Why I Became a Security Engineer 🔐 as An Aspiring Software Engineer 💻

Cybersecurity has quickly became one of fastest growing industries 📈, offering benefits such as: competitive pay, remote work opportunities, diverse career paths and excellent job security.

“Cybersecurity Ventures’ prediction that there will be 3.5 million unfilled cybersecurity jobs globally by 2021, up from one million positions in 2014. Despite industry-wide efforts to reduce the skills gap, the prediction has come true and the world’s open cybersecurity positions in 2021 is enough to fill 50 NFL stadiums” (Morgan).

You often hear people attempt to break into cybersecurity (and tech in general) but struggle. The rising cost of college plays a role but large applicant pools and rigorous interviews have been gatekeepers for years.

1. My Journey Into Cybersecurity Was Happenstance 🎲

Despite this, I switched internally at Amazon from security engineer to software engineer after one year. Why? Well, my goal wasn’t to become a security engineer. My journey into cybersecurity was a dice roll. I majored in computer science and aspired to become a software engineer after loving coding my first semester. As a backup for no internship sophomore summer, I applied to a research program called Research Experience for Undergraduates (REU). The program offered students the chance to research and learn about a specific area in many fields. I applied to 14 computer science programs in fall 2018.

I got a response from Oakland University (OU) in spring 2019 and accepted. Although, what I’ve never told anyone is that I got a response from another university Texas State University (TSU) two days later, asking if I was still interested. The TSU REU program according to the school: “This Research Experience for Undergraduates (REU) Site engages students in research in the emerging area of Smart & Connected Communities (S&CC), the essential building blocks of smart cities”.

REUs typically don’t have interviews so it’s likely I would’ve received an offer but I’ll never know definitively. In an alternate reality, maybe TSU’s REU reaches out first and I’m in a different state and company now. It’s fascinating, how happenstances can drastically alter our lives. In the OU REU program, professors and their graduate research assistants presented their projects to all 10 of us undergrads, letting us pick our top 3. I chose the project, that felt like a coding-heavy introdution into cybersecurity. Thankfully, I got my first choice and my intuition was spot-on. The goal was to develop a secure communication scheme for IoT devices, which face security challenges because of resource constrainsts (low processing power and battery life).

The project gave me good cryptography knowledge, which is at the heart of cybersecurity. I had a blast learning about cyberattacks like distributed denial of service (DDOS) and learning the inner workings of crypto algorithms like AES, SHA and ECDH. During the summer, I also greatly improved my programming skills and loved learning at my own pace by jumping from one subject to another 📚. It was a nice break away from the traditional and rigid learning structure, where I learned one specific thing at a time before moving onto the next subject. Where, I only learned enough to complete a task and rarely had the luxury of taking time to explore those rabbit holes that nurture my curiosity.

I ended up landing a software engineer intern role at Cisco in summer 2020, where I learned more about some software engineering best practices (version control, code review, DRY) and how to work in a team. Then, during my new grad job hunt, I applied to over 300+ job postings and wait for it………………...only a single security engineer job 🎲, which was at Amazon! It’s ironic considering, I got the position despite never having taking a cybersecurity course or intending to pursue it as a career long term. I did end up getting 3 other software engineer offers and one 24 month (three 8 month rotations) technology development rotation program (one of roles was software engineer). My offers for my 2020-2021 job hunt are below.

I did a 180 and chose the Amazon offer for a few reasons. My goal was to stick around for ideally a year and switch internally or leave Amazon. Ended up picking the former, though I went through the same interview process as external candidates due to the role change. I ranked the rest of the sections in order of importance.

2. Compensation 💵

Come on, you probably knew this was coming 👀. My main reason for getting into tech wasn’t for the money though 😅. I love technology and would find a way to pursue it, even if it payed poorly. Although, it’s no secret that FAANG companies pay A LOT. I won’t reveal my Amazon offer since I currently work here, although the numbers were similar to entry level software engineer roles on Levels.fyi for Amazon. Meaning, my Amazon offer was nearly double my next highest offer. The difference was live changing so there wasn’t much consideration here.

There’s other notable things, when comparing large companies to small ones. For engineers, stock-based compensation at certain tech companies is a significant portion of their total compensation (TC). Large companies tend to have more stable stock prices with a history of consistent growth. Generally, the more you rise up, the more your comp is composed of RSUs. So being in big tech, means my comp is less volatile and grows consistently well, as I progress through the typical 4 year vesting schedule. In smaller tech companies, the growth can be very high like in Snap’s case, although it can fall just as fast and your TC could be cut by a significant amount (like 30% or more in mere months).

While these losses aren’t realized, it may take years for the stock to recover. The general advice is to sell your RSUs immediately, effectively treating them as cash since you’re taxed upon receiving them. So if I held onto company stock that’s tanked hoping for a rebound, I’d be taking on more risk. My best course of action is to sell immediately and realize these losses and invest ETFs for a much safer and tried and true method for generating wealth. The likelihood of smaller tech companies outperforming FAANG companies, during a four year vesting scheduling is incredibly uncertain. There’s a lot of volatility and thus risk, I think many overlook when accepting an offer.

