Start Engineering

CYBERSECURITY
CAREER GUIDE
Prepare for today’s hottest career—become a cyber warrior!
LEARN ABOUT: Types of jobs, where and what to study, salary info, and more.

Updated 3rd Edition!

START-ENGINEERING.COM 1
Brought to you by
 LEVEL table of contents
8 36 | WORKPLACE
Support for minorities and women

CAREERS
38 | Companies needing cyber pros
40 | Cybersecurity firms
Hello, my name is Ron Green and I’m the Chief Security Officer for Mastercard. My job is 42 | Government cyber careers
to protect Mastercard’s computer systems and information as well as our customers’ 44 | CYBERCOM and DC3
and cardholders’ data from hackers and criminals around the world. I didn’t start my career 46 | Military cyber careers
in cybersecurity because it wasn’t an option when I was college many years ago, but I’m
thankful that all of my previous jobs led me to where I am today—working at my dream job! 48 | TEST YOUR ABILITIES
Is cyber for you?
Mastercard is one of the leading digital payment companies in the world. Our network is
able to process a transaction in 140 milliseconds, half the time it takes to blink an eye!
50 | TRY OUT A CYBERGAME
We use our technology and expertise to make payments simple, smart and safe. This means 56 | FACTS & FIGURES
we need to always be on guard, ready to protect and defend against hackers and criminals. Salary info and more
We are thrilled you are interested in learning about a career in cybersecurity because we need
talented people like you to help us defend against cyberattacks and keep information safe. 4 | WHAT IS
CYBERSECURITY?
While the Internet abounds with knowledge, entertainment, and life-enriching content,
Find out how breaches
it can also be a dangerous place. Nefarious actors lurk in dark, safe havens across affect every industry
the Internet, waiting to strike innocent people like you. They are also responsible for
attacking our businesses, schools, hospitals, emergency management systems, and 12 | CRISIS AND RESPONSE
other critical infrastructure. How a ransomware attack spreads

If you want to help defend public and private networks and keep people safe and secure 14 | PATHWAYS 16
in this increasingly digital world, this profession is for you. Cybersecurity offers a variety Choose the path that’s right for you
of career paths, ranging from government to Fortune 500 companies to startups. Every
industry and workplace needs security experts. Your technical knowledge and skills can be 16 | TYPES OF CAREERS 26
put to work as a software developer, a security architect, an ethical hacker or as a digital Learn about all the different
forensic expert. There are also supporting roles in logistics, legal, human resources, and cybersecurity careers
more that require less technical skills.
20 | GET STARTED
In the following pages, you’ll discover the various education and career options as well 7 things to do now
as the many benefits gained by being a part of this exciting, demanding and rewarding
22 | ONLINE SAFETY
30
field. Whatever you choose, there will always be a road that leads to a career in
cybersecurity and this guide will help you explore the many paths possible.
Be safe—and b

I hope you join me in being a cyber warrior, dedicated to making our online experiences 24 | CYBER CAMPS,
safer. I can’t wait to see where your journey takes you! COMPETITIONS AND MORE
Ways to get involved.
Sincerely,
EDUCATION
Ron Green 26 | Cyber certifications
Chief Security Officer 32
28 | Community colleges
Mastercard
30 | 4-year college programs
34 | Financial aid
Mastercard is a registered trademark, and the circles design is a trademark
of Mastercard International Incorporated. ©2019 Mastercard. All rights reserved.

START-ENGINEERING.COM 3
 what is cybersecurity?
A Great Career Option!
Are you into computers and video games? Solving puzzles and mysteries? Writing
code and programming computers? Tracking criminals? Defending our country?
Then cybersecurity could be for you! Because CYBERSECURITY IS...
Defending Our Nation
America is under constant attack. Nefarious “black hat”
hackers work nonstop to break into government and
industry computer systems to wreak havoc or to steal
personal data and trade secrets. Some hackers are
part of criminal gangs; others are agents of hostile
nations—Russia, China, North Korea, and Iran
among them. In 2015, state-sponsored Chinese
hackers snatched the records of around 22.1 mil-
lion Americans from the U.S. Office of Personnel
Management. A 2019 attack hidden within a
software update released by SolarWinds, a Texas
company, was the work of Russian agents. The
malignant code affected about 100 companies
and government agencies, including such tech
giants as Microsoft and Intel, and the depart-
ments of Justice, Energy, and Defense. Microsoft’s
Exchange servers were breached last January
by Chinese hackers—the third big attack on the
company within two months. There’s also an
ongoing surge in ransomware attacks, where
hackers lock up systems and demand a ransom to
release them. A Russian gang’s May ransomware attack on
Colonial Pipeline froze 5,500 miles of gasoline pipeline on the
East Coast (see page 12). Clearly, the effort to thwart these at-
tacks and punish the hackers is a 24/7 job. Led by the U.S. Cyber
Command (CYBERCOM), a joint Pentagon/National Security
Agency operation, it’s an enormous task that utilizes the
skills of cybersecurity specialists in every government
agency. See page 44 for more information.
4 START-ENGINEERING.COM
Securing Our Phones
Because the telecommunications industry
builds, controls, and operates the nation’s
critical information infrastructure, these
businesses are inviting targets for both cyber-
criminals and foreign adversaries. In August
2021, T-Mobile announced that a cyber-
attack on its systems affected more than 50
million current, former, and prospective cus-
tomers. Some of the exposed data included
names, social security numbers, and birth-
days. The massive breach comes on the heels
of four other T-Mobile leaks in recent years
and a SIM-swapping attack earlier in 2021. In
these incidents, hackers may have leveraged
some of that breached information to access
phones and all the precious data we keep
in them, such as photos, emails, passwords,
and even that handy banking app. (Time to
borrow someone else’s phone and call your
bank, asap.)
Safeguarding Our Money
No need for masks, weapons, or demand notes. Bank robbers today
can often get inside financial institutions undetected. According to
JPMorgan Chase Bank, big banks experience cyber attacks nearly
every day. The bandits use sophisticated malware to get deep into
the banks' computer systems, allowing them access to private
customer data to try and take out loans in a customer's name or
commit other kinds of identity theft. For example, a 2022 heist
at Flagstar Bank — 150 branches across 28 states — netted the
bad guys the names and Social Security details of over 1.5 million
customers. In response to the increase in cyber attacks — aver-
aging $5.72 million per data breach — financial institutions are
dramatically increasing their security budgets. For instance, Bank
of America’s CEO Brian Moynihan said his company is now spend-
ing over $1 billion a year on cybersecurity. According to a report by
Positive Technologies, 92 percent of ATMs are vulnerable to hacks.
Cybersecurity for banks is definitely a growth industry.
ENTRY-LEVEL SALARY RANGE FOR THE CYBERSECURITY INDUSTRY:
$89,000 – $98,000
SOURCE: CYBER SEEK
Protecting Our
Electrical Infrastructure
Having weathered countless cyberattacks, including the
breaches that targeted SolarWinds and Microsoft Exchange
software in early 2021, the country’s electrical infrastructure is
increasingly at risk, says Energy Secretary Jennifer Granholm.
“The U.S. faces a well-documented and increasing cyber threat
from malicious actors seeking to disrupt the electricity Ameri-
cans rely on to power our homes and businesses,” said the
secretary in a statement announcing a 100-day initiative
to strengthen the cybersecurity of critical infrastructure. “It’s
up to both government and industry to prevent possible harms.”
ISTOCKPHOTO.COM (3) START-ENGINEERING.COM 5
 what is cybersecurity?
Shielding Our Schools U.S. CYBERSECURITY JOB OPENINGS

769,736
Think about the wealth of information your school accumulates
about you: your grades, test scores, social security number, health
history...and of course, also your parents' names and social secu-
rity numbers, work locations, and if you attend a private school,
possibly banking information, too. This treasure trove of data is
the reason cybercriminals are increasingly targeting schools. The
Going Airborne
2022 school year was just beginning when a massive cyberattack Hackers are targeting airlines as never before: Attacks increased
struck the Los Angeles school system. With the private data of 15,000 percent between 2017 and 2019. (Yes, 15,000 percent!)
over 400,000 students suddenly at risk, officials quickly shut So far, hackers have primarily caused computer outages with
down the entire computer system. It is still unknown how much distributed denial of service (DDoS) attacks. By disrupting
data was stolen — the FBI and the Dept of Homeland Security are internet connections, hackers cause terrible delays, with all
on the case — but schools need to be ever-vigilant. Guarding Against the impact on business and

Subway Scares personal lives that you can

imagine. Fortunately, noth-
The New York City Metropolitan Transportation ing worse has been reported.
Authority discovered earlier this year that its com- But a plane’s Wi-Fi or enter-
Foiling Pirates puter systems had been breached. The perpetrators,
believed to be backed by the Chinese government,
tainment system could be
hacked to enable tampering
We’re not talking Blackbeard with his cutlass or even modern-day marauders with assault rifles. Today’s tech-savvy didn’t demand ransom, nor did they access systems with satellite communica-
pirates hack into the GPS systems of cargo ships as they sail the ocean blue, taking over command from the captains. that controlled train cars (which would have put tions and interfering with
Malware can affect command-and-control systems to disrupt shipping of major commodities (such as grain and other passengers at risk). Nonetheless, the intrusion is a navigation and control. A
foodstuffs) or hold ships for ransom, and cautionary tale for public transit systems across the tech-savvy hijacker could
even use captured ships to engage country. While 80 percent of transportation agen- change your route—or worse—without worrying about getting
in cyber spying. Fully 90% of the cies say they’re prepared to manage cybersecurity through airport security to board the plane. While airlines have
world’s trade is transported by sea, threats, only 60 percent of them have a plan in place, robust cybersecurity systems in place, and pilots can still take
and ships that carry that cargo— according to a study last year by the Mineta Trans- control away from autopilot, without cybersecurity vigilance,
worth billions—are vulnerable portation Institute. passengers could experience more than just a bumpy flight.
to cyberattack. In 2016, A.P.
Moeller Maersk, the world’s
biggest container shipping line
and operator of 76 seaports worldwide,
was hit with a computer virus that shut
Protecting Our Ride
down operations across the globe, blocking In September of 2022, employees at Uber received this Slack message: “I announce I am

normal operations at multiple ports for weeks. a hacker and Uber has suffered a data breach.” The hacker gained access by pretending
to be from Uber's tech department and persuading one unfortunate employee to give
Los Angeles, the busiest port in the U.S., was stalled
up their password. (This technique, called social engineering, was used in similar attacks
for days, with ships unable to off-load goods. As a result,
at Twitter and Microsoft.) It was not the first time cyber criminals had stolen data from
not only oil transport but also oil production was affected—
Uber. In 2016, hackers stole information from 57 million driver and rider accounts and
without ships to load in port, oil fields had to shut down. Luckily,
demanded $100,000 to delete their copy of the data. Uber arranged the payment but
this was temporary. But as a result, the shipping industry must adopt ever more advanced
kept the breach a secret for more than a year. When the theft came to light, the CEO was
technology to protect itself against the increasing variety of attacks by cyber pirates. Having all hands on deck
fired. Here's hoping that transparency works better for Uber this time.
in cyberspace to fend off a serious attack is vital for the shipping industry’s continued success.

