Getting Into Infosec, Episode 33: Switching Into Infosec Success Story And Lessons Learned
Published July 16, 2020 · 10 minutes
Episode page: https://www.gettingintoinfosec.com/episodes/anonymous/

[0:00] Anonymous guest: But I just wanted to share with everyone that it is not impossible to start a career in IT with your dream job.

[0:26] Ayman Elsawah: Hey there, welcome to another episode of Getting Into Infosec. I'm your host, Ayman Elsawah. Today's episode is going to be a little short. It was a story that was sent to me by a listener out there, reached out to me on LinkedIn, and he told me of his success story. And I've mentioned it before. I did a walkthrough on YouTube about it. I figured it would be really beneficial for you to hear the success story. Now, it was not recorded in his voice. I had someone else record it. But the point is, he talks about his struggles and what he went through in his journey to information security.

[1:10] Anonymous guest: I ended up applying for probably 130 to 150 positions.

[1:14] Ayman Elsawah: And he finally did land it, so it does have a happy ending. But I think it's a really good listen and I do plan on having him come onto the show in the future. I think it would be good to kind of dig deep and listen to his story. So here it is. It's not too long, but I think you will find it really interesting. As usual, everything Getting Into Infosec is at gettingintoinfosec.com. There you'll find a preview of my practical guide into the field, a link to join my mailing list for previews and insights, and t-shirts and swag. If you like this podcast, please share your favorite quote or leave an awesome review. And please thank our guests for sharing their time and journey.

[1:53] Anonymous guest: All right, on to the show. I just want to share my story with everyone here, since it is probably going to differ a lot from the experiences of other people, and a lot of the expectations that people in this sub like to present when it comes to entry-level roles. For the past 10 years, I have been working at a company in a non-IT field doing admin work at first, then shipping logistics, then digital marketing. In December of 2018, I decided to try to make a career change and go into it with the hopes of one day getting into a cybersecurity role. I wanted to see if I even had the aptitude for this kind of work, so I started with the CompTIA IT Fundamentals Plus exam. I knew that the exam itself was going to be fairly useless on a resume, but I figured it was a good place to start.

[2:45] Anonymous guest: I passed that exam in January 2019, but then had to take a break for a few months due to work reasons. Long story short, I worked hard and studied hard and was able to pass the A+, Net+, and Sec-Plus exams in about a six-month period from July 2019 to December 2019.

[3:05] Anonymous guest: Ever since I passed my Sec Plus in early December, I've been applying for any job I thought might be interesting. At first, I tried to focus mostly on network admin roles because I thought that would be the best bet. But eventually, I just started applying to any kind of role I thought would be interesting. That I could have a realistic shot at getting after lots and lots of applications getting no responses getting ghosted by recruiters after one phone call getting ghosted by companies after in-person interviews I was finally able to accept an offer given to me last month For an information security analyst position with a large company near a major East Coast city. In my old position, I made about 72k a year and was prepared to have to take at least a 10 to 15k drop in salary to get my foot in the door in this field.

[3:54] Anonymous guest: But I'm actually now making a few thousand more in this new role. In reality, it's a bit of a wash since the commute time is much greater than my old job and the cost in gas and tolls will basically make this more of a lateral salary move than anything. I just wanted to share this story so that people out there can know that it is not impossible. This can happen, even if it is rare, and I'm incredibly lucky that this place is taking a chance on me in a role like this. If you work hard, grind it out, and refuse to undervalue yourself, it's not always necessary to start your career in a help desk position. Some things that I did on my journey that may help you. College degree. I do have a bachelor's degree, but it is in something non-IT computer related.

[4:38] Anonymous guest: Unless you have some way to prove you're an absolute rock star, it will probably be difficult to get past HR filters without a degree of some sort. Certs. The CompTIA certs definitely helped me get this job, but what I think is the most important aspect of the certs is how quickly I was able to attain them. Getting the A+, Net+, and Sec+, within six months, demonstrated, I believe, that I was able to learn this material quickly and competently, And more importantly, it demonstrated that I had a passion for learning, not settling for less. I was in a kind of weird situation, trying to change careers at the age of 37 with a mortgage and daycare expenses. I simply was not in a position to bite the bullet and drop all the way down to a 40k help desk role to get my start.

