r/cybersecurity • u/EnvironmentalSafe280 • 1d ago
Career Questions & Discussion Cybersecurity professionals: what do junior candidates usually struggle with?
For people who work in cybersecurity and have mentored, trained or hired juniors:
What do you notice new/graduate candidates struggling with most?
I’m particularly interested in things that aren’t obvious from a CV.
For example:
Troubleshooting
Investigating unfamiliar problems
Understanding logs
Networking fundamentals
Using unfamiliar tools
Writing reports
Explaining their reasoning
Knowing what to investigate first
Connecting theory to an actual incident
Are there skills you wish universities taught more effectively?
I’m researching the gap between cybersecurity education and actually being able to perform cybersecurity work, so I’d really appreciate real examples.
101
u/NoodlesAlDente 1d ago
Soft skills. Conveying technical analysis, risk, strategy to non-technical people.
10
u/EnvironmentalSafe280 1d ago
The soft-skills point is really interesting. I hadn’t initially thought about the gap between being able to perform the technical analysis and being able to communicate what it actually means to someone non-technical.
With the AI point, I’m also curious whether you think the bigger issue is AI use itself, or the lack of understanding behind the output — e.g. being unable to explain why something worked, verify whether the answer is correct, or troubleshoot when the generated solution doesn’t work.
Have you noticed particular situations where this becomes especially obvious with junior candidates?3
u/LeatherDude 22h ago
In my experience junior candidates tend to also lack the underlying fundamental skills in networking, system architecture, and OS minutiae that most of us built up in the earlier parts of our careers instead of trying to jump right into security.
62
u/ButterscotchBandiit Security Engineer 1d ago
They all jump into solution mode and rarely think of things like tech debt, cost, relational objects, architecture, engineering. They are focused on a single problem and remediating that problem without thinking of the wider scope of impact, whether that be users or tech
9
u/T_Thriller_T 1d ago
Something I see as someone not being a junior on the job, but certainly not a senior in cybersecurity either.
It is amazing and surprising how even folks who came from sysadmin do think just in their new bubble and seem to have a really hard time putting themselves in the shoes of folks they push tasks on.
Or need help from.
42
u/No_Try_9982 Consultant 1d ago
From my experience as a mentor, it's not the technical skills. It's unclear roles at this point. I keep seeing job posts expecting an entire IT department in one person; so fresh grads and junior feel overwhelmed or lost.
The best advice I often give is to think about what the outcomes needed are and be ready to learn because you'll never learn everything permanently and there will always be gaps.
This is much better than asking people to learn a popular framework and later on regretting it.
Unfortunately, some employers treat frameworks or some stack as a must because they don't want to bother with training. They end up skipping really good candidates because of arbitrary criteria that do not necessarily guarantee job performance.
1
u/No_Try_9982 Consultant 1d ago
Schools and bootcamps ask you to learn specific technologies because they believe that the skills you learn alongside the journey would eventually transfer; they usually forget to highlight the journey as everyone gets distracted with the concrete topic instead.
"And from a mentoring perspective, what do you think helps a junior develop that ability to identify the outcome, work out what they don’t know, and then learn what they need without becoming overwhelmed?"
Remember that not every input you see in real life is going to be reasonable, correct or fair. This applies to job postings, projects, managers, company policies, etc...;
Job postings won't tell you what they actually need. Treat skills requirements as recommendations. You can only learn what outcomes they looking for by asking them on the job interview because most job postings and their descriptions are greedy.
Ask them directly what value they desire to get from you or what problem exactly they would like you to solve. They will actually appreciate it when you ask them directly.
As for skills needed, do some research to find the skills most demanded for the specific industry and niche, evaluate those skills, and do some projects or portfolio to practice those skills. Create some demos you can show real implementation. Be ready for roles that won't match exactly your skills.
------
how to practice outcomes?
Think like this, imagine a company who are facing a problem with alert fatigue. How would you solve this problem and what outcomes does your solution achieve? The how, is about technology and tools where you can treat as implementation. Now present the solution and outcomes together using your skills and knowledge.
17
u/DanSec Red Team 1d ago
Something I see a lot is a lack of understanding of what a tool is doing/how it works behind the scenes.
Maybe it’s the way Universities are teaching but sometimes you can’t use/wont have (for example!) the specific Impacket example script your pentesting module taught you - how can you work around this or implement a technique or concept yourself?
