What Gets You Through Any Door

Three ways to move through a security career, and the one thing that decides all of them.

The week opened by admitting that nobody hands you a map for a career in this field. Five days on, this is the closest thing to one I've got, which is a single observation that held up in every direction you can move.

A security career is made of three moves: getting into the field, changing lanes once you're in, and leaving without burning what you built. They look like three separate problems, and the people in the middle of them rarely think they have much in common. They do, and it was the point of the whole week.

Monday was about getting in. Almost nobody walks through the front door of cybersecurity; they arrive sideways, out of IT or some adjacent job, and the credential that's supposed to admit them mostly just gets them read. What gets them hired is the thing they can show they can do, and the people who'll vouch that they can do it.

Tuesday took apart the idea that the field is one job. It's a dozen crafts that share a vocabulary, and moving between them is a bigger jump than the org chart lets on. The move works when you can show the new lane's work. Naming it isn't enough, and the certificate only points a direction.

Wednesday turned to leaving, and where the skills go when you do. The first rule was custody: put down the access, the secrets, and the company's work without making a mess of it. The second was translation: the judgment travels, the deep specialization mostly doesn't, and you describe yourself to outsiders by what you can show.

Thursday asked how much of the job is real. Security has a problem: its theater is easy to see and its real work is invisible. A binder of policies and a wall of dashboards look like security. A breach that never happened leaves nothing to point to. So the money flows toward what can be seen, and the people doing the work that matters can't easily prove they did anything.

Line those up and almost the same shape appears every time. Getting in and changing lanes both come down to proof that you can do the work. Leaving well runs alongside that without being the same move: it's knowing what you carry, what you put down, and how to name the judgment that travels with you. But in every direction the contest is the same one, between real capability and the proxy that stands in for it. The title, the certificate, the years on the resume, the hours at a desk: those are the proxies, and the field leans on them because the real thing is so hard to see. The person breaking in and the veteran twenty years deep are stuck at the same wall, and so is everyone between them. The leaver meets a version of it too: which part of the work travels, and which part stays behind. The work is real, and nobody can see it.

That's the gap the week kept circling back to. This field never built a trusted way to turn what a practitioner can do into something an employer, or the practitioner, can see and carry from one door to the next. The proxies filled the vacuum, and everyone involved quietly knows they're hollow. Closing that gap is the work I care about, and it's the reason this newsletter exists.

If any part of this week hit home, whether you're trying to get in, change lanes, leave well, or just convince the people who hold the budget that your invisible work is real, there are two easy ways to stay in it. Subscribe, so the next stretch of this lands in your inbox instead of getting lost in the feed. And come into the Nearshore Cyber Discord, where people working through these same doors trade notes in real time: https://discord.gg/7yAQMrU5B3.