How to Mentor Newcomers Entering Cybersecurity

TL;DR

Effective cybersecurity mentoring starts by helping newcomers explore a few suitable career paths without overwhelming them. Mentors should provide resources in manageable batches, prioritize communication skills, evaluate certifications according to individual circumstances, share honest career stories, and introduce mentees to affordable local events and professional contacts that can support their first steps into the industry.

Transcript

Hello, everyone. Welcome to RSA Conference, and thank you for tuning in to Seven Tips for Mentoring Security Newbies. My name is Sandy Carielli. I'm the Director of Security Technologies at Entrust Datacard, and I love mentoring. I've been both a mentor and a mentee through both formal mentoring programs and informal mentoring relationships. Today,... Read More

Key Insights

• Cybersecurity is a collection of diverse career paths rather than a single, uniform industry. Mentors should explain roles such as analyst, administrator, auditor, consultant, researcher, developer, and tester, then help newcomers identify a small number of directions that fit their interests and preferred ways of working.
• Career exploration is most useful when it connects personal motivation with practical choices. Asking what excites a mentee, how they like to work, and what drives them can eliminate unsuitable options and help prioritize relevant classes, events, blogs, and professional conversations.
• Information overload can discourage newcomers before their careers begin. Mentors should distribute learning resources in small, manageable batches, starting with a couple of favored websites or blogs and no more than ten to twenty people to follow on Twitter.
• Communication skills are valuable across cybersecurity roles. Writing, presenting, and speaking help practitioners describe the business impact of vulnerabilities, explain how security issues were prioritized, and tell leaders why an issue is serious enough to stop a release or why it is not critical.
• Certifications are signals of learning, interest, and commitment, but they do not prepare someone for a security role by themselves. Their value depends on the mentee's background, existing resume, route into the industry, and likely obstacles to establishing professional credibility.
• Career stories can teach lessons that formal instruction may not communicate. Mentors should thoughtfully share successes, failures, mistaken early assumptions, and decisions they would change, while being vulnerable, honest, authentic, and clear about what each experience taught them.
• Local security communities can expose newcomers to people, topics, and opportunities that are difficult to discover independently. Mentors should identify cheap or free events, invite mentees along, introduce them to established contacts, and allow them space to explore activities that attract their curiosity.
• Volunteering is a practical way to meet people and demonstrate commitment, but it should follow initial exploration. Newcomers should attend several events first, assess the subject matter and participants, and then decide whether contributing to the event or organization would be worthwhile.

Questions & Answers

Q: How should mentors help newcomers choose a cybersecurity career path?

Mentors should begin by showing newcomers that cybersecurity contains many different roles, including analysts, administrators, auditors, consultants, researchers, developers, and testers. They should explain the skills and characteristics associated with those roles, arrange conversations with people doing the work, and ask what excites the mentee, how the mentee prefers to work, and what motivates them. The goal is to eliminate unsuitable options and prioritize a few promising paths.

Q: How can cybersecurity mentors avoid overwhelming their mentees?

Mentors should provide information in small, manageable portions instead of handing over an exhaustive collection of books, blogs, websites, classes, webinars, and people to follow. A useful starting point is a couple of trusted websites or blogs and ten to twenty Twitter accounts at most. Mentees can then discover additional sources independently or request more focused recommendations as their interests become clearer.

Q: Why should cybersecurity newcomers study communication?

Communication skills remain useful regardless of which cybersecurity role a newcomer eventually chooses. Strong writing, speaking, and presentation abilities help security professionals explain the business impact of a vulnerability, justify how competing issues were prioritized, and communicate with business leaders. These skills also support difficult judgments, such as explaining why a problem warrants stopping a release or why an apparently serious issue is not actually critical.

Q: Should cybersecurity beginners pursue professional certifications?

The decision depends on the beginner's individual circumstances. Certifications cannot prepare someone for a security role by themselves, and treating them as the sole qualification is inappropriate. However, they can signal learning, interest, and commitment, especially for people entering from unusual or disadvantaged backgrounds. A mentor should examine the mentee's existing resume, prior experience, career route, and likely obstacles before recommending or discouraging certification.

Q: What kinds of career stories should cybersecurity mentors share?

Mentors should share honest accounts of both successes and failures, with an emphasis on the lessons those experiences produced. Useful subjects include early assumptions about the security industry that later proved inaccurate, successful projects that still could have been handled differently, and decisions the mentor would change in hindsight. Preparing these stories helps mentors communicate their meaning clearly while vulnerability and authenticity make the experiences more instructive.

Q: How can local events help someone enter cybersecurity?

Local events can introduce newcomers to security topics, practitioners, organizations, and possible employment connections. They can be difficult to discover because there may be no central listing, so mentors should identify suitable gatherings and accompany mentees when possible. Cheap or free local events can provide substantial value without requiring expensive conference tickets, flights, or hotels, making them a practical starting point for students and other newcomers.

Q: How should a mentor help a cybersecurity newcomer network?

A mentor should do more than tell a newcomer to network. The mentor can bring the mentee to suitable events, introduce them directly to known professionals, and then give them room to explore subjects and activities that attract their interest. These introductions are especially important because cybersecurity has no single standard career route, and professional relationships can help newcomers discover opportunities, understand roles, and eventually find work.

Q: When should a cybersecurity newcomer volunteer at community events?

A newcomer should consider volunteering only after attending a few events and evaluating the organization. Initial attendance allows the person to decide whether the subject matter is interesting and whether they feel comfortable with the people involved. If the fit is good, volunteering can deepen participation, create opportunities to meet more people, and visibly demonstrate commitment and interest in the security community.

Summary & Key Takeaways

• Cybersecurity includes many roles, employers, and working styles, so newcomers can easily become overwhelmed or choose a path based on an incomplete picture. Mentors should describe the available options, explain their required skills, introduce practitioners, and ask mentees what activities, environments, and challenges genuinely interest them before prioritizing possible directions.

• Newcomers need a manageable learning plan rather than an enormous collection of books, blogs, classes, websites, and accounts to follow. Mentors should begin with a few trusted resources, add material gradually, and emphasize communication training because writing, speaking, and presenting remain valuable across cybersecurity roles as technologies and security practices evolve.

• Career preparation should reflect each mentee's background and likely obstacles. Certifications can signal learning, interest, and commitment, but cannot prepare someone for a role by themselves. Mentors should also share candid stories, identify affordable local events, make personal introductions, and suggest volunteering after mentees determine whether an organization suits their interests and preferences.