve.
I want to truly thank you for taking the time to read through this eBook and consider the advice I have
provided. The goal of this eBook is to help give you a foundation for breaking into Cyber Security instead
of giving you exact suggestions that are likely to change every year.
Feel free to reach out to me as we all continue this journey through the Cyber Security industry and help
companies strive for secure networks!
Sincerely,
Jon Good
Guide to Cyber Security Careers
15
https://www.jongood.com