topic Re: Advice Needed: Career Change in Career Discussions

Advice Needed: Career Change

cguido — Wed, 26 Mar 2025 00:41:08 GMT

Hello everyone!

I'm currently transitioning from a career in public history to information security, and I'm eager to learn from your experiences. The cybersecurity field is incredibly fascinating to me, and I'm open to exploring various career paths within it.

I recently earned my ISC2 CC certification, and I'm actively preparing for the CompTIA Security+ exam. I'm also considering pursuing CompTIA A+ to strengthen my foundational IT knowledge.

My background in public history has provided me with valuable transferable skills. Specifically, my experience at a history museum involved significant data analysis, meticulous auditing, and detailed record-keeping, all of which I believe are highly relevant to compliance roles within cybersecurity. I am also very proficient with research, and communication, both written and oral. I'm also open to roles in risk management, and security awareness training.

I'm aware that my lack of formal IT education might be a concern for some employers, but as I only received my degree a few years ago, going back to school is not really an option for me.

My questions are:

Given my background and certifications, what are the most effective strategies for breaking into the cybersecurity field?
- What sub-field would you recommend that I start in?
What additional skills or certifications would you recommend I pursue to enhance my employability?
How can I best highlight my transferable skills and demonstrate my passion for cybersecurity to potential employers?
Are there any specific entry-level roles or internships that would be a good fit for someone with my profile?

Thank you for any advice/ help!

Re: Advice Needed: Career Change

nkeaton — Wed, 26 Mar 2025 02:37:36 GMT

Congratulations on your CC. I would not recommend against reading CompTIA materials, but I would not recommend taking the exams. While I have helped hundreds get their Security+, it no longer differentiates a candidate. The last brag saw from CompTIA was 700K certified in Security+. So that is the competition, and they have completely flooded the job market. A+ is worse. Besides the materials being very out of date, it takes 2 exams making it much more expensive than Security+. People who come to me can pass the first exam but not the second. The maintenance fee for Security+ is $50 a year. It is much more complicated and frustrating to do continuing education with CompTIA than ISC2. As far as a next certification, I would suggest the SSCP. It is very similar in content to Security+ but is much less expensive ($249 vs $404) and no performance based questions. You will only have one continuing education system to deal with. ISC2 is much easier and more flexible for earning continuing education. The annual maintenance fee goes up to $135 but would be paying $100 for both your CC and CompTIA. That amount never goes up even when you earn the CISSP.

Not keeping to your format, but look in your area for active cybersecurity chapters, and attend meetings. People there will have a much better idea of local job opportunities. Join no cost organizations such as Infragard and CSA. Even if they don’t have active local chapters, you will get other information and can list the memberships on your resume.

Re: Advice Needed: Career Change

Spirnia — Wed, 26 Mar 2025 12:42:28 GMT

Congratulations on earning your ISC2 CC certification!

Next, I recommend you study for and pass your CompTIA Network+ and Security+ certifications. These certifications do not have a work experience requirement for earning the certification.

An ISC2 SSCP certification cannot be earned until you have completed one of the following:

- One year of cumulative work experience in one or more of the domains of the ISC2 SSCP exam outline; or

- A college degree in Computer Science, Computer Engineering, IT, MIS, or another approved related curriculum; or

If you pass your SSCP exam but do not have one of the above, you will earn an Associate of ISC2 designation until you have completed the required experience.

Since you mentioned transferable auditing skills, I recommend you look into the ISACA CISA certification for later on in your career.

Re: Advice Needed: Career Change

emb021 — Wed, 26 Mar 2025 17:54:14 GMT

Let me add to the comments of both @Spirnia and @nkeaton made.

I would advise you to look into the different types of cybersecurity roles. Without a lot of technical knowledge, some may not be a good fit for you. As you noted your experience in the area of audit, and feel that compliance, such as security audit and assessments may be a good fit for you. Take a look at ISACA. While their CISA cert isn't something you can get now, some of their audit related certificates (and the training for them) maybe a good fit.

For more technical training, tho it IS expensive, there is the SANS Institute. Look at their "work study" program to lower the costs.

While I would not recommend getting the A+ cert, I do think getting the Sec+ and Net+ certs a good idea. Regardless that there are just TOO many Sec+ holders out there, too many companies respect it more so then the CC. So having it you avoid being ignored. I would agree that looking to the future of getting the SSCP and CISSP a good idea.

I also encourage getting involved with local groups. Look for local chapters of ISSA, ISC2, ISACA, and the like. I'd also recommend Infragard as well. Attend local events, especially BSides Conferences, which often will have a job track or the like, and local recruiters and consultant companies who may be hiring. In getting involved with local groups, please realize that this is a long-term investment in your networking. Don't expect an immediate payoff, but I know of many who have gotten their 2nd, 3rd, etc jobs thru their networking connections (myself included). It's just not going to happen overnight.

