No degree and doing well in infosec here. First, there are a lot of people that know security related subjects well but have never worked in infosec. Those peo

No degree and doing well in infosec here. First, there are a lot of people that know security related subjects well but have never worked in infosec. Those people in my experience give bad advice. Second,what they keep saying about high demand in infosec is true. But like another commenter said there's the typical catch 22. My advice: I have known people from a non-IT background do well but you still need to get your foot in the door by doing intetnships or some other work. Another approach would be socializing at local meetups or cons (which I know little about). Infosec is very broad. It would benefit you greatly to have done some other IT work prior to infosec. I've met a lot of peopoe who can't code, don't have certs,don't keep up with current security news,can't even name a single malware family to save their lives and they do well in infosec. The thing is you can do complaince,architecture,incident response,vulnerability management,penetration testing,security engineering and my favorite: a generic infosec analyst. A lot depends on the size,maturity and architecture of the infosec team. I have been at a company with dedicated teams for red teaming,IR,SOC,security engineering,etc... With total of >50 infosec staff. And i have been in a team where the whole infosec team is 3-5 people. The smaller the team,the more they need prior infosec experience and the broader your skillset needs to be. On larger teams, they try to diversify skillset so if you bring something valuable to the team they don't care all that much about your certs and experience so long as they can be sure they don't have to train you extemely basic things. In a big team you are siloed which means you can either be complacent or grow deeper into the area of infosec you picked. Aim for very large companies first. But before that be good enough at everything. Code something and have an ok github,get certs to show you're serious,know enough networking,sysadmin(especially windows) ,etc...and keep up with latest security news and chatter (twitter!). All that is to help you get an interview. You gotta be flexible with work conditions for entry level work. Exploit/vulnerability research,bug hunting,pentesting and malware analysis get a lot of press. Before I got into infosec I didn't know about the wide range of jobs in infosec. People even tried to convince me I needed to be great at mathematics,crypto,reverse engineering or whatever. A lot of people give advice with a survivor-bias mentality. In reality if you have passion and specific areas of interest within infosec it's only a matter finding an entry point that will help you get there. If vuln management (boring) intetests you for example offensive security certs and a solid IT experience will help. If incident response interests you,finding a SOC job which will require basic IT/security certs and breadth (you need to understand context behind a wide range of security events) is natural. SOC or other entry jobs can also benefit you as a starting point for security engineering or red teaming. For certs, a lot of people would tell you OSCP (and it is great) but in practice Security+,CySA+ and SANS GIAC entry level certs go very far and teach you a lot of things that are out of scope for OSCP. For entering infosec, your provable ability to understand formal infosec methodologies and various IT processes,network protocols and applications function is what you need to showcase in addition to "passion". All that said,study MITRE's ATT&CK framework [1] and use it to develop your vocabulary and see what real life techniques and tactics are seen. Regardless of which area of infosec you pick having an accurate understanding of realistic threats is foundational. I have also heard linkedin social networking helping a few colleagues. YMMV. I hope that helped,be happy to answer questions. [1] https://attack.mitre.org/ https://attack.mitre.org/