Last week, I talked a local community member off the ledge of a $16k cybersecurity “fast track” program. She’s a bartender. Her husband recently passed away. She has grit and determination. But she heard the millions of vacancies, many in high six-figure roles, and she found her ticket.
Cybersecurity has never been an entry-level field. You have to understand systems before you can secure them or exploit them. Most of us started in IT, learned how things actually work, and moved into security once we had the foundation.
But there is a lot of money in telling people otherwise. The “millions of unfilled jobs” number gets repeated constantly by the same people selling certs, bootcamps, and training programs. They pitch a short runway to a high-paying career. Students sign up, earn a few credentials, then discover employers want something those programs never provided: hands-on experience.
The frustration that follows lands on employers for “unrealistic expectations.” And sure, some of them do. But the general expectations in cyber aren’t new. They were there 25 years ago and will remain, even as the latest tools expedite capabilities.
Entry-level security roles exist, but they’re rare and often help desk disguised as an analyst. The better path is time in engineering, development, or operations. Learn how things are built, how they break, and what it takes to keep them running.
The industry owes newcomers honesty.