Finally, if you DO want to get into more GRC type roles, you WILL need to become more knowledgeable about various standards, frameworks, and regulations. This means getting up to speed on things such as the CIS Controls, NIST RMF and NIST CSF, ISO/IEC 27001, PCI-DSS, et al. For some of these there are courses and even certificates, and while learning about some of these can be low cost, this isn't always the case.

Hope this helps.

Re: Advice Needed: Career Change

Spirnia — Wed, 26 Mar 2025 15:31:29 GMT

Good thinking, regarding SANS:

The SANS Cyber Academy, although quite competitive, I would recommend as well!

Re: Advice Needed: Career Change

nkeaton — Wed, 26 Mar 2025 20:11:58 GMT

@emb021 Thank you. I do try to do full disclosure on pricing, in this case AMFs. I think that the $135 for ISC2 is maybe more of an advantage to the $50 + $50 for CC + Security+ especially since it never goes up even if add a CISSP (right now my $135 comes to $19.29 per certification a year). DoD started the mess with Security+, and unfortunately private industry followed. Fortunately though DoD has changed their requirements and now values experience and education over certifications; hopefully private industry will follow again. SANS is a good security organization. I am not always impressed with their training, but I would only recommend them if an employer was paying. They carry a hefty price tag. It does bother me that their materials are highly proprietary as well. I appreciate you giving your thoughts as well. They did ask for a lot of information. Hopefully they make the right choices for themselves with any information that we give them. This post was much more thought out and detailed than the usual asking by beginners, thank goodness. The interesting thing about ISACA is that a person can pass an exam but cannot submit the application until they have the experience (you and I know that but just detailing it for those that do not know). I have mixed thoughts on that. It might reduce some of the issues with Associates of ISC2 misrepresenting themselves but would not be as profitable to ISC2. I have run into a couple of fairly bad examples of that and did end up turning someone in recently. I didn't like it, but they were the one that was misrepresenting themselves. An Associate of ISC2 is only a membership and not a certification for anyone reading this that does not know.

Re: Advice Needed: Career Change

dcontesti — Thu, 27 Mar 2025 00:57:06 GMT

As @emb021 has said, find local chapters of (ISC)2, ISACA, Infragard, etc. and attend their meetings. Talk to folks at these meetings. Ask about volunteer positions that you may be able to pick up.

I would recommend that you apply for the SSCP, (you did state that you recently graduated), so you would have the pre-requisite.

I would also say that you should take some basic IT courses. CompTIAs A+ and Net+ are good places to pick up information and new skill sets..

ISC2, also offers a number of certificates (not certifications) that you could take to augment your existing skill set.

https://www.isc2.org/professional-development

The organisation also offers a number of Express Courses that might assist you in defining "who you are" to a potential employer.

Regards

Re: Advice Needed: Career Change

cguido — Sat, 29 Mar 2025 17:46:31 GMT

Thank you for all of this info!! I'll definitely take your recommendations about skipping the Sec+ etc into consideration. I agree that, regardless of whether or not I end up going for the certification, I'll continue studying the exam materials. So far, its lots of overlap with ISC2 CC but I think it goes beyond it at some point (Its a good refresher in any case!)

Definitely going to look to join my local ISC2 chapter and network/ learn through that.

Thank you again for the help! 🙂

Re: Advice Needed: Career Change

cguido — Sat, 29 Mar 2025 17:52:40 GMT

Thank you!

Very interesting about the ISC2 associate status. Would employers be impressed by this, or would getting the full Sec+ certification hold more weight to them? I definitely don't have the work experience to get the full SSCP certification, but if being an "ISC2 Associate" holds some weight, maybe this is the next step for me?

Re: Advice Needed: Career Change

cguido — Sat, 29 Mar 2025 17:59:34 GMT

Thank you for the tip about the SANS Institute! I ended up looking into both the Institute and the Academy.

I applied to do some online moderation for one of their conferences, but am still waiting to hear back. Fingers crossed, as it would be great to be able to sit in on the lectures.

I think the SANS Academy applications open in May, so I'm waiting to apply around then. Not holding my breath, as I know its very competitive.

I'm going to look into ISACA certificates and chapter too. I've located my local ISC2 chapter, so I'll hopefully apply for entry very soon.

I think I agree with you on the Sec+ and Network+ certifications. I was going to study both exam materials anyways, so why not go through with the exams while I'm at it. I think that my lack of formal education and work experience really necessitates obtaining a solid collection of entry level certs.

Thank you again!

Re: Advice Needed: Career Change

dcontesti — Sat, 29 Mar 2025 17:59:54 GMT

What degree did you get? If from a college or university, you should qualify for the one year experience for the SSCP.

