My journey going into cybersecurity as an arts student.

The cybersecurity industry is always looking to hire as they constantly face a demand. Job articles mentioning how the lack in qualified professionals compared to the increased risk in cyber attacks will only continue to increase as more of the world gets connected to the internet. Surely they will be willing to accept anyone who has a passion and would train them from scratch right?

Not to mention, the pay was more than enough to make ends meet. After graduating, I took up a permanent position at a tuition company. I was making enough to make ends meet, but after meeting my friends in cyber and hearing about their monthly compensation, I was enticed. NGL. Furthermore, my current job at that time did not provide me with any performance bonus or wage supplement and that effectively took out months of pay that I would be getting.

Those two factors convinced me to give the world of cybersecurity a try. After all, I was looking to change industry anyway. It was either this, or pursue my masters in psychology and work as a counsellor.

I took the risk and submitted my three (yes, three) month's notice to my tuition company, since I believed that it would have been enough time to change jobs.

For the month of Feb, I signed up for Certified Ethical Hacker (CEH) by EC-council as well as TryHackMe, to learn the basics of cybersecurity, completing 2 certs from TryHackMe in that time. The initial course, Intro to Cybersecurity was easy to wrap my head around and I completed it quickly. Moving on, I set up my own lab with the help of my friend. I used VMware Workstation Pro with a Kali Linux IOS image, which came included along with all the basic programs needed such as Burpsuite and Wireshark.

I used those considerably when trying out the next course which familiarized me to an extent with these programs. It wasn't that hard to grasp at first, I got to be honest and I sort of became a little bit too overconfident, rushing through the rooms like nobody's business. What was in my mind at that time was that I had to get certified as fast as possible to enter the industry and start earning the big bucks.

I also took part in my first CTF, hosted by Mentor High School. I couldn't do many questions and treated it as an exposure. Needless to say, I did not get first place but did not end the CTF with 0 points!

Mentor High's CTF page

https://mentorhigh.mentorschools.net/apps/pages/index.jsp?uREC_ID=2711893&type=d&pREC_ID=2289012

With my background in psych, I knew I was experiencing the Dunning-Kruger effect, where my confidence skyrocketed and I really just wanted to complete my rooms as fast as possible. I was really enjoying my time with Dunning, so as to speak, but I was soon going to meet Mr Kruger.

Once March rolled around, I embarked on the CEH journey. With this new journey on my belt, I could add "completing CEH to my resume" and started applying for jobs in the cybersecurity industry. I was super confident that recruiters will be jumping over themselves to get me into their company. I heard from my friends that when they were in their penultimate year of university, they would have a constant stream of recruiters in their linkedin profile, asking them to sign on with their company or another.

So, week after week, I studied CEH and attended the course on weekends and applied for cyber jobs on Jobstreet, mycareersfuture, linkedin, etc. I started to lose interest in my current job and really just did the bare minimum, as I knew that better opportunities were just waiting for me. I could not wait for the months to tick by.

I had my hands full at the time, as my family was also in the midst of shifting houses at that time and had many things to pack and move over.

I also received a pre-assessment from CSA that I had to fill up, my first real challenge in the industry, where my hand was not held. The questions pertained to real-life situations and what steps I would want to implement to reduce the attack surface and harden against cyber attacks, suggest product solutions to a company and interact with a program to deduce what was going on with the logs.

Most of my time in this month was taken up with the CEH practical, which was tedious to say the least. Step by step instructions to learn how to recon, how to burpsuite, how to metasploit. How to HOIC, LOIC etc. the instructor placed great emphasis that we needed to complete all the labs for the week before the next lesson.

April rolled around and I completed the CEH course and now was the time to roll up my sleeves and take the exam.

Also, I went for CSA's final interview where I believed that I did quite well, answering all the questions (albeit 1) to an acceptable degree. I was quite confident that I would get the role.

Mr Dunning told me to take the exam at the earliest possible date, and thats what I did. After all, I breezed through the labs and felt that I didn't learn anything much from that, how hard could the exam possibly be?

Also, there was this website that I used when I just started learning CEH theory content which provided sample CEH questions to test understanding. At this point, I was still teaching and I used this website extensively to look at questions while my students were doing work of their own. Over time, I started to memorize the questions and my % of correct answers kept increasing. I discarded the textbook (which was around 3000 pages and focused solely on running practice exams over and over again.

