How to Build Your Cybersecurity Career: Exploring Lateral and Upward Moves

The career ladder is a thing of the past. The days of staying put at a given company and building tenure within that organization is generally an antiquated concept. It doesn’t mean that it doesn’t happen; it’s just rare. And it’s particularly rare within cybersecurity, where an individual’s market value typically increases much faster than a company’s willingness and ability to accommodate advancement.

I think the model today is more akin to a stream with rocks. There are many different potential paths. There is no defined objective. Every hop will yield something different and new. You can look at your choices and make your decisions, one at a time.

There is a reason that the number of jobs that a person will hold in their lifetime is increasing.

A suggestion- view your career progression as explicitly building a set of options, testing the benefits of moving parallel with the benefits of moving up.

• Moving parallel (new projects, new clients, lateral moves within a company etc) allow you to build exposure and breadth. These moves can help you discover the type of work you really like doing and are very good at. The variety can keep you sustained if you are a person that gets bored easily if not constantly challenged
• Moving up allows you to get more responsibility, including managing other people (if that’s something you want to do). It exposes you to other parts of an organization and requires you to elevate your skillset, particularly from a communication standpoint.

Try to keep these two in balance- move laterally enough to feel very good about what you do, but not so much that you don’t build expertise.

The other element to think about is building a set of choices. Choice is a good thing. In abundance it can be crippling, but in general, having the ability to make choices allows us to pick paths that are a ‘truer fit’ for our own selves.

I am amazed at how often I see people setting themselves up for binary career choices. Meaning, the question becomes: is my status quo better or worse than the alternative right in front of me? Frequently this looks like looking at an opportunity from a recruiter and saying, well this looks better than where I’m at, so yeah I’ll go with it.

My advice- be more proactive. If you are ready to move on to your next opportunity, try to set up your search so that you have a funnel of opportunities, with at least a few moving in to land at the same time. Not only does this allow you to make a decision with more information and opportunity than A vs B, it gives you a chance to negotiate compensation with a stronger hand- and you will rarely have more compensation leverage than you do before you join, with another offer in hand.

Here are a few simple things you can do to build your options:

1. Expand your network
2. Be active at industry conferences
3. Contribute in slack/ discord channels with the security community in your local market
4. Go to local cybersecurity meetups
5. Build your Linkedin presence
6. Do some contract/ consulting work
7. Use it to test working with various types of clients: different sizes, industries, cultures. What do you like?
8. Test working on projects adjacent to your comfort zone. Do you enjoy the work?
9. Nail your narrative. You will get much more traction (and inbound) when you have a story that fits into a strong framework
10. What are you exceptional at?
11. Where do you want to go?
12. What are compelling proof points?
13. Run your search process as much like a ‘funnel’ as you can
14. Batch your applications and outreach to hiring managers and recruiters
15. Try to get interviews and processes to roughly line up
16. Manage the timing to the best of your ability to get multiple offers in around the same time

‍