Here is a grid showing the requirements for the DoD. Note both Sec+ and SSCP are listed.

https://www.wlac.edu/sites/wlac.edu/files/2022-11/Dod.pdf

Re: Advice Needed: Career Change

cguido — Sat, 29 Mar 2025 18:02:04 GMT

I got a BA in History back in 2021, so I'm thinking that I wouldn't qualify for the experience 😕

Thank you for the grid! This is super helpful to have

Re: Advice Needed: Career Change

Spirnia — Sat, 29 Mar 2025 19:34:06 GMT

I would recommend getting the Network+ and the Security+ because you earn the certification once you pass each exam. I have both of those and truly feel they are both worth it!

I do not know how much weight the ISC2 Associate status holds as it is a designation and not a certification. I have just earned that designation through passing another ISC2 exam.

I highly recommend that once you are situated in the cybersecurity field that you go for your ISC2 CISSP, for sure! I very much enjoyed the CISSP curriculum.

I just began studying for the CCSP (cloud) curriculum. It will be many months before I sit for that exam.

The ISC2 CISSP and CCSP exams are known for their high degree of caliber!

I wish you the best of luck with your application to the next cohort of the SANS Cyber Academy which accepts applications in the month of May! Just in time!!

Re: Advice Needed: Career Change

dcontesti — Mon, 31 Mar 2025 15:46:32 GMT

@cguido

The best folk to make a call on your experience are management. I believe they would need to review your courses etc to make a decision.

Re: Advice Needed: Career Change

nkeaton — Sun, 30 Mar 2025 01:34:54 GMT

@dcontesti That is a nice chart for reference, but the 8570 was replaced by the 8140. I can find you a link if want but unfortunately is a little more complicated than that very succinct chart which have always liked. One thing that I really like about the 8140 is that DoD emphasis has been changed to what I believe is more important which is experience and education. Hopefully private industry will follow again. I don’t know the situation where you are, but in the US Security+ has completely flooded the job market. I think that we can agree that having Security+ does not mean that a person belongs in cybersecurity or can find a cybersecurity job.

Re: Advice Needed: Career Change

dcontesti — Sun, 30 Mar 2025 01:50:09 GMT

@nkeaton if the Sec+ has gone by the way side, why is listed Under both Technical and Management in the DoD 8140.

FYI here is the 8140 table from https://enterprisetraining.com/dod-8140/

Re: Advice Needed: Career Change

nkeaton — Sun, 30 Mar 2025 01:58:20 GMT

@Spirnia I have very mixed emotions on recommending CompTIA. While I have helped hundreds of our folks earn that certification, it does not carry the weight that it did when I earned mine in 2010 and has completely flooded the job market. Almost none of our people have A+ or Network+. No learning is bad. I would not recommend against reading their materials but would not recommend taking the exams. I have neither but earned Cloud+ and Server+ participating in beta exams. The Associate of ISC2 is very problematic to me. The biggest issue that I have seen with it is people misrepresenting themselves. I also do not like that people invest the time and money to get as you indicated, essentially nothing. It is only a membership and not a certification. For my CCSP I did read the Sybex book, but I feel that my best resources were no cost materials from CSA (Cloud Security Alliance) and NIST. The former is to me a very cool organization. They helped ISC2 develop their CCSP and ISACA their CCAK. Their materials (for their CCSK certificate) assume that have the cybersecurity knowledge and concentrate on cloud concepts and cloud security. That is about half of the exam with cybersecurity being the other half. Best wishes. Feel free to ask me questions. It is maybe my favorite certification especially for those active in the job market.

Re: Advice Needed: Career Change

nkeaton — Sun, 30 Mar 2025 02:06:46 GMT

@dcontesti Security+ was not on the 8140 lists for about 10 months which kind of had CompTIA scrambling. This is the official site: https://public.cyber.mil/wid/dod8140/qualifications-matrices I picked the qualifications matrices but is much more information on the site itself.

Re: Advice Needed: Career Change

nkeaton — Sun, 30 Mar 2025 03:22:32 GMT

@dcontesti I looked more at your link. I have never heard of this training vendor before, but there are other issues with what they posted. The DWCA has not existed for many years. I do not know why they got rid of it. My understanding is that certifications if the person does not have the experience or education are based on work role; so the IAT, IAM, etc designations are only relevant for 8570 which no longer applies. The table that showed should at least should have had the correct name for CAP which was changed a few years ago to CGRC. The names changed for the former ISC2 concentrations and for CASP+ to SecurityX are somewhat recent but not reflected.

Re: Advice Needed: Career Change

Spirnia — Sun, 30 Mar 2025 07:59:25 GMT

I will allow the data to speak for itself.

It is good to hear differing views.

In the end, one makes the best decision based on available information to them.

I stand by my recommendations.

My recommendations are based on my personal experience and current available data and information.

The images I have posted are all from the respected cyberseek.org website.