Latest / The Career Change Podcast with Fexingo: Switching Fields, Bootcamps, and Reskilling / How Bootcamp Grads Can Break Into Cybersecurity
Transcript
- Lucas: Let me start with a number that stopped me cold. There are roughly 850,000 unfilled cybersecurity jobs in the U.S. right now, according to industry group ISC2. And yet, when I talk to bootcamp grads, security rarely cracks their top three target fields. That's a massive missed opportunity. Luna: I think the perception is that cybersecurity requires a secret handshake — networking certifications, years of IT experience, maybe a degree in computer science. Is that actually true? Lucas: It's partly a myth and partly a hangover from how the industry used to hire. Fifteen years ago, most security people came up through system administration — they just happened to be the ones who liked locking down boxes. But the landscape has changed. The entry-level roles today are much more accessible, especially for someone who already knows how to code. Luna: So what does a realistic first cybersecurity job look like for a bootcamp grad? Give me a concrete title. Lucas: Security Operations Center analyst — SOC analyst, for short. That's the most common on-ramp. You sit in a room — or a virtual room — monitoring security alerts, triaging incidents, escalating the serious stuff. It's shift work, it can be repetitive, but it teaches you the fundamentals: how to read logs, how to use tools like Splunk, what a real attack looks like versus a false alarm. Luna: And the pay? I've seen numbers all over the place. Lucas: Glassdoor puts SOC analyst one at around $75,000 to $90,000, depending on the market. That's competitive with many junior developer roles, and the ceiling is higher because security specialists are scarce. A senior incident responder can clear $150,000. Luna: Okay, but what about the certification wall? A lot of job postings ask for Security+ or CISSP. Can a bootcamp grad actually get those without a traditional IT background? Lucas: Yes, and here's the distinction. Security+ — that's CompTIA Security Plus — is a foundational certification. No experience required. You study for it like you studied for the bootcamp. I've seen people pass it in six to eight weeks. The CISSP, on the other hand, requires five years of paid experience. Don't even look at that one yet. Focus on Security+ or, if you want something more technical, the CySA Plus — that's Cybersecurity Analyst. Luna: So study for Security+, build a home lab, apply to SOC roles. But what about the portfolio? In software engineering, you have GitHub repos. What's the security equivalent? Lucas: That's the part most advice columns get wrong. They tell you to 'set up a home lab' without explaining what that actually means. Let me be specific. Get a free or cheap virtual machine — Oracle VirtualBox works — install a lightweight Linux distro, then install two tools: Wireshark to capture and analyze network traffic, and Kali Linux which is a distro preloaded with security tools. Then do a simple project: capture your own network traffic, identify the protocols, write a two-page report on what you saw. That's your portfolio piece. Luna: And that demonstrates what exactly to an employer? Lucas: It shows you can navigate a command line, understand network basics, and communicate findings in writing. That's literally 60 percent of what a junior SOC analyst does. The other 40 percent is learnable on the job. Luna: I want to push back a little. Some bootcamp grads I've talked to say security feels like a closed club — that HR filters them out because they don't have 'IT experience'. How do you actually get past that ATS screening? Lucas: Two strategies. First, reframe your bootcamp projects as security-adjacent. Did you build a web app? Mention that you implemented authentication, input validation, HTTPS. That's application security. Second, look for roles with titles like 'vulnerability management analyst' or 'GRC analyst' — governance, risk, and compliance. Those are less technical but still a foot in the door. And they don't require five years of sysadmin work. Luna: GRC sounds like policy and paperwork. Is that a good fit for someone who actually likes coding? Lucas: It depends. If you want to stay hands-on keyboard, SOC analyst is better. But GRC roles often lead to security architect or security engineer tracks, and they pay well — $90,000 to $110,000 for mid-level. Plus, they teach you the regulatory side: GDPR, HIPAA, SOC 2. That knowledge is gold in any industry. Luna: What about bug bounty programs? I see those mentioned a lot as a way to break in. Do they actually work? Lucas: They can, but with a caveat. Bug bounty hunting is competitive. You're going up against people who do this full-time. But even reporting a low-severity bug on a public program — say, a missing security header on a well-known platform — gives you a write-up you can link on your resume. It shows initiative. I know a former bootcamp grad who got his first security job because he found a reflected XSS vulnerability in a retailer's site and the hiring manager was impressed by the report. Luna: So the portfolio piece is the bug bounty report, not the bounty itself. Lucas: Exactly. Nobody cares if you made $50 or $5,000. They care that you understood the vulnerability, reproduced it, and wrote it up clearly. Luna: Let me ask the elephant-in-the-room question. Is there a risk that AI will automate entry-level security jobs? I see all these ai powered SIEM tools claiming