3 ms·

>Add to that the general lack of education around cyber security, hardly any mainstream CS course teaches cyber security as a mandatory course Paradoxically, w

>Add to that the general lack of education around cyber security, hardly any mainstream CS course teaches cyber security as a mandatory course Paradoxically, when someone has a pure (or at least focused) cybersec program (a few 3-4 year programs are taught by reputable institutions near me), and a Sec+ or equivalent, all of the old guard shout about needing years of experience (decades preferably) before you should be allowed to even think about security. It only takes a few days in r/cybersecurity or r/securitycareeradvice to see these people in action, yelling at kids coming out of a 4-year university course focused on cybersec to "put in their dues" and work a call-center/help-desk for a few years resetting people's passwords before being allowed the honor of applying to an "entry-level" security position. If a 4 year program cannot prepare you for an entry-level position, either the program is broken or the hiring expectations are broken. Just in this thread someone was saying they would require 10 years of system administration AND 5 years of security experience before considering to hire them. In the same amount of time you can become a doctor or lawyer, and be operating on people or have established your own law firm.

bencollier49 5y ago
I'm tempted to rather rudely suggest that the people who managed to get a job on a helpdesk without any qualifications and then worked their way up to an "old-school" bureaucratic security manager position might feel threatened by graduates with new fangled ideas about DevSecOps.
andrewflnr 5y ago
Exactly what counts as an entry level security position? Manually analyzing alerts or something?
- ziddoap 5y ago
  Really, any cybersec role but with "Jr." in front; lightened duties and lightened responsibility, under the management of someone with more experience, doing whichever duties their manager thinks they can handle. - Compliance auditing (PCI, ISO, WebTrust, etc.). - Software auditing. - Delivering basic consumer-level security awareness training. - Tier 1/2 SOC and NOC duties. - Member of an incidence response team. - Member of a penetration testing team. - Policy development, deployment and management. - Jr. Researcher for XYZ (PKI, cryptography, authentication systems, malware, etc.)

bencollier49 5y ago

I'm tempted to rather rudely suggest that the people who managed to get a job on a helpdesk without any qualifications and then worked their way up to an "old-school" bureaucratic security manager position might feel threatened by graduates with new fangled ideas about DevSecOps.

andrewflnr 5y ago

Exactly what counts as an entry level security position? Manually analyzing alerts or something?

ziddoap 5y ago
Really, any cybersec role but with "Jr." in front; lightened duties and lightened responsibility, under the management of someone with more experience, doing whichever duties their manager thinks they can handle. - Compliance auditing (PCI, ISO, WebTrust, etc.). - Software auditing. - Delivering basic consumer-level security awareness training. - Tier 1/2 SOC and NOC duties. - Member of an incidence response team. - Member of a penetration testing team. - Policy development, deployment and management. - Jr. Researcher for XYZ (PKI, cryptography, authentication systems, malware, etc.)