I’ve done a lot of mentoring over the years, helping people break into the cybersecurity field. One of the obstacles I inevitably face is convincing people that they even have a shot. Everyone thinks they’ll need 23 advanced degrees and certifications and an IQ of 690, and the simple fact is, none of that is true. Yes, you need to have a modicum of education, but that can easily be achieved without a university-style formal education. Yes, you need to be intelligent, but you don’t need to be Richard Feynman.
Maybe it will be helpful to some if I tell you how I got here, so buckle up for a strange ride!
I grew up in rural south Mississippi, at least half feral. I spent my time running the woods, hunting, foraging, and generally trying not to go inside. Ever. Eventually, though, economic growth happened even in Mississippi, and we got access to this magical thing called the internet. My family got our first computer in the late 1990s and I took to chat rooms (IRC, for those old enough to remember it) and such. That was about the extent of my computer experience. I didn’t grow up with the knowledge or resources to get an early start like some, and I thought “hacking” was wizardry that only “those other people” could do. I was just a dirt dumb redneck who spent too much time in the woods, right?
I got kicked out of high school at the end of my 9th grade year, got my GED, and started college. More than 20 years later, I still don’t have a degree. I dropped out and joined the military, where I received a very rudimentary education in basic computer repair. Think A+ certification level.
Because I was something of an adventurous soul, I volunteered for, and was accepted for some interesting assignments that introduced me to fundamental concepts of information and intelligence analysis, but I still had no way of applying those outside of a military context.
When I got out of the military, with (to my knowledge) no marketable skills, I held down a string of strange jobs: I was a rodeo cowboy for a few months, then a carpenter, then a boilermaker and structural welder. I took odd jobs doing manual labor for some local farmers. Whatever I could find to keep the bills paid. What I had going for me, though, is that I realized those jobs weren’t sustainable. I knew that if I put in the hours required to keep the bills paid, I’d work myself to death before I turned 30…so I decided to pour on the short term stress in order to seek long term advantage. I took my meager time off work to study. At the time, and in that region of the country, that meant reading books at the library. I had an uncle who had done very well as an executive at a computer company, and I thought that might be just the ticket, so that’s what I studied.
Once I felt confident in my skills, I sent out my resume and was eventually offered a job as a helpdesk tech for an ISP, for a whopping $10.50/hr. The catch? It was in San Antonio. Still, it was a job. I sold my car, which barely ran, packed up my few possessions, and bought a one-way bus ticket to Texas. After a short stint at this ISP, I was offered a job as a help desk technician on contract for the US Air Force, and I accepted. The pay was amazing (about $15/hr, so not actually amazing, unless compared to carpentry).
All the while, I continued to study, expanding and deepening my skillset. I bought a book called Hacking: The Art of Exploitation, which introduced me to some fundamental concepts such as buffer overflows, and for the first time, I realized I could put that old training in analysis to use. I continued to study, updated my resume, and eventually took a job as the lowest paid intrusion detection analyst at the Air Force Computer Emergency Response Team (AFCERT), where I stayed for several years, working on different contracts and always slowly climbing the ladder.
I also continued to study. I was pretty convinced that if I just learned everything I could, I’d be “set.” I learned digital forensics and malware analysis, incident response, threat intelligence, and a host of other things. After about 5 years with the AFCERT, I decided it was time to give up the security clearance, move to the private sector, and finally succeed. Since then, I’ve worked for a number of companies, in a number of positions, but always climbing, always learning, and always with an eye on what could better position me to eventually move toward senior leadership.
Now…why did I bother typing all of this out? I need you all to understand that winning the genetic lottery or being born into the kind of money that pays for a college education are not the only paths to success. Sometimes, it may be a strange and winding road, but yes, you do have a shot. You’ll have to put in some long hours studying, and probably take some chances, stepping outside of your comfort zone, but if a high school dropout from Mississippi with almost no formal education can do it, so can you.
Stop looking at the reasons you can’t do it, and look deep within yourself for the reasons you can do it. I assure you, there are infinitely more of the latter, especially now, when the information is available for free, and easily found with a simple search-engine query.
Article Link: Stop telling yourself that you can’t. – It's Biebs the malware guy!!