Latest / The Side Hustle Career Podcast with Fexingo: Second Income, Freelancing While Employed / How an IT Support Analyst Built a 10k Monthly Side Hustle in Cybersecurity Auditing
Transcript
- Lucas: So, you hear 'cybersecurity side hustle' and you probably picture someone in a hoodie running penetration tests from a coffee shop. Luna: Right, the ethical hacker archetype. But that's not what Miguel Torres does. Lucas: Not at all. Miguel is an IT support analyst in Phoenix, Arizona. His day job involves resetting passwords, setting up email accounts, patching servers. The stuff most people don't think about until it breaks. Luna: And he turned that into a ten thousand dollar a month side hustle in cybersecurity auditing. That's the part that surprised me. Lucas: Yeah, and look, if we've helped you think through a career move or a side hustle of your own, we keep this show ad-free thanks to listeners who chip in a couple of bucks a month at buy me a coffee dot com slash fexingo. It genuinely makes a difference. Anyway, back to Miguel. Luna: So what exactly is he auditing? I mean, he's not a CISSP or a security architect. Lucas: No, and he doesn't need to be. He audits small businesses — think dental practices, law firms, local manufacturers — for SOC 2 and HIPAA readiness. These are compliance frameworks. SOC 2 is about data security controls. HIPAA is healthcare privacy. Small businesses often don't have anyone in-house who understands them. Luna: So he's basically the compliance guy they hire for a few weeks a year. Lucas: Exactly. He does a gap analysis, writes a report, recommends fixes. Some clients bring him back for quarterly reviews. The key is his day job gave him the foundation. He spent years monitoring logs, running vulnerability scans, handling incident tickets. He just didn't realize those skills were marketable on their own. Luna: What was the trigger that got him to start? Lucas: A conversation with a friend who runs a physical therapy clinic. The friend needed to prove HIPAA compliance for insurance contracts, had no clue where to start. Miguel offered to help for five hundred bucks. Took him a weekend. Then the friend told two other clinic owners. Within three months he had six clients. Luna: So it spread through referrals. That's a pretty organic start. Lucas: Totally. But he also made a deliberate choice early on. He got two certifications: CompTIA Security+ and the Certified Information Systems Auditor, which is CISA. Total cost was about six hundred dollars, mostly exam fees and study materials. That gave him credibility to charge more than the 'IT guy who helps out' rate. Luna: He went from helping a friend to being a certified auditor. How did he find clients beyond his network? Lucas: He found a niche platform called CyberHoot. It's a marketplace specifically for small business cybersecurity services. Compliance audits, employee training, phishing simulations. Miguel set up a profile with his certifications and a sample report he'd redacted. The platform charges a fifteen percent commission on first engagements, then ten percent on repeat work. Luna: That's way better than Upwork or Fiverr for this type of work. Lucas: Yeah, because it's specialized. Clients on CyberHoot are already looking for compliance help. They're not comparing you to someone who designs logos. Miguel says his close rate on proposals is about sixty percent, which is insane for freelance. Luna: What does a typical engagement look like? Lucas: He charges fifteen hundred to three thousand dollars for an initial audit, depending on the size of the client. A small dental practice with three locations runs about two thousand. A manufacturing company with fifty employees is closer to three. The audit takes him between fifteen and twenty hours over two weeks. Then he offers quarterly check-ins at five hundred dollars a pop. Luna: So if he gets four new clients a month and retains a few for quarterly work, ten thousand is very doable. Lucas: That's exactly his math. He works roughly fifteen hours a week on side hustle work, mostly evenings and weekends. His day job is nine to five, so he's careful not to let it bleed over. But the audit work is project-based with clear deadlines, which makes it manageable. Luna: What's the biggest risk he's seen? Lucas: Liability. If he misses something and a client gets breached, he could be sued. So he invested in professional liability insurance — about twelve hundred dollars a year — and he puts a limit of liability clause in every contract. He also doesn't do any penetration testing or hands-on security fixes. He strictly audits and recommends. The client hires someone else to implement. Luna: That's smart. It keeps his scope narrow and his risk manageable. Lucas: Exactly. And he says the key lesson for anyone in IT support is: you already have the raw material. You know how networks work, you know what compliance questionnaires ask for, you've probably filled out vendor risk assessments for your own company. That knowledge is worth money to businesses that can't afford a full-time CISO. Luna: So the barrier to entry is lower than people think. Six hundred bucks in certs, a platform, and some confidence. Lucas: And a willingness to start small. His first client paid five hundred dollars. He didn't wait until he felt ready. He just did it. And that's the part that translates to almost any side hustle — you don't need the perfect setup, you need the first yes. Luna: What's next for him? Is he planning to go full-time? Lucas: He's thinking about it. His side hustle income has been steady at ten thousand a month for about six months now. But he says he actually likes the balance. The day job is low-stress, good benefits, and the side hustle is intellectually engaging. He's not in a rush to quit. He's more focused on raising rates and maybe adding a virtual assistant for scheduling. Luna: That's a good problem to have. Do you see other people in IT following this path? Lucas: I think we'll see more. Demand for small business cybersecurity is growing fast. The SEC has new rules, insurers are requiring audits, and state privacy laws are multiplying. Someone with basic IT skills and a compliance certification can fill a real gap. It's not glamorous, but it pays. Luna: And it's a side hustle that actually leverages your day job instead of competing with it. Lucas: Right. Miguel's story is a reminder that the best side hustle is often the one hiding in plain sight in your current role. You just have to look at what you know from a different angle.