Verdict

My past post: https://www.reddit.com/r/sysadmin/s/drhMqvlhGo Below is a long post on my cybersecurity career so far and what I've learned since posting my first threads here some years ago. Sorry for the length, but it may help someone! About 6/7 (haha) years ago I posted here about starting out in helpdesk. Two years later I posted again, still in a sysadmin-ish role, climbing the ladder. Well, the ladder kept going. I'm now a cybersecurity engineer with a few years of experience across a lot of different environments. Here's an update for anyone getting into the field or trying to move up. I went full security about 4-5 years ago. I started as a security analyst after 3-4 years in general IT, and since then I've worked across MSSP ("SOC as a service"), healthcare, a startup, retail, food/restaurant, entertainment, and sports. I've touched most of the major tools along the way: EDR (CrowdStrike, Defender, SentinelOne, Cylance), WAFs, PAM (BeyondTrust, CyberArk), "zero trust" (ZScaler, Cisco), SIEM in every flavor (on-prem, cloud, managed, unmanaged), and MDR/XDR. Plenty of GRC too, with audits both internal and external, across SOC 2, HIPAA, ISO 27001, GDPR, CCPA, and SOX. **How to actually transition into security** This is the question I get asked most, so let's start here. It usually takes a few years in general IT first, and that's not wasted time. Those years are where you learn the basics and, more importantly, where you learn what the *point* of IT even is and what it is you'll eventually be securing. Security is very technical, so your foundation matters a lot. You don't need to be an expert at everything. What you need is to understand the tools, people, and processes behind most orgs. That means the corporate network, endpoints, websites (usually built by devs, but IT manages the infrastructure and security manages the security stack), identities and users and OAuth, and vendors. If you understand how those pieces fit together, you understand what you're protecting. To break in, you usually start as an analyst. If you can, make your way into an MSSP for a stretch. The client-facing part can be a headache, but you learn a ton of both people skills and technical skills, and you get exposed to way more than you would in a single in-house environment. The pay is good too, often $125,000+. One skill that's worth more than people realize: learning to simplify technical things into executive-friendly language. What is needed, what does it cost, how long does it take, what resources does it require. The people who can translate between the technical and the business side move up the fastest. Here's what else actually stuck. **Most companies run a "one-man SOC."** One analyst or engineer holds the program together, usually with an MDR or managed service bolted on for after-hours coverage. That's not a failure state. It's the norm at most orgs. **Every product promises the same thing.** Fancy dashboards, alerts, solid detection and response. What you actually get comes down to budget, which stays low right up until the company eats a serious incident and suddenly takes security seriously. The exception is leadership that's already been through one. Those people are worth their weight in gold. **Your stack is only as good as three things:** the log sources you feed it, the experience of the team running it, and the hours spent tuning it. Once you hit a decent maturity level, you lean harder on SOAR (playbooks, SOPs, automation) because that's what keeps the program running and keeps you ready for incidents. **Incidents happen more than people think.** The good news is that most should die at the single-user or single-device level, usually phishing or the occasional malware install. That means your stack needs to contain both identity and endpoint incidents fast. Occasionally you draw an advanced actor abusing some tiny misconfig, or very rarely a zero day. The attack surface is the same as always, so good hygiene (patch and vulnerability management) is what stands between you and ransomware on every endpoint. And let's be clear about where the incidents come from: most of them start with phishing. Probably half or more. You can push out as much training as you want, but users are never going to be as focused on learning security as you are, and that's just reality. What does help is making your phishing training and campaigns as realistic as possible. The closer they mirror what attackers actually send, the more your users actually learn and the more cautious they get. **Every environment is different, but the attack surface isn't.** It's always user, device, websites, code. Documentation is rare unless you're at an MSP/MSSP, so you baseline the environment for a few months and build intuition for what's normal. Alert severity also varies by vendor. The same event can be "Critical" in one product and "Informational" in another, which is exactly why knowing your environment beats trusting the dashboard. **Learn to build a SIEM.** Nearly every product generates alerts from logs, so understanding how that works under the hood puts you ahead of people who only click through alerts. And keep your hygiene tight: patch often, scan often, daily if you can. Nessus on-prem is the cheapest solid option (not affiliated). **Learn detection engineering too.** It's symbiotic with SIEM work and best learned alongside it. It's also genuinely one of the more fun parts of the job and a seriously valuable skill to have. Writing detections that actually catch real behavior, then tuning them so they fire on the right things and stay quiet on the rest, is the kind of work that makes you better at everything else in security. It's the difference between reacting to whatever a tool hands you and actually shaping what your program can see. **Experience lets you see through the marketing.** Plenty of vendors spend more on the pitch than the product, then charge 3-5x for the same thing a competitor offers. Time in the trenches is your BS detector. **On AI**, since you knew it was coming. I've used Claude, ChatGPT, and Copilot Enterprise, and Claude and ChatGPT lead. In security it's genuinely useful for triage, investigation, and SOAR. Can it replace pen testing? I don't think so. The tools themselves are built on human logic, and pen testing is a deep craft full of very smart people. AI helps, but it's being overhyped because private equity is convinced it'll print trillions. **On pen testing:** most companies outsource it annually or so. It's standard practice, stress-tests your tools, and exposes your gaps. It's also genuinely fun from the defender's chair. You get cat-and-mouse with talented people, a rare look at real-world TTPs, and a great excuse to write new detections. **A note on titles and career moves.** Most execs can't tell a security engineer from an analyst from a red teamer, which is why nearly every in-house role gets labeled "security analyst." MSP/MSSPs are usually better about real leveling. If you can swing it, do a tour at an MSSP or MDR provider at least once. You get to see how an entire enterprise SOC is built, with analysts, engineers, incident responders, and red teamers all coming together, and you learn to build one from scratch. That's a huge advantage walking into an in-house role. **Where security is now:** mostly the same. EDR + SIEM + MDR + WAF. Vendors are cramming AI into everything, but right now it's little more than SOAR facilitation with a shinier label. Know how to build a SOC and you can hit the same results for far less, because AI burns through money fast. **Where it's going:** AI gets baked into more products, but the fundamentals won't change much. Pen testing might get faster, but not easier. It'll lower the barrier so less-skilled people can launch attacks, though that's really just script kiddies with a new toy, same as ever. The field will keep growing because the scale of attacks keeps growing, and s