Latest / The Career Change Podcast with Fexingo: Switching Fields, Bootcamps, and Reskilling / How Bootcamp Grads Can Transition Into Cybersecurity
Transcript
- Lucas: So, we've talked a lot about bootcamp grads moving into product, data, DevOps — but one path that keeps coming up in listener questions is cybersecurity. And I think the conventional wisdom says you need a degree or years of IT experience to even get your foot in the door. That's not really true anymore. Luna: Yeah, I've seen a lot of bootcampers pivot into security, especially on the blue team side. What's the actual on-ramp for someone who's been coding for maybe a year or two? Lucas: Great question. Let me anchor this with a real example. I talked to a grad named Priya — she finished a full-stack bootcamp in 2024, spent about 10 months as a junior developer at a mid-size e-commerce company, and then moved into a security analyst role at a fintech firm. Total time from bootcamp to security: about 18 months. She didn't have a CS degree or any prior IT background. Luna: Okay, so what was the turning point? How did she make that jump? Lucas: She started by recognizing what she already knew. Bootcamp grads are actually well-positioned for security because they understand how web applications are built — the full stack, the database layer, authentication flows, API endpoints. That's exactly the kind of stuff you need to know to find vulnerabilities. She spent about three months studying for the CompTIA Security+ certification, set up a home lab with VirtualBox and a couple of vulnerable machines from VulnHub, and then started applying for analyst roles. Luna: Did she apply broadly, or did she target specific industries? Lucas: She targeted fintech specifically — because her one year of dev experience was at an e-commerce company that handled payments, so she could talk about PCI compliance, tokenization, and how payment flows work. That gave her a huge edge. The role she landed is basically a SOC analyst — monitoring alerts, triaging incidents, doing basic forensics. She told me the first three months were intense learning, but she felt her coding background helped her automate some of the repetitive work with Python scripts, which her teammates appreciated. Luna: That makes sense. What about salary? I've seen data that security roles pay about 30 percent more than entry-level development on average. Was that true for her? Lucas: Priya's case is consistent with that. She went from about $72,000 as a junior dev to $95,000 as a security analyst. And that's just the starting point — after a couple of years, SOC analysts can move into incident response or threat hunting and hit six figures pretty quickly. The Bureau of Labor Statistics projects cybersecurity jobs will grow 33 percent through 2032, which is way faster than the average for all occupations. Luna: So for bootcamp grads listening, what are the three most common entry points? I've heard SOC analyst, security engineer, and maybe something like GRC? Lucas: Exactly those three. SOC analyst is the most accessible — it's the frontline monitoring role, and many companies hire entry-level analysts with just the Security+ and some demonstrated curiosity. Security engineer is a bit more technical, often requires some scripting and familiarity with cloud security tools like AWS GuardDuty or Azure Security Center. And GRC — governance, risk, and compliance — is less technical but still in high demand, especially at regulated companies like banks and insurers. GRC roles focus on policy, audits, and frameworks like NIST or ISO 27001. Luna: I think GRC is underrated for bootcamp grads because it doesn't require deep networking or exploit knowledge. You can learn the frameworks in a few months, and your ability to write clearly and communicate technical concepts is actually a huge asset. Lucas: Totally. And we often forget that a bootcamp grad has already proven they can learn a complex technical skill quickly. That's exactly the trait hiring managers want in cybersecurity, where the landscape changes every few months. The old idea that you need a degree in computer science or a decade in IT — it's fading fast. Many companies now run apprenticeship programs specifically for career changers. Luna: Let's talk about certifications. I know Security+ is the gold standard for entry-level. But what about others? OSCP? CISSP? Lucas: Security+ is the one to start with — it's vendor-neutral and covers the fundamentals of threats, vulnerabilities, cryptography, and identity management. It's not hard for someone with basic IT knowledge. After that, if you want to go red team or penetration testing, the OSCP is great, but it's very hands-on and takes months of lab work. CISSP requires five years of experience, so it's not entry-level. I'd recommend Security+ first, then maybe CySA+ or the Certified Ethical Hacker if you want to go deeper. But the most important thing is practical experience — a home lab where you actually practice. Luna: Yeah, and one thing I'd add: there are free resources like TryHackMe and Hack The Box that give you guided learning paths. You can go from zero to being able to solve basic challenges in a few weeks. That's way more impressive to an interviewer than just listing a certification. Lucas: Right. And quick honest thing — a handful of listeners chip in monthly through Buy Me a Coffee dot com slash Fexingo, and that's literally what funds making this many episodes. No ads, no sponsors, just listeners who find value in the show. It keeps us independent and able to dive into specific topics like this. Luna: Yeah, it really does. We don't have to tailor anything to an advertiser, we just cover what we think is useful. And it's a small group — but it makes a big difference. Lucas: So back to the career path. What I'd tell any bootcamp grad considering cybersecurity is this: start by identifying where your current skills overlap. You probably already know how to read and write code, debug errors, understand web protocols, and use the command line. Those are all foundational for security. Then pick one area — maybe SOC analysis — and build a project. Set up a security onion or Splunk instance at home, generate some alerts, and write a blog post about what you learned. That portfolio piece will open doors faster than a degree ever could. Luna: Are there any specific job titles that bootcamp grads should search for? I've seen 'junior security analyst' but also 'cybersecurity analyst I' or 'information security associate'. Lucas: All of those. Also 'security operations center analyst', 'threat analyst', and 'vulnerability management analyst'. One trick: search for 'Security+' or 'entry-level cybersecurity' on LinkedIn and see which titles appear most often. And don't be afraid to apply even if the posting asks for two or three years of experience — many companies are flexible if you can demonstrate skills. Luna: What about cloud security? That seems like a hot area, but maybe better for someone with a few years of experience? Lucas: Cloud security is definitely growing, but it usually requires some cloud experience first — like AWS or Azure. That said, if you're a bootcamp grad who's already deployed apps on AWS, you're halfway there. You could study for the AWS Security Specialty certification and pivot into a cloud security role. But I'd say it's a second step, not an entry point, for most people. Luna: One more thing: networking. How important is it for landing that first security role? I've heard it's even more relationship-driven than development. Lucas: Extremely. But here's the good news — the cybersecurity community is very welcoming. There are local meetups, online Discord servers, and conferences like BSides where you can meet people. Many bootcamp grads have found mentors through Twitter or LinkedIn just by sharing their learning journey. One guy I know posted his home lab setup on Reddit, got feedback from a senior analyst, and ended up with a referral. Luna: So the playbook is: get Security+, build a home lab, do TryHackMe, network at a BSides event, and apply to SOC analyst roles. That's doable in maybe 6 months while working a day job. Lucas: Absolutely. And I'd add one more thing — tailor your resume to highlight the security aspects of your dev work. If you ever fixed a cross-site scripting bug, or implemented authentication, or worked with HTTPS certificates — that's security experience. Frame it that way. You have more relevant experience than you think. Luna: It's a smart pivot. The demand is huge — I saw a stat that there are over 700,000 unfilled cybersecurity positions in the US alone as of mid-2026. And bootcamp grads bring a practical, hands-on mindset that a lot of traditional IT grads don't have. Lucas: That's the key point. Cybersecurity is about solving problems under pressure, and bootcamp grads are trained to build and fix things fast. If you're looking for a career change with strong growth, good pay, and room to learn, this is one of the best moves you can make. Luna: Next episode, we'll look at another pivot — maybe into data privacy or AI ethics? There's a lot of crossover. Lucas: I like that. Let's do it.