6 START-ENGINEERING.COM TOP PHOTO BY THIRDMAN FROM PEXELS; ISTOCKPHOTO.COM TOP PHOTO BY ONO KOSUKI FROM PEXELS; ISTOCKPHOTO.COM (2) START-ENGINEERING.COM 7
 what is cybersecurity?
Any device
connected to the
internet is vulnerable
to cyberattacks.
So, how many devices
are connected to
the internet?

21.5 billion
This number is set to explode
in the coming years as
internet consumption rises
and new gadgets and

Defending Our Food Supply machinery hit the market.

The world’s largest meat processor, Brazil-based JBS, announced in June 2021 SOURCE: STATISTA

that an attack earlier in the spring had targeted its computer networks in Keeping Gamers Going Shielding Our Social Sites
Australia and North America. The attack forced it to shut down production
Cost of cyber crimes in Stuck at home during the pandemic, many of us In another incidence of "social engineering" (see the Uber item,
plants, including all its beef facilities in the U.S., which process nearly a quarter
the U.S. in 2021: turned to video games for entertainment. Hackers page 7), some Instagram users received a message last year
of the country’s supply. The news sparked worries of a rise in meat prices,
already high due to the pandemic. In the end, JBS said that it lost less than
a day’s worth of food production during the shutdown. The company later
$6.9 turned to video games for profit. The year 2020 saw
a 340 percent increase over 2019 in web application
claiming that a post of theirs was guilty of copyright
infringement. They were further instructed to go

confirmed it had paid the equivalent of $11 million in bitcoin to the attackers,
whom the FBI believes to be Russia-based ransomware outfit REvil.
billion video game attacks, the biggest increase for any in-
dustry. In June 2021, hackers broke into the systems
to a link in the message to resolve the issue, where
they were then asked to enter their Instagram login
SOURCE: FBI of Electronic Arts and stole 780 gigabytes' worth information. Of course, the message was really from a
of source code used in the company's games. The cybercrime gang. And users who followed the instruc-
hackers boasted that they gained full access to FIFA tions ended up making their accounts fully accessible

Protecting Our Drinking Water
Several states issued alerts to water systems in early 2021 after an incident
in Oldsmar, Florida, in which a hacker attempted to raise the level of
sodium hydroxide—used to remove metals and control acidity in drinking
water—to poisonous levels. The compound, also known as lye, is the main
ingredient in liquid drain cleaner and can cause severe damage to the
respiratory and digestive system. The hack came to light in real time as the
system’s plant operator noticed the cursor on his computer moving around
on its own. He swiftly undid the changes. The breach came on the heels of
an intrusion into a San Francisco Bay Area plant by a hacker using a former
employee’s login to delete programs used to treat water.
21 servers, as well as the source code and debugging
tools for EA’s most popular games, such as Battle-
field, FIFA, and Madden. Stolen source code could
subsequently be sold and copied by other developers
or used to create hacks for games. Overall, criminals
seek any opportunity to exploit video game players
who spend real money on virtual, in-game items
like skins, character enhancements, and additional
levels. They look to steal player email addresses,
passwords, login details, and geolocation informa-
tion, which they can then sell on criminal markets.
What a way to ruin the fun!
to the hackers who promptly changed people’s passwords and
usernames. Then, the hackers asked for ransom payments in ex-
change for access to the account, in amounts as high as $40,000.
Six months later, hackers struck again, this time with a
phishing attack. Victims received an email notification that their
account was eligible for the coveted "blue badge", pending con-
firmation of all their info at a "badge form" link. The scam worked
to create urgency in targets’ minds, warning users the verification
process would expire within 48 hours. Many willingly gave up their
private information. Last year, Instagram rolled out a new security
feature meant to help users secure compromised accounts and
kick out hackers — yet the phishing attacks continue.

8 START-ENGINEERING.COM ISTOCKPHOTO.COM (3); COURTESY MADDEN START-ENGINEERING.COM 9

 what is cybersecurity?
Maintaining Medical
Confidentiality
Details about your health are just between you and
your doctor—and the databases holding your personal
medical file. In the past, healthcare professionals wrote
down your vitals and other sensitive information and
filed the notes in a physical folder that was kept from
prying eyes. Now, a nurse or doctor types this informa-
tion into a digital file that gets stored in an electronic

Keeping Retailers in Business database. This makes sharing

information between experts
One of the biggest leaks of 2020 involved cosmetic giant easier so that you can get
Estée Lauder. The multinational retailer exposed 440 million care more quickly. But
records to anyone with an internet connection, thanks to inad- with the benefits of
equate password protection. Once it discovered the problem, accessible data
the company moved quickly to secure the data. While no come the threats:
consumer payment information was leaked, email addresses, HIPAA Journal tallied
IP addresses, and middleware logs were all accessible, making 3,705 breaches of data-
the system vulnerable to malware. The fallout could have been bases holding 500 or more
much worse, considering that retailers are common targets for healthcare records between
hackers seeking to steal credit card and email information—a 2009 and 2020, leading to the loss, theft, or exposure
hacker with more knowledge of Estée Lauder’s system could of more than 268 million records—the equivalent of 82
very well have done more damage. percent of the population of the U.S.
Driving Improvements
Time was, car problems originated in a car’s mechani-
DID YOU KNOW?
cal parts. Now, cars depend on computers that let the 1. Cybersecurity isn’t just coding and programming.

Coding Cyber Weapons driver access smartphone apps, music from streaming
platforms, and navigation. Computers also control
Tech-savvy countries are creating increasingly sophisticated tools for conduct- autonomous sensors to protect the driver from unseen
ing online sabotage. The theory behind these weapons is that an enemy’s capa- threats. Since car computers have to connect to a larger
bilities can be destroyed without the need to use military force. While this may network, they’re just as vulnerable to attack as your PC.
sound like an improvement, cyber war is no less threatening to world peace and A consumer watchdog found that a malicious hacker
freedom than any other kind. For instance, after Iran downed a U.S. surveil- could cause as many as 3,000 deaths by disabling
lance drone flying over the Strait of Hormuz, the U.S. Cyber Command retali- braking, steering, and even airbags. One particularly
ated by launching a cyberattack on the Iranian computer systems that control disturbing way to hack a car is a malware “worm” that
rocket and missile launches. There were no deaths, and the strike was deemed can move from car to car within close proximity to shut
“very” effective. But two weeks later, Cyber Command issued a warning that an off crucial systems and cause a wreck. And cyberse-
Iranian-led hack was targeting millions of American Microsoft Outlook systems. curity challenges will only increase as driverless cars
Because cyber weapons are within the reach of many “bad actors,” the mission become more of a reality. Technologies aimed to create
to maintain a strong defense is one of the most demanding—and exciting—for a safer world for the driver have opened up a Pandora’s
cybersecurity professionals. box of threats that cybersecurity experts must fight.
It’s also drafting and implementing cyber policies for secure
information exchange and storage. And cybersecurity is digi-
tal forensics for finding out how who did what, where,
and when, in order to stop cybercriminals in the future.
2. The most important skills for success in a cyber job
aren’t necessarily tech-related. Problem-solving, commu-
nication skills, and teamwork are commonly cited as being
extremely important.
3. Cybersecurity thrives on diversity. Teams made up of
people with varied personal and academic backgrounds
benefit from the different perspectives that all the members
bring to the work. Women and minorities can contribute
insights to cybersecurity teams because they often see things
differently from white men.

10 START-ENGINEERING.COM SOURCES: THE WALL STREET JOURNAL, THE NEW YORK TIMES, ACCENTURE, DELOITTE, REUTERS, FORTUNE, FORBES, WIRED, CNN, NPR, BUSINESS LAW JOURNAL, NEWAMERICA FOUNDATION, STUDY: AGENTS OF CHANGE: WOMEN IN THE INFORMATION SECURITY PROFESSION ISTOCKPHOTO.COM (4) START-ENGINEERING.COM 11
 crisis and response
How a Ransomware Attack Spreads
I
n May 2021, hackers broke
into the data networks
of Colonial Pipeline, a
company that supplies gas
through a major pipeline
from Texas to New Jersey. The
hackers locked out the com-
pany’s own IT staff, encrypted
huge numbers of business-
critical files, and demanded
millions of dollars to provide
the decryption key.
Not only did this ransom-
ware attack disrupt the daily
lives of millions of Americans,
it also consumed the work
lives of hundreds, even thou-
sands, of people in jobs of
all kinds. Read on to find out
how this drama played out.
12 START-ENGINEERING.COM
MAY 7: The Attack
4:45 A.M. An employee at
Colonial Pipeline discovers
a ransom note on a system
in the IT network. The note
says that hackers have taken
files from the company’s data
networks, and it demands
about $5 million in exchange
for the files.
5:55 A.M. The company de-
cides to shut down the entire
pipeline network to contain
any possible risk of physical
harm or damage.
6:10 A.M. Along with the
pipeline shutdown, systems
throughout the company go
offline. Everyone’s job–
from billing to administra-
tion to communications
to personnel–becomes
figuring out how to do what
they are supposed to do
without fully functioning
computer networks. The
company contacts the FBI.
MAY 8: Ransom Paid
With the help of the
FBI, Colonial
Pipeline
pays a $5 million ransom (in
bitcoin) to DarkSide, a cyber-
criminal group operating
out of Russia. The hackers
then send Colonial Pipeline
a decryption tool to restore
their network, but it operates
very slowly.
MAY 8: Damage
Assessment
The communications team
releases an announcement of
the attack to news organi-
zations. All departments
figure out which systems
can still function and which
cannot. Colonial Pipeline
employees engage with law
enforcement, government
agencies involved with the
energy industry, and clients
and customers suddenly cut
off from gasoline supplies.
The shutdown causes major
disruptions to gas delivery up
and down the East Coast, as
PHOTO AND MAP COURTESY COLONIAL PIPELINE
with departments through- Conclusion
out the company either Any organization that relies
to resurrect or rebuild the on the internet to conduct
data networks required for business operates under the
full resumption of business threat of the same kind of at-
activities tack that befell Colonial Pipe-
line. Which means every orga-
MAY 17: Operations Resume nization is at risk and in need
Scores of people are still of employees with cybersecu-
monitoring the status of rity skills and an awareness of
pipelines and other equip- online safety practices. This
trucks struggle to restock containing damage from ment as systems crank back cybersecurity crisis originated
gas stations, and long the ransomware attacks. At into full action. The commu- with a phishing email that
lines develop at pumps, this point, the attack requires nications department works an employee treated care-
especially in the Southeast. the involvement of numerous to repair public relations and lessly, thereby opening the
Airline operations also other government and the company stand- door to calamity for the
are disrupted. law enforcement ing in the public company and severe
entities, the arena. nuisance for the
May 9: State Department general public. It
of Emergency of Energy, JUNE 7: also illustrates
President Joe multiple Ransom the imperative for
Biden declares private-sector Partially everyone to bring
a state of emer- cybersecurity Recovered! crack cybersecurity
gency. The decla- firms with exper- Sophisticated skills with them to
ration removes limits tise in ransomware digital sleuthing work every day. Keep
regarding the transport of incidents, and the many dif- allows the federal reading to learn more about
fuels by road, in an attempt ferent financial organizations government to recover about careers in the field and which
to alleviate any potential involved in the company’s half of the ransom payment. one might work well for you.
shortages. money operations.
MAY 10: A Team Effort MAY 12: Reassessment
Operations start to come Company engineers and secu-
back online. Updates and rity staff examine hundreds of
continued coordination miles of pipeline and oversee
with Colonial Pipeline alternate shipping arrange-
clients, partners, and wider ments to ensure safety.
contacts focus on three Media and communications
things: the safety and staff provide regular updates
security of restored opera- regarding what has become
tions, minimizing disrup- a story of interest to people
tions to customers, and around the world. IT works
TOP TO BOTTOM: WOODY MARSHALL/NEWS & RECORD; AP PHOTO/ MIKE STEWART; AP PHOTO/ DAMIAN DOVARGANES START-ENGINEERING.COM 13
 educational pathways
There are many
options for starting
and advancing in
GET A CYBERSECURITY
careers within
cybersecurity.
Pick a path that
ENTRY-LEVEL
POSITIONS
IT Support Specialist
CERTIFICATION
(Computer Network Support
Specialist)
See page 26 for more info.
Associate Cybersecurity
Analyst (Junior Analyst)
AVERAGE To advance further, you’ll
SALARY
need an associate degree
or bachelor’s degree.
$40,000 Or, you could enlist in one
of the branches of the military.
See page 46 for more info.

works for you.

