I have a bachelor’s in Information Technology. Almost six years in this industry: tier-one and tier-two investigations in a SOC, then detection engineering at Datadog, now detection & response at Amazon. College wasn’t a waste of time for me.
But 2026 isn’t the environment I came up in, and if I were 18 again walking into my first semester, I’d do this very differently.
Three things changed. More people hold a degree and a Security+ than there are entry-level seats for them. AI is already doing a chunk of what used to be somebody’s first job: summarizing logs, writing basic scripts, drafting first-pass triage. And the biggest threat to actually building skill now isn’t a lack of resources. It’s your attention.
Also, my goal wouldn’t be to graduate with a degree. It would be to graduate with four years of evidence, starting week one, that I belong in this industry.
I wouldn’t assume I need a cybersecurity degree
I’d be choosing one of three degrees: Computer Science, IT or Information Systems, and Cybersecurity. All three get you here. The real question is what foundation you want underneath security.
CS goes deeper on programming, algorithms, data structures, and computing theory. IT puts you on the systems side: networking, operating systems, infrastructure, cloud, server administration. Cybersecurity programs give you a security-focused curriculum from day one.
I did IT, and that systems foundation has been immensely useful because security engineering is still engineering. You can’t investigate a Linux server without understanding Linux. You can’t analyze network traffic without understanding networking. You can’t secure AWS if you’ve never deployed anything to it. However, I had to learn to code on my own.
There’s a newer wrinkle too. AI writes code, generates configs, and explains concepts faster than almost any professor. Genuinely useful. It also means the value isn’t in memorizing syntax anymore. It’s in understanding systems well enough to know when the AI system is wrong. In security and compliance work, being confidently wrong about a control is how you get breached, not just how you get a bad grade.
So I wouldn’t ask whether the degree says cybersecurity. I’d ask what I’ll actually know how to do when I finish it.
I’d weigh the boring stuff seriously, too: cost, flexibility, the real curriculum, and whether the school is thinking about what happens after graduation or just during it.
A note on this issue’s sponsor
Grand Canyon University sponsored the video behind this issue, and it fit the topic. GCU has over 400 programs, including cybersecurity, built around career preparation and hands-on skills. There’s a personal piece for me as well. I’m a Christian, and GCU builds faith into education the same way I think about it: not just earning a degree, but discovering your God-given purpose and living it out through learning, leadership, and service. GCU offers both campus and online paths, and in 2025 awarded more than $404 million in institutional scholarships. Private. Christian. Affordable. Nonprofit.
Freshman year: apply before you feel ready
This is the one part of my own story I’d repeat exactly, and lean into harder.
I got my first internship freshman year at a company called BenefitMall. Not by applying to Amazon or Google. I got it by applying to smaller local companies after getting turned down everywhere else. By sophomore year, I had a cybersecurity engineering internship offer from Intel in June, two months before the start date, after people told me it was already too late to try.
Most advice says spend years one and two getting ready, then chase internships junior year. In 2026, I think that’s dangerous. If the entry-level market is already tight and AI is already absorbing the easiest first-job tasks, waiting two years to build verifiable experience means starting the race two years behind.
So freshman year I’d do two things at once, not in sequence.
Learn fundamentals. Networking, Linux, Windows, basic programming, Git. How operating systems work. What DNS actually does. What happens when two computers talk to each other. Processes, permissions, authentication.
Apply that same semester. Help desk, sysadmin, cloud, networking, anything that puts me around real infrastructure. You are never going to feel ready. I didn’t. You get the internship first, and the readiness catches up.
And alongside both, a homelab. VirtualBox, VMware, Proxmox if I have spare hardware. A Linux box, a Windows machine, maybe a Windows Server. I’d break things on my own time and figure out how to fix them.
I broke down the full internship strategy (resume, technical prep, timing, target companies, interviews) here:
Sophomore year: the lab becomes cyber-focused
Ideally, I’m interning again with more responsibility, and layering security onto that IT base. How Active Directory works and how attackers abuse it. What an EDR actually sees. What gets logged when someone authenticates. What malicious PowerShell looks like next to normal PowerShell.
That’s when the IT lab turns into a real security lab. Deploy Wazuh, Splunk, or Security Onion. Collect Windows logs with Sysmon and Linux logs alongside. Generate telemetry, attack your own environment, then go look at it from the defender’s chair.
