Cybersecurity as a Career Path

Gerry Bayne: Welcome to EDUCAUSE Exchange, where we focus on a single question from the higher ed IT community and hear advice, anecdotes, best practices, and more.

Currently, there are more than 300,000 cybersecurity positions available in the United States and cyber security continues to be one of the top 20 fastest growing fields in the country. Individuals with cybersecurity skills are needed at all levels in a variety of industries, but many young people are intimidated by the qualifications and what they perceive as dry, technical work. But cybersecurity jobs are not just about coding and hacking, they're also about communicating, managing, and being creative. So I asked several cybersecurity professionals, how would you encourage young people to look at cybersecurity as a career option?

Tara Schaufler: First off, I would definitely tell them not to be discouraged if they did not study cyber security in college or computer science or anything like that. Most of us you'll find when you talk to us have very, very interesting backgrounds and didn't necessarily plan to be in this field.

Gerry Bayne: Tara Schaufler is Awareness and Training Program Manager for Information Security at Princeton University. She says that until she got into the field, she never thought cybersecurity would allow her to explore certain parts of her personality.

Tara Schaufler: My bachelor's degree is in the social sciences. My master's degree is actually in nonprofit development and in human resources. So yeah, not exactly what you would expect, but I started working for Princeton University in 2004, and I worked in a lot of different jobs. A lot of those jobs being communications related and training related, and ultimately I wound up in this position. I happen to be a very creative person and I find it really interesting that I wound up in this field. And the cool thing about this specific job is that I actually do get to do a lot of creative stuff. I'm constantly trying to think outside the box and look for different ways to communicate with and educate our community. And that doesn't have to be dry and boring. You can do a lot of cool things, a lot of creative stuff.

Zarmeena Waseem: I myself studied Spanish and broadcast journalism. I landed in the tech world by chance.

Gerry Bayne: That's Zarmeena Waseem, Director of Cybersecurity Education at the National Cybersecurity Alliance. She says that many of the things that excited her about pursuing a degree in journalism translated into cybersecurity.

Zarmeena Waseem: When you work in the tech world, information security or cybersecurity often is seen as it's for the nerds or it's for the really, really smart kids who can be security engineers and whatnot, but there's so many different aspects to security. I'm not saying that it's not technical. I think that the same way that all of us possess a certain level of creativity, I think that everyone possesses the potential to be able to be technical as well.

For me, one of the reasons I think that I'm comfortable in this field is the same reason that I went after a journalism degree. It's like every day it's something different. Every day I have to learn something new. Every day there's a new threat. Every day there's something that I need to talk to my team or talk to the public about. There's something to learn. There's something to teach. You're never going to be bored.

Cheryl Washington: I think part of the challenge that I see is far too many people still equate cybersecurity with IT.

Gerry Bayne: Cheryl Washington is Chief Information Security Officer for the University of California Davis. She wants to attract more people to the field by changing perceptions about what security means.

Cheryl Washington: If you were say, a philosophy major, and we're still talking about cybersecurity as if it's an IT discipline, chances are you're not going to consider cybersecurity. And unfortunately that's our loss. So one of the things I want all of us to do, not just the person asking the question, but those of us responding, is to demystify what cyber is and what it isn't. It is not IT. Start there. We've got to change that conversation completely. There are so many different dimensions to cybersecurity that anyone who's interested in the challenge, anyone who's interested in trying to help an organization or an individual can find a place to do all of that and then some in the cybersecurity world.

Mike Corn: I worry that we still are viewed as the people that install anti-virus software.

Gerry Bayne: Mike Corn is Chief Information Security Officer for UC San Diego.

Mike Corn: The beauty of cybersecurity as a career, and maybe its curse, is that it is so rich and broad. There is no aspect of the organization, be it IT, business process, where you're worrying about resilience. There's nothing we don't pay attention to or stick our nose in. So yeah, we really have to help people understand that cyber security, it's a portfolio. It's just massive and that's exciting.

Gerry Bayne: Another important aspect about attracting young people to the field of cybersecurity is creating a diverse tapestry of professionals. Again, Zarmeena Waseem.

Zarmeena Waseem: Diversity is a lot more than just making sure there's more than one race in the room. We want to make sure there's a mix of different ages. We want to make sure that the LGBTQ community and other communities feel included as well. And so when we're talking about students and attracting younger people to this field, I just think that there are some really easy ways that people don't think about. For example, I talk a lot about how you can use hashtags when you're doing job posts on Twitter, LinkedIn, or wherever else. If you're using hashtags like Black Tech Twitter, if you're using minorities and cyber minorities in tech, et cetera, you can do the same thing for young people. If you want to use hashtags like HBCU Grad or Grads, I don't know, new grad looking for job, whatever. There's some really simple ways to bridge these gaps.

Gerry Bayne: Let's talk about the inroads, ways to find a path into the cybersecurity industry. Here's Tara Schaufler once again.

Tara Schaufler: There are so many resources. If you're interested in it, you don't even have to make a big investment. You can go online, watch a lot of free webinars. There's great blogs. There's great websites. EDUCAUSE included a lot of information in there that you can get and read and get a taste for what the field is like.

Gerry Bayne: Again, Zarmeena Waseem.

Zarmeena Waseem: Find yourself a really good mentor. There's no amount of money I could ever give my mentors, there's just a debt that will never be paid. And they're fine with that because they want me to be even better than them. And I mean, the fact that I'm sitting here with you today I think is a testament to something like that. This is my third year in cybersecurity, and I get to do this because I was able to stand on the shoulders of giants.

Gerry Bayne: Brian Kelly is Director of the Cybersecurity Program at EDUCAUSE.

Brian Kelly: I think, as we grow professionally, whether you're new to the profession of cybersecurity or you've been around for a while, we've all had people that have helped us along the way. Right? So I encourage folks to either ask to become a mentor or be a mentee and help sort of the next generation. Right? Help sort of pass that torch from what we were given as we were coming up.

Gerry Bayne: If you're interested in mentoring or finding a mentor, visit educause.edu/findingmentors. That's educause.edu/findingmentors. I'm Gerry Bayne for EDUCAUSE. Thanks for listening.