[5:24] Anonymous guest: I wouldn't be able to keep my house and I wasn't willing to lose 30k in salary. So while I knew I would be aiming for a higher-paying role, I also realized that it might take me a lot longer to get hired than if I just applied to every low-level help desk role I came across. I ended up applying for probably 130 to 150 positions, the vast majority of which I'd never heard anything back from. Sometimes I'd get a call from a technical recruiter, who would then say they'd pass my info along to a hiring manager, and then I'd never hear anything from them again. I interviewed for a network admin role at an MSP, where I got through the HR screen, a phone interview, an in-person interview, and then an online personality assessment before they decided to go with someone with more experience.

[6:11] Anonymous guest: Of the 130 to 150 positions I applied for, I only got about five in-person interviews. It was disheartening, and I felt dejected at times, but in the end, it was worth it. Being active with online communities and local chapters of IT organizations. If you can find any kind of online community that is active, like Operation Code, TraceLabs, etc., get involved. There's usually a good amount of information you can gain from people in these groups. Also, if you have chapters of IT groups in your area, like ISSA, Information Systems Security Association, join them and attend meetings, network as much as humanly possible, resume. This may not be an option for everyone, but I paid to have mine professionally done, and I think it was worth every penny.

[6:58] Anonymous guest: I found the resume writers through LinkedIn, and what I got in return was a resume that stood out in all the right ways. You can do it yourself and can probably make it look just as good, but these people know how to get through HR filters without gaming the system in a bad way. So, if you can afford it, I highly recommend having it professionally done. Know that it's going to be difficult if you haven't interviewed in a long time or never really have interviewed before. It's really going to suck. You're probably going to bomb a few. I'm thinking specifically of an interview I had for an SOC analyst role that's making me cringe when I think of how I did. Think of each interview as practice for the next.

[7:34] Anonymous guest: Try not to go in there too nervous or desperate. Just relax and be yourself as much as you can. Don't fall in love with a job before you get an offer. This is the one I really struggled with the most, and it really, really sucked to deal with. Early on in my search, every time I had an HR screen, I would start imagining myself in that role, with that company, and really, really wanted to work there. Then, when I would end up getting ghosted, it really hurt. I mean, it just plain hurt. It really... With me until I finally realized I needed to stop getting my hopes up with every phone call or interview. Things that may not help you. In the interest of fairness, I may as well explain some advantages I might have had that may not help you at all.

[8:17] Anonymous guest: My military service. I spent four years in the military back in the mid-2000s, and while IT had nothing to do with it, from what I could tell during the interviews, it seemed like that part of my resume was something that they all liked about me for whatever reason. Just plain luck. When I try to think of why exactly they chose me, someone with zero IT experience over all the other candidates who applied for that role, I just kind of draw a blank. I know that they must have seen something in me that they like, but not only do I feel incredibly lucky to be starting a job with this pandemic running rampant in the world right now and all the companies instituting hiring freezes, But I feel incredibly lucky that they picked someone with no IT experience over candidates who have established IT work histories.

[9:02] Anonymous guest: I'm well aware that situations like this are damn near unheard of, but I just wanted to share with everyone that it is not impossible to start a career in IT with your dream job. If anyone has any questions, I'll happily do my best to answer them. Until then, keep working towards your goals and don't give up. You can make this happen.

[9:21] Ayman Elsawah: Thanks for listening. Hope you enjoyed that as much as I did. As always, if you like this show, please thank my guests for their time and let others know about the show. They might thank you for it. Intro music is Cascadia by Trash80, Trash80.com. Check out the website GettingIntoInfosec.com for show notes, clickable timestamps, a preview of my book, and more. And stay in touch on Twitter for more Getting Into Infosec reflections. Hey, thanks for listening. So I built a lot of things and I'm building something new. I'm working on a new community. I want to bring everyone together with all the things that I've done into just one space. So I'm really excited about it and would love to stay in touch and get some early adopters or feedback.

[10:03] Ayman Elsawah: So check out the link below in the show notes and send me a hello. And that's about it. I hope you're having a wonderful day. Thanks. Talk to you soon. Thank you.