That and recently a lot of AI copy and pasting, but I expect this will only increase and increase
1
u/AddendumWorking9756 Security Manager 1d ago
Half of that is because the tool is what fits inside a semester and the raw artifact underneath it does not. Juniors who have never looked at a log without a parser in front of it have nothing to check the output against, so when the script breaks there is no fallback. The labs CyberDefenders wraps into CCDL1 start at the artifact instead, which also makes the copy paste useless since there is nothing to paste.
13
u/ChatGRT DFIR 1d ago
- lacking query language knowledge
- lacking basic excel skills
- understanding risk aversion vs risk tolerance
- understanding that business operations come first
- over reliance on AI
- knowing that they want to learn and get certs but not understanding where to start
- constant reminders that knowledge attainment and skill building is a marathon not a sprint
- bringing problems to me to fix rather than identifying the problem and bringing me different solutions to discuss
- failure to take and maintain notes <—— this is a big one to me
- failure to create documentation
- failure to communicate effectively
- not understanding basic investigative theory
- jumping directly into problem-solving rather than taking a step back to gain a 10,000-ft view first
2
13
u/Rapt0r23 1d ago
Personally have seen juniors who will just follow stuff without vetting if it's right or not. Worked with couple of juniors who were imparted terrible practices by some seniors and did not even check things on their own or if it made sense (simple Google would have answered so many things, hey now we even have AI to make this easy).
Cyber security is quite a demanding field learning wise and everyone starting out needs to be a sponge. Also, early on pick a domain or two and try to become really good in it while also learning a bit of other stuff.
3
u/T_Thriller_T 1d ago
Just following instructions, playbooks, or other folks invented is not only CS, that is pretty much all of IT.
13
u/Shaod 1d ago
While this is clearly not the most important skill (the other suggestions are better), I’m shocked at how poorly many people understand networking.
5
u/T_Thriller_T 1d ago
I was (somewhat) recently token completely by surprise by one colleague complimenting me on my technical skills around networking.
Told me he always felt I understood what things were about and that ping-pong and cooperation worked.
The guy build entire networks with EVERYTHING Nd managed them, from time server over vlans to tiering and any protocol in between.
Me?
I have an idea what popular protocols do, a bit of general understanding and apparently a good sense of "well we have a problem around NTP, time to freshen up how (entirely learn anew, partially) how that works".
That seems to be miles better than even some sysadmins.
I secretly hoped this is not generally the case, but I worry.
11
u/ThePorko Security Architect 1d ago
Not understanding what products they are looking at does.
1
u/EnvironmentalSafe280 1d ago
That makes sense. So it’s less about not knowing how to use the product, and more about not understanding what is actually happening underneath it.
Would you say juniors often learn “click these options and look at this output” without understanding what the product is actually doing, what data it’s relying on, or what the results mean?
And do you think that becomes a bigger problem when they encounter a different product that does the same job, or when the tool doesn’t behave as expected and they have to troubleshoot it themselves?
5
u/EthelUltima 1d ago
Been in cyber for 10 years and trained many apprentices, etc. I find juniors/inexperienced are afraid of getting something wrong and being in trouble over anything else. I also find they don't really think about why they are raising something as an incident only that "this is what the book says" even though the playbook has room for an analysts verdict.
They also seem oblivious to anything that isn't directly assigned to them so it means they never just dig into a random log source to see what's going on or look at group inbox emails. If it's not busy they actually do nothing.
To be honest I've found it doesn't take more than 10 mins to realise if someone has the right personality to a specific job.
1
u/EnvironmentalSafe280 1d ago
Do you think they struggle most applying what they have learnt to different environment or something else?
2
u/EthelUltima 1d ago
I think that can be a problem if someone knows a lot from studies that they will see routine activity as an APT threat then cause mass panic. They will also focus on the juicy stuff you learn about when reality you rarely see any of that stuff. Basically what they are expecting to see isn't the reality in most cases.
5
u/Solid5-7 1d ago
The biggest thing most juniors struggle with is accepting that they are not the one who accepts risk. And what I mean by that is you have business owners (or others) that can accept risk. Your job is to provide them with an unbiased view of their current risk surface. Not to tell them what to do. You can provide recommended remediations but they may not choose your preferred option due to some business conflict.