to replace SOC analysts. Lucas: It's a fair concern. But the consensus among security professionals I follow is that AI augments, not replaces. AI can triage 90 percent of false positives, but the remaining 10 percent — the novel attacks, the sophisticated social engineering — still need a human who understands context. And someone has to tune those AI models, write the detection rules, and investigate the edge cases. That's still a person. Luna: So the junior role evolves rather than vanishes. Lucas: Right. Five years from now, a SOC analyst might spend less time staring at dashboards and more time writing detection logic. That actually plays to a bootcamp grad's strength — you can code. You're already ahead of the traditional sysadmin who only knows GUIs. Luna: Alright, let's get tactical. If a listener decides today, June 9, 2026, 'I want to pivot into cybersecurity by the end of the year', what's the step-by-step plan? Lucas: Month one: study for Security+. Use Professor Messer's free videos and the official CompTIA study guide. Month two: set up the home lab I described — Wireshark, Kali Linux, maybe a free tier of AWS to play with cloud security. Month three: apply to SOC analyst roles, vulnerability management roles, and also look at 'security operations specialist' titles. While applying, start a small bug bounty on HackerOne or Bugcrowd, just to get one report. Luna: And salary expectations? I don't want people to take a huge pay cut from a bootcamp dev role. Lucas: Entry-level security generally pays on par with or slightly above junior development, especially in larger metros. But there's a catch: many SOC roles require shift work, including nights and weekends. That's the trade-off. If you can handle that for a year, you can lateral into a better schedule. Luna: I want to circle back to something you said about reframing bootcamp projects. Can you give me one specific example of how someone would rewrite a project description for a security resume? Lucas: Sure. Say you built a simple e-commerce app in the bootcamp. Standard resume bullet: 'Developed a full-stack web application with React and Node.js.' Security version: 'Implemented user authentication with hashed passwords and session management, validated all input to prevent SQL injection, and enforced HTTPS via redirect middleware.' Same project, completely different framing. Luna: That's good. That's actionable. Lucas: And it's honest. You probably did implement those things, even if you didn't realize they were security features. Bootcamps teach password hashing and input sanitization as standard practice. You just have to call it what it is. Luna: Let me switch gears slightly. What about the non-technical security roles? Compliance, policy, third-party risk. Is that a viable path for someone who's burned out on coding but still wants to be in tech? Lucas: Absolutely. A role like 'third-party risk analyst' or 'security awareness coordinator' doesn't require deep technical skills. You're reviewing vendor security questionnaires, tracking policy exceptions, running phishing simulations. The pay is still solid — $70,000 to $85,000 for entry-level — and you can grow into a CISO track if you're strategic about it. Bootcamp grads who are good at communication and project management should seriously consider this lane. Luna: That's a great point. Not every pivot has to be technical. Lucas: And here's something I don't hear enough: the cybersecurity community is surprisingly welcoming to career changers. There are free resources like Cybrary, TryHackMe, and the SANS Cyber Aces program. There's even a mentorship program called WiCyS for women in cybersecurity, and a group called VetSec for veterans. The culture is less gatekeep-y than it used to be. Luna: But you still need the certs, the lab, the reframed resume. That's real work. Lucas: It is. But it's not harder than the bootcamp itself. And the payoff is a career with massive demand, interesting problems, and the satisfaction of doing work that genuinely matters. I'd argue it's one of the best pivots a bootcamp grad can make today. Luna: I think that's a solid note to land on. Before we wrap, I do want to mention something quickly. If this episode helped you think through a career move or gave you a concrete next step, consider supporting the show. It keeps us ad-free and independent. You can buy us a coffee — literally — at buy me a coffee dot com slash fexingo. Small gesture, big difference for us. Lucas: Yeah, honestly, if today was worth the price of a coffee to you, that link is there. No pressure, just gratitude. And we'll keep bringing you the specific, actionable stuff either way. Luna: Alright, so back to the path. Lucas, you mentioned TryHackMe. Can you give listeners one specific room on that platform that's a good starting point for a bootcamp grad? Lucas: I'd start with the 'Pre Security' learning path. It covers networking fundamentals, web basics, and Linux. It's free. That alone, combined with Security+ study, will put you ahead of at least half the candidates applying for SOC roles. And it's fun — it feels like a puzzle, not a textbook. Luna: Great recommendation. I think we've given listeners a clear map today. Lucas: One last thing: if you're a bootcamp grad who's made the pivot into security, I'd love to hear your story. We're on Twitter at Fexingo Business. Drop us a line. I think hearing real examples is what convinces people that this is possible. Luna: Until next time, keep building and keep pivoting.