Zkitszo - The Real
October 18, 2026

Breaking Into Cybersecurity, Without Ticking Every Box

Scroll a security job board and the same posting turns up in a hundred costumes.. a degree, two or three certifications, five years of incident response, Splunk, Python, cloud, "excellent communication skills"- for a junior role. Most folks read that list as a locked door and close the tab.

In July 2020 Sebastián Ramírez, the person who created FastAPI, posted about a job ad asking for 4+ years of experience in FastAPI. He couldn't apply.. he'd only had 1.5 years with it, counting from the day he wrote it.

Read the Job Ad Like a Wish List

A job ad describes the dream candidate. The hiring manager knows that person probably isn't coming- they want as close as they can get and will settle for less. Maybe the dream candidate grabbed a better offer last week. Nobody outside that office knows who else applied, so nobody outside it can say we don't qualify.

The famous figure- men apply at 60% of a list, women only at 100%- traces back to one unpublished Hewlett Packard internal report, quoted in a 2014 Harvard Business Review piece by Tara Mohr and repeated secondhand ever since. Mohr's own survey of over a thousand people found the top reason for not applying was believing the listed qualifications were really required (41% of women, 46% of men). Doubting they could do the job well came in around 10 to 12%.

In Harvard Business School and Accenture's 2021 Hidden Workers study, 88% of employers agreed that qualified high-skills candidates get vetted out "because they do not match the exact criteria established by the job description"- 94% for middle-skills. Use the ad's own words on the résumé wherever they're honestly true of us.

The old line that companies are so desperate they'll take anybody who ticks one box belongs to a hotter market. ISC2's 2025 workforce study (16,029 respondents) puts cybersecurity hiring freezes at 39% in one paragraph and an "overall average of 34%" in another- the page disagrees with itself. Layoffs sat at 24%. ISC2 dropped its workforce gap number, saying skills matter more than headcount now.. though a quarter of respondents admitted putting underqualified or inexperienced people into roles they couldn't fill. Apply anyway- it costs an email- but expect more silence than the old advice promised.

Small Shops Count Too

Everybody wants the famous logo.. the Microsofts, the Googles, the Apples- the same places running the automated filters and posting degree requirements. On a five-person security team at a company nobody has heard of, the work we ship shows up in the product and we get a say in where a project goes. At a giant, real influence tends to arrive with a leadership title.

In ISC2's 2025 numbers, nearly half (49%) of enterprises with 10,000+ staff reported cybersecurity hiring freezes, against 28% of the smallest organizations. Layoffs ran 32% at the giants and 17% at shops of 1 to 99 staff.

Gatekeepers and the Degree Argument

Wander into any infosec Discord or comment section and someone will be along shortly to explain that we're not good enough, or that without a degree we'll never make it. A lot of that is insecurity- people worried about their own spot, pushing newcomers off the ladder. When the haters get loud, a word on energy vampires helps.

The degree argument never seems to end. The 2023 US National Cyber Workforce and Education Strategy pushed for skills-based hiring:

They should compete for jobs based on what they can do rather than merely credentials.

The same strategy quotes a 2021 Burning Glass study- 46% of US federal cybersecurity jobs were open to applicants without a bachelor's degree, against only 20% in the private sector. That strategy came from the previous administration- whether it survived is anyone's guess. Over 80% of ISC2's 2025 respondents hold a bachelor's or higher. Without one, the pile of postings is smaller.. government jobs were the wider door.

There's No One Door In

Security people got in every which way- college and an internship, a startup, years on the help desk. A story gets repeated that the older crowd started out with no security qualifications at all.. not quite- ISC2 launched the CISSP in 1994. What holds up is how many people walked in sideways, carrying a whole other field with them.

Picture the IT support person at a school that got hacked, who ends up owning the security side of school administration. The farmer who comes in through the machinery and software on the farm. Someone from medicine who drifts into medical device security. Security folks often don't know how the thing they're protecting gets used. "Block that, it's risky" sounds great in a meeting- until that "risky" workflow turns out to be half of somebody's day.

Borrow ideas from other people's paths- a free certification, YouTube, a degree. If we catch ourselves copying a path that isn't working for us, that's the cue to try a different door.

Salary Sites Lie by Omission

Tech grew fast. To pull new people in, companies kept raising the offer for new hires while plenty of the folks hired years back- when the job was still "IT"- stayed close to where they started. SHRM and Payscale both call it salary inversion when newer staff make more than experienced staff.

Glassdoor's numbers blend a machine-learning estimate, employer-provided pay and anonymous reports from current or former employees. It only shows a median with three or more submissions. Its estimates are base pay only. Find someone who started at that company in the last year or two and ask what they're making- that's today's rate.

In the US, asking is protected- the National Labor Relations Board puts it plainly, "employees have the right to communicate with their coworkers about their wages" (supervisors are mostly left out). British Columbia's Pay Transparency Act has required public job postings to carry the expected pay or pay range since November 1, 2023. Employers there can't punish anyone for asking about their pay or revealing it to a coworker. Ontario followed on January 1, 2026- employers with 25 or more employees must post the pay, any range no wider than $50,000 a year (unless the pay tops $200,000), plus whether AI screens the applicants. With a real range in hand, the negotiating side gets a lot less scary.

The paycheque isn't the whole pay

A lot of tech jobs pay in three pieces- base, bonus and stock. Levels.fyi breaks offers down that way. Google's US Security Engineer page (ten submissions, checked October 18, 2026): entry level L3 totals about $194K, with $143K base, $30.5K first-year stock and $21.4K bonus and sign-on. L6 totals $484K on a $228K base. Base is roughly three quarters of the package at entry level and just under half at L6.

