Certs are not that important to people in the industry, but they are important to HR. As a beginner who wants to get into infosec, very very often a cert or tw

Certs are not that important to people in the industry, but they are important to HR. As a beginner who wants to get into infosec, very very often a cert or two is the difference between the resume being thrown out or getting an interview. As an experienced security professional with years of experience, a cert is literally never the reason you do or do not get an interview. I have mentored 4 people into security within the last 3 years, 3 from IT and one from general sales (of golf carts), and my advice is always the same to them all. 1. Start the networking game immediately. If I was to guess, I would say 2/4 or 3/4 infosec hires are because the new hire knows someone on the infosec team before applying. Find your local infosec meet ups, (They still meet virtually, and soon in person again). Start going to local infosec conferences (look into bsides), and look for community hosted events. Infosec is full of nut jobs who think its a good time to spend hundreds of hours hosting a CTF for no freakin reason other than it is fun. Go to these, get to know the local infosec community. 2. While doing #1, Start Getting a general understanding of all areas of IT. Know what helpdesk does, what windows admins do, what nix admins do, what developers do, what network admins do, and of course what security analyst/engineers do. Develop the skills necessary so that you could confidently do the entry level job of the IT vertical. 3. While Doing #1 and #2 Focus heavily on identifying what aspect of security you want. Like all IT verticals, once you get into it, there are a million specializations, identify if you want to go Offensive, or Defensive. If you are into Risk and Compliance, SOC analyst, Solutions Engineer, pretesting, red team, exploit development, the list goes on and on and on. For the most part, identifying Offensive or Defensive will be enough. There are probably 5 Defensive Infosec jobs for every 1 offensive job. And there is plenty of opportunity to switch to 'the other team' during your career. And just because you are defensive doesnt mean you will NEVER do any offensive work, you will dabble in it weekly/monthly, you just will be like 90% focused on defense. And for those reasons I usually recommend people trying to get into infosec to try and land a defensive infosec role for their first infosec job, even if they know they ultimately want to go offensive. 4. Pick up at least one cert focused on either offensive or defensive infosec (depending on what you want). I specifically recommend OSCP for offensive, and I recommend Sec+ for defense. This is not to develop skills, but for those other 1/4 or 2/4 hires that are not placed by networking. The reality of our world is that Certs get you past the HR filter. These certs are specifically for landing you interviews, no amount of certs will help you perform well in an interview, and if you only do certs for training, you will 100% fail every single interview. Getting a cert almost always increases the number of interviews to places where you do not know someone. 5. While doing #1 and #4, and after #2, #3, focus in on what you find interesting about infosec. Try to become an expert on that area. Not only should you learn about that area, you should learn about every technology that supports that area. If you think webapp security is interesting, learn every single piece of technology that is even peripheral to webapp (A lot of stuff). Security is a mindset, not a skill set. The knowledge a nix admin has and the security engineer have are similar, the difference is mindset and priority. Once you are working on #5, you should start applying full force. You 100% can apply while you still know absolutely nothing, but odds are against you, but still dont let an opportunity pass you up. The first infosec job is the hardest one to get.