If You're Trying to Break Into Security Right Now
I read every message you send me.
I know it doesn’t feel that way when you don’t hear back. But I do read them. Over the past few weeks I’ve gotten hundreds of connection requests, and almost all of them come from the same place: new grads and junior folks trying to break into security, doing everything they were told to do, and still hearing no.
I feel the weight in those messages. A lot of you are working hard, staying hopeful, and getting nothing back. That’s exhausting. It wears people down. I see it, and I want to help in a way that’s actually useful, not just kind.
So here’s the honest version of useful.
First, this is not in your head
The entry-level market is genuinely brutal right now. You are not imagining it, and it is not a reflection of your worth.
The numbers back you up. The 2025 ISC2 Cybersecurity Workforce Study found that 36% of organizations had their security budgets cut last year and 24% went through layoffs. A third say they don’t have the resources to staff their teams properly. 29% say they can’t afford to hire the skills they actually need. The doors into the field are narrowing from the top down, and federal cuts have closed some of the most visible ones.
You’ve probably heard there are millions of unfilled security roles worldwide. That number is true and almost useless to you right now. The need is real. The budget to hire for it often is not. None of that is your fault.
I’m telling you the hard part up front because I respect you enough to be straight with you. Now let’s talk about the part you can control.
Why the templated message works against you
Most of the messages I get have the same shape. A line or two of background. A credential. Something about being passionate about cybersecurity. A polite ask to connect because you’re exploring opportunities.
I understand why. When the market won’t respond, you reach for whatever scales. You find something that sounds professional and you send it to everyone.
The problem is that when hundreds of messages share the same shape and the same phrasing, they blur into one. Not because anyone is cold, but because there’s simply too much of it to read closely. And if you used AI to write it, it sends the opposite of what you’re hoping for. You want to come across as sharp and resourceful. A template says you did what everyone else did and hoped volume would carry it.
Volume won’t carry it. Signal will.
What makes me stop and read
I can’t speak for every hiring manager. I can tell you exactly what makes me pause.
Something you built. A repo with a tool you wrote. A home lab writeup. A detection rule you published. A CTF you played and documented afterward. It doesn’t have to be impressive by senior standards. It has to be real. Real work is rare right now, and it stands out instantly.
A specific thought. Skip the generic intro. If you’ve read or watched something I made, tell me what you actually thought about it. Push back if you have a reason to. Agreement is easy to forget. A grounded, specific reaction tells me you read, you thought, and you have a point of view.
Proof you move without being told. The people who stand out found a problem, picked an approach, and shipped something before anyone asked. That instinct is hard to teach. If you have it, show it.
A cert list is not enough
ISC2’s 2025 hiring trends research found that hiring managers weigh hands-on experience and certifications almost equally, and both beat formal education on its own. Three of the top five skills they prioritize are soft skills: teamwork, problem-solving, and analytical thinking.
So a long cert list is not the cheat code it gets sold as. It proves you can study and pass a test. It doesn’t answer the questions that actually get you hired: can you think through an ambiguous problem, build something from nothing, and figure out what matters when everything is on fire? You can’t list your way to those answers. You have to show them.
What I’d do if I were you
Pick one thing and build it in the open. A small tool. A writeup of a bug you researched. A post about something you learned the hard way. Put it where people can find it. Link to it in every message you send.
Then send fewer messages and make each one count. Research the person. Say something real. Show that you did the work before asking them to do any.
This market is hard, and I won’t pretend otherwise. But the people who break through are the ones who stop competing on volume and start competing on signal. You have far more control over that than the market wants you to believe.
I’m rooting for you. If you’re building something, reach out and lead with the work. I’ll read it.