ENTRY-LEVEL AVERAGE
POSITIONS SALARY
Network Support Specialist WITH WORK AVERAGE
(Network Administrator; EXPERIENCE SALARY
System Administrator or
GET A 2-YEAR Network Support Specialist
Security Administrator;
HIGH SCHOOL ASSOCIATE DEGREE Computer Support Technician)
$61,000-
Computer Forensics Analyst $76,000
See page 20 for more info. $65,000
See page 28 for more info. Penetration Tester
Computer Forensics Analyst

Cybersecurity Specialist

ENTRY-LEVEL AVERAGE
POSITIONS SALARY
Set your Cybersecurity Specialist/ $92,000
Technician (Information Security WITH WORK AVERAGE
sights: GET 4-YEAR Specialist or IT Specialist) EXPERIENCE SALARY
BACHELOR’S DEGREE
84 percent See page 30 for more info. Cybercrime Analyst (Security $94,000 Cybersecurity Analyst $95,000
Analyst - Digital Forensics; Penetration Tester $103,000
of job postings Computer Forensics Analyst; Cybersecurity Consultant $91,000
Senior Investigative Agent)
ask for a Cybersecurity Engineer $106,000
Incident Analyst/Responder $89,000 Cybersecurity Manager $105,000
bachelor’s (Senior Analyst, Information
Cybersecurity Architect $133,000
Security; Information Security
degree or higher. Project Manager; Cyber Defense
Center Analyst)

IT Auditor (IT Audit Manager) $98,000

14 START-ENGINEERING.COM SOURCES: CYBERSEEK.ORG, INDEED.COM, PAYSCALE.COM, ZIPRECRUITER.COM START-ENGINEERING.COM 15

 types of careers
Pick Your Path
C
ybersecurity is an industry, not
a job. Eager to test your coding
skills as a “white hat” hacker?
Curious about how data banks are orga-
nized and protected? Concerned about
who holds our personal information?
Cybersecurity professionals are
detectives, figuring out how break-ins
occurred and “who done it.” They are
doctors, curing IT systems attacked
by malicious viruses. They may be
librarians, organizing information so
that it is accessible. Cybersecurity
professionals are prosecutors of cyber-
16 START-ENGINEERING.COM
criminals and advocates looking out for
the right to privacy in the digital age.
Above all, cybersecurity professionals
are team players, because the many
workplaces that rely on IT systems need
expertise in all of these functions—and
more. The possibilities are awesome!
The National Initiative for Cybersecu-
rity Education (NICE) was created in
2010. NICE oversees the Cybersecurity
Workforce Framework, an online re-
source that maps seven fundamental
functions and capabilities any cyberse-
curity system needs. These functions
COLLECT and OPERATE
Collect, process, analyze, and present information from adversaries
that may be used to develop intelligence and counterintelligence.
WHAT THEY DO
n Collect intelligence, and interpret and analyze information
n Discover and mitigate criminal and adversarial threats
JOB TITLE EXAMPLES
Cyber Analyst
Intelligence Analyst
Information Systems Manager
ANALYZE Security Software Developer
ADVANCED DEGREE OR TRAINING
Review and evaluate incoming Cybersecurity
cybersecurity information to Computer Science or Engineering
determine its usefulness for IT or Network Security
intelligence.
WHAT THEY DO
n Identify and assess the capabilities
and activities of cyber criminals or
foreign entities INVESTIGATE
n Produce findings to help initialize Investigate, review, and evaluate cyber events and cyber crimes.
or support law enforcement and
counterintelligence investigations WHAT THEY DO
or activities n Investigate cyber crimes
n Analyze threat information from n Recover data from computers to use in prosecuting crimes, analyzing
multiple sources, disciplines, and and decrypting any type of hidden information
agencies across the intelligence n Identify and assess cyber criminals or foreign entities
community n Help law enforcement and counterintelligence investigations
embrace many different jobs. NICE also
JOB TITLE EXAMPLES JOB TITLE EXAMPLES
manages CyberSeek, an interactive and
Cyber Threat Analyst Forensic Computer Analyst
expanding website that details jobs and
Cyber Counterintelligence Analyst Cryptographer
what they require in education, training, Cryptanalysis and Signals Analyst Cyber Intelligence Analyst
and certification. Security Analyst Security Analyst
Check out the Cybersecurity Workforce
Framework detailed on the next pages ADVANCED DEGREE OR TRAINING DEGREE OR TRAINING
and go to CyberSeek.org. Because some Computer Science Cybersecurity
functions overlap, if you start in one job Criminal Justice Computer Science
area you generally can add some training Forensics Network Security
to shift to another. In cybersecurity, Information Technology Information Assurance
being multi-talented is a plus! Use this Engineering Forensic Science
Law IT and Security
Career Guide to learn more and pick your
path to skills training and education.
ILLUSTRATIONS BY KEVIN MYERS START-ENGINEERING.COM 17
 types of careers

OPERATE and MAINTAIN PROTECT and DEFEND CALLING ALL

Provide support, administration, and maintenance necessary to Identify, analyze, and prevent cyber threats to an organization. (ETHICAL) HACKERS
ensure effective and efficient IT system performance and security. A penetration tester (a.k.a., ethical
Of all the paths, this one has the most job openings. WHAT THEY DO
hacker) probes for and then ex-
n Look for weaknesses in software, hardware, and networks of an
WHAT THEY DO organization and find creative ways to protect it ploits security vulnerabilities in
n Develop, support, and maintain databases and networks n Respond to incidents web-based applications, networks,
n Manage intellectual capital and content n Manage and monitor networks to remediate unauthorized activities and systems. In other words, you’re
Conduct assessments of threats and vulnerabilities paid to hack—and it’s legal! Using a
n Install, configure, test, operate, maintain, and manage network n

server configurations, access, firewalls, and patches series of penetration tools, some
JOB TITLE EXAMPLES that you will design yourself, you
JOB TITLE EXAMPLES
Customer/Technical Support
OVERSEE Ethical Hacker
Incident Responder
simulate real-life cyberattacks,
perhaps taking part in Red Team/
Specialist
Data or Database Specialist
and GOVERN Chief Information
Security Officer
Blue Team exercises that mimic
Penetration Tester cyber warfare. Your ultimate aim is
Information Systems Provide leadership, management,
Intelligence Analyst to help an organization improve its
Security Engineer direction, development and
Network Specialist Security Analyst cybersecurity. Most pen testers
advocacy so that individuals and
System Administrator organizations may effectively don’t hold a specialized degree.
DEGREE OR TRAINING
conduct cybersecurity work. Since ethical hacking is more about
Computer Science
DEGREE OR TRAINING skills than course credits, a bache-
Cybersecurity
Computer Science WHAT THEY DO lor’s or master’s degree in cyberse-
Information Assurance
Information Technology n Oversee the cybersecurity
IT and Security curity may be unnecessary if you
Network/Computer Systems program
Network Security have the right experience.
n Offer legal or policy advice
and recommendations
n Manage the technical direction
and strategic plan for an
WHO DONE IT? organization

A digital forensics expert examines an IT system just as a medical

n May include e-commerce,
privacy, copyright, and
SECURELY PROVISION Conceptualize, design, and build secure IT systems.

forensics scientist examines a dead body! As noted forensic com- intellectual property WHAT THEY DO JOB TITLE EXAMPLES
puter examiner Eric Robi says, “A computer forensic analyst has to n Create tools for virus, spyware, Computer Programmer
be incredibly curious about how computers work and how people JOB TITLE EXAMPLES or malware detection Computer Systems Analyst
Chief Information Officer Prevent intrusions to computer Software Developer
behave.” In addition to curiosity and insight, you will be expected to n
Cyber Security Trainer systems Systems Engineer
have strong written and oral communication skills. A large part of
Lawyer or Legal Advisor Information Assurance Developer
an expert’s job is devoted to writing reports and explaining evidence.
n Analyze and test computer
Policy Analyst Network Security Analyst
applications or software
In the case of criminal prosecutions, you need be able to explain Systems Security Architect
n Conduct technology research Information Technology Director
your findings before lawyers, judges, and juries who lack tech back- ADVANCED DEGREE
and development
grounds. Can you defend your findings when cross-examined by OR TRAINING
Business n Determine systems DEGREE OR TRAINING
opposing counsel? Whether you are speaking to intelligence part- requirements and
Criminal Justice Computer Science
ners, corporate clients, or law enforcement, you need to be able to Information Technology development Networking
be crystal clear! Law n Test and evaluate systems Electrical or Systems Engineering

