Navigating a career in technical cyber security
If you are just starting your career in cyber security, it can be a confusing journey. There are countless certifications, training organisations and ‘must have requirements’, and it’s not easy to navigate which path to take – even if you already have a formal academic qualification in cyber security.
The Cyber Scheme are committed to aiding those who have chosen this career path in gaining their first job – whether straight out of education, or reskilling from another vocation. Read on to discover how to identify the best choices for you.
Be prepared for constant learning, and constant change.
In order to succeed in a career in cyber security, you must love to learn – your career will be demanding, ever changing and constantly developing as new threats evolve. It’s what makes a job in cyber security so rewarding – but you do need to commit time and effort and be prepared to self-learn and self-assess every step of the way.
You’ll need to stand out if you want to gain a foothold at entry level; the first step is making sure you have what employers are looking for. Don’t rely on Google to help you – instead research, find mentors in industry, ask questions, and above all gain practical experience. Then you’ll be on your way.
Steps to Success
Determine which area of cyber security you want to enter.
Different specialisms require very different skill sets, and it’s vital that you choose an area which fits yours, and stick to it. Being single minded at this point will help you stay focused when choosing learning pathways and certifications. Aim for fewer, higher quality certifications, and get independent, objective advice before you buy any.
Conduct your own research into which field of cyber security you wish to enter. This signifies to a would-be employer that you have the required curiosity, research capability and independent thought that is needed. Candidates who can say they have identified a specialism that meets their skills – whether it’s technical capabilities, or an interest in ethics and law – will stand out at application and interview.
So your first step on this journey is to conduct self analysis of your own skills and interests, including an honest appraisal of how technical you are or wish to be, and map your skills against recognised cyber specialisms and job roles.
The following are recognised as the 15 specialisms within cyber by the UK Cyber Security Council.
You can use these specialisms to plan out a possible career; bear in mind that a job may include parts, or the whole, of one or more of the specialisms outlined here.
Build your Skills
So you now know which area you wish to work in. What next?
This depends on the specialism you have chosen, but in the majority of cases will require you gaining practical experience on top of any academic, formal education you may have received.
It’s an uncomfortable truth that many cyber security qualifications, even Masters degrees from NCSC-certified universities, do not prepare students for a real-world job. Employers rarely rely on formal education to tell them a student is worth employing – so, while formal degrees have their place and you should be proud if you have one – it’s time to accept that a career in cyber security will not fall into your lap just because you have been to university.
Why is this? Because the world of Information Technology is changing all the time – think of how quickly cloud, AI and quantum computing have entered our world. A formal syllabus simply can’t keep up. Threats evolve at the same rate, if not even faster, than IT solutions – meaning that theoretical learning can only ever take a high-level view of what is happening. Once you understand that, you can begin to build a skill set that matches your chosen specialism, to add to what you learnt at university.
Technical cyber security – the ‘offensive’ (red) side of cyber which includes penetration testing, hacking, red teaming and threat hunting – will require practical skills which you will need to be able to demonstrate to a potential employer. If you have determined that you are more interested in a career in defensive cyber (the ‘blue’ side) you may wish to research areas such as ethics, law and governance and risk.
There will always be a crossover of skills regardless of which area you choose to specialise in – at the very minimum you should make sure you are able to demonstrate the skills shown below.
Fundamental Technical Skills
Programming
Analytical Skills
Troubleshooting
Adaptability
Communication Skills
Interested in a career in security testing?
The Cyber Scheme are industry leaders in training and assessing security testers, otherwise known as penetration testers or ethical hackers. If you are interested in a career in security testing, you will be expected to understand and demonstrate the following practical attributes – even at entry level.
- Experience with web development and web application frameworks
- Demonstrable network knowledge (TCP/IP, switching and routing)
- Knowledge of operating systems such as Windows, MacOS, and/or Linux
- Databases such as SQL, MySQL, Postgres, and NoSQL
- Knowledge of the setup and management of cloud providers
- Knowledge of security tools (e.g. Burp Suite)
- Understanding various cyber security and IT methodologies, technologies, and techniques
- Demonstrable gamified hacking (Hack the Box, Immersive Labs, TryHackMe, CTF etc)
- An awareness of up-to-date cyber security industry news and a genuine desire to work in this industry.
FAQs
Penetration testers (otherwise known as pen testers and security testers) are the so-called “ethical hackers,” or the good guys. Penetration testers are hired by network system owners and web-based application providers to probe for vulnerabilities that hackers might be able to exploit to gather valuable data and intelligence, which can then be sold on or used to hold the company to ransom.
