It is, by far, the most frequent question I get asked: How do I get started in IT/InfoSec? So many seem interested in the field of computers, system administration, networking, or information security but have no idea where to start, which can be a frustrating place to be. This blog post is for all of you (and, selfishly, an easy link for me to hand out next time someone asks).

My goal is to give you a few high-level ideas to get started with today if you’re still at ground zero looking to take the first step. I’ll also discuss things that I think will boost your resume and get you noticed in a stack of IT/InfoSec applicants.

My plan is a pretty straightforward one and consists of a few basic steps.

Step 1 – Decide What Interests You

Notice that I didn’t say decide what you are “passionate” about, which is a common, and quite frankly irritating thing to say to someone who has no idea what they are passionate about. Generally speaking, passion follows experience, it doesn’t precede it. If you are interested in playing guitar, you pick one up, take some lessons, and practice. Only once you see results does passion kick in and propel you to new heights of skill. Yes, I realize there are examples of people who know exactly what they want to do from a very young age, but I believe those folks to be the exception, not the rule. For the rest of us, deciding what you are interested in is a better way to go, and it is usually the first point I make in response to someone who asks me that question.

I had a conversation with a college student—I’ll call him Pete—who approached me after a talk I gave and asked me “the question”: Jason, where do I start in IT? The conversation went something like this and is one I’ve had with many people over Twitter and at cons:

Me: What are you interested in?

Pete: Honestly, I don’t know.

Me: Anything high-level come to mind?

Pete: All of it, I’m interested in everything, “computers”.

Me: Ok…writing code, building PCs, or networking. Of those three, if you had to pick one, which would you pick?

Pete: Networking.

Me: Setting up networking hardware, running cables, or configuring firewall rules/security. How about now?

Pete: Definitely setting up networking hardware.

Me: Perfect. Maybe consider the entry-level Cisco Certified Technician cert to help you get started with some foundational knowledge.

Pete was incredibly thankful for the advice, and I learned a valuable lesson: Many times, people already have a subconscious idea of what interests them but don’t know how to think about it in a way that allows them to arrive at any positive conclusions. Asking specific questions can help narrow the field and make the choices seem less daunting.

If you are reading this wondering where to start, my question to you would simply be: In the realm of IT/InfoSec, what, broadly speaking, interests you? Chances are you already know or have an idea or two.

Step 2 – Get Yourself Right

What do I mean by this? When it comes time to apply for a position, there are some key attributes you should have that will help you stand out from others. One thing that I look for in people before I recommend them for hire is a sense of “humble ability”. In our industry, having ability without humility simply won’t do (for long, at least). As the saying goes: hire personality, train skill.

A good acronym that I use is AFT:

        Available – What’s your schedule? Can you accommodate the demands of the job or are you too inflexible? Sometimes, as a consultant, I have to respond to clients even while I’m on vacation (gasp!). I’m happy to do it because I love the relationship that I’m building and know that happy customers mean a happy career, which means more vacations.

        Faithful – Companies take care of people who take care of companies. Want to know what precisely zero companies want? An employee to use them as a steppingstone to get somewhere else. A sense of loyalty is something of a rare quality these days and is highly prized by employers. Ghosters need not apply.

        Teachable – Can you get over yourself enough to learn about the company and serve its customers, or are you holding out for a “management position”? My 16-year-old recently got his first job and my advice to him was to get to know the business—all of it, not just the particulars of his job. Get to know what other people do and how and why they do it. Say yes to every job they ask you to do (illegal limitations are obvious). If you do that, you will become indispensable with more money and opportunities to follow.

Step 3 – Get to Know People

This is the real secret and one that is usually completely overlooked in favor of GitHub projects and blog posts. The absolute best hires are ones that are already known and trusted by other employees. If you want to get into a certain company, join their Discord/Slack, ask questions, get involved in whatever online community they have and become “known” to the company. Show any interest. Believe me when I tell you that the single best thing I have done in my career is get to know my peers in the industry. They will answer your questions and possibly help you switch jobs if you need to. Be aware of your reputation, however—that’s why step 2 comes before 3.

I understand what I’m asking you to do here can be difficult. As an introvert myself, I would much rather be alone than in a room full of people I don’t know. But at a conference you’ll usually find me at lobbycon rather than at a talk. This is intentional and has served me greatly over the years.

Step 4 – Develop Those Skills

I’m working with a young man now who decided he wanted to get into “computers”. Where to start? He had a computer but not a ton of extra cash to spend on something like a certification. The good news is there is a ton you can do for free. These things will also help you get noticed and can make for great resume builders.

1. Build a lab at home. It doesn’t have to be fancy—just use VirtualBox, which is free, on your machine and install some Linux distributions (cough Arch cough). Now do things like set up an email client to connect to your online mail account, configure samba file sharing, and research and install some security software. Don’t be intimidated by this; just try it. Anything you learn here is valuable and time well spent, including mistakes. YouTube is your friend here.
2. Learn any programming language. Most code that you’re likely to encounter is similar in nature and flow, and once you get some of the basic programming concepts down (conditionals, methods, properties, structure), you’ll be in good shape. If you aren’t sure where to start, I’d recommend Python or PowerShell. Again, don’t be intimidated! Just try it. There are so many free tools to help you: YouTube, StackOverflow, and sites like www.codeacademy.com. For your first project, don’t get crazy, just do things like print the numbers 1 through 10 out to the screen. The very best programming projects are the ones that solve your own problems for you.
3. After you get some coding experience, start building something useful. It doesn’t matter what it is. Put it out on GitHub. Even if you’re new, you are still beginning to build up your “brand”. This is important. Find other GitHub projects you can contribute to and make contributions! You’ll get noticed.
4. Start up a blog. Do not fall into the trap of thinking that you must be an expert before you can publish anything. The very best time to publish or teach is when you are smack in the middle of the learning process. All the information is fresh and even if you just wrote a bunch of, “How to do this super basic thing” posts, someone will come across it and benefit from it.
5. After you’ve built yourself up a bit, don’t be afraid to submit to conferences and get your name out there by giving talks. Giving public talks opens up doors and is easier than ever now that many cons are virtual.
6. Put your GitHub projects, YouTube videos, and blog on your resume. These things will all help you get noticed and will give potential employers an idea of what makes you you, and that’s important for them to feel comfortable about you before hiring.

Lastly, a piece of advice: Don’t be afraid to try and fail. This probably should have been step 1, but I saved it because it really is the most important. Don’t be afraid to set lofty (but attainable) goals. Even if you don’t reach them, there are valuable lessons to be learned for those that have the ability and wherewithal to learn them. Failure is a key part of life and one that usually works toward our benefit. Get over that single fear and you’ll find that you can do incredible things.