Breaking Into Security

I put this together for a family member — mid-career IT, most recently in medical software — who asked how to get into cybersecurity. It turned out to be the kind of thing worth sharing, so here it is.

The short version: cybersecurity is not one job, it's a dozen jobs that share a mindset. Almost nobody starts in security; the standard on-ramp is exactly where you are — years of IT, development, or ops experience, plus some deliberate skill-building and a foot in the door. If you can run infrastructure, ship software, or untangle a weird ticket at 4:55 on a Friday, you already have most of the raw material. What's left is learning the security lens, picking a direction, and getting some evidence on paper.

The field guide, in three parts:

• 01 — The Lay of the Land — the role families (defense, offense, engineering, governance), what each one actually does all day, and which ones hire career-changers.
• 02 — Your IT Years Are the Head Start — what transfers directly, the classic pivot paths, and why a medical software background is a genuine niche advantage, not baggage.
• 03 — First Moves — skills, hands-on labs, an honest take on certifications, and how to actually land the first role.

Plus a resources page — the links, labs, and communities mentioned throughout, in one place.

One piece of advice before any of it: don't wait until you "know enough." Nobody in security knows enough; the field moves too fast for that. The people who get in are the ones who start doing the work — in a lab, in their current job, in a community — before anyone gives them the title.