I felt big tech RSUs were low risk and high reward, compared to most other companies. So FAANG was a prime target.

3. Career Growth & Culture 📈

A major reason people want to work at a tech company besides compensation, is the culture. Technology is not a feature nor an accessory, it’s THE product. At many companies people wouldn’t consider as tech companies, the focus is mainly on other sectors. For example, for a bank like Wells Fargo, the financial services take the spotlight. Compare this with SoFi’s (a fin-tech company) focus on growing its digital banking platform (Galileo), and embracing emerging tech, like crypto and you’ll see this.

That strong emphasis means more investment in improving tech, which translates incredibly for engineers. I got to work with modern technology (AWS), popular programming languages (Java, Python, Javascript) and learn best practices (CI/CD, code review, threat modeling and architecture review) from experienced engineers. I knew even if I did no coding at all in my new role, I’d likely learn a ton about cybersecurity and computer science overall. I believe understanding fundamental cybersecurity concepts, is important as a dev. As people create more social networks, financial services and other web applications (app stores, blockchains, etc.), these platforms become increasingly more valuable and prime targets for cyberattacks.

I was right and despite minimal coding, I still learned a lot. I discovered how a big tech company builds internal web applications and how they talk to each other. I learned how teams handle severe outages. I felt the uncertainty that comes with being on-call every 2–3 months. I was intrigued by the different authentication and authorization mechanisms within Amazon.

These companies are well-known for developing their talent. Many big tech companies offer great mentoring programs, where you’re paired with an engineer who’s been in the company for a while. It’s something I greatly appreciated during my time at Cisco. I had daily one-on-one’s with a coworker, where I asked questions about his decision to switch from law to software engineering, our team’s operations and questions about Cisco’s culture. I craved this quality of mentorship in future roles. Unfortunately, not every new grad get’s as much valuable time with their coworkers or managers.

I figure, for a company to reach a market cap in the billions or trillions, it must have developed a culture that promotes effective communication. So it would help me develop excellent communication, teamwork and other soft skills faster. As an Amazonian, I already learned one soft skill I’ll never forget.

4. Company Size 🏢

Some dream of working at small unheard-of startups. Others, long to get into tech unicorns like Databricks and Stripe. I dreamt of working at a large tech company. Big tech companies are generally more stable. COVID-19 brought a lot of uncertainty to the global economy. I’ve seen countless students and recent grads get offers rescinded on LinkedIn. I was thankful, my internship at Cisco wasn’t affected. My worst nightmare is resetting my job search 😬.

I sought job security, especially as a broke new grad. My parents are there to fall back but the peace of mind is bliss. Overtime, I’ve noticed big tech companies cut a great amount of “slack” to recent grads. I’ve observed smaller companies, expect too much from new grads. From expecting mature system design skills to ramping up in a month to understand a large codebase.

While big tech has high expectations, it’s known and accepted that a new engineer takes around 6 months to ramp up and become productive (a net-positive for the team). While it seems like someone could be a net-positive sooner, considering the productivity cost of team mentorship, it’s likely they’ll be a loss for sometime (especially as a new grad).

Big tech companies aim to hire engineers who are fungible. Quick-learners, who can perform on almost any team. Amongst tech companies, big tech had the most reasonable expectations for new grads I’ve seen. Don’t get me started, on the countless Reddit horror stores I’ve seen. Where new grads in some smaller companies, are expected to deliver complex projects with minimal guidance 🔥. With some managers even avoiding or cancelling one-on-ones. I’m good 😂.

I wanted to push myself without pressure that felt…unreasonable. The skills and intuition tech companies pay for, take years to develop. Some companies want a senior engineer for a bargain 🤔. Watch out 😬.

5. Lifestyle ⛱

I used to work at a bookstore in my hometown (Maplewood, NJ). The job was amazing by all accounts. Snack-galore, could sit down for hours, talked with customers, quiet atmosphere, holiday gift cards and super nice coworkers! Although, I quit when my first semester of college rolled around. I never told anyone why but I just wanted something new. I got my next job at a movie theater and had a to wear a uniform for the first time. The job was okay but wearing a uniform bothered me more than I expected. That job taught me what I didn’t want: a dress code.

At Amazon, I come to work and wear whatever. Nothing beats just tossing on an outfit. It allows me express myself comfortably while giving work a natural and authentic vibe. My dream job is coming in at a flexible time with a tee, shorts and flip flops (my favorite attire).

6. Location 🧭

The security engineer role was in Seattle, WA. I never thought I’d end up in Seattle 🤔, although WA was in my list of top states:

1. Texas
2. Washington
3. North Carolina
4. New York
5. Everything Else

Notice a pattern 🔍? All these locations have tech hubs! I wanted to live in a tech hub because it’d be amazing for future job hunts. I pondered, uprooting my life out of NJ for years. I was prepared though, it’s still hard to leave everything and start a new life hundreds of miles away. I don’t want to do that often.

Weather is critical for me. NJ’s weather has slowly felt more extreme (very cold in winter yet hot during summer). During the summer 2021 heat wave, many days in NJ were hotter than TX 🔥. I