Oluma / Foundations So you want to get into cybersecurity?Start here. Not with a certification, not with a job title — with a clear, honest picture of what this field actually is, and what it actually takes. This is written for the person who has never opened a terminal in their life. Oluma — cyber for everyday people · Foundations series · 8 min read 01 / The honest starting point Before we talk about cybersecurity, let’s talk about the noise around it. If you’ve spent any time on social media lately, you’ve probably seen it: “I went from zero experience to a $120,000 cybersecurity job in 6 months.” “No degree, no experience, just this one certification.” It’s everywhere, and it’s designed to grab you — because fear of missing out sells courses. Here’s the truth we’d rather tell you upfront, before you spend a dollar or an hour on anything: cybersecurity is a real, stable, deeply human field with genuine career potential. But it is not a shortcut, a lottery ticket, or a get-rich-quick scheme. The people who succeed in it long-term are not the ones chasing a fast outcome — they’re the ones who got curious about how things break and stayed curious long enough to get good at fixing them. This article won’t get you a job by Friday. It will give you a foundation that doesn’t collapse the first time something gets hard — which, in this field, will be often. 02 / What cybersecurity actually is Strip away the hoodies-and-hacking imagery. Here’s the plain version. At its core, cybersecurity is the practice of protecting information and the systems that hold it — computers, networks, applications, and the people who use them — from being accessed, changed, or destroyed by someone who shouldn’t be able to. That’s it. Everything else — firewalls, phishing simulations, encryption, incident response, compliance frameworks — is just a tool or a process built to support that one idea. Security professionals usually organize that idea around three questions: Confidentiality — Can only the right people see this information? Integrity — Can we trust that this information hasn’t been secretly changed? Availability — Can the right people actually get to this information when they need it? Almost every job, tool, and headline in this industry is answering one of those three questions. A hospital protecting patient records is answering “confidentiality.” A bank verifying a transaction wasn’t tampered with is answering “integrity.” A hospital keeping its systems online during a ransomware attack is answering “availability.” Once you see this pattern, the field stops looking like magic and starts looking like a discipline you can actually learn. And it’s a wide discipline — not just one path. It includes people who write policy, people who train employees not to click bad links, people who investigate breaches after they happen, people who build secure software, and people who spend their day thinking like an attacker to find weaknesses first. There is likely a corner of this field that fits how you think, not just how a recruiter’s ad describes it. 03 / Clearing up the myths The stories that get people started for the wrong reasons — and what’s actually true. The Myth The Reality “I’ll get a certification and land a six-figure job in a few months.” Certifications are useful proof of knowledge, not proof of experience. Most entry roles still weigh hands-on skill and judgment — things built over time, not over a weekend course. “Cybersecurity is an easy way to make big, fast money.” Experienced specialists can earn well, but that comes after years of building real, specific skill — not as a starting point. Anyone promising fast wealth is selling you something, not teaching you something. “I don’t need to understand computers, just security tools.” Security is built on top of IT fundamentals — networks, operating systems, how software works. Skipping that foundation means memorizing tools without understanding what they’re protecting. “There’s one ‘right’ certificate that opens every door.” There isn’t. Different paths (helpdesk, networking, systems administration, development) all lead into security differently. The right next step depends on where you’re starting from. The field rewards people who came for the problem-solving and stayed for the craft — not people who came for the paycheck and hoped the craft would follow. 04 / The foundation under the foundation You can’t secure what you don’t understand. One of the most overlooked truths in this field: you don’t start by learning security. You start by learning information technology — because security is the practice of protecting IT systems, and you can’t protect what you can’t explain. Before diving into security tools, it genuinely helps to get comfortable with: How a computer works — operating systems, files, permissions, processes. How networks work — what an IP address is, how data moves from one device to another, what a firewall is actually doing. How the internet works — websites, servers, browsers, and the basic language of “requests” and “responses.” Basic troubleshooting instincts — the habit of asking “what changed?” when something breaks. This is why so many people land their first security-adjacent role in IT support, help desk, or systems administration before moving into security specifically. It’s not a detour — it’s the on-ramp. You learn what “normal” looks like on a system, and security is largely the practice of noticing when something isn’t normal anymore. 05 / What actually determines success The technical skills are learnable. These are the traits that decide whether you keep going. We’ve watched enough people start this journey to notice a pattern: the difference between the people who make it and the people who quietly disappear after three months isn’t intelligence. It’s these six things. Passion Not motivational-poster passion — the quieter kind, where you’re a little curious about why a scam email works, or how a breach actually happened, even on a day you’re not “studying.” Dedication Showing up on the boring days. Reading documentation. Redoing a lab exercise for the third time because it didn’t click. Progress in this field is mostly unglamorous repetition. Patience This is a multi-year path, not a multi-month one. The people who burn out fastest are the ones who expected mastery on a sprint timeline. Network Most opportunities in this field come through people, not job boards. Communities, mentors, local meetups, and honest conversations open doors that applications alone don’t. Continuous study Threats, tools, and best practices change constantly. Learning here isn’t a phase before the job — it’s a permanent part of the job. Humility The best analysts we know are still comfortable saying “I don’t know, let me find out.” Ego is one of the most common reasons good technical people plateau. 06 / A reasonable first year Not a “6 months to $120K” plan. A realistic one. Get literate in IT basics first Spend real time understanding operating systems, networking, and how the internet works before touching security-specific tools. This is the part people skip and later regret. Build a small home lab A free virtual machine and some curiosity go a long way. Break things on purpose. Fix them. This is where theory turns into instinct. Pick one foundational credential — and treat it as learning, not a finish line Something broad and respected (many people start with CompTIA Security+) is fine as a structured way to learn, as long as you understand it’s a starting credential, not a career. Find your people Join a community — online or local. Ask questions. Attend a free meetup. Careers in this field are built as much through relationships as through resumes. Look for an on-ramp role, not a dream role Help desk, IT support, junior sysadmin — these build the real-world troubleshooting instincts that security work is built on. Almost nobody starts at the top. Document what you learn Notes, write-ups, a simple portfolio. It proves your learning is real, and it becomes something you can talk about in interviews and with mentors. Expect the timeline to be longer than you’d like And keep going anyway. This is the step most guides leave out, and it’s the one that matters most. 07 / Why this matters to us You don’t need to come from a technical background to belong here. Oluma exists because cybersecurity has historically felt gatekept — full of jargon, expensive courses, and the assumption that you already know what a “packet” is. We don’t think that’s fair, and we don’t think it’s necessary. What this field actually needs more of is people who are patient, curious, and willing to keep learning — not people who already had a head start. So if you’re starting from genuinely zero: that’s a completely normal place to start. Come with the curiosity. We’ll help with the rest — free resources, real explanations, and a community that would rather tell you the truth than sell you a shortcut. Start learning free → Explore cyber roles