To be honest, CEH's scope was very broad and not very deep, so memorizing answers was not the key to long term success. But I felt that it was much better than sitting down and reading the textbook as I was not internalizing much content. For me, this was the strategy I employed to prepare for my CEH exam.

Throughout the whole of April, I continued looking at CEH questions and started to get faster and faster in completing them. At the peak of my confidence, I was completing entire CEH examinations in around 30 minutes with a score of 90%. I thought that the exam was a piece of cake and I could earn my certification the first time I ran the exam.

This is where Mr Kruger stepped in. From this point onwards my confidence plummeted.

The earliest run of the exam happened on the last week of Apr and after some revision, I went in and took the exam. Lo and behold, the questions were quite alien to me and I panicked. What I realized after the exam was that they tested version 12, which was completely different from the questions that I was doing in the past. Although I did see some questions that we similar to what I had been doing, the majority of questions were unknown to me and I had to guess.

Of course I failed the exam and was a huge bummer. In addition, I was also rejected from CSDP. It came as quite a shock to me at that point in time because I had been waiting for their reply for about 2 months at that point. My rationale was that they would've rejected all the unsuitable candidates already and my application was more than secure.

At this point, I was still quite optimistic. I had one more month left to go in my contract and I was sure that I could apply to other companies and it would be a breeze once they found out that I was studying for CEH. I remember telling my girlfriend that I was more bummed about the rejection from CSDP cause that meant that I had to start looking for other jobs again.

I thought to myself, once you get a foot in the door, it would be hard to not be employed due to the constant demand. That's when I started buckling down and mass sending my resumes out to all companies and revised for CEH by taking detailed notes and making sure I had complete coverage on the topics that was tested. I signed up for the next run of CEH and that was my routine for that month, with cookie clicker running constantly as I churned out notes for CEH.

The month of May passed by in a breeze. As it was my last month of full-time employment with my company, I did not have to go to work as my classes had already been handed over to others. All I had were my Wednesday classes and Sunday morning classes. I extensively memorized questions for CEH and sat for the test on 31st May 2023, slightly more confident about the topics that were going to come out.

Topics that were confusing were the encryption algorithms, types of attacks and what they affected and the whole list of acronyms that you have to memorize. Not to mention, the differences between Iaas, Paas and Saas. I felt like each time I encountered that question, it was a guessing game for me.

On the day of the exam, I packed my luggage as we were going to malaysia after and headed off. I remembered that my girlfriend had her interview scheduled that day as well so I chilled in a cafe doing my final revision before going to take the exam proper.

During the exam, I could answer more questions than previously and took the utmost precaution to read each question and the options available multiple times before answering. I had just lost too many marks from not paying proper attention to the questions and I could not afford to lose any for this.

Halfway through the examination, the system hanged. Each time I pressed answer question, it would not proceed to the next question. Luckily, at this point I had answered every question and was just reviewing through questions that I was not certain of. I had to reenter the examination at every question which gave me more time to think about whether my answer was correct and to self-reflect.

After I was confident of every single answer, I clicked submit and to my disbelief, I managed to pass! I got 78.4% which was like borderline pass, but a pass is a pass. After all, what do they call a lawyer who just barely passed his bar exam? It was a huge sigh of relief that I managed to get a professional cybersecurity certification under my belt and could be more confident about my chances with CEH on my resume.

With CEH under my belt, I was confident that I would be able to land a cybersecurity job pretty quickly. I was freshly unemployed and sat down to make the first real job search of my life, I mean how hard could it be? Everyone seems to be in need of cybersecurity analysts!

Some people might think that I was foolish to tender my resignation at my old job before even finding a new job, but my situation was pretty unique, as in my company at that time had a 3 month notice period. If I had left before the 3 months was up, I would've had to pay the difference in salary, not to mention that the availability period of 3 months would scare most recruiters off.

I fired off my resume to countless companies and eagerly waited to be contacted. Meanwhile, I thought of my next steps to improve my chances of being hired. I continued my efforts on Tryhackme and prepared to take the CCNA exam.

For the next step of my journey, please have a look at part 2 of the story! Thank you and I hope this has helped you understand more about getting into the cyber industry.