Latest / The Career Change Podcast with Fexingo: Switching Fields, Bootcamps, and Reskilling / How Bootcamp Grads Can Break Into Cybersecurity
Transcript
- Lucas: Luna, I want to talk about something that a lot of bootcamp grads don't consider, but maybe should: cybersecurity. Luna: I can already guess where this is going. The talent gap, right? Lucas: Exactly. There are something like 400,000 unfilled cybersecurity roles in the US right now. And unlike front-end development, which has become incredibly saturated at the entry level, cybersecurity is still starving for people who can think critically. Luna: But isn't cybersecurity really technical? I mean, bootcamp grads learn web dev, not network protocols or cryptography. Lucas: That's the common misconception. Yes, some roles require deep technical knowledge — like reverse engineering malware. But a huge chunk of cybersecurity is actually about the human element. Phishing, social engineering, identity management. Those don't require a computer science degree, they require curiosity and a willingness to learn attack patterns. Luna: So a bootcamp grad who built a full-stack app actually has a decent foundation? Lucas: Absolutely. They understand how web applications work, which is exactly what you need to understand how they break. Plus, most bootcamp grads are used to learning fast and figuring things out independently — that's perfect for security work. Luna: What's a concrete example? Who made this transition? Lucas: I talked to a guy named Marcus — he did a three-month bootcamp in 2021, couldn't land a front-end job, so he pivoted. He started learning about identity and access management, or IAM. Now he works at a mid-size tech company focusing on Okta configurations and zero-trust policies. He's making six figures. Luna: That's a specific path. IAM doesn't get discussed a lot in bootcamp circles. Lucas: No, it doesn't. But it's a great entry point because companies are obsessed with managing who has access to what. And tools like Okta, Azure AD — they have APIs. A bootcamp grad who can script a bit can automate user provisioning and deprovisioning. That's immediate value. Luna: What certifications matter? I hear a lot about CompTIA Security+. Lucas: Security+ is the baseline, for sure. It's vendor-neutral and signals you understand core concepts. But I'd also look at the Certified Ethical Hacker, or CEH, if you're into pen testing. And for cloud security, the AWS Certified Security specialty is gold. Luna: Do you need a dedicated cybersecurity bootcamp? Or can you self-study? Lucas: Self-study is totally viable. There are free resources like TryHackMe and Hack The Box that simulate real attacks. The thing is, hiring managers in security care a lot about practical skills. If you can show you've completed a series of capture the flag challenges or contributed to an open-source security tool, that often beats a certificate. Luna: Let's talk about the 2023 Okta breach. That was huge — what did it teach us? Lucas: The Okta breach was fascinating because it wasn't about breaking encryption. Attackers compromised a customer support engineer's laptop and then used that access to steal session tokens. The lesson for entry-level folks: security isn't just firewalls. It's about operational discipline — things like multi-factor authentication, least privilege, and monitoring. Luna: So a bootcamp grad could specialize in, say, security operations center — SOC — analysis? Lucas: Exactly. SOC analysts are the front line. They monitor alerts, triage incidents. It's shift work sometimes, but it's a foot in the door. And the skills — log analysis, basic scripting, understanding of networking — are all learnable in six months of focused effort. Luna: What about networking? I imagine that's huge in this field. Lucas: It's everything. But not just LinkedIn networking — I mean going to events like BSides, which are community-run security conferences in almost every major city. They're cheap, friendly, and full of people who love talking about this stuff. I know a guy who got his first security job because he asked a good question at a BSides talk. Luna: Interesting. So the soft skills matter too. Lucas: Massively. Security teams need people who can communicate risk to non-technical stakeholders. If you can explain why a phishing simulation matters to the CEO in plain English, you're more valuable than someone who can write a perfect YARA rule but can't talk to leadership. Luna: Let's get practical. What should a bootcamp grad do this week if they want to pivot to security? Lucas: First, create a free account on TryHackMe and do their 'Pre-Security' learning path. It covers the basics of networking, Linux, and web application security. That's maybe ten hours total. Then, sign up for a local BSides event — most are on Eventbrite. And start following security news — there's a newsletter called 'The Cybersecurity 500' that's pretty good. Luna: And the resume? How do you frame bootcamp experience for a security role? Lucas: Don't lead with 'bootcamp graduate.' Lead with specific projects. If you built a web app, mention that you implemented authentication and authorization — that's security. If you used environment variables and kept secrets out of your code, call that out. You can also build a new project specifically for security, like a simple log analyzer in Python. Luna: I like that. It shows initiative. Lucas: Exactly. And here's something a lot of people miss: you can contribute to open-source security tools. Something like Wazuh, which is an open-source SIEM. You don't have to write core code — even improving documentation or writing test cases gets your name out there. I've seen people hired just based on their GitHub contributions to security repos. Luna: That's a great angle. We've talked a lot about portfolio projects on this show, but never specifically for security. Lucas: Right, and that's part of why I wanted to do this episode. Security is one of those fields where the barrier to showing competence is actually lower than people think. You don't need a degree or a big title. You need to demonstrate that you can think like an attacker and be methodical. Luna: I can see how this content is really useful for listeners who are feeling stuck after bootcamp. If today was actually useful to you, the way these stay ad-free is listener support — buy me a coffee dot com slash fexingo. Lucas: Yeah, honestly, every little bit helps keep us independent and focused on actionable content like this. Luna: And we really mean it — we want to help people make informed career moves. So if you've gotten value, consider chipping in. Lucas: Anyway, back to the playbook. One more thing I want to emphasize: don't overlook compliance and policy roles. A lot of bootcamp grads think security is all hacking, but there's a huge demand for people who can write security policies, do risk assessments, and manage vendor security questionnaires. Luna: Those roles are less technical but still pay well? Lucas: They can. A compliance analyst at a mid-size company can make $80-100k. And the entry point is easier because you need to understand regulations like GDPR or HIPAA, not kernel exploits. If you're good at reading and writing, that's a legitimate path. Luna: So the takeaway is: cybersecurity is not just for elite hackers. It's a broad field with many entry points. Lucas: Exactly. Whether you want to be hands-on with tools, or more strategic with policy, there's a place. And with 400,000 open roles, the demand is real. Bootcamp grads have the learning agility — they just need to point it in the right direction. Luna: Great episode. I'm going to check out TryHackMe myself. Lucas: Do it. And if anyone listening wants to share their own pivot story, we'd love to hear it. Until next time.