How much you can make in an entry level cyber security job

How much you can make in an entry level cyber security job is a good question. We’ve all heard there is a shortage of people in cyber security, and while the money is good, there are certain limits. In this blog post, I’ll talk about the limits of the entry level cyber security job, and some possible career paths.

You will sometimes hear that cyber security jobs make six figures. And I don’t want to pour cold water on your hopes and dreams, but the entry level cyber security jobs typically do not. And when they do, it’s in places that have a high cost of living. If you make $100,000 in New York City, that’s the same as making $41,000 in Omaha.

I saw a LinkedIn post suggesting that people have this expectation, and it’s also something I have experienced first hand. I don’t want to give too much detail, but I once had a co-worker who finished a degree in cybersecurity and she let her displeasure be known that she wasn’t making $100,000. The problem with that was, at the time, no one but her manager was making $100,000 either.

I don’t like talking specifics about salary, and your mileage will certainly vary. I can point to a specific time when I crossed that threshold. In my case, I had a former employer and a prospective future employer who were both interested in me, because I could solve a specific problem for them. I told one about what the other was thinking in terms of salary, because I wasn’t sure both of them were on the same page. Both of them were on the same page.

But I didn’t just take the job that offered more money. One of the jobs had little or no advancement opportunity. The money was good, but that was as high as I was going to go with that organization, and the chances of using that to make anything other than a lateral move weren’t all that good. The other job, besides the money, offered valuable experience that built on experience I already had, but also offered new experience, and also positioned me to greatly expand my network.

But I’m getting ahead of myself a little bit. Let’s talk about how to get to that point.

Years ago, there was a best-selling book titled What They Don’t Teach You at Harvard Business School. The point of the book was that while there are valuable things you learn in the classroom, to be really valuable, you need to know things that you won’t learn in the classroom. It also pairs up with the book What They Teach You at Harvard Business School to make a great meme.

If you want to be worth $100,000, you need to know things that people graduating in a few months don’t know. Or at the very least, you need to be doing those things in production environments, not in lab settings.

In my case, what pushed me over that threshold was I reached a level of experience where I could solve a very specific problem for either of those two prospective employers. I could offer both of them something other than general knowledge. It was specific knowledge and experience that pushed me over the threshold.

Other companies who just wanted to utilize the general knowledge I had didn’t value me as highly.

So to do that, you need to get your first job. Even if the pay isn’t very good. And even if it’s not strictly a security job. One of the best things you can do is take enough classes in general IT that you can get a job in IT rather than in security.

My career path is a bit unusual. But most of the ways I’m able to provide value leverage my operational system administrator experience. I can tell another security person when a system administrator isn’t being straight with them. I know their language, and I know the playbook.

And just this past week I had a conversation with a member of the technical support team at work. He knew what our employer says about running its products on VMware. But I was able to tell him when you can break that rule and under what specific circumstances. He understood it after I explained it to him. But since he didn’t have VMware experience, he needed someone to tell him.

So I think it’s worth it to take a job as a system administrator for a few years, even if it means taking a pay hit. And if you can’t find a job as a system administrator, there are opportunities in desktop support.

And then, whatever role you find yourself in, volunteer for security related tasks. For example, when I was a system administrator, nobody wanted anything to do with antivirus. I ended up doing antivirus and event log collection and patching because nobody else wanted to do them. It took me 7 years to accumulate 5 years of security experience, which sounds like a rip off, but look at it another way. My first security job wasn’t an entry level security job. I was able to apply for a job that needed 5 years of security experience, and I landed it. And after getting CISSP and about five years of experience in full-time security roles, I was ready to jump another pay grade.

And that’s good news. The shortage for security professionals is at the mid and senior levels, not so much the entry level. You can get a job as a SOC analyst and make decent money, and the experience is good. But you’ll be up against a huge number of applicants. Perhaps as many as 3,000. There won’t be as many applicants for those sysadmin and desktop support jobs.

And when they ask you in the interview, simply say you took security classes because of interests you, but you’re a technologist. You like technology, you like the city of the job is in, and you like the company. Make sure you know enough about the city and the company to be able to back that up. You can also say that it and security frequently have to work together, so having a background in security will make you a more effective IT professional.

And once you get in, interact with the security team as much as you can. If the company has a security champions program, participate in that. If there is an initiative to roll out security tools, participate in that. Examples of that include deploying Crowdstrike or Splunk or Nessus agents. If the security team needs help from the IT team in managing any on-premise tools, or setting up things like single sign on or multifactor authentication, volunteer for that. It all counts as security experience.

A good way to find opportunities is to watch job listings. I’m not saying to go get a new job right after you just got one. But look at jobs that are out there, and find something that sounds good to you, but is out of your reach. Look at the experience it requires, and look for opportunities to get some time with those tools or a competing tool. Use those job listings to figure out where you want to be, and how to get there from where you are at the time.

Keep watching, and keep making adjustments along the way.

And then, when you are ready to make your move, tailor your resume for that job. You will have 3 to 5 years of experience with your first full-time employer, plus your education, plus any internships or part-time jobs you had. Take the job duties for the job that you want and relate them to what you did at your first full-time job, and if possible, at your part-time jobs or your internships. And when it comes to your education, mention specific classes that apply to those job duties.

If your resume lands on my desk, you want me to read that resume and conclude that you have been working toward this position for seven or eight years.

And when you get into the interview, as long as you have enough experience that you can talk intelligently about all of the things that you list, you’ll pull it off. Maybe not the first time, but the thing about job searches is whether you interview with one company or 10, you can only accept one job offer. As long as you get one decent offer, it doesn’t matter if it’s the first or the 10th company extending it.

share

share

save

share

share

share

pocket

share

email

RSS feed

Dave Farquhar

David Farquhar is a computer security professional, entrepreneur, and author. He has written professionally about computers since 1991, so he was writing about retro computers when they were still new. He has been working in IT professionally since 1994 and has specialized in vulnerability management since 2013. He holds Security+ and CISSP certifications. Today he blogs five times a week, mostly about retro computers and retro gaming covering the time period from 1975 to 2000.