First steps in cybersecurity: what I tell people who come up to me at Ekoparty

At the last Ekoparty I was there as a sponsor with MODO, and over the three days several students from technical high schools and people with no prior experience came up to me, always with some version of the same question: what’s the most important thing for landing your first job in this field. It happened so many times, with so many different people, that I ended up realizing the doubts were almost always the same. So this is basically the conversation I had ten times over those days, turned into a post.

Before the specific advice, something I told a few people right there: the feeling of not knowing where to start doesn’t go away with more theory, it goes away by taking the first step even if it feels scary. That happened to me too.

Get in wherever you can, not where you want to end up

I started in technical support. It wasn’t the role I dreamed of, not even close, but it was a real way in. There I learned to solve problems under pressure, to understand how infrastructure works from the inside, and above all to show something that matters more than technical knowledge at the start: being proactive and eager to learn. No one is going to hire you for the dream role with no prior experience, but almost anyone values someone who stays ten extra minutes to understand why something happened.

I tell the students who came up to me at Ekoparty the same thing I tell myself when I doubt. Your first role in cybersecurity is almost never the dream role. It’s the one that gets you a foot in the door of the industry, from where you can start building the path toward where you actually want to go. Waiting for the ideal role from day one usually means waiting a long time, while others are already in, learning along the way.

Practice in labs, don’t just watch tutorials

Watching videos and reading writeups helps, and it’s fine as a starting point, but it doesn’t replace getting your hands dirty. I recommend platforms like Hack The Box and Let’s Defend because they force you to solve real problems in a controlled environment, both on the offensive and defensive side. You don’t need to start with the hardest boxes. What matters is building, session after session, your own track record of “things I’ve already solved.” That track record is worth more in an interview than a list of concepts you read about but never applied. If you get lost among too many scattered topics, the cybersecurity roadmap from roadmap.sh helps you order what to tackle first without having to build the path yourself from scratch.

Free certifications matter too

A real obstacle for a lot of people starting out is money, and I heard it those same days more than once. The heavier, paid certifications are out of reach at the start, and that’s fine. That’s why I recommend starting with the free cybersecurity certifications from Google and IBM SkillsBuild: they have no financial barrier to entry and give you two concrete things, applicable knowledge step by step, and something tangible to show when you don’t have work experience to show yet.

That “something to show” isn’t a minor detail. Every finished certification or solved lab is real content to post on LinkedIn, and every post is an excuse for someone in the industry to see you, comment, or reach out directly. That’s how you build a real network, not out of nowhere or by asking for favors, but by showing concrete work anyone can check.

Ekoparty and networking spaces aren’t optional

The technical talks at Ekoparty are great, the level is very high every year. But what gave the most value to the students who came up to me wasn’t a specific talk, it was being able to talk face to face with people who are already in the field, ask the question that feels a little embarrassing to ask in a Discord server, and see that people on the other side are happy to answer. Events like this one, local meetups, and cybersecurity communities on Discord or Telegram are where you build the network that later opens doors a resume alone never will.

If you’re starting out, show up to these spaces even if you feel like you “don’t know enough yet” to be there. That feeling is almost universal, I had it, and most of the people you see looking confident in those hallways had it too. No one expects a technical high school student to be at a senior analyst’s level. What really stands out is curiosity and the willingness to ask questions.

The core idea

There’s no single correct path into cybersecurity, but there is a pattern that worked for me and that I see repeat in people who make it: land a first role wherever it opens the door, practice in real labs instead of piling up theory you never apply, add free certifications that give you something tangible to show, and show up in the spaces where people in the field actually are, even if it makes you nervous. Technical knowledge builds up over time. Your network and reputation do too, but the difference is you have to start building them now, not once you feel “ready.”

If you’re at this stage and want to talk it through in more detail, reach out on LinkedIn. In whatever way I can help, I’m here, just like I was those days at Ekoparty.