Building a Successful Cybersecurity Career Foundation

Cybersecurity professionals must master the fundamentals to build a successful career and tackle complex challenges effectively.

### Journey to Success in Cybersecurity: Building a Strong Foundation
* 💼 Reflecting on a decade of growth, I began my cybersecurity career earning between **$24,000 and $36,000 a year**, and now I earn **$500,000** as a principal security engineer at a top tech company.
* 📚 Despite being an average student with limited real-world experience, I learned the importance of **mastering the fundamentals in cybersecurity**, such as networking and coding, which laid the groundwork for my success.
* 🛠 Hands-on experience is crucial; I started with small internships, installed VPN servers, and tinkered with technologies, emphasizing the need to **set up a cybersecurity lab** to practice skills.
* 📈 The landscape of cybersecurity has evolved, with current demands for skills in **cloud security**, **offensive security**, and the ability to **secure IT systems**, which are increasingly **hosted on the cloud**.
* 💻 I encourage aspiring professionals to **experiment with technologies**, set up websites for **practical experience**, and engage with the community to **learn from others in the field**.
* 🔍 It's vital to challenge yourself and push your limits, as success in cybersecurity requires **dedication, continuous learning, and a solid understanding of core concepts** like **encryption and databases**.
* 🚀 Ultimately, **mastering the fundamentals** is the key to making advanced topics easier and achieving **long-term success** in the cybersecurity industry.

You know, today is a Sunday afternoon. It's quite an afternoon, and it's interesting because just I was just thinking about this. Like, there were a few things that happened, and just just 10 years ago, I was starting out my career in cybersecurity. And if you were to come up to me and tell me, Hey, Mr. Heck Aoy, or back then, it would have been back then, it would have been Scrip KY Loy, and you say, Hey, 10 years later, you are going to make $500,000 a year as a principal security engineer at Fang or Bang. I would say, How is that possible? What did I do? Can it really be done? Difficult? I would say challenging, not the least. And at that time, 10 years ago, I was just starting out. I was helped as an engineer, and at a time in my city, if you could get anything from $24,000 a year to $36,000 a year, that's amazing. Anything more is just unbelievable. And I wasn't the best student. I wasn't the brightest student, far from it.

I was like the average student, and I learned computer science. I learned computing. I learned how to code a thing or two, but they didn't really have a lot of real-world experience. I've done some internships at small-sized companies, and like installing VPN servers, fixing computers. I knew nothing about fixing computers back then. They gave me the shot, and I was pretty excited about it. So, I was at the start of my career, and it was exciting. It was pretty exciting. It was fun. It was challenging. But I knew cybersecurity was something that felt natural. And there are some things that you should really get good at when it comes to cybersecurity, and that's the fundamentals. Get the foundation right. If you get the foundation right, everything will come to you. All the great things will come to you. So, get the fundamentals right. Like, think about computers, right? And think about how they talk to each other, networking piece, the compute piece. Get those right. Think about coding, some things. Get those right. Think about something complex like a content

management system enterprise resource planning system work on them see how it goes but don't say no go for it you have vitality in you. If you're coming into cyber security, getting the fundamentals right is critical because that's where you build a really solid, really, really solid foundation for everything else. And cyber is not easy, and I see lots of courses that are being marketed, that are being promoted. They kept saying 3 weeks boot camp, a month boot camp, and you get into cyber security. It's possible. It's possible if you come from a computer science background. That's possible. But the majority of the time, if you're not coming in from an IT background, it would be pretty difficult, very challenging. And how many companies out there think about it? You're an IT manager, you're a cyber security manager, you want to hire, and you probably have some options where you hire someone who is coming out three years from college or university from computer science, who has done some coding, who has built some sites, who has done a bit of internships.

here in there or would you go for someone who is like just had a three-week boot camp. The answer is obvious, and in the interview process, it'll be pretty different too. The way that they could answer the questions, the way the questions are answered. You'd be asking simple things like how do two computers talk to each other, how do you secure a database, how do you, in fact, simple one, what is the OSI layers, what are they, how many layers are there. Those are simple questions, get them right, get them right, you go a long way. And of course, like I say, I would have never imagined myself here in this position, like being a security engineer at a mang or a Fang company. I would never have imagined that, and it came from lots of reading, burning through lots of weekends, starting a lot, reading a lot. And how can it be success without any sacrifice, so sacrifice that. And it usually be because you have a passion for it, it's something that you feel some interest in it, but it's not

developed fully where it becomes an obsession. It's just the start, start of a journey, and you want to become obsessed with it, so you have to tinker with it. You have to try. You have to play around with it. Like, for example, when I was just several years ago, when I was interviewing at Amazon, I was also interviewed by several other companies who gave me an offer too. I was given the offer at Cisco. I was given the offer at McAfee, now known as Skyhigh. I passed all of them. It all went down to fundamentals, always the foundational piece of things. You get it right, all the questions are asked off you, you'll be able to tackle them easily. Of course, back then, there weren't things like Chat GPT, and you had to really get lots of books for it. But now, with this Gen AI, Chat GPT, you can just ask questions if you don't know. Fire it up, ask Chat GPT your question, have a passion for it, set up a cyber security lab, an ethical hacking lab.

