Thank you for your help
I just wanted to offer a genuine thank you to everyone who spent time helping me try to find a cyber security position as a new grad. Unfortunately, it was all for not.
I graduated from a reputable school last June with a BS in Computer Science & Cybersecurity with a respectable GPA, in a tech hub, with multiple projects. I spent 9 months submitting over a hundred applications to any and every entry level security position up and down the West coast, with most paying $60-75k, with not so much as a phone screen. I received rejection emails from <5% of the companies to which I applied. And yes, I leveraged my network wherever possible.
I finally broke down, applied for a position as a SWE, and was offered the job. With a tech hub SWE salary. My student loans are coming due, and I have mouths to feed. I couldn't wait forever.
I dedicated almost a full year of my life beyond getting a CS degree to side projects so that I could work in your industry, but it was all a complete waste of time. If I were looking at going into tech with zero skills, with what I know about the industries, there’s no chance I’d have wasted my time on learning how to use Burp Suite or nmap. I’d have fully skipped the hundreds of hours of podcasts, DEFCON, and Black Hat talks that have extended my daily study time by hours most nights. That is to say nothing of learning networking protocols or the Extended Euclidean Algorithm to find multiplicative inverses so I could both encrypt and decrypt RSA messages by hand. HTB, THM, OTW… all just a waste of time. Don’t even get me started on the Udemy courses and certification grind.
I know this sounds like “I’m so amazing and you should all be upset that I fell through the cracks”, but I promise it’s not. What I want to know is this: How does the security industry expect to attract and retain talent if the barrier to entry is this high for positions that pay far, far less than development jobs? Is it that security is a cost center while development is a profit center? Is it that companies aren’t penalized enough for preventable data breaches? What can be done to change this so that I don’t see ads everywhere saying “the cyber security industry has loads of open positions” and have an aneurysm?
Posted Mar 24, 2021, 9:57 PM UTC
Are you mad you couldnt find a direct fill into the security realm out of college? Welcome to the club, its very rare for someone out of college to get right into security.
Sorry to be blunt, but you literally graduated at one of the worst times, no fault of your own. Companies could and cannot still, in most instances afford (not monetarily but logistically/resource wise) or risk to bring on green security people. They need people with the advanced or intermediate knowledge to come in and get things done (mainly because they either never spent the money before or they got effed going remote). Most are looking for security engineers not pen testers, not saying there arent any out there. And frankly security implementations are company unique and therefore they want people with intimate knowledge of their tools and suites.
There are plenty of jobs postings, but I dont see any entry level ones in any major cities. Did you try dice.com? I get multiple somewhat relevant emails daily.
Also, dont ever beat yourself for learning more, its an unprecedented time.
I might have something if you want to utilize your swe skills to automate and develop security and compliance work. But it probably wont match a tech hub swe salary.
I'm upset that I spent years working night and day toward being a high quality candidate, only to receive a tiny handful of automated rejection letters. It's a little ridiculous that all but one of those emails came from F5 after putting out that many applications.
It also sucks to see so many ads touting the huge job market for cybersecurity just to find yourself shouting into the void when you're finally capable of doing the work.
Like I said, I'm really appreciative of the help people here gave me. But like I've said for months in other posts, if I get a SWE job first then the money will keep me there.
I get it, it's frustrating. Have you tried applying elsewhere (location wise)? Many security people who get a job right after college typically had an internship with the same company.
Frankly if you enjoy the swe work, see if you can pivot to application security and be the defender. Pay is similar to swe as well.
https://www.reddit.com/r/Information_Security/comments/md39mr/hiring_100_remote_multiple_senior_appsec_engineer/