Tough love for aspiring hackers

So, you want a job as an ethical hacker, huh? Dreaming of breaching firewalls and exposing vulnerabilities like a tech ninja? I get it. Ethical hacking is often glamorized as the pinnacle of cybersecurity. I was in your shoes too. But here’s the hard truth: it’s not an entry-level gig. There’s a ton of groundwork you need to lay before you even think about getting a job as an ethical hacker. Don’t worry, though, I’ve got an alternative path that’s going to make your life a whole lot easier.

The Misconception: Ethical Hacking as an Entry-Level Role

First off, let’s clear the air. Ethical hacking isn’t the kind of job you land right out of the gate. It’s a role for seasoned professionals who have a deep understanding of operating systems, networking, and security fundamentals. When I first joined the military, I had the same dream of being a hacker. But reality hit hard when I realized hacking wasn’t an entry-level role. Instead, I dove into cybersecurity from the blue team side, tackling cryptography and InfoSec in the Air Force. And let me tell you, that journey was worth it.

So the best advice I have for those who want to start their cybersecurity career is to pick a niche.

Well, honestly, most people have literally no clue what they REALLY want, so I’m going to assign you the path of least resistance.

You will thank me later.

Your Cybersecurity Niche: Governance, Risk, and Compliance (GRC)

Let’s dive into a corner of cybersecurity that’s often overlooked: GRC (Governance, Risk, and Compliance). Not many people are aware of it, which is a shame because I think it’s the best work-life balance of cyber. We’re talking about an unemployment rate of around 2%, impressive paychecks, and enough free time to chase your other passions. Unlike the crowded pentesting arena, GRC offers entry-level positions that don’t even require coding skills. It’s a golden ticket into cybersecurity, where you can build a solid foundation without the immediate pressure to dive into hacking just because it sounds cool.

Think about it. To exploit a system effectively, you need to understand how to defend it first. GRC teaches you the essentials. You learn about vulnerabilities through CVE IDs and how to run vulnerability scans across networks. It’s like learning to play defense before you start playing offense.

Starting with GRC also means you’re not letting ego dictate your career choices.

The experience you gain here is directly relevant to hacking, and you can easily explore that in your downtime. If you excel in your cybersecurity role, going above and beyond, there’s a good chance your employer will let you rotate into different roles based on your interests. But let’s be real: a fresh university grad with zero experience isn’t likely to land a pentesting gig right off the bat.

So, here’s the game plan: take the less glamorous, yet highly strategic path of GRC. It checks all the boxes—amazing money, free time, a solid grasp of the basics, hands-on experience, and early career growth opportunities. Forget about the flashy stuff for now and focus on building a strong, sustainable career in cybersecurity.

Why Blue Team Experience is Crucial

My blue team experience in the military was invaluable. It taught me to secure networks, prioritize vulnerabilities, and understand the intricacies of InfoSec. This background made transitioning to ethical hacking seamless. It’s a misconception that you need to be a coding wizard to hack. You need a solid foundation in cybersecurity principles, which is exactly what GRC and blue team roles provide.

The Path of Least Resistance: How to Start

Here’s my actionable roadmap for you:

1. Start with GRC: Dive into a GRC role. Learn the ins and outs of governance, risk, and compliance. It’s not super technical, but it’s critical.
2. Learn Security Fundamentals: While working in GRC, start building your knowledge of operating systems, networking, and security protocols. This can be done through online courses, certifications, and self-study.
3. Set Up Home Labs: Practical experience is key. Set up a home lab to practice what you learn. Simulate attacks and defenses to deepen your understanding.
4. Build a Personal Brand: Document your entire learning journey (yes, especially when you’re bad at it in beginner mode). Share your projects & notes, write about your experiences, and engage with the cybersecurity community online. This not only helps you learn but also builds a portfolio that stands out to employers.
5. Get Certified: Consider certifications like CompTIA Security+, Certified Information Systems Security Professional (CISSP), or Certified Ethical Hacker (CEH) as you progress. These add credibility to your resume.
6. Network: Join cybersecurity groups, attend conferences, and connect with professionals. Networking can open doors and provide invaluable insights.

The Harsh Reality: Be Patient and Persistent

Here’s where the tough love comes in. Becoming an ethical hacker isn’t an overnight process. It’s a journey that requires patience, persistence, and a willingness to learn. You’re not going to jump straight into pen testing. Instead, focus on becoming a well-rounded cybersecurity professional first.

Remember, the goal is to build a strong foundation. GRC roles give you the perspective needed to understand the big picture of cybersecurity. As you gain experience, transitioning to ethical hacking becomes a natural next step.

Be Loud About Learning

Don’t let the competition discourage you. While others might have more experience, your enthusiasm and eagerness to share what you learn can easily set you apart. Make your learning process extremely visible. Share your successes and failures, and show your growth. This transparency can be your biggest asset. It’s also the fastest way to learn if you’re doing something wrong (which is the most valuable knowledge you can attain… and for free???!!)

Links

• Learn more about Governance, Risk, and Compliance.
• Get my free Wiki resource I publish from 14 years of experience in cybersecurity here.
• More Beginner Hacking Content.
• Sign up for my weekly newsletter, Cyborg Bytes all about integrating technology to redefine your life.