set that up. Don't wait. Set it up. It's low cost. Get a Raspberry Pi. It's less than $200. Get it. Install it with Kali Linux. Use it. Get a small laptop, a small PC. Install Kali Linux on it. Try it. Try running them. You have to have hands-on experience. And back then, of course, clout really wasn't that big of a thing. All right, it was growing, but it didn't become the mammoth that it is today. So, but there were glimpses, there were indicators that it was coming up, there were things that were showing that it was coming up, and that's those are the things that you need to take note of, that you need to be, that you need to know of. Like now, what's hot right now in cybersecurity? Think about it. Other than Geni, of course, what else is hot about cybersecurity? Now, call security is that hot, is that big. Are there demands for it? When you're searching for jobs, you go to LinkedIn. Do you see it come up? Do you see those skills being asked of you like, Aw?

security Azure security Google Cloud security. Do they come up? What about offensive security? Do they come up? Do they ask a few to do? Do they ask a few how do BU payloads? How do you bypass EDRs? How do you secure service? The ultimate goal of many of these businesses and organizations is simply just don't get hacked, okay? And you have to align yourself to that. You have to get the skills of that. So think about like a company we just started a couple of years ago. They are likely going to be deploying their workloads, their IT systems, likely on the cloud. 90% of the chances they're on a cloud. Their workloads are running. They're growing. They're growing aggressively. They want to make sure it never goes down. So that because it's revenue. It creates revenue for them. It's revenue-generating. They don't want it to go down. And your job as a cybersecurity professional is to ensure that, is to help them secure those systems. And that's how you get a job. That's how you

get a roll at it, and to get a roll at it, you need to demonstrate that you have the skills and experience on it. So, experiment, experiment with these technologies. If you have not started a website on a cloud, go out there and do it right now. Log in right now, set it up. It's only like $5 a month to set it up, maybe even lower or maybe a little higher depending on where you go, but the experience is what matters. I mean, think about it. It's at least $4, $5,000 a month compared to hosting a website, gaining the experience, gaining the knowledge for $10 a month. It's worth it, well worth it. Tinker with security technologies. There's lots of free ones, open-source ones. It's all around, they're all around. Go for them, try them out. Don't just watch the videos I produce, don't just watch the tutorial I produce. Reproduce them in your own lab, try them out, be curious, be really curious about things that are happening. Think about all the common vulnerabilities.

exposure. Have you read the payloads? Have you tried the payloads? Have you tried to install a server of that version that is vulnerable? Try that, get experience for it. Join the community in the city near you. I am certain there are monthly meetups for Cyber Security Professionals, security user groups. Go for it, go there and meet people, talk to them, interact with them, try to mirror them, see what you're doing with the careers, what certifications are they going for, what are they reading, what are they watching. Go for that too, ultimately get a fun as right, get the fun right first, then you start doing all these things, you start meeting people, you start connecting with people, you start tinkering with things that are a little more advanced, but it's good for you, it's good for your career. You know that cyber security is not... I mean, if you see boot camps to tell you that you can get in cyber security within a week, within a month, highly unlikely. Go for things that are hard, that challenge you, then you move

faster than you really know your own limits, and then you can keep testing the limits of yourself. Keep pushing yourself, get better, get further. A new CV, go read it. A new exploit, go try it. Have a hacking lab in place, get the F right. These are the things you need to get really good at Cyber. That's how I do it again. That's how I would do it all over again. Get a form is right. Think about encryption. Think about networking. Think about databases. Think about applications. If you have the core, you have the basic rights. You get them right, you go far, and everything else would just look easy or easier for you.

How I Would Learn Cyber Security If I Could Start Over | Amazon Principal Security Engineer

Loi Liang Yang

Journey to a Successful Cybersecurity Career

The speaker reflects on their 10-year journey in cybersecurity, starting with a low-paying job and average academic performance.

They emphasize the importance of getting the fundamentals right in areas like networking, computing, and coding.

The speaker's real-world experience through internships and challenging tasks helped them find their passion in cybersecurity.

Getting the fundamentals right is crucial for a solid foundation in cybersecurity.

While a computer science background can make the transition easier, those without IT experience may find it challenging.

Companies are more likely to hire candidates with relevant experience, making it important to excel in interviews and understand key concepts.

Becoming obsessed with cybersecurity is essential for success, and hands-on experience is key.

Setting up a low-cost cybersecurity lab with a Raspberry Pi and Kali Linux is a great way to start.

Staying updated on industry trends and in-demand skills, such as cloud security, is crucial for job searching and career growth.

The Importance of Cybersecurity Skills in the Cloud Era

Azure and Google Cloud security are crucial, with a focus on offensive security and bypassing EDRs.

Many businesses are deploying their IT systems on the cloud, aiming for seamless operation to generate revenue.

Aspiring cybersecurity professionals should gain hands-on experience with cloud technologies and security tools to demonstrate their skills and secure a job in the field.

Gaining hands-on experience with vulnerable server versions and trying out payloads is essential.

Joining local cyber security meetups and interacting with professionals can provide valuable insights and guidance.

Focusing on challenging tasks, continuously pushing personal limits, and mastering core concepts like encryption, networking, and databases are key to success in the field.