18 START-ENGINEERING.COM SOURCE: CYBERDEGREES.ORG: BECOME A FORENSICS EXPERT SOURCE: LOUDPROGRAMER.NET: 9 SKILLS THAT WILL GET YOU A JUNIOR PENETRATION TESTER JOB START-ENGINEERING.COM 19
 get started
7 THINGS
TO DO NOW
Making smart decisions in high school will pay off later.
T
he diversity of complex infor-
mation systems and the ever-
expanding internet of things
make cybersecurity one of the most ex-
citing career areas out there. Any cyber-
security career requires a credential of
some kind, but there are certifications,
online education, and two- and four-year
degrees. You can get there! Taking these
steps in high school keeps your options
open and readies you for the future.
1. Take Math. Be sure you cover algebra
through calculus. If you can, take com-
puter science or statistics, but prioritize
the fundamentals, including physics.
2. Take English, too. Keep any class
that demands critical thinking skills in
your school schedule. You need to be
able to organize and communicate your
great ideas!
3. Learn to code. If you can’t do this in
school, you can enroll in courses at a local
college. Or take FREE computer coding
classes online at Code Academy, Alison
.com, and Kahn Academy. Start with
20 START-ENGINEERING.COM
Python, a valuable cybersecurity pro-
gramming language that can be used in
detecting malware, penetration testing,
scanning, and analyzing cyber threats.
Other good languages to learn are
JavaScript, Java, Go, C and C++.
4. Build a website. Once you have
basic coding down, build a website by
yourself or with friends for programming
experience. Try building a home com-
puter network!
5. Go out for the team. Cybersecurity
jobs often require working independently
but as part of a team, using skills best
learned by doing. Competitions like
CyberPatriot and Capture the Flag
events teach skills and teamwork. If
your school lacks robotics teams and
competitions, start a cyber club! Maybe
a computer teacher will “gamify” some
class objectives for team activities. Con-
tact local community colleges and univer-
sities to see what they host. Contact the
Institute of Electrical and Electronics En-
gineers Computer Society for help finding
sponsors for new or existing activities.
6. Connect to a community. Meet
others—actually or virtually! Being part
of a people network enhances prospects
for learning and employment. NOVA-
Labs and Hour of Code offer online com-
munities for games. The Girl Scouts have
cyber badges developed with the Na-
tional Security Agency and businesses
such as Palo Alto Networks. In many
areas, community colleges, universities,
and businesses have partnered to create
“hackathons” and STEM fairs. Start your
search with NICE-certified cyber events.
See page 24 for more ideas.
7. Use summer for cyber. Any job that
has you working with computers and
security rules boosts your resume. Use
IEEE or an online search to find intern-
ships. Or go to cyber or computing camp!
ISTOCKPHOTO.COM; COURTESY JROTC
The NSA runs the GenCyber Camp pro-
gram, based at colleges nationwide
(see page 24). Check out Palo Alto
Networks’ Cyber A.C.E.S. program and
take the free online Foundations class.
Palo Alto Networks also offers online
courses with labs for the PCCSA, a basic
certification that could have you ready
for an entry-level position in cybersecu-
rity just as you finish high school!
JROTC Program
Adds Cyber Focus
The U.S. Air Force Junior ROTC has
launched a four-year pilot program to
add cybersecurity education to the ex-
isting curriculum at 30 schools nation-
wide. The program consists of activities
and mentoring throughout high school,
including participation in the CyberPa-
triot competition (freshman year), AP
Computer Science Principles (sopho-
more year), a summer Cyber Academy
(after junior year) at a local university,
and opportunities for internships. The
goal is to prepare students to enter the
cyber workforce, pursue postsecondary
studies, and/or enter military service.
Though the classes will be open to all
high school students, the Cyber Summer
Scholarship will only be awarded to ca-
dets enrolled in the JROTC program. Ask
about it at your school!
START-ENGINEERING.COM
 online safety
Be Safe—
and Be Good
Make smart online—and IRL—decisions.
C
ybersecurity, it turns out, has
as much, if not more, to do with
human behaviors and choices as
with technical defenses and safety sys-
tems. About 95 percent of all data leaks
22 START-ENGINEERING.COM
originate with bad choices people make
to click on emails or download attach-
ments they should instead be deleting.
The best security systems in the world
cannot eliminate the haste, inattentive-
ness, and carelessness that underlie
most mistakes people make with online
data networks. As you think about both
your private life on the internet as well
as future career options, reckoning with
the role of human factors in online
safety is key.
Build strong passwords. The fragility
of trust online explains why we have
elaborate systems of passwords, en-
cryption, and other security measures
to keep data visible and available only
to those authorized for access. Navigat-
ing this trust-deficient internet world
means, at a minimum, developing and
managing a system for using strong
passwords.
Watch out for scams. Learn to identify
email scams and shady websites. Know-
ing a bogus email when you see one is
tricky. The best ones look really convinc-
ing, just like lots of other emails in your
inbox. Phishing hackers are counting on
people not paying close attention to
emails and just clicking or answering
without looking very hard at what
they’re doing.
Be careful what you post. All the items
you share on social media, for example,
should reflect behaviors and language
that you are willing to live with for years
to come. Sketchy photos and dubious
words from the past have come back to
bite many people when college admis-
ISTOCKPHOTO.COM
sions officers and prospective employers
come into the picture. Mark Loepker, Di-
rector of Education at the Cyber Center
for Education and Innovation, observes,
“If you think a yearbook’s going to haunt
you, wait until they pick up all your Face-
book posts.” Or Instagram posts. Or
tweets or snaps.
Protect your privacy. As a texter or
emailer, social media user, shopper, or
just website visitor, we all must make
choices all the time about what kind
of personal information to offer up as
public or to keep private. The basic ques-
tion involved in all of these choices is
whether to trust the machine or person
who is (apparently) on the other side
of our screen. And the best answer is
usually no—or at least to put less trust
in these exchanges than we usually do.
Providing your bank with a home ad-
dress, birthdate, and phone number
might be okay, but in an online game
chat room? No way!
Not only should you not trust people
online, you should recognize that people
won’t trust you online, either. “You say
you are Harry Potter?” the login screen
asks. “Prove it by telling me your user-
name and password!” “Oh yeah,” you
say to the fishy-looking email in your
inbox, “You say you’re the Bank of Amer-
ica? Show me your ‘https’ web address.”
And learning how many ways compa-
nies use (and profit from) the data we
share with them should give us all pause
regarding the volume of personal infor-
mation we let them gather when we buy
their products and use their services.
Say no to drugs. Whatever your state’s
laws say about the use of marijuana, let
alone other recreational drugs, federal
law continues to make it illegal. Many
private-sector employers follow federal
law and will disqualify potential employ-
ees for positive drug tests. And govern-
ment security clearances require clean
drug tests over extended periods of time.
Be cautious—and thrifty. Start moni-
toring your bank accounts and credit
cards so that you can spot identity theft
that can create debt in your name. Avoid
high consumer debt of your own—you
don’t want your credit card balance to
make it look like you could be bribed for
access and information. How you spend
your money will also be visible through
your credit rating to anyone evaluating
you for a possible job. Showing irrespon-
sibility with your own personal finances
will raise a flag for anyone trying to de-
cide if you should be trusted with other
people’s sensitive, personal data and re-
sources. Whether using the internet now
as a student or defending it in the future
as a cybersecurity professional, keeping
things clean online and IRL will always
be the right approach.
Which leads us to cybersecurity
careers. Indeed, establishing trustwor-
thiness online is central to cybersecurity
professionals’ work, but so is maintain-
ing it offline. As it turns out, all of these
best online security practices can set you
on a path towards a career in cybersecu-
rity. Learning how to build strong pass-
words, distinguish real emails from
phishing scams, and track how far your
data can travel beyond the website you
just gave it to can well serve as the basic
training needed to launch you towards a
career in cybersecurity. Knowing what
can go wrong with your own online life is
a great way to start thinking about how
to prevent things from going wrong with
other people’s online lives.
START-ENGINEERING.COM 23
 camps, competitions and more

Ways to Get Involved

Let’s Play Cyber Games
Launched by Ohio Cyber Woman, Let’s Play Cyber Games is
based on the 4-H experience of founder Janis Mitchell. Middle
school girls take part in project-based activities that teach
both computer skills and business practices. Young women in
Look for online and IRL competitions, camps, and other activities. They’re fun, don’t require the cybersecurity field serve as mentors for hands-on activi-
prior knowledge of cybersecurity, and teach real skills. ties using Raspberry Pi, a credit-card-size computer that plugs
into a monitor and is given to participants. Mitchell surveyed
the participants and found that after attending Let’s Play, 74
percdent of attendees would now consider a career in cyber.

B
oth learning and fun can be had at cybersecurity compe- and mentors. Find those near you using the GenCyber website For more information, go to https://ohiocyberwomen.org.
titions and camps. And when you’re done, the technical (gencyber.com) and check out the video. With GenCyber, you
skills and teamwork experience you gain from partici- can’t beat the scope or the price—thank you, NSA and National The National Cryptologic Museum
pating will have community colleges, universities, the military, Science Foundation. Located in Fort Meade, MD, outside NSA headquarters, the
and employers taking a serious interest in your good time. Major museum explores the history of cryptology and cybersecurity.
government agencies and private-sector companies collabo- CyberPatriot Competition Visitors can learn about code-makers and -breakers through-
rate to sponsor competitions and finan- Created by the Air Force Association and sponsored by major limited to six but can be as Students work with mentors to solve a out history, from early Native Americans to professionals to-
Clockwise from top right: Capture the Flag challenge during the
cially support student participation, so Cyber camp at University cybersecurity companies and government agencies, CyberPa- small as two! A coach is Security Advisor Alliance Converge Tour.
day working in high-tech spycraft. The museum also provides
playing games can lead to finding schol- of Texas, Austin, and triot challenges teams of students to keep a virtual IT system required, but a technical opportunities for high school students to chat with experts in
GenCyber camps at
arships, internships, and mentors. In Coastline College in functioning while finding operating flaws and cybersecurity mentor is optional. Many teams and coaches come in without the field on a wide range of topics; check out the listings at
fact, says Kammy Sanghera, Executive Fountain Valley, CA, and vulnerabilities. As Tamara Shoemaker, founder of the Michigan experience. The local and state rounds of timed events are held https://tinyurl.com/hv4hxnjt. The museum will soon be
Harford Community
Director of STEM Outreach at George CyberPatriot program, says, “The CyberPatriot program reaches online, over several months, on weekends, with the national moving to a new state-of-the-art building filled with interac-
College in Bel Air, MD.
Mason University, that is just what students where they are with round taking place in person in Baltimore, MD. If there isn’t one tive educational exhibits for students to explore (see the
the sponsors intend. competition and games! in your area, ask your school counselor about putting together a photo below for an early look).
It facilitates creative team. For more info, see https://www.uscyberpatriot.org.
GenCyber Camps thinking, teamwork, To find out about events near you, search online for terms like
Offered at over 120 and hands-on Security Advisor Alliance Converge Tour cyber ranges and capture the flag connected to local educa-
locations in 38 states project-based This program connects middle school, high school, and college tion centers and cyber organizations.
(plus D.C. and learning while students with working cybersecurity pro-
Puerto Rico) in 2019, instilling sound fessionals to inspire and engage the next
these FREE camps judgment and generation of cyber talent. Their interactive
are open to middle ethics. Best of all, workshop allows students to test-drive ca-
and high school stu- the CyberPatriot pro- reers in cybersecurity in a real-world-appli-
dents and teachers, gram is inclusive, with cable way. Local mentors work through
regardless of experience, three levels of play, and challenges with students that teach ana-
and are hosted by public and not expensive to run.” lytical thinking skills, teamwork, and cre-
private schools as well as col- With thousands of teams in all ativity. The Alliance’s gamified Capture the
leges and universities. Each is a unique, 50 states, you should be able to find a Flag experience teaches students the skills
week-long residential program. Camps team nearby. There are three divisions: and tools being used to defend the largest
can have different kinds of specific ob- Middle School, Open High School, and All companies in the world. The day is capped
jectives, but all are designed to grow Service. While the All Service Division is with a discussion on career pathways and
and spread campers’ knowledge of limited to JROTC and other cadet corps available resources to help guide students
cybersecurity and careers and build up teams, the Middle and High school divi- to a fulfilling future in the industry. For Architect rendering of the
skills and awareness of safe online prac- sions are open—teams may include home- more info on the Converge Tour and the interactive kiosk and exhibits
planned at the Cyber Center
tices. In addition to having a great time, par- schooled students, Girl or Boy Scouts, Boys Security Advisor Alliance, visit https:// for Education and Innovation.
ticipants can develop their networks of friends and Girls Clubs, or other youth groups. Teams are www.securityadvisoralliance.org.

