Cybersecurity

What the job is actually like

Depends heavily on which corner you land in. Defensive work — the majority of jobs — means monitoring alerts, investigating whether something is an incident or noise, patching, reviewing access, and writing up what happened. Offensive work means structured, authorised testing and, mostly, writing the report afterwards. Both involve far more documentation than the films suggest, and the work is often about persuading other teams to do unglamorous things.

A roadmap

Lengths are what this typically takes alongside other commitments, not a promise. The "prove it" line matters more than the timeline — that is what someone hiring will look at.

1. Know what you are defending

   Networking, operating systems and how web applications work. You cannot secure a system whose normal behaviour you cannot describe. This stage is identical to the first stage of engineering or DevOps, and skipping it is the most common failure on this path.

   Typically

   Three to six months

   Prove it

   Explaining the full path of a login request and where each step could be attacked.

2. The common failure modes

   Injection, broken authentication, misconfiguration, weak access control. The OWASP Top Ten is the standard starting map, and most real incidents are still boring versions of these.

   Typically

   Two to three months

   Prove it

   Finding and clearly writing up a vulnerability in a deliberately vulnerable practice application.

3. Practise legally

   Deliberately vulnerable labs and capture-the-flag exercises. Testing systems you do not own and have no written permission to test is a crime, and doing it will end this career before it starts.

   Typically

   Ongoing

   Prove it

   Consistent lab or CTF activity, plus write-ups explaining your reasoning.

4. Defensive fundamentals

   Logging, detection, incident response, and least privilege. Most roles that exist are defensive, even though most course marketing is offensive.

   Typically

   Three to five months

   Prove it

   A home lab where you generate suspicious activity and then detect it in your own logs.

5. Writing and communication

   Turning a finding into something a busy team will actually act on: severity, impact, and a concrete fix.

   Typically

   Ongoing

   Prove it

   A report a non-specialist manager could read and correctly prioritise.

What AI has changed

It cuts both ways and the balance is genuinely unclear, so treat confident claims in either direction with suspicion. Attackers get cheaper and more fluent phishing and faster reconnaissance; defenders get better triage of alert noise and faster analysis. The practical effect on entry-level work is that routine first-line alert triage is being automated, while investigating the ambiguous cases — the ones where the answer is genuinely unclear — is not. A new category of work has also appeared around securing AI systems themselves: prompt injection, data leakage through model inputs, and over-permissioned agents. That is unusually open ground for someone entering now, because few people have deep experience in it yet.

Common mistakes

• Trying to enter security without first understanding systems. Security is a specialisation on top of fundamentals, not an alternative to them.
• Chasing offensive roles because they look exciting, while nearly all the openings are defensive.
• Testing systems without written authorisation. This is illegal and career-ending, not a grey area.
• Buying expensive certifications early. Most matter more at senior level than for a first job.
• Reporting findings in a way that annoys the team that has to fix them.