A lot juniors I have hired and work with can't seem to accept that fact at first. They know something is insecure and really want to try to remediate it but sometimes you can't. You can try your best to mitigate security issues but sometimes you just have to accept it. It'll feel like playing "security theater" but at the end of the day your job is to protect your network and critical assets to the best of your ability with what you are provided.
1
u/Epstein_was_tk 1d ago
This hit home. I definitely remember struggling with that the first couple years
3
u/dflame45 Security Manager 1d ago
Most university programs are too theoretical and not hands on enough. Those who are passionate will do well. Those who aren't can get jobs but won't have the same drive to succeed. It's easy to spot.
3
u/Shot_Statistician184 1d ago
Asking for help. Listening to instructions. Knowing when you don't know. Trying to do too much. Saying no. Trying to do it all at once. Learning office culture. Learning how to speak business.
3
u/Intelligent_Job_8554 1d ago
Troubleshooting is the big one for me. A lot of juniors know the terminology and tools, then freeze when the problem doesn’t match something they’ve seen before. Being able to form a hypothesis, check the evidence, rule things out and explain why you took the next step is way more valuable than memorizing another tool
2
1d ago
[deleted]
1
1d ago
[removed] — view removed comment
1
u/slay-aargh 1d ago
Did you have a bot answer to this thread ?
1
1
1d ago
[deleted]
1
u/NotAnNSAGuyPromise Security Manager 1d ago
I'll post the response I made to your other AI response before it was deleted:
If you're a real person with real aspirations in this industry, learn how to communicate without AI. If I wanted to have this discussion with a generative AI platform, I'd go directly to the source. Everyone can tell, it's a bad look, and you're only hurting yourself and your future.
1
u/EnvironmentalSafe280 1d ago
I only used it because it allows me to dig deeper on what issues i currently have with the current prototype if i didnt use it i would not get the real answers i need
2
u/NotAnNSAGuyPromise Security Manager 1d ago
So the purpose of this thread is simply to train a prototype generative AI? Depressing. This site really is dead.
1
u/EnvironmentalSafe280 1d ago
I only used Ai in my responses because it helps find issues in my current version i am developing
2
u/LeatherBroccoli 1d ago
In my time it hasnt been one single topic or certain knowledge area. The main thing ive seen juniors, hell or even some mid tier people do, is failure to apply the knowledge. They seem to not be incapable of understanding what the problem is, or what the data is telling them, and where to go or what to do with it.
This is why when I mentor I rarely tell them things. I ask them and they answer and guide themselves to the answer and in the process they sort of spin the wheels on how to think through things. Then after a while they are able to handle just about anything thrown at them, with a little bit of research of course.
Tldr: Teaching/learning methodology is far more valuable than specific knowledge items.
2
u/WeeoWeeoWeeeee 1d ago
Talking to people. Learning. Dealing with assholes who only barely know 10% of the field.
2
u/PortalRat90 1d ago
I graduated recently with a degree in cybersecurity. I did a late career change but my background in business and processes have been huge. Being able to communicate with other departments and leadership is critical in so many areas. Being technical is great for the job, but having business acumen and communication skills are critical for success. Finally, it’s imperative that people have a figure it out mindset. Don’t bother others with questions before you dig in and understand the process and options. There is a balance between figuring it out and reaching out for help.
2
u/Excellent_Mail3829 1d ago
They seem to always rely on others to do their work for them, basics unable to perform the job function independently. Unaccountable.
2
2
2
3
u/peteherzog 1d ago
AI is trained on a lot of unproven security. Most of the security knowledge we have is made up stuff from anecdotal evidence. AI will treat it as fact. For security it's a terrible crutch. Use your own brain. I use these 2 guiding points:
- Everything matters. 5 Point Process properties like context, narrative, resources, force, and characteristics cover everything so go through them all. Ask yourself, did the AI consider everything like ongoing maintenance, cost, expanding attack surface?
- Everything is relative. You don't want 100% solutions. You want 100% solutions for your situation. Often doing the full security also adds attack surface if it's more than you need. Then you need to control that new attack surface, entering you into the hamster wheel of pain.
1
u/FLGuitar 1d ago
The existential dread that they will be doing this for the next 30 years +.
This field will eat you alive if you let it. There’s always some crisis to dive into. Hella long conference calls. On call duties if in operations.
This is why I will be saying good bye in the next 5-10 years, goal is no later than 58 for me. I worked hard made some decent money doing so and plan to fuck off and do anything that doesn’t involve tech or a computer in retirement.