24 START-ENGINEERING.COM PHOTOS COURTESY THE SCHOOLS MENTIONED, CYBERPATRIOT AND THE NATIONAL CRYPTOLOGIC MUSEUM START-ENGINEERING.COM 25
 education: Certifications
The Georgia Cyber Anne Arundel
Center at Augusta Community
University, in College, in
Augusta, GA Arnold, MD
Whatcom Community
College, in Bellingham, WA
Jump-Start W
hile having a few high school
computer science classes un-
der your belt is a great start to
Your Career
a career in cybersecurity, a certification is
key to getting your foot in the door. Some-
times called Network Security or Informa-
tion Assurance, certifications are skills-
focused credentials that can help your
resume stand out, especially if you plan
Get a certification for a leg up on your way to work while continuing your education.
The good news is that you can earn them
to a career in cybersecurity. through classes or online at your own pace.
Entry-level certifications are generally
inexpensive and don’t require previous
work experience. For starters, CompTIA’s
Security + certificate, which doesn’t de-
mand a lot of hours, covers best practices
26 START-ENGINEERING.COM
Coastline College,
in Fountain Valley, CA
for IT security and is a foundation for
other certifications.
Palo Alto Networks, a worldwide
cybersecurity company (see page 40),
has a Cybersecurity Academy with a free
online Cybersecurity Foundation course,
as well as longer online courses with labs.
These courses help prepare you for Palo
Alto’s PCCSA certification, qualifying
you for an entry-level position in cyber-
security. The online classes are also
offered through a site called Coursera.org.
More advanced cyber certificates,
such as the management-focused CISM
(Certified Information Security Man-
ager) offered by ISACA, a nonprofit in-
volved in cybersecurity, and EC Council’s
COASTLINE COMMUNITY COLLEGE PHOTO COURTESY LPA; ALL OTHER PHOTOS COURTESY THE SCHOOLS
Bismarck
State College, in
Bismarck, ND
CEH (Certified Ethical Hacker), are geared
toward established cyber professionals
looking to move up the career ladder.
Another way to break into the cyber
industry is to take classes at a university
or community college. In North Dakota,
for instance, high school students can
earn a cybersecurity certificate from
Bismarck State College. Check your local
schools to see if that’s possible where
you live. These courses boost employ-
ability and can help prepare for certifi-
cates or further academic studies.
Cybersecurity bootcamps are also
offered by a number of certifiers.
A simple Google search will yield
plenty of options on where and what to
Free Online
University Courses
MOOCs (Massive Open Online
Courses) are a good introduction to
the field of cybersecurity. MOOCs
are basically teasers to excite
students about the subject and
interest them in the university’s
fee-based programs. Because
they’re free and self-directed, you
won’t receive college credit. You
may be able to get a certificate of
completion, but that usually comes
with a price tag. Classes are offered
throughout the calendar year, but
check the university’s schedule
because even online classes usually
have fixed starting dates.
The classes are usually pre-
recorded video lectures, although
instructors interact with students
in virtual forums, live chats, and/or
during virtual office hours. See
https://www.cyberdegrees.org/
resources/free-online-courses.
study—just be sure to use an accredited
program for a recognized certificate.
The National Cybersecurity Institute,
the American National Standards Insti-
tute, ISACA, the Committee on National
Security Systems, and IEEE Computer
Society are all good sources of informa-
tion on cyber certificates that meet
standards for employment.
For a state-by-state list of schools
offering certifications, please see our
website at start-engineering.com/
certifications.
Once you have your first certification,
you may decide that a degree from a
community college or university is the
next step for you.
START-ENGINEERING.COM 27
 education: Community Colleges
Two-
Year
Plan
Community colleges offer
hands-on experience prized
by employers.
W
hether you’re fresh out of
high school or looking to pick
up some new skills to boost
your career, community colleges are
an excellent resource for budding cyber-
security professionals. A cybersecurity
program at a community college can be
a stepping stone to a bachelor’s degree,
an entrée into the work world, or both.
Campus-based or online, these courses
are low-cost and offer the sort of hands-
on training that employers love.
An associate of applied science de-
gree, or AAS, offers a variety of concen-
trations, all of which equip students with
practical skills needed to get hired in en-
try-level roles. Areas include threat anal-
ysis, monitoring a network for indicators
of compromise or penetration, and digi-
tal forensics analysis to determine who
hacked a system and how to prevent
future compromise. To a lesser extent,
students also study the engineering of
computer hardware and software.
28 START-ENGINEERING.COM
Be on the lookout for companies pro-
viding scholarships and resources for
students—particularly students from
low-income families. Microsoft, for ex-
ample, just announced a major initiative
to help students interested in cybersecu-
rity careers with an array of financial and
Forsyth Tech, in
Winston-Salem, NC
Alexandria Technical
& Community College, Tarrant County College,
in Alexandria, MN in Fort Worth, TX
educational benefits, including assis- “I’d advise starting in community col-
tance up to $500 as well as networking lege and be looking at job postings, but
and technical learning opportunities. position yourself for a four-year degree,”
Most community college graduates says Laura Bate, a senior director for the
continue their education at some point, U.S. Cyberspace Solarium Commission.
because bachelor’s degrees are impor- So-called articulation agreements
tant for long-term career development. make transitioning from community
PHOTOS COURTESY THE SCHOOLS
County College
of Morris, NY
Lehigh Carbon
Community College,
in Schnecksville, PA
college to a four-year college a cinch.
At Alexandria Technical & Community
College, in Alexandria, MN, for example,
AAS students in the cybersecurity, virtu-
alization, and networking concentration
can seamlessly transfer their 60 credits
to Metropolitan State University, in
St. Paul, or Dakota State University, in
Madison, SD. And at Coastline College
in Fountain Valley, CA, cyber students can
opt to sequence their courses aimed at
various career pathways to obtain “stack-
able” certificates, which can ultimately
count towards a four-year degree at Na-
tional University. Even better, National
and many four-year colleges offer schol-
arships to students with the AAS degree.
Great opportunities for apprentice-
ships are another advantage to commu-
nity college education. An apprenticeship
with a government agency enhances your
marketability and may include a basic
security clearance, which shows any em-
ployer that you can be trusted. However,
be aware that getting clearance may take
months of waiting and not working, even
when you have a job offer. For appren-
ticeships in the private sector, make sure
they are registered with some sort of
state authority. “There should be some
government seal,” says Bate, “and they
should offer some kind of credential at
the completion of the program.”
Finally, starting your education at a
community college is a great way to save
money. The cost of the average commu-
nity college has been stable over the
past 20 years, while four-year institu-
tions over the same period have seen
costs skyrocket! Today the average
annual total cost to attend a two-year
institution is $10,300. And don’t forget
to look at your home state. Seventeen
states, including New York and California,
offer tuition-free community college—
now that’s a bargain. Even if you later
finish your education at a four-year insti-
tution, you will have saved yourself from
two years of considerable debt.
For a state-by-state list of community
colleges offering associate degrees, see
our website at start-engineering.com/
associates-degrees.
START-ENGINEERING.COM 29
 education: Colleges and Universities
University of Colorado,
in Colorado Springs, CO
New York Institute
of Technology,
in New York, NY
Four Years D
epending on your interests,
there are many paths to study-
ing cybersecurity in college. For
starters, a bachelor of science degree
of Cyber
in cybersecurity combines computer
science or engineering with classes in
specific cyber skills. You’ll learn how
to analyze the structure of IT systems
to eliminate any vulnerabilities, recon-
struct compromised systems, and build
better ones.
A cybersecurity-focused bachelor’s degree is a
The NSA accredits some cybersecurity
great investment in your future. B.S. programs as National Centers of Ac-
ademic Excellence in Cyber Operations. A
30 START-ENGINEERING.COM
University of Texas
in Austin, TX
CAE-CO badge means a degree program
includes classes in science and engineer-
ing, the technology of cyber operations,
and additional cyber-learning activities.
“You know you have a high-octane pro-
gram if they have that designation,” says
Eric Brown, the assistant director of the
Cybersecurity Education, Research &
Outreach Center at Tennessee Techno-
logical University. There are highly
ranked programs all over the country,
including those at New York Institute of
Technology, Tennessee Tech, and the
University of Southern Mississippi. (See
PHOTOS COURTESY OF THE SCHOOLS
Tennessee Tech UT Austin
University, in
Cookeville, TN
start-engineering.com/4year-degrees
for many more options.) Before deciding
where to apply, talk to your college coun-
selor in addition to searching online.
While most cyber programs are found
within computer science or engineering
schools, not all cyber tracks are strictly
technical. “Cyber is a mile wide and
about an inch deep,” says Brown. You
might choose a major such as law en-
forcement, psychology, public policy, or
business, and combine it with cyberse-
curity and computer science classes for a
job that may be managing a cybersecu-
University of Tulsa,
in Tulsa, OK
rity project that requires drafting strate-
gic plans and policy analyses.
Even if you decide to pursue a com-
puter science degree, coursework
outside of tech can enhance your mar-
ketability, says Mark Loepker, director
of education at the Cyber Center for
Education and Innovation. For example,
you might be better able to understand
an adversary’s behavior and attack
strategies by studying psychology.
Studying library science or biology may
help you design better, user-friendly sys-
tems. Law enforcement is fundamental
START-ENGINEERING.COM 31
 education: Colleges and Universities
to issues of evidence for prosecuting opportunity to work on a team project.”

Apprenticeships: cybercrime. And the increasingly thorny

public policy questions of who should
Another key component to maximize
your post-grad job opportunities: extra-

Mentorship Plus a Paycheck have access to information and how we

can protect individual privacy won’t be
curricular activities. “Cybersecurity, like
any technical field, is mastered by doing
settled with coding. There are business and not passive reading,” says Babak

W ith elements of blue-collar and white-collar work, cybersecurity professionals

are often classified as “new collar.” Many jobs in the industry call for skills
learned outside a degree program. Advancement, however, generally demands edu-
management courses for the tools to
manage teams, projects, and your own
Beheshti, dean of the College of Engi-
neering and Computing Sciences at New
cybersecurity company. Most cyber York Institute of Technology. He sug-
cation, too. That’s where cybersecurity apprenticeships come in. Structured to take
programs accommodate coursework gests getting involved in “hackathons,”
you from raw talent to becoming a skilled and educated professional, these pro-
outside of tech. New York Institute of competitions, and student club activi-
grams are designed to be paired with coursework in both two-year and four-year
Technology’s B.S. in Information Tech- ties. “You will learn by doing and will
degree programs. Even better: You may well end up with your employer paying for
nology, for instance, allows students to start building a network of like-minded
your higher education.
customize the program with several friends.” Build your own network, install
While internships
electives. Sarah Basset Lee, director of virtual machines on a spare PC or laptop
can be valuable, they
the School of Computing Sciences and to experiment with it, and be willing to
are part-time or short-
Computer Engineering at the University intern in a company or business to learn
term and offer low or
no pay. Apprentice-
of Southern Mississippi, also recom-
mends jumping at any opportunity to
the day-to-day needs of organizations
and how you can make yourself indis-
For Maximum Cred,
ships are full-time
jobs in which you are
foster communication skills. “Even if
you’re going down a technical path,
pensable to them.
For a state-by state listing of schools
Join the US Cyber Team
paid a salary as you

T
you’re going to have do some writing. offering four-year degree programs, go to he US Cyber Games are cybersecurity-meets-esport, with a goal to in-
gain skills. Unlike in-
I’d suggest that students celebrate any start-engineering.com/4year-degrees. spire the next generation of cyber professionals and recruit a killer
ternships, apprentice-
team to represent the US at the International Cybersecurity Championship.
ships are not left to
University Each year, the season starts with the US Cyber Open Capture the Flag
employers to design. of Southern
Challenge (CTF), where individuals of all skill levels can play. In 2022, over
Rather, they are regu- Mississippi, in
Hattiesburg, MS 1,200 participants, ages 16-24, from 50 states and Washington, DC, com-
lated by the Depart-
peted in this free, 10-day virtual event. The contest consists of online
ment of Labor and
cybersecurity challenges in cryptography, cyber forensics, re-
must include mentor-
verse engineering, web, and more. Prizes are awarded in each
ship by a professional
CTF category and to the overall champion.
at the journeyman level, on-the-job training at no less than 60 percent of the stan-
From there, a diverse group of high-potential cyber
dard wage for the job, and related tech instruction (though you may be responsible
for tuition for such instruction). "athletes" is invited to participate in the US Cyber Combine

