Is Cybersecurity Still a Good Career?
Disclosure: This article may contain affiliate links, and some products, courses or services mentioned may be ones the author has a financial interest in.
Is cybersecurity a good career? In my experience, yes, it’s a really great one, and there are a few reasons why. The first is the financial rewards, which tend to be higher than in other fields, including the rest of IT. You can often make a lot more as a security engineer than as a network engineer. The opportunities are also growing. I don’t think AI is replacing these jobs. If anything, I think there will be even more of them, because more infrastructure will need to be secured. There are plenty of remote cybersecurity roles, nearly every industry and company needs security, and with AI in the picture it’s only becoming more important.
Will AI Replace Cybersecurity Jobs?
The next question is whether AI is going to replace cybersecurity jobs, and I don’t think so. It’s going to change the current jobs, and the day-to-day work will look different, but the core of it stays the same. I think of it like mechanics. A hundred years ago mechanics worked on carriages, now they work on cars, and in another hundred years who knows what they’ll be working on. The idea of a mechanic is still the same: they fix things. In cybersecurity you’re still securing important systems so other people can’t steal the data.
Entry-Level Roles in Cybersecurity
You might be wondering what the entry-level roles are. There are two really good starting points: incident management and a security operations center (SOC). You can also start in an IT job, such as a help desk role or a junior sysadmin, and then move into security, which is common too. But if you can get started in a SOC or doing basic incident management, that’s probably ideal. There are a lot of mid-level and senior cybersecurity jobs, so once you have a little experience, you’ll have plenty of options and your pay can increase quickly.
Entry-Level Pay
In my experience, entry-level pay is often around 60,000, but take that with a grain of salt. These roles are often overnight shifts. The work can look like a typical 9 to 5, just at night, so if you don’t mind taking an overnight shift, it can give you an advantage when applying for entry-level roles.
Are You Too Old for Cybersecurity?
Another question that comes up a lot is whether 30 or 40 is too old to start in cybersecurity. I don’t think so at all. At every age, people think you’re too old for something. When I was 26, someone told me I was too old to change careers. I think that’s mostly fear, the idea that you can’t learn anything new. I find that to be false. If you’re in a dying field and you want skills in a field with a lot of growth, it’s very possible to make the switch. It might even be easier to find a job in the new field than in your current one, precisely because your current one is shrinking. It’s not too late.
Does Ageism Exist in Cybersecurity?
It does. Some domains are less affected than others, though. I’d say governance, risk and compliance (GRC) is a good fit for people over 40 or 50, because it’s slower moving and less stressful and fast-paced than something like working in a SOC.
Top Companies Hiring Cybersecurity Pros
As for which companies hire cybersecurity professionals, just about every company is trying to. The biggest names, mid-sized firms and even small businesses all need to understand security and have protocols in place.
Common Careers and Domains
Common careers in cybersecurity include security operations center work, governance, risk and compliance, identity and access management, incident response, network security, cloud security and security architecture. On-premise security is still a big deal, since people still need to protect data centers, and that falls under network security. On top of that, banking, finance, healthcare and government all need these roles. The larger the industry, the more cybersecurity professionals it tends to need.
Most Valued Certifications
The most valued certifications depend on which domain you go into. If you’re just starting out, CompTIA Security+ is one of the best entry-level certifications. I’ve held it for over 12 years. CompTIA keeps adapting to the market, and it’s still a go-to for learning the fundamentals, with plenty of affordable online courses available. I also have a 100-day GRC challenge that teaches cybersecurity fundamentals and GRC fundamentals as you work through a real-world project.
Governance, Risk and Compliance Certifications
As you progress, you’ll choose a domain. If you’re heading toward GRC, ISACA and ISC2 are the two big certifying organizations. I’d call the CISSP more of a leadership GRC certification. The CISM, from ISACA, stands for Certified Information Security Manager and is great for learning governance, risk and compliance. If you want to become a cyber or IT auditor, the CISA (Certified Information Systems Auditor) is the one. Those are the three main ones that come to mind. There’s also the CGRC from ISC2, which teaches the risk management framework. That one is popular in healthcare, banking and government, which are heavily compliance-oriented.
Highest Demand Skills
As for the most in-demand skills, GRC is high demand and one of the highest-paying skill sets in cybersecurity. Identity and access management is growing rapidly and is probably the highest-paying skill you can gain. Incident management has lots of jobs, and so does digital forensics. Those are first-response roles, so they can be more stressful than GRC or back-end work, and security operations center roles are important too.
AI Governance
AI governance is also getting popular, but I wouldn’t call it an early-career path. It’s more mid to senior level, and I wouldn’t start there. Cloud security and network security both have lots of demand as well. Basically every domain in cybersecurity is in demand, and with AI, I think that demand will grow even faster.
Tools You Should Learn
Are there tools you should learn? In the beginning, I’d focus on concepts and the big picture rather than tools. That said, some tools matter for specific jobs. If you want to become a vulnerability analyst, which is a good entry-level role, Tenable Nessus is worth learning. If you want to work in a SOC, Splunk, a security information and event management (SIEM) tool, is a good one to know. For incident management, learn how to collect information and respond to an incident.
Gaining Practical Experience
Gaining practical experience comes down to doing. The hard part is having a structure to follow. The information itself isn’t that difficult. What’s hard is knowing what to learn in what order, and getting feedback along the way. A structured program that teaches practical skills is, to me, a great way to do it, but it can be hard to find. There are a few good ones, but many people teaching don’t have real experience in the field, so it’s hard for them to build a practical course.
The most useful thing is finding something that shows you how it actually works in the real world. That’s what my 100-day GRC challenge is built around. It teaches practical GRC skills along with cybersecurity fundamentals, and I think it’s a great place to start if you want to go into GRC.
Final Thoughts
I’m really glad I work in cybersecurity. There are a lot of opportunities available, and in my experience the financial rewards track closely with the effort you put in. In many fields the effort doesn’t match the reward, but here I think it does. The field is growing quickly and you should be in demand for a while. I know a lot of people say AI is going to destroy cybersecurity, but I don’t think that’s true.
I think AI will change what tasks a person does, and the quality of the work will be higher than it is now. Compare how websites looked in the 2000s with how they look now. The standard just goes up. I also think there will be more jobs, because AI makes building things easier and faster, which means more infrastructure and more to secure. It’s a great career.