Testers simulate actual cyber attacks using a wide range of methods, in their attempt to discover vulnerabilities in security protocols for networks, systems, and web-based applications.
The goal is to find gaps in security systems before the real hackers can get in. As a result, pen testers often work on highly confidential and time-sensitive projects, hence the need for measures such as CHECK to be in place.
The NCSC is the UK’s ‘technical authority’ for cyber incidents. It is part of GCHQ, one of the UK’s security services, and was formed in 2016 to provide a unified national response to cyber threats.
The NCSC acts as a bridge between industry and government, providing a unified source of advice, guidance and support on cyber security, including the management of cyber security incidents. Find out more here.
CHECK is the term for the NCSC approved penetration test companies and the methodology used to conduct a penetration test. Companies providing CHECK services do so using staff who hold NCSC approved qualifications and have suitable experience. Penetration tests are conducted using NCSC recognised methods and the subsequent report and recommendations are produced to a recognised standard.
NCSC traditionally provided IT health check services to identify vulnerabilities in IT systems and networks which may compromise the confidentiality, integrity or availability of information held on that IT system for HM Government and the wider public sector.
Due to growing demand, a partnership with industry was deemed necessary. The IT Health Check Service, or CHECK, was developed to enhance the availability and quality of the IT health check services that are provided to Government in line with HMG policy. Companies belonging to CHECK are measured against high standards set by the NCSC.
The NCSC and The Cyber Scheme work in collaboration to provide a set of examinations that are acceptable to industry and meet the requirements of private and public sectors. The NCSC now requires all existing and future CHECK Team Leaders and Members to have passed an approved professional examination designed to test for a basic grounding in the discipline.
NCSC will accept a pass from one of our examinations when approving CHECK Team Member and Team Leader status.
Security Clearances: SC and DV
There are a range of security clearance levels for different roles within the cyber security industry.
Among the most common high-level security clearances in the UK are Security Check (SC) and Developed Vetting (DV). These are both rigorous processes and will be vital for anyone seeking a career in areas such as central government or defence.
Understanding Security Check clearances
SC clearance is the most common form of security clearance in the UK. Being SC cleared is a requirement for any role that involves frequent access to documents classified as Secret, or occasional supervised access to Top Secret files in government or defence organisations.
To receive SC clearance, a candidate will need to have been a UK resident for at least five years and undergo the following:
Completion of BPSS
A full security questionnaire
Checks on criminal records, credit and financial history, and Security Service records
A review of work history, including personal files, staff reports, sick leave returns and security records.
SC checks usually take a minimum of six weeks to complete.
The requirements for Developed Vetting
DV is the highest government security clearance in the UK and is required for personnel who will require frequent and uncontrolled access to Top Secret material, either directly as part of their job or indirectly.
As the most thorough form of vetting, you’ll need to have been a UK resident for a minimum of ten years to apply for DV clearance and you can expect the process to take up to nine months to complete.
In addition to the same types of checks required for SC clearance, the vetting procedure for DV jobs includes a detailed interview with an Investigating Officer for both the candidate and their referees.
Those who hold a DV clearance will be required to renew it after a maximum of seven years.
CTM = CHECK Team Member, the term applied by NCSC
The CSTM exam you take with The Cyber Scheme = Cyber Scheme Team Member. The terms are essentially interchangeable, with CSTM being the brand name for our CTM-level exam.
CTL = CHECK Team Leader, the term applied by NCSC
The CSTL exam you take with The Cyber Scheme = Cyber Scheme Team Leader. The terms are essentially interchangeable, with CSTL being the brand name for our CTL-level exam.
We offer two CTL-level exams, CSTL-INF (Infrastructure) and CSTL-Web App (Web Applications). There are no requirements for a pass in one exam before taking another; if you have any questions about your readiness to take an exam please get in touch.
Passing an exam with The Cyber Scheme is one of the mandatory assurance checks undertaken by the National Cyber Security Centre (NCSC) before CHECK Team Member or Leader Status can be awarded. The Cyber Scheme cannot award CHECK status, but do award Certificates recognised by NCSC as confirmation that the necessary technical standard for CHECK has been met.
Find a mentor and build your profile
It’s difficult to begin a career in cyber security if you are relying on the internet to help you.
Training companies and certification providers with the biggest advertising and marketing budgets – those who will appear at the top of any search engine – are not necessarily the correct ones for you. Chasing certifications – especially when you have no proof they will help you find a job – can be an expensive waste of time. It’s important therefore to find a mentor who is already in the field of cyber you wish to enter. This person should be able to provide you with objective opinions about self-learning, which practical skills you will need, how long it will take you to find a role, how to present at interview and more. They may – if you’re lucky – be able to introduce you to potential employers, but this shouldn’t be your priority. Instead find someone who is happy to support you, to listen and to impart wisdom. Taking the time to find the correct mentor for you can be invaluable in gaining the correct, impartial advice you need.