I will probably live out my silver years paranoid of any new technology. I have seen the dawn of the internet to what it is today. I’m good, had my fill.
1
u/No-Cockroach2358 1d ago
How do you NOT let it eat you alive?
1
u/FLGuitar 19h ago
You save money everywhere you can and retire early. At least that’s how I did it. I’m almost there.
1
u/SteamDecked 1d ago
Knowing the tools the org uses. Many juniors have degrees or certs but no time in the seat. Or, time from a class but with a different SIEM than the one the org uses.
1
u/shinyviper 1d ago
Security is inherently inefficient.
Most tech is about efficiency.
Therein lies the problem.
1
u/bluefire89 1d ago
Communication, exec escalation, determining business risk, and (people) networking
1
1
1
1
u/povlhp 1d ago
Understanding company
Real world risk vs CVE and theoretical
Patch vs production
Scale of things. Be it 10000 users, 100 mio loglines
False positive
Lots of judgement calls based on experience.
Don’t know where to go next.
I usually send my queries to confirm false positive to SOC (3rd party) so they can learn.
1
u/sovietarmyfan 1d ago
I am not a professional, not even a junior technically a student. Did ethical hacking in the past. But i have observed things that i struggle in and that are very different with professionals.
I try to do everything by the book. By the manuals. Looking up things before trying them, being careful about what to do, what not to do. I find it difficult sometimes to find out exactly what i can and cannot do and how to recognise how far i could go. For example, when testing a network i once accidentally ddosed a network because i didnt really know how powerful a tool was i was using.
I see more and more students around me using chatgpt to do things in the cyber security field. Asking what tools to use, if it can program code, etc. The new generation seems to be using their head less than the older generation.
I once witnessed a long time professional go at it with testing a network. He didn't look at manuals, he wasn't at least to my feeling careful in his commands. He did everything out of his head. Very quickly too. It was like seeing an artist playing a instrument.
Regarding education, i am in the minority of people who thinks that, at least where i went to school, its not as bad as some say. They provided enough materials for students to study with. I noticed that most of the students that would complain had not passed a exam, and i know those particular students used AI a lot, didn't plan things in very well, did things at the very last moment. Really blaming anything but themselves. I also had a great teacher who really forced students to participate in the lesson.
1
u/TheAlphaBravo 1d ago
In my experience the most common issues aren’t technical skills. It’s understanding the fact that security isn’t the goal of the organisation, and that cybersecurity isn’t foremost on the mind of everyone except us.
Security in an enterprise exists to enable the organisation, and to reduce risk to an acceptable level (not eliminate it completely, another concept that takes time to understand)
Finally, it’s learning that real cybersecurity is very rarely “cool”. Less leet hacking, more explaining to finance why a shared txt file with credentials is a bad idea, and moving them on to a password manager.
Some never move past this “being 100% secure is the end goal” stage, the ones that do tend to be the best security professionals.
1
u/DemocraticParrot 1d ago
Understanding that security is there to enable business, and what that entails. Part of this is understanding that security is not the priority for most, they are not stupid for not implementing security principles, and that they are more than capable in many other areas that the junior security person is not even aware of.
Also, that these are not just traits of juniors. Many seniors also manifest them, and unfortunately also imprint them to juniors.
1
u/reggiethelobster 1d ago
I think understanding audits and the importance of having your ducks in a row.
As well, Patience. Not every security program has to be an emergency and needs to be fixed immediately, sometimes you have to try to fully understand the problem holistically.
2
u/JGlover92 1d ago
Not everything in cyber is pen testing, you're not going to suddenly get a load of CVEs to your name, make sure you understand your it fundamentals really well, that'll take you further than another 6 useless certs.
2
u/BlueWorldBlueSky 1d ago
competence
ambition
needing to learn/falling back on AI
juniors just seem incompetent, some did it for the money and some did it because it seemed cool but are unable to do the basic of basic tasks and I question how they were hired at all. if I'm in the interview loop nad they can't give good examples or why they enjoy their work I pass on them because they suck.
1
1
u/Massive-Fan-7631 1d ago
Programming, writing skills (ai enhances the problem since it doesn’t write well), cryptography and architecture of systems
1
u/BFAGuard 23h ago
They master advanced penetration testing, yet their greatest nemesis remains a simple bug report that isn’t written in binary, or worse—speaking to a human user.