Another advantage to apprenticeships is the opportunity to test your skills. Invitational. It's an 8-week period of evaluation and assess-

Observes Craig Koroscil, senior executive at Circadence, “It’s okay to fail now–once ment where they engage with other athletes and the coaching
you start work, it may not be.” staff, attend Sr. Tech Mentor lectures, demonstrate their techni-
Just as with cyber camps or other programs, make sure the apprenticeship states cal and interpersonal skills via assignments and challenges, and net-
the learning objectives in specific terms and outlines the measures of performance, work with industry professionals. Finally, a select group of athletes is con-
together with any certifications earned. Martha Laughman, director of cybersecurity sidered for selection to the US Cyber Team. This team competes in a variety
workforce development at Smoothstack, suggests searching online for apprentice- of global virtual and in-person scrimmages.
ships registered with Department of Labor. You can also check Cybersecurity Ap- Participating in cybersecurity competitions offers tremendous benefits
prenticeship Tracker and use the NICE Workforce Framework and CyberSeek to align to students interested in pursuing a career in cyber. Head Coach Ken Jenkins
the opportunity with the credentials you want for your future. Structure is key, says, "We aim to develop the future cybersecurity leaders by immersing our
Laughman adds. Look for community colleges and universities that have partner- athletes in an environment that emphasizes diversity, collaboration, and
ships with reputable employers. career-focused approach." Find out more at https://www.playcyber.com/.

32 START-ENGINEERING.COM ISTOCKPHOTO.COM; PHOTOS COURTESY THE SCHOOLS START-ENGINEERING.COM 33

 education: Financial aid
How to Cut
Your Tuition Bill
It’s more important than ever to find ways to reduce college costs.
I
f you’re looking for financial aid,
start with scholarships at the
schools you are interested in attend-
ing. These are usually the most gener-
ous. But there are also numerous
cybersecurity scholarships from many
sources, such as non-profits, founda-
tions, institutions, government organi-
zations, and corporations. Did you know
that many available scholarships go un-
Center for Cyber Safety and Education
Women’s Scholarship
Award amount: $1,000 - $6,000
https://iamcybersafe.org/s/scholarships
CIA Undergraduate Scholarship Program
Award amount: $18,000 + salary
https://www.cia.gov/careers/jobs/undergraduate-scholarship-
program/
The Colonel Sully H. De Fontaine Scholarship Award
Award amount: $1,200
http://www.afio.com/13_scholarships.htm
Cybersecurity Talent Initiative
Student Loan Assistance Program
Award amount: up to $75,000
https://cybertalentinitiative.org/
David L. Boren Undergraduate Scholarships
Award amount: $8,000 - $25,000
https://www.borenawards.org/scholarships/program-basics/
boren-scholarship-basics
34 START-ENGINEERING.COM
used? So apply for as many as you can! Engineers, the Society of Hispanic Pro-
Websites for almost all government fessional Engineers, and the Society of
agencies include details on scholarships Women Engineers all offer scholarships.
generally, as well as partnerships with Ask your high school guidance coun-
non-profits and professional organiza- selor to help you. In the meantime,
tions, such as Women Who Code. These here’s a good list to get you started.
organizations often have partnerships Note that some scholarships require
with universities and private employers government service in return for the
for scholarships, paid internships, or award.
both. The National Society of Black
ESET Women In Cybersecurity Scholarship
Award amount: $5,000
https://www.eset.com/us/about/newsroom/corporate-blog/
eset-women-in-cybersecurity-scholarship-now-accepting-ap-
plications/
Google Scholarship
Award amount: $10,000
https://buildyourfuture.withgoogle.com/scholarships/
(Isc)² Graduate and Undergraduate Scholarships
Award amount: $1,000 - 5,000
https://iamcybersafe.org/scholarships/undergraduate-
scholarships/
KNOWBE4 Women’s Scholarship
Award amount: $10,000
https://iamcybersafe.org/s/knowbe4-womens-cyber-
scholarships-
Microsoft Cybersecurity Scholarship Program
Award Amount: Up to $500
https://www.lastmile-ed.org/microsoftcybersecurityscholarship
National Science Foundation Scholarship
for Service (SFS)
Award amount: $25,000 - $34,000
https://www.nsf.gov/funding/pgm_summ.jsp?pims_
id=504991
Naval Research Enterprise Internship Program
Award amount: $7,000 - $11,000
https://www.onr.navy.mil/en/Education-Outreach/
undergraduate-graduate/NREIP-naval-internship
Navy Information Assurance Scholarship
Award amount: tuition + stipend
http://www.doncio.navy.mil/contentview.aspx?id=535
Raytheon’s Women In Cyber Security Scholarship
Award amount: $10,000
https://iamcybersafe.org/s/raytheon-womens-scholarship
Scholarships for Women Studying Information
Security (Swsis) Program Scholarship
Award amount: $2,000 or more
https://cra.org/cra-w/scholarships-and-awards/
scholarships/swsis/
The Science, Mathematics and Research for Trans-
formation (Smart) Scholarship for Service Program
Award amount: full tuition + salary + benefits
https://www.smartscholarship.org/smar t
Sourcefire Snort Scholarship
Award amount: $10,000
https://snort.org/community#snort_scholarship
The Stokes Program
Award amount: $33,000
https://www.intelligencecareers.gov/icstudents.html
Vision Integration Professionals,
Women in Technology Scholarship
Award amount $2,500
https://trustvip.com/vip-now-accepting-applications-
for-13th-annual-women-in-technology-scholarship/
Women In Computing Scholarship
Award amount: $1,000
https://www.loadview-testing.com/scholarship/
ISTOCKPHOTO.COM START-ENGINEERING.COM 35
 workplace: Support for Minorities and Women
DIVERSITY REQUESTED
L
ike a lot of STEM fields, cybersecurity has long
been dominated by white men—but that’s
changing. Today’s cybersecurity professionals
know that the best cybersecurity solutions come from
diversity. It’s been proven: Having a variety of back-
grounds and experience on a team yields maximum
creativity.
The field is committed to becoming more inclusive.
Scott Young, executive director of synED, a major cyber-
security education initiative in California, has a mes-
sage for anyone thinking about pursuing a cyber career:
“We need you as you are! We don’t want you to change!”
36 START-ENGINEERING.COM
In fact, success depends on it: The more thought diver-
sity a cybersecurity team has, the better.
Cybersecurity is so broad that no one should give up
interest or opt out because of weak skills at the intro-
ductory class level. It’s possible to get into the field
through multiple means, says Davina Pruitt-Mentle,
lead for Academic Engagement of the National Initia-
tive for Cybersecurity Education (NICE). “As long as
you have some good analytical skills and you’re willing
to keep learning, we’ve got something for you.”
One key is to reach out for support. “Seek mentors
both in and outside of the career who can help you in
the workplace,” suggests Charles Britt, a cybersecu-
rity expert and former CIA officer. “Have at least one
trusted individual in your network you can talk to
about both professional and personal challenges im-
pacting your career as well.” But don’t be discouraged
if a mentor within your field doesn’t look like you. Kate
Plough, a software developer with the NSA, found that
men were ready to help her advance her education and
career goals. Above all, she says, don’t decide tech
isn’t for you because you’re in the minority. Symantec,
the company that developed the Norton anti-virus
ISTOCKPHOTO.COM
The cybersecurity field needs
people from every background.
software portfolio, is committed to raising the per-
centage of women employed in cybersecurity. It part-
ners with numerous professional and educational or-
ganizations and has developed the Symantec Cyber
Career Connection to help prepare women and other
underrepresented individuals for cyber careers.
There are more organizations ready to help you build
up and connect than we can list here. Just for starters:
Women in Cybersecurity, which has student chapters
at more than 100 colleges; AllStar Code; the National
Society of Black Engineers; Black Girls Code; and the
Women’s Society of Cyberjutsu.
START-ENGINEERING.COM 37
 careers: Companies of All Kinds

Jobs Available
Everywhere!
America’s top companies for pay top dollar for cyber sleuths.

W
hat do video game publisher hackers are innovative criminals. Most
Electronic Arts, online career companies and organizations collect
networking service LinkedIn, and store the personally identifiable
and Reverb, a web-based marketplace information, or PII, of millions of clients
for music gear, have in common? They’re and customers. Criminal gangs or for-
recent victims of cyberattacks. Black- eign adversaries target PII for ill-gotten
hat hackers are routinely targeting all gains. Sometimes they’ll encrypt data,
kinds of businesses—from retailers to lock it up, and demand a ransom to free
power companies—as well as govern- it. Or they’ll use people’s personal infor-
ment agencies, school districts, hospi- mation for fraudulent purposes, which
tals and … well, pretty much any kind of is called identity theft. But they’re not
entity you can name with an online pres- always aiming for PII. Many businesses
ence. Cyberattacks have “gone from have trade secrets they want to keep
a novelty to a form of from competitors—
destruction,” says Jon which makes them
Brickey, a senior VP at Big Business tempting targets, too.
Mastercard. “It’s a ma- Top U.S. companies hiring For instance, the hack-
jor risk factor to every cyber professionals ers that hit Electronic
enterprise.” Accord- Arts stole source code
1. Las Vegas Sands
ingly, there’s a huge used in its most popu-
need for cybersecurity
2. Booz Allen Hamilton lar games. Meanwhile, and government agency. Private-sector
experts, who devise 3. Lockheed Martin devices are increasingly companies tend to pay higher salaries
ways to protect propri- 4. NBC Universal becoming connected to than public-sector agencies, even to
etary information and 5. Chevron each other via the In- entry-level employees. But the skills
keep hackers at bay. 6. Bank of America ternet of Things. That and experience cybersecurity pros ac-
For career-minded 7. Accenture makes life easier for quire in either private or public sector
young people, it’s a consumers—“Hey, jobs are similar, so moving from govern-
8. SAIC
field jam-packed with Alexa, play Dua Lipa!”— ment to the corporate world or vice
9. J.P. Morgan
high-paying jobs and but it creates even versa is always an option. Unfortunately,
too few candidates to 10. General Motors more targets. there will always be nefarious hackers
fill them. 11. Northrop Grumman The upshot? Jobs in out in the ether, devising new ways to
The work is always 12. Leidos cybersecurity are avail- attack. So the need for cybersecurity
challenging because able in every industry experts, Brickey says, “is here to stay.”
SOURCE: COMPARITECH.COM

38 START-ENGINEERING.COM START-ENGINEERING.COM 39
 careers: Cybersecurity Companies
IBM Security Mastercard Operations &
Headquarters in Technology Hub in St. Louis, MO
Cambridge, MA