Where do you find someone like this? Join membership organisations such as CIISec, SASIG and the UK Cyber Security Council (if you don’t know what these organisations are, here’s a timely reminder that curiosity, self-learning and awareness of the industry are crucial in getting a job – so now’s the time to start researching). Engage with them wherever possible. Attend security shows and – instead of visiting the trade stands where you will only talk to sales people – attend the talks held by industry experts.
Create a LinkedIn profile and become a voice people want to hear. Don’t worry about being a beginner; your opinion is just as valid as someone who has been in the business for decades. Think “What can I do for you?” Not “What can you do for me?”. The more you offer insight and curiosity to someone in this industry, the more likely you will build a rapport with them.
You can share resources, source articles, include links to white papers and offer opinions on other people’s posts – all this establishes you as an independent thinker who engages with the cyber community and isn’t afraid of contributing. Your profile will definitely be taken into consideration by potential employers so it’s a valuable selling tool – but don’t just use it as a job hunting platform.
Tips to help you build your profile
- Aim to post original content a couple of times a week – this can be reposted, or shared from a news site.
- Sign up for relevant emails from companies in your field and share their content – it establishes you as an expert.
- Set up Google Alerts for relevant phrases – for example new stories about breaches or cyber attacks – and share the stories as they happen.
- Follow industry leaders and engage on their posts, follow their followers and aim to be consistently growing your follower count.
Once you have found someone whose guidance you trust - ask their advice on every step you take. Don’t commit to an expensive course or certification without making sure it’s right for you. And remember to stay focused on your chosen specialism - don’t be swayed by special offers, or answer job ads for positions you’re not suited to. Be the person that - when you are a leader in this field - you would want to employ.
Are you already in an entry level role and looking for employer-supported training?
Working in collaboration with your employer, we can help give you the best introduction into cyber security with clear defined career pathways. Our aim is simple; to shorten the length of time it takes for you to contribute fully to technical projects.
The Cyber Scheme aims to fill the gap between the practical skills and knowledge demonstrated by a recent graduate or career starter, and those required by employers. We have a proven track record in creating NCSC certified and assured training and assessments for technical, offensive security at the highest level available.
We aim to change the narrative around entry level recruitment. We focus on teaching practical skills, and candidates are given the fundamental knowledge to begin the journey towards becoming a certified security tester.
The Cyber Scheme firmly believe this is an essential qualification for those starting their career in technical cyber security. It provides the skills employers are looking for, and bridges the gap between education and practical learning.
CSFL (Cyber Scheme Foundation Level)
Ask your employer to contact us regarding the in-house training we offer to junior technical consultants.
Topics include:
- The Laws and Ethics Associated with Security Testing
- Building and Maintaining a Security Testing Device
- Fundamental Linux CLI for the Purpose of Security Testing
- Fundamental Linux Scripting for the Purposes of Security Testing
- Fundamental Python Coding for Ethical Hackers
- Fundamental Windows Operating System Commands
- Computer Networking Fundamentals
- Packet capturing for Security Testing and Ethical Hacking
- Web Application Fundamentals
- Vulnerability Analysis Fundamentals
- Testing Mobile Devices Fundamentals
- An Introduction to Testing in the Cloud.
Please note we DO NOT offer this training to individuals at the moment. We can only talk with employers directly.
Inclusion and Accessibility
The Cyber Scheme believe everyone should have access to a career in security testing. We are available to discuss any concerns you have and are more than happy to make reasonable adjustments for any candidate who requires them during examinations.
These reasonable adjustments are to ensure you are given an equal opportunity to demonstrate the necessary knowledge, skills and behaviours required. We recognise that not all disabilities are visible.
We have a range of reasonable adjustments we can offer depending on what difficulty you might face. If you request an adjustment which we are unable to offer, we will give you a reason why we cannot offer it. This might be because it maps to a key Knowledge, Skill or Behaviour that we have to assess against within the certification. If that is the case, we will tell you which aspect we think would not be properly assessed.
There may be background noise during an assessment. Please bring (or ask for) ear plugs / ear defenders or listen to music if background noise is likely to affect your concentration.
Mobility
Access to all of our facilities is suitable for people with mobility issues. Should any other special facilities be required please get in touch at time of booking. For some reasonable adjustments, such as access to a disabled parking space, we will need to see supporting documentation around the condition to allow us to apply for this access for you. No information will be retained or stored once the request is validated.
