Background

Hi, I'm Ashley Kang! Here are my 2¢ on getting started in cybersecurity. My perspective is shaped by my experiences being a grad student in computer science, interviewing for cybersecurity internships in 2020 and 2021, and interning as a security engineer (product security) at a start-up and a security consultant (application security) at a Big 4 accounting firm. While there may be a lot I cover here, there's a lot more to be explored!

Information security (infosec) professionals are often categorized into red team (penetration testing, etc.), blue team (DFIR, malware analysis, threat hunting, etc.), purple team, governance/risk/compliance (GRC), privacy, and so on, so what to learn to become a cybersecurity professional may vary! Perhaps a start is to consider whether you'd be interested in an offensive or defensive approach to cybersecurity problems. Also, depending on the maturity of security at a company, you may see different types of security teams like offensive security, application security, detection and incident response, product security, infrastructure security, and corporate/enterprise security. Whatever you end up doing, it will be helpful to understand how your work fits into business needs. Asking what the security organization looks like at a company is a great question for the team you are interviewing with. Some security teams at companies like Google, Bishop Fox, and Cloudflare have public blogs that can give you a better idea of what someone in a security role does there (and what you might like to do)! I also recommend looking at security job postings and noting what kind of job descriptions sound interesting to you.

Foundation

An approach I heard from a former coworker and mentor (who transitioned from software to security engineering) is to build off what you know already. My background is in web development, creative computing, and software engineering, and cybersecurity has without a doubt strengthened my understanding of these technologies! My formal introduction to cybersecurity has been through my MS in CS program, specifically my elective coursework in network security and web security (and soon digital forensics), so I can't really vouch for the quality of classes outside of my degree program other than by word on the street. However, I believe it's important to start with high-level concepts and from there, dive deep into a topic at a time and build your toolbox. Sometimes, the tools won't catch everything, but you can.

Experience

These suggestions are inspired by the Friday Hack Days that were hosted by my campus club, Offensive Security Society, in 2019. Also, I've often been encouraged to blog. I recognize that keeping a blog is not an option everyone should be expected to have capacity for, but it may help you keep track of your learning better than anything else. This may also serve to help you stay ready for interviews so you don't have to get ready!