Palo Alto Networks’

corporate campus in
Palo Alto, CA

Cyber Specialists for Hire

Companies that provide
cybersecurity services to both
government and industry can
be a great career option.
munity college graduate who had picked
up a few certifications in cybersecurity,
was working in retail and earning around
$17 an hour, after taxes. Once joining
Palo Alto, her after-tax income immedi-
ately jumped to $30 an hour. “One of
the huge benefits (of working in the cy-
bersecurity industry) is that you will
$240 billion by 2025, according to one
recent report. It’s an industry whose
goods and services are in high demand
because there’s no shortage of bad
guys—criminal hackers are constantly
attacking the computer systems of
businesses of every stripe, as well as
everyone else’s, including federal, state,
up, or damage data, or disrupt services.
“We specialize in network security,
cloud security, and security operations
technologies,” Richardson-Sequeira
explains. Their products range from fire-
walls to software that scans for threats
and automatically responds to attacks.
Companies like Palo Alto also do re-
search. “Investigating trends is a huge
part of our company,” she says. It has
an entire unit that “regularly reports
on trends and other information related
to the threat landscape.” Palo Alto
crimes is so huge, many still enlist the
help of specialized companies. “No
one person can know it all,” Richardson-
Sequeira says, “so it is easier to work
together.” Jon Brickey, a senior VP at
Mastercard, agrees, noting that the
field is so diverse it requires a vast vari-
ety of knowledge and technologies.
The industry is “critical,” he says. “We
all have to rely on the innovations and
effectiveness of these companies. They
provide the products and services that
protect the entire ecosystem of industry
ultimately earned a bachelor’s degree
in English. “It’s not so much about the
degree, but what you bring to the table.
If you’re trying to break in, a lot of com-
panies will train you.” One reason why
companies offer training is to help fill
positions. There’s a massive talent
shortage and nearly 3 million jobs are
open at any given time, Richardson-
Sequeira says. “The competition for top
talent is stiff.”
She admits cybersecurity isn’t easy
work. Let’s face it, the threat levels

O
kay, let’s cut to the chase:
A career in the cybersecurity
industry can do wonders for
your bank account.
In 2019, when Ashley Richardson-
Sequeira started at Palo Alto Networks,
one of the country’s leading cybersecu-
rity companies, she was a recent com-
typically be well compensated for your
work,” says Richardson-Sequeira, who is
now 33 and a senior technical trainer for
security operations at Palo Alto.
Here’s why the industry can afford to
pay top salaries: The global cybersecu-
rity market’s worth will top $156 billion
this year and mushroom to more than
and local government agencies, univer-
sities, and medical providers. Cyberse-
curity companies like Palo Alto, IBM, and
McAfee are major players in the nonstop
efforts to thwart cyberattacks. They
develop hardware, software, and strat-
egies to protect networks, data, and de-
vices from hacks that aim to steal, lock
researchers, for instance, recently
reported that ransomware payment
demands have soared 518 percent since
2020.
To be sure, most large companies
and federal agencies have their own
in-house cybersecurity teams (see page
38). But the job of combating cyber-
and government.”
Accordingly, the companies look to
hire people from a wide range of back-
grounds beyond computer engineering
and computer science, including law,
management, and marketing. Strong
communications skills are also highly
prized. Indeed, Richardson-Sequeira
never let up, so it’s go, go, go, go, all
the time. “You absolutely have to be
passionate and dedicated to do well
in this field.” Nevertheless, Richardson-
Sequeira stresses that the work is also
thrilling and satisfying. Which means
it’s rewarding in every sense of the
word.

40 START-ENGINEERING.COM JOHN MOTTERN/FEATURE PHOTO SERVICE FOR IBM; COURTESY PALO ALTO NETWORKS; COURTESY MASTERCARD START-ENGINEERING.COM 41
 careers: NSA, DHS, FBI, and CIA
Q
uick, name the federal government agencies most
involved in cybersecurity. If the first ones that
popped into your head were the FBI, the National
Security Agency (NSA), the Department of Homeland Security
(DHS) or other major law-enforcement and national-security
agencies, that’s understandable. They’re the ones most often
making headlines in cyberspace. But in truth, pretty much ev-
ery federal agency, from the Department of Transportation to
the Department of Commerce, has an in-house unit grappling
with challenging cyberattacks. Accordingly, the U.S. govern-
ment is the country’s largest employer of cybersecurity ex-
perts. Which is why, if you’re hoping to work in the field, it’s a
good idea to keep Uncle Sam in mind.
What’s the difference between public and private-sector cy-
bersecurity professionals? “The work is pretty much the same,”
explains Charles Britt, a cybersecurity expert and former CIA
officer, “but it’s a much different mission.” It all boils down to
national security. Working in cybersecurity for a federal agency
is a bit like joining the military, Britt says. “Most (people) do it
NSA DHS With cyberattacks on the rise, protecting and defending in cyberspace is mission-critical.
Work in National Security
NSA: If you’re interested in working in the intelligence com-
munity, the obvious choice is the NSA, which gathers and an-
alyzes signals intelligence, or foreign electronic communica-
tions, ranging from emails to phone calls to radar. Currently,
the NSA is looking for folks with backgrounds in computer
science, computer/electrical engineering, intelligence analy-
sis, and math.
DHS: If the law-enforcement side of cybersecurity interests
you, one option is DHS. Its wide-ranging mission includes
fighting terrorism, border security, immigration, and natural
disaster prevention and relief. Home to the Cybersecurity &
Infrastructure Security Agency (CISA), DHS is on a hiring tear
right now. It recently hired 300 cybersecurity pros and made
offers to another 500. CISA serves as the main coordinating
body for cybersecurity programs at all levels of government.
Such a big job helps explain why DHS estimates it still has
FBI CIA nearly 1,700 more vacancies to fill.
42 START-ENGINEERING.COM CIA PHOTO: GETTY IMAGES; ALL OTHERS COURTESY PHOTOS
because of a sense of wanting to serve their country.”
Government cybersecurity experts are involved in such things
as intelligence analysis, counterintelligence, criminal investiga-
tions, and counterterrorism. The government’s mission is not
only protecting critical infrastructure and networks, but files
containing sensitive data, ranging from top-secret intelligence
to the personal information of employees and American citizens
to proprietary information. And sometimes the less obvious
agencies face the biggest challenges. For example, Britt says,
“the FDA (Food and Drug Administration) is a target right now
because of the pandemic.” Black-hat hackers are trying to grab
COVID-19 vaccine formulas and disrupt vaccine supply lines.
It’s a safe bet that nearly every agency is on the lookout for
cybersecurity hires. “If you have a clean background, you’re
pretty much in the door,” Britt says. “And the demand is going
to be there for a long time,” because the problem of cyberat-
tacks isn’t likely to end. And the agencies are not only looking
for hires with computer skills; job-seekers with other back-
grounds, particularly communications and law, are also valued.
FBI: The bureau made headlines recently after it recovered
$2 million in cryptocurrency of the ransom paid by Colonial Pipe-
line when it was hit by a ransomware attack last spring (see
page 12). Ransomware attacks are surging, and Christopher
Wray, the FBI director, says the national security threat posed
by them is equal to 9/11 terrorist attacks. Not surprisingly, the
bureau was recently posting job openings for software engi-
neers, information security engineers, and computer scientists.
CIA: America’s cloak-and-dagger outfit, the CIA, is also in-
volved in cybersecurity. That may sound odd, given that the
agency gathers and analyzes human intelligence. But Britt
says that while the CIA does do some counterintelligence work,
“its (cybersecurity) focus is on protecting its own internal sys-
tems.” Or making sure its secrets stay secret.
If you’d like to see what it’s like to work at these agencies,
look for internships, many of which are paid!
START-ENGINEERING.COM 43
 careers: CYBERCOM and DC3
Spycraft,
Front and
Center
The Pentagon’s main cybersecurity unit, CYBERCOM,
disrupts the sources of cyberattacks.
F
ears ahead of the 2020 U.S. elec-
tion that foreign hackers would
interfere with the vote thankfully
proved unwarranted. Indeed,
the federal Department
of Homeland Security’s
Cybersecurity & Infra-
structure Security
Agency declared that the
election was “the most
secure in American his-
tory.” One reason for that
great result was efforts made
by the U.S. Cyber Com-
mand (CYBERCOM), the
Pentagon’s main cyber-
security unit, in conjunc-
tion with the National
Security Agency (NSA), to
harden defenses of voting
systems nationwide and to dis-
rupt foreign threats to the vote.
CYBERCOM, which is only 11 years old,
44 START-ENGINEERING.COM
is one of 11 unified combat commands of
the U.S. Defense Department. Why was
it involved in election security efforts?
Well, its mission includes working to
strengthen America’s ability to
withstand and respond to
cyberattacks, as well as
supporting the global mis-
sions of combat command-
ers and defending the Pen- U.S. Cyber Command
tagon’s information network.
It’s based at the NSA’s head-
quarters at Ft. Meade, MD. The initially set up to have a defensive pos- using its network instead of military partment of Defense Cyber Crime Center trains DoD personnel who work to pro-
agencies have what’s called a ture, today it often plays offense. As the ones, CYBERCOM has more freedom to (DC3), which was created in 1998 as a tect the Pentagon’s information sys-
“dual-hat” structure, be- New York Times reported earlier this disrupt the sources of criminal attacks. computer forensics laboratory and train- tems from unauthorized use, including
cause the director of the year, in the early days of the internet, cy- CYBERCOM is always looking to recruit ing center. Today, it still specializes in criminal, fraudulent, and foreign-intelli-
NSA is also CYBERCOM’s ber attacks were expected to evolve into highly talented civilian workers in cyber digital and multimedia forensics, or the gence efforts. According to its website,
commander. a new type of warfare. Instead, hacking and support jobs in many areas, includ- identifying, recovering, preserving, and DC3 civilian employees work with highly
CYBERCOM could be a has become a widely used tool of state- ing information technology, cyberspace analyzing of evidence in digital devices. skilled military and government person-
great place to work for students craft. “Hacking is coming to play a role in planning and policy, budget analysis, It also develops cyber forensic and ana- nel “to solve the most demanding prob-
who are interested in working in cy- the 21st century much like espionage did cyber operations, human resources, and lytic tools. DC3 continues to offer spe- lems facing our nation.” In other words,
bersecurity but who are also intrigued by in the 20th,” the Times noted. By often logistics. cialized cyber training. As such, it oper- it offers jobs in cybersecurity that are
the secret world of spycraft. While it was working in conjunction with the NSA and The Pentagon is also home to the De- ates the Cyber Training Academy, which challenging and rewarding.
COURTESY US.S CYBER COMMAND START-ENGINEERING.COM 45
 careers: Military Branches
Enlist in
Your Future
“Cyberspace is not just a computer on your desktop. It’s the way that
we as an Air Force intend to fly and fight,” General Robert J. Elder, Jr., USAF
O
kay, so a career in cybersecurity
interests you. But not every stu-
dent who graduates from high
school has either the academic or financial
wherewithal to go to college. But hang on!
There’s another possible route: the military.
All branches of America’s all-volunteer
military—the Army, Air Force, Navy, Marines,
and Coast Guard—have cyber commands
dedicated to national security. They work
24/7 to protect military networks, weapons
platforms, combat units, and critical U.S.
infrastructure from global cyber threats
generated by adversarial nations, non-state
terrorists, and criminals.
Beyond needing a high school diploma
or GED equivalent to join up, it also helps to
have strong communications, math, and
problem-solving skills. But new recruits are
given aptitude tests to determine which
military occupational specialties (MOS)
they’re best suited for. So to qualify for a
cybersecurity MOS, it may be a good idea to
first get a basic certification in the field from
an accredited organization and bolster your
computing skills before you march down to
46 START-ENGINEERING.COM
your local recruiter. New recruits first spend
around 10 weeks in boot camp, which in-
cludes physical and weapons training, and
learning tactical and survival skills. Next
comes advanced training in cybersecurity
that can last approximately nine to 40
weeks, depending on your MOS assignment.
This training often includes classroom and
on-the-job instruction in things like data-
base design and computer networking—
even a foreign language, if necessary. Cyber warfare specialists serving with
the 175th Cyberspace Operations Group
Once your (usually) four-year enlistment of the Maryland Air National Guard
is up, the skill sets and security clearance engage in weekend training at Warfield
Air National Guard Base. Below:
you gained while serving your country mean
Military personnel engaging in cyber-
you’ll be well positioned to earn a college security operations and training.
degree to further your cybersecurity career.
Veterans are eligible for the GI Bill, which
typically covers tuition and fees, while
providing extra stipends for housing, books,
and supplies. Another option: re-enlist and
use your benefits to earn a college degree
while on duty. You could then consider get-
ting some brass to go with your sheepskin
by enrolling in an officer commission school
to jump up the ranks from enlisted member
to officer.
PHOTOS COURTESY U.S. DEPARTMENT OF DEFENSE START-ENGINEERING.COM 47
 test your abilities
Reasoning

Is Cyber for You?