This is also where I’d use AI deliberately: explain a concept I’m stuck on, debug a script, quiz me on what I just learned. Not generate a detection rule without understanding.
If you can’t explain what the AI gave you, you haven’t learned anything. You’ve outsourced the exact part of the job that was supposed to make you employable.
Certifications, with receipts attached
Somewhere in year one or two: Security+, maybe Network+ if networking is shaky, maybe a cloud cert.
I made this mistake myself. It’s easy to get addicted to collecting them. Every “congratulations, you passed” screen feels like progress, and it is. But passing an exam proves you can pass that exam. AI has made cramming multiple-choice easier than ever, so a cert alone tells an employer less than it did five years ago.
Certs support learning; they don’t replace it. Security+? Put a project next to it. AWS cert? Show me what you built in AWS.
The fight that runs all four years
When I was in school, there were distractions, but they weren’t engineered against me the way they are now. Short-form video, endless feeds, notifications, all designed to fragment your attention into smaller pieces.
The skills that matter here require the opposite. Reading logs carefully. Following a chain of reasoning through an investigation. Sitting with a problem you don’t understand yet. Sustained, boring, uninterrupted focus.
So I’d treat homelab time like a class I can’t skip. Phone in another room, one task, a timer if needed. And I’d be honest about the difference between learning and consuming content about learning. A two-hour video on AD attacks feels productive. Two hours building and attacking your own AD, getting it wrong four times before it works, is productive.
Everyone has the same tutorials and the same AI now. The differentiator isn’t access to information. It’s who can sit still long enough to use it.
Years two and three: pick a direction
Cybersecurity isn’t one job. Detection engineering, cloud security, AppSec, pentesting, security engineering, incident response, threat intel, GRC, identity. At some point you have to go deeper.
I didn’t start in detection engineering. I started in a SOC on tier-one alerts and worked my way in. Picking a direction doesn’t mean landing there day one. It means having a target instead of drifting.
Then build toward it. Detection engineering: write detections, generate telemetry, learn Sigma, learn how logs get parsed and normalized, learn Python. Cloud security: build environments, learn IAM, Terraform, containers, Kubernetes, cloud logging. AppSec: write a lot more code, learn CI/CD, learn how applications actually get built.
The goal is walking into an interview with something you built, broke, and fixed, not a summary of a course you watched.
Senior year should be boring
If the earlier years went right, I’m not scrambling for a first internship. I’ve had two or three, probably with a return offer or at least a team that knows my work. Degree nearly done, a couple certs, real projects, a homelab, a clear direction.
Now I document properly. GitHub. Writing about what I’m learning. Talking to people already doing the job I want. That’s literally what became Cyberwox for me. Documenting my own journey publicly turned into a body of work that speaks for itself in a way a resume never could.
And I’m applying for full-time roles before graduation, not after somebody hands me the degree.
What I’m Taking Away From This
The shift is timing, not credentials. Not which degree or which certs. It’s refusing to split college into two years of preparing and two years of doing.
Every piece has one job. Classes give structure. The degree gives a credential. Certs give focused learning. Projects give practical experience. The homelab gives somewhere to experiment. Internships starting freshman year give real exposure early enough to compound. Documenting all of it gives proof.
Attention is the actual scarce resource. AI raised the floor on information access and did nothing for your ability to focus for three uninterrupted hours, which is exactly why that ability is worth more now.
The Challenge
You don’t need your career figured out at 18. I definitely didn’t. Explore, build things, break things, find what you’re actually interested in.
But don’t treat the degree as the destination, and don’t assume you have time to wait.
So do one thing this week: apply to one internship you feel unqualified for, or spin up one VM and start the lab. Then reply and tell me which, or drop it in the Discord.
Graduation shouldn’t be where your cybersecurity journey starts. It should be where you cash in four years of proof.
Sources and further resources for this issue:
Interested in sponsoring Cyberwox?
Sponsoring Cyberwox helps me continue creating practical cybersecurity education, labs, and industry analysis while connecting your brand with a trusted multi-platform audience of 120,000+ cybersecurity practitioners, engineers, students, founders, and technology leaders across the global cyber community on our YouTube, LinkedIn, X, & Substack 🌎
Until Next Time
That’s it for this one.
As always, keep learning, keep building, and keep thinking deeply about the systems we’re trusted to defend.
See you in the next one.
~ Day 💙
This issue includes a sponsored mention from the original video sponsor.