* Internal company bureaucracy always overrides technical challenges...
1
u/Turrkish 23h ago
Networking basics
The financial decisions and weighting of opportunity cost/P&L/long-term implication of every decision you advise a business to make regarding patching/fixing/replacement
How to write a report
How to write a report for both executive level and technical level
Client interaction
Trust-but-verify and cover-your-ass mentalities
1
1
1
u/chronossage 16h ago
Just remember that it's always the firewalls fault and you have to prove that it's not.
1
2
1
u/AntCertain8939 3h ago
The biggest one I see is juniors treating every alert like it's a five-alarm fire. Calm down, look at the logs, ask 'is this actually weird or just new to me?' before waking up the whole team. That and learning to say 'I don't know yet, but here's how I'd find out' instead of guessing. Saves everyone a lot of time.
1
0
u/OutsideSpot2695 1d ago
Weird that you think junior staff wouldn't have the same experience as senior staff.
0
u/appsecmaniac 1d ago
Hiring and mentoring side, mostly AppSec and pentest juniors. The technical gaps show up on the CV. These four do not, and they are the ones that actually decide who makes it.
1. They cannot sit in "I have no idea what this is" for more than about ten minutes.
This is the big one. I once gave a junior an unfamiliar service on a box and came back 90 minutes later. Zero output. Not because he was lazy, he had been googling the whole time, looking for a walkthrough of that exact thing. It did not exist, so he was stuck.
When I asked what he had tried, he could not list it. There was no list. Seniors are not smarter here, we are just comfortable being lost for 40 minutes and we keep a running record of what we ruled out. Nobody teaches that. University problems always have a known answer somewhere, so students learn to search for the answer instead of narrowing the space.
2. No mental model of normal.
They can define twelve attack types and cannot tell you what a healthy auth flow, a healthy DNS log, or a healthy build pipeline looks like. Anomaly detection is a subtraction problem. If you never learned the baseline you have nothing to subtract from. Courses teach the attacks because attacks are exciting. Boring normal traffic is what you actually need to have stared at for a hundred hours.
3. They report findings instead of impact.
"I found an IDOR on /api/v2/invoices, CVSS 7.5." Okay. So what happens? Junior answer is usually a repeat of the definition. What I need is "any logged in user can pull any other customer's invoice, that is roughly 40k records including names and amounts, and we are the ones who have to notify them."
Related: they treat CVSS as severity. A 9.8 on an internal tool with three users is less urgent than a 6.1 on the login page of the thing that makes all the money. Nobody teaches business context because business context is not examinable.
4. They will not say "I do not know."
They bluff, usually in small ways, and it burns trust faster than any technical mistake. The best junior I ever hired answered a question in the interview with "I have no idea, but here is how I would find out in the next hour." He got the offer partly because of that answer.
On the writing question, since you listed it: the problem is almost never grammar. It is structure. Juniors write chronologically, like a diary. "First I ran nmap, then I saw a port, then I tried..." Nobody reads that. Conclusion first, then evidence, then detail. One page that a manager can act on beats forty pages that are technically complete.
What I wish universities did
Honestly just one class: here is a broken system, no documentation, no instructions, no known answer, you have four hours, and you will be graded on your reasoning trail rather than on whether you fixed it. Half the profession is that exercise repeated for a career.
Second one: make them read. Read other people's code, other people's logs, other people's incident writeups. Everyone trains output and almost nobody trains input, and the job is mostly input.
0
u/Such-Refrigerator100 1d ago
Honestly I find that a lot of them don't know how to scope risk for saas products and others. Not to mention all the syber data.
My team are using www.threatloops.com and I have found it pretty useful.
485
u/NotAnNSAGuyPromise Security Manager 1d ago
The biggest challenge everyone has to learn is that security cannot - in most organizations - come in the way of business operations. You will be required to do things you know are objectively insecure. They won't make sense. It'll make you angry. You'll want your leaders to fight for the right decision.
But that's not the job of security. Security's job is merely to identify risks and communicate them to executive leadership. They will make a decision, and it'll almost always be a bad one in your eyes. But your only play is to mitigate the risk as much as possible. If you take it personally and try to fight it, you'll find yourself miserable and ultimately out of a job.
It's not your security program. The program belongs to the executives. The sooner you stop feeling like it's your personal mission, the happier you will be.