# Your Path Into Cybersecurity The most common question people ask when they discover cybersecurity is: *where do I even start?* That question is the right one. The field is enormous. The jargon is thick. The path isn't obvious. And unlike medicine or law, there's no single accredited route. Cybersecurity professionals come from computer science degrees, military service, IT helpdesks, network administration, and occasionally from no technical background at all. This chapter cuts through the noise. By the end of it, you'll understand what the field actually looks like from the inside, which corner of it fits your personality and existing skills, and exactly what to do in the next 30 days to start moving. *** ## The Talent Crisis That Works In Your Favor Every year, the cybersecurity industry publishes a workforce gap report. Every year, the numbers get worse. {% hint style="info" %} **By the numbers:** In 2024, there were over **4 million unfilled cybersecurity positions** worldwide. Entry-level roles in the US average **$70,000 to $90,000** annually. Mid-level positions cross **$120,000**. Senior engineers and architects regularly earn **$150,000 to $200,000**. CISOs at large enterprises can earn $300,000 to $500,000. {% endhint %} Companies aren't being selective. The talent genuinely doesn't exist. Organizations ranging from small businesses to national governments are operating with security teams that are too small, too stretched, and too slow to keep up with the threat landscape. This is your opportunity. More importantly: many of these roles don't require a computer science degree. They reward demonstrated skill, curiosity, and the ability to keep learning. Former military personnel, IT helpdesk workers, developers, network admins, and career-changers from unrelated fields have all built successful cybersecurity careers. What matters is what you can actually do. One more thing worth noting: remote work is the norm in cybersecurity, not the exception. The nature of the work means it can largely be done from anywhere. A motivated person in any city, any country, with a laptop and an internet connection can enter this field. *** ## What Cybersecurity Actually Is Popular culture paints cybersecurity as hooded figures in dark rooms typing furiously while red text scrolls across screens. The reality is more varied, more interesting, and honestly more human than that. At its core, cybersecurity is the discipline of protecting systems, networks, and data from attack, unauthorized access, and damage. But that description undersells it. It's a cat-and-mouse game. Attackers evolve constantly. Defenders must evolve faster. The adversaries aren't static. They're intelligent, adaptive, well-funded, and sometimes operating at a nation-state level. Defending against them requires the same mindset. It's as much communication as it is technical work. You can find every vulnerability in a network and still fail at your job if you can't explain the risk to a non-technical executive, write a clear incident report, or convince an engineering team to patch a system they'd rather leave alone. The professionals who can bridge the technical and human worlds are the ones who advance fastest. Understanding psychology matters as much as understanding code. Most successful attacks don't break cryptography. They manipulate people. Phishing emails, social engineering, pretexting, and insider threats all exploit human behavior. Defending against them requires understanding it. And somewhere in this field, breaking things is literally part of the job description. Penetration testers and red team operators are paid to attack systems legally, with permission, to find weaknesses before real adversaries do. Not every security professional is an attacker. But understanding offensive techniques makes every defensive practitioner better. Consider the scale of what you'd be protecting. Every time someone uses a banking app, boards a plane guided by digital systems, receives medical care from networked hospital equipment, or sends a private message, cybersecurity is either working or it isn't. The consequences of failure are real. So is the satisfaction of doing it well. *** ## Is This Field Right for You? Cybersecurity isn't for everyone. But it's for far more people than typically think it is. {% hint style="success" %} **You might thrive here if you:** * Enjoy puzzles and don't give up easily when something is hard * Like learning genuinely, not just for the credential * Can stay calm and think clearly when things are going wrong * Care about doing work that has real stakes * Are comfortable with constant change and continuous self-study {% endhint %} {% hint style="warning" %} **You might struggle here if you:** * Need work to be predictable and routine * Prefer to specialize deeply in one narrow area and stay there forever (the field changes too fast for that) * Truly dislike writing: reports, documentation, and communication are unavoidable in every role {% endhint %} One thing that doesn't matter as much as people think: prior technical expertise. Many people break in from non-technical backgrounds by building skills deliberately through labs, certifications, and personal projects. What matters is the willingness to build those skills, not whether you already have them. *** ## The Reality of Getting Started {% hint style="warning" %} **The entry-level catch-22:** Most jobs ask for experience. But experience requires getting a job first. This is real, and it's frustrating. The way around it is to build *demonstrable* skills before you apply. Free and affordable tools let you build those skills so you walk into interviews with specific things to discuss, not just a resume. {% endhint %} The tools to do this are free or affordable. **TryHackMe and Hack The Box** are hands-on learning platforms where you practice real techniques in safe, legal environments. Completing their tracks is something you can put on a resume and discuss in interviews with specifics. **CTF competitions** (Capture The Flag) are security competitions that test practical skills in a time-limited format. Participating, even without winning, builds experience and signals genuine interest to employers in a way a certification alone cannot. **Home labs** using virtual machines let you build and break your own environments safely. Spending a weekend setting up a vulnerable machine and attacking it teaches more than most courses. **Certifications** like CompTIA Security+ demonstrate foundational knowledge to employers even without job experience to point to. The professionals hiring you know what the entry-level catch-22 looks like. What they're evaluating is whether this person did the work to demonstrate they want this, or just submitted a resume. The ones who built labs, earned certifications, played CTFs, and can talk about specific things they learned stand out immediately. The next section maps the career paths within cybersecurity so you can choose where to focus that energy. *** ## Further Reading | Resource | What it is | | ----------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------- | | [ISC2 Cybersecurity Workforce Study](https://www.isc2.org/research) | Primary source for global workforce gap stats. Published annually. | | [CyberSeek](https://www.cyberseek.org) | Interactive map of real-time US job demand by region, role, and cert. | | [BLS: Information Security Analysts](https://www.bls.gov/ooh/computer-and-information-technology/information-security-analysts.htm) | Authoritative US salary and employment projection data. | | [TryHackMe](https://tryhackme.com) | Beginner-friendly browser-based labs. Start with Pre-Security path. | | [Hack The Box](https://www.hackthebox.com) | More open-ended competitive labs. Academy section has structured paths. | *** *Have questions or want honest feedback on your path into cybersecurity? Join the community on* [*Discord*](https://discord.gg/vkXWVFdFe) *or reach out on* [*LinkedIn*](https://www.linkedin.com/in/ahmadscience/)*. If this book helped, contribute back. That pull request is your first open-source credit.* --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://book.ahmad.science/chapter-1-breaking-in/choosing-an-advanced-career.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.