A common line says stock and bonuses come with tax advantages. For the usual tech package that's wrong. The IRS taxes restricted stock units as ordinary income when they vest. Canada's tax agency says the benefit from employee stock options may be taxable under section 7 of the Income Tax Act. The breaks sit in narrower corners- US statutory stock options, held past the holding periods, get capital gain treatment. Compare offers on the total and know the vesting schedule.

Let the Job Ads Pick the Next Skill

Job requirements work better as a map than a gate. Save fifteen or twenty postings for the role we're after as plain text files in one folder, list the skills we care about in terms.txt (one per line), then count which ones keep turning up:

import sys, pathlib, re, collections
terms = [t.strip() for t in open(sys.argv[2]).read().splitlines() if t.strip()]
ads = list(pathlib.Path(sys.argv[1]).glob("*.txt"))
hits = collections.Counter()
for ad in ads:
    text = ad.read_text(errors="ignore").lower()
    for t in terms:
        if re.search(r"(?<!\w)" + re.escape(t.lower()) + r"(?!\w)", text):
            hits[t] += 1
for t, n in hits.most_common():
    print(f"{n:>3}/{len(ads)}  {t}")

Save it as tally.py next to the job-ads folder and run it:

python3 tally.py job-ads terms.txt

A line like 14/20 Python means fourteen of twenty ads asked for it. Anything sitting in most of them is worth learning.

Python makes a gentle first language- automate the boring part of a job first, heavier languages later. The official tutorial costs nothing: docs.python.org/3/tutorial.

Certifications add credibility. ISC2's free "One Million Certified in Cybersecurity" program closed to new enrollments on May 20, 2026. Anyone holding an unexpired free exam code can still sit the exam until December 31, 2026. For everyone else the Certified in Cybersecurity exam is now US$199, plus a US$50 annual maintenance fee. Run it through the tally first.. if the ads we want don't ask for it, the money might be better spent elsewhere.

Hacking Is a Small Slice

Say "hacking" and most people picture red teaming or penetration testing. That work is scoped and simulated- NIST's testing guide (SP 800-115) puts a plan or rules of engagement in place before anything starts. "At the conclusion of the test, a report is generally developed." If what we love is the curiosity side of hacking, plenty of other jobs scratch the itch.

The US government's NICE Framework, the official catalogue of cybersecurity work roles, lists 42 roles in version 2.2.0. Not one is called "penetration tester". Penetration testing turns up as a task in just two of them- Vulnerability Analysis and Software Security Assessment- while knowledge of how pentesting works is expected in eight.

42 Work Roles, Five Categories NICE Framework Components v2.2.0 (NIST / CISA). One square = one work role. Oversight and Governance 17 Design and Development 9 Implementation and Operation 7 Protection and Defense 7 Investigation 2 Threat Analysis Penetration testing listed as a task Cyberspace Intelligence and Cyberspace Effects roles now live in the DoD Cyber Workforce Framework.

Threat intelligence is worth a look- digging into real attacks and the people behind them instead of simulated ones. NICE files it under "Threat Analysis": collecting, processing, analyzing and sharing cybersecurity threat assessments and developing indicators. The defensive side can be practiced at home too.. a few Raspberry Pis listening to every WiFi and Bluetooth signal in the house is a real detection project.

Which door did you come through- help desk, a degree, a cert, something completely sideways like farm tech or a hospital? Or still staring at a job ad, wondering whether it's worth hitting send? Leave a comment.. the next person reading might be standing right where you were.

Glossary

  • Applicant tracking system (ATS) — software that collects job applications and filters résumés, often by keyword, before a person sees them.
  • Certified in Cybersecurity (CC) — ISC2's entry-level certification.
  • CISSP — Certified Information Systems Security Professional, ISC2's senior security certification, first offered in 1994.
  • Discord — a chat platform where a lot of infosec communities gather.
  • FastAPI — a Python framework for building web APIs.
  • Incident response — the work of detecting, containing and cleaning up after a security breach.
  • Infosec — information security; used loosely as another word for cybersecurity.
  • ISC2 — a membership body for security professionals that runs certifications and a yearly workforce study.
  • NICE Framework — the US government's catalogue of cybersecurity work roles, tasks, knowledge and skills (NIST, published through CISA's NICCS site).
  • Pay transparency law — a law requiring employers to show the pay or pay range in job postings and protecting workers who discuss pay.
  • Penetration testing — an authorised, scoped attack on an organisation's systems to find weaknesses, finished with a written report.
  • Red teaming — a longer, goal-driven simulated attack that also tests how well the defenders notice and respond.
  • Restricted stock unit (RSU) — a promise of company shares that become the employee's once they vest; taxed as income at that point.
  • Rules of engagement — the written agreement, made before a security test starts, on what testers may and may not do.
  • Salary compression — when pay for newer hires creeps up close to what long-serving staff earn.
  • Salary inversion — when newer staff are paid more than experienced staff in the same kind of job.
  • Skills-based hiring — hiring on what a candidate can show they can do rather than on degrees or certificates.
  • Splunk — a widely used log search and SIEM product; shows up on a lot of security job ads.
  • Statutory stock options — US incentive stock options and employee stock purchase plan options, which can get capital gain treatment if holding periods are met.
  • Threat intelligence — collecting and analysing information about attackers, their tools and their behaviour so defenders can act ahead of them.
  • Total compensation — everything an employer pays: base salary plus bonuses, stock and other pay.
  • Vesting — the schedule on which granted stock actually becomes yours.

Sources

Comments

Post a Comment