6. You are a bus driver. At the first stop of the day, eight people get on board. At the second stop, four get off, and
eleven get on. At the third stop, two get off, and six get on. At the fourth stop, 13 get off, and one gets on. At the
fifth stop, five get off, and three get on. At the sixth stop, three get off, and two get on. What color are the bus
driver’s eyes? ____________________________________________________________________________________________________________________________________________________________
Test your problem-solving and deductive reasoning skills!
7. A certain five-letter word becomes shorter when you add two letters to it. What is the word? _____________________________________________________

D
o you need technical skills to Numbers, Numbers, Numbers
8. Some months have 30 days. Some have 31. How many months have 28 days? ____________________________________________________________________________________________________
succeed in cybersecurity? Sure,
though more in some jobs than 1. What is the number missing from the last row?
others. And leaders in the field say these Attention to Detail
74, 11, 56
skills are readily taught on the job.
The secret sauce in cybersecurity success 81, 9, 45 9. In a computer program, valid combinations of data are five characters long and start with a letter and finish
actually consists of many different flavors. 97, 16, 88 with a letter. In between, numbers or letters may be used. Identify which block below contains a violation of
Imagination and creativity, finding patterns 32, ________ , 14 this pattern.
and making connections, and working with
different kinds of people are great starting
2. What is the next number in this sequence? Line 1: A123B C546D m874A P461N M938A v847F
points. People with strengths in these areas
excel in the deductive reasoning, critical 47, 28, 16, _____________ Line 2: x82aC D546j z834A 7421N y935B k142q
and flexible thinking, and complex problem-
Line 3: A123B Ca46D m474A P411N Mj38A v8b7F
solving skills that go into cybersecurity work.
3. Identify the next two numbers in the sequence below: Line 4: x82aC D566j z8f4A h4x1N y93aB k122q
We’ve gathered some activities here that
draw on many of the basic cognitive skills
202, 122, 232, 425, 262, 728, ___________________ , ______________________
that can lead to success in cybersecurity. 10. On a network, each computer has a special address called an IP address. In IPv4, the addresses must take the
Look for patterns, use your imagination, form [0-255].[0-255].[0-255].[0-255]. A valid IPv4 address, for example, is ‘192.168.13.2’. Look at the blocks
and don’t take what you see at face value. Words, Words, Words
of IP addresses below. Which block, if any, contains an invalid IP address?
Sometimes the answers are “hidden” in
4. For each set of words below, what single word can be added to
plain sight. Once you get the hang of it all,
you could be on your way to cybersecurity form a compound word or common phrase to all three? Block 1 Block 2 Block 3 Block 4
success. 192.168.1.3 10.10.0.3 14.17.1.1 10.10.16.4
Find lots more activities like these in Powder, stool, ball ________________________________
192.168.2.7 10.1.6.4 192.1.5.1 192.168.4.3
the Student Workbook that accompanies Motion, poke, down ________________________________
this career guide (for sale on our website at 192.1.4.9 254.250.1.1 192.192.1.4 172.16.9.8
Blue, cake, cottage ________________________________
https://start-engineering.com/shop). It 172.16.4.3 200.1.3.1.1 221.122.1.4 4.4.4.8
offers more than 20 hours of cybersecurity- 194.13.2.2
related activities to help you explore the 5. The two double blanks in each word below can be filled in with
field even more widely. the same pair of letters. Can you figure out what they are?
ANSWERS 5) ar; ho; is; wo; ed
You can also try out a free, interactive
1) 5. The outside numbers, taken as sums, add up to the inside num- 6) “You are a bus driver.” The driver’s eye color is the color of whoever
game called CyberStart (cyberstart.com). H _ _ dw _ _ e ________________________________
bers; 3 + 2 and 1 + 4 both equal 5. “you” is.
No previous cybersecurity experience is _ _ rses _ _ e ________________________________ 2) 6. The digits of one number, multiplied together, generate the next 7) Short. Adding two letters – er – turns it into “shorter.”
required—just an observant eye, persis- number; 1 x 6 = 6. 8) All months have 28 days. Some months have more, in varying
D _ _ tingu _ _ h ________________________________
tence, and some problem-solving skills. 3) 293, 031. Seeing the sequence as two-digit numbers, rather than amounts.
_ _ od _ _ rk ________________________________ three-digit numbers, reveals it as 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31. 9) Line 2 (7421N is the violation)
And don’t worry, there are clues to help
P _ _ dl _ _ ________________________________ 4) foot; slow; cheese; 10) Block 2 (200.1.3.1.1 is the violation)
you along the way. Have fun!

48 START-ENGINEERING.COM START-ENGINEERING.COM 49
 cybersecurity game

Try Out
a Cyber Over 200 cyber security

Game! challenges across four bases

“CyberStart Game is a challenging,
Test your cybersecurity aptitude rewarding, and detailed intro to
with CyberStart, a free online game hacking, programming, and
that grounds hands-on training in fun
real-world simulations.
forensics.”
CyberStart student
Already played and loved by over

I
t’s time to try your hand at cybersecu-
rity! Log into CyberStart (cyberstart 200k students world wide
.com) and become an agent for the vir-
tual Cyber Protection Agency. In this inter-
active game developed by SANS, you’ll
investigate and thwart criminal gangs who
are using their cyber skills to do damage
online.
No previous cybersecurity experience is
required—just an observant eye, persis-
tence, and some problem-solving skills.
The game features over 200 interactive
security challenges ranging from simple to
extreme. You’ll explore code-breaking, try
writing scripts and programs, and analyze
forensic evidence. But don’t worry, each
challenge offers clues to help you!
Turn the page for more information
about this dynamic game, or simply try it
out at cyberstart.com.

50 START-ENGINEERING.COM START-ENGINEERING.COM 51
 Welcome to CyberStart Game - the most proven
cyber security training tool for young adults.

Full of challenges that will test the persistence and research needed when
facing authentic cyber security tasks, CyberStart Game builds up students’
technical skills and creative-thinking. Whether approached by beginners
with a casual interest or hobbyists who are steps away from becoming a
cyber security professional, it offers scalable challenges that engages and
sharpens anyone’s talents.

Players become an agent for the virtual Cyber Protection Agency, where
they embark on stopping criminal gangs who are using their cyber skills to
do damage online. Agents must use various defensive tactics to thwart
these cyber criminals’ attempts. The rich narrative, highly designed
challenges and user-centric progress system, is designed to enable a
student to work through the challenges at their own pace.

Built with our players at the forefront of every decision, its gami!ed
learning environment is designed to teach complex security concepts in a
way that promotes exploration and investigation over traditional learning
methods. The offer of being rewarded by badges and points lets students
develop in a positive, yet addictive, learning environment.

Students with no previous cyber security interest or experience have gone

on to master Linux fundamentals, write their own programs, and even
gain an appreciation of cyber security as a career.

52 START-ENGINEERING.COM START-ENGINEERING.COM 53
 Forensics Base
Four Exciting Bases To Explore Forensics Base

Here students will step into the shoes of a police

Headquarters Base investigator, dealing with actual memory images akin to

real-world investigations. Here, they will have to
The Headquarters (HQ) Base contains challenges across all the cyber security
digitally decode and use their sleuthing skills to !nd the
disciplines. Based on real cyber security scenarios that have been adapted for the
cyber criminals’ digital trails.
students, the levels get scale alongside the students’ knowledge.

Moon Base

Moon Base
Students will learn how to program in the Moon Base.

HQ Base
But, unlike other programming learning tools, here they
can write their own security tools and understand their

limitations. For example, building their own password

cracker helps them understand why and how
passwords are weak.

Volcano Base

For the best of the best, with an authentic replica

network full of real-world security challenges, students
can prove they have the skills needed to be a cyber

security practitioner.

Volcano Base
54 START-ENGINEERING.COM START-ENGINEERING.COM 55
 facts and figures

FAST GROWING JOB OPENINGS IN THE U.S. WHERE THE

WHERE THE MONEY IS
Big Business

1. Apple
Top-paying U.S. cybersecurity jobs
2. Federal Reserve
Bank of New York
Job Title
3. Patient First
Average
Annual Salary
& WELL PAID
Jobs for cybersecurity
analysts are
769,736 SOURCE: CYBERSEEK
JOBS ARE
Cities with a high concentration
of cybersecurity jobs
4. Lockheed Martin
expected to grow by Huntsville, AL
Director of Information Security
5. General Motors $188,708
6. Capital One
7. Cisco 31% HIGH JOB SATISFACTION Washington, DC

71%
Software Architect $137,014 Augusta, GA
8. Intel
9. Northrop Grumman
between now and
Application Security Engineer
10. Boeing $130,809 2029, with a median Des Moines, IA
annual salary of Raleigh, NC
Chief Information Officer $129,299

Senior Security Consultant $129,251

$103,590. of cybersecurity professionals are
Utica, NY
SOURCE: US DEPARTMENT OF LABOR,
satisfied with their jobs, compared Silicon Valley, CA
Penetration Tester $119,142 BUREAU OF LABOR STATISTICS

with 45% of workers in general. Santa Barbara, CA

Risk Manager $118,222 Denver, CO
SOURCES: ISC2.ORG AND CAREERVISION.ORG

Cloud Engineer $114,841 Austin, TX

Security Engineer $108,387
SOURCE: COMPARATECH

Information Security Analyst $94,422

Start Engineering
SOURCE: INDEED
Publisher: Robert F. Black
Creative Director: Stacie A. Harrison
VP, Learning and Communications: Eric Iversen
Editors/Writers: Thomas K Grose, Eric Iversen,
Catherine P. Lincoln, and Margaret Lotfus.

If you’d like to purchase more cyber career

guides, go to: start-engineering.com/shop/

Contact us at bblack@start-engineering.com

© 2021 by Start Engineering, LLC

www.start-engineering.com

56 START-ENGINEERING.COM START-ENGINEERING.COM 57
LEVEL

Investigate. Analyze.
Develop. Operate. Protect.
The latest video games are no match
for an exciting career in cybersecurity.

Join a company where anything is possible.

We have the bandwidth. Do you?

mastercard.com

Mastercard is a registered trademark, and the circles design is a trademark of

Mastercard International Incorporated. ©2019 Mastercard. All rights reserved.