Part 2 – Cybersecurity journeys: What even is this job?

What it is

A career-focused interview post from the AWS Security Blog (Part 2 of a series). The summary covers who is profiled. This note covers the repeatable tactics the three people used to move into roles they weren't yet qualified for.

How it works

Plan backward from the end role (Jason Lane).

• Define the "level 20" role (here, vulnerability research), then step back through what must be true at each earlier level.
• The gap this exposed was application security, so Lane told an IT recruiter the plan and their actual level. The recruiter found a credit card processing company hiring an application security engineer who wasn't one yet.
• Lane framed it as trading a steeper learning curve for a faster path. After 4 years there, Lane moved to Google for nearly 7 years of Android vulnerability research.
• Amazon's application-risk team then hired Lane for that research background. The work is now ranking about a million applications by potential damage if compromised and by likelihood of being targeted.

Earn stretch work from inside (Jason Goodman).

• While in customer service and studying for a cybersecurity degree, Goodman asked the internal threat team's manager what to do to keep progressing.
• That led to small projects, then a fraud prevention dashboard for spotting misuse of customer account access, and then a first security engineering role on that team.
• Skills carried across later moves: Splunk queries moved from customer service into insider-threat work, and detection logic moved from insider investigations into adversarial detection.

Mentors by purpose. Goodman approached people whose work they admired, asked specific questions, and stayed in touch. The result was four mentors, one each for school, stretch projects, thinking like an adversary, and application security.

Follow a question past easy answers (Harshvardhan Chunawala).

• Chunawala began by reporting flaws found in real products to the vendors while still in high school.
• Chunawala's view is that with generative AI answering surface questions, curiosity matters more than credentials.
• The space work (mission operator for the Iris lunar rover) rests on one premise: anything remotely commandable can be commanded by the wrong person.
• Chunawala has written a two-part guide to satellite incident response on AWS, which the post mentions but doesn't link.

What to do

• Write down the target role and work backward to the missing skill. Then ask a recruiter or hiring manager directly for roles that will train that skill.
• Ask a security team's manager what you can take on. Deliver small items first to earn larger ones.
• Pick mentors per skill gap rather than waiting for one assigned mentor.
• Use the post's exploration resources: NICE Workforce Framework, CyberSeek, AWS Skill Builder, CISA's Cybersecurity Awareness Month page.

Caveats

This is anecdotal career advice from three people at or near AWS and Amazon, not a study. It contains no technical procedures, and the outcomes depend on employer openness to unqualified candidates.