Here is the advice I give to anyone wanting to break into any industry. Get any job you can get in that industry and try to learn it. Then volunteer to do extra stuff. Get an IT job, even if it is outside cybersecurity. There is a cybersecurity component to almost every IT job. Then look for jobs that are going undone. Volunteer for every extra duty you can, even if it means no more pay, or extra duties outside of your normal duties, etc. I see so many people get hung up on the idea of "I'll do more after they pay me more." and they miss out on so many learning and resume building opportunities because they cannot see how gaining the experience now is worth more than gaining the money. Or they say "I'm not going to let my employer abuse me that way." And yes, I know that there are employers that will overwork employees, that's not what I'm talking about.
I am talking about soaking up as much experience as you can get even if you have to seek it out, that will be applied to future opportunities. That is how I, and several more successful people I know, got ahead. We were hustling for tomorrow's opportunities/money, not today's money.
Ask about shadowing other people who have jobs you want. As if your company would be able to do job rotation. Can you volunteer at your church, or at other places that need some IT or cybersecurity help.
Be realistic about salary too. I have seen some people come out of college and expect to make 80K in an entry level position. They would rather stay unemployed with an unrealistic expectation than take a job for 40K, work 2 years and have plenty of experience to start to apply for those 80K jobs, or maybe the 60K jobs.
As a hiring manager I can tell you the experiences of 3 interviewees this week.
One had IT experience but didn't show enthusiasm for the position or that they had given much thought into the cybersecurity aspect of the job. Didn't have any questions for us at the end of the interview, and hadn't done work on their own into learning cybersecurity, like taking classes, experimenting with free tools, etc. I once hired a person to be on my team who had zero IT or paid cybersecurity experience. They had taken free cybersecurity courses on their own time to get into the field. Since they showed that much ambition into getting into the field, I gave them a chance. But it was not this candidate.
One had over embellished their skills. They had no IT work experience but because they had used a few tools for a few hours, they listed themselves as an expert in using those tools. They talked about a home lab they had built, but it seemed more like a project they were planning on doing, but hadn't really given it much thought or work. Or that they had started to set up but never finished. When questioned in the interview, they were unable to substantiate those skills. It became very evident that they could talk the talk, but not walk the walk. Their only question at the end of the interview revolved around benefits. Plus their social media posts were not very flattering (yes some of our team members will check out your social media).
The 3rd candidate, while very eager, had taken the initiative to learn the tools of the trade, had done their research on our company, had prepared questions for us (that were not just about salary or benefits). They had some part-time experience that they had gained while at school and that will be enough to push them into a forthcoming offer.
I can teach a candidate about cybersecurity tools. I can't teach passion, initiative, and ambition. Practice interviewing and if you are going to list a tool you've used in your resume, please don't embellish. Have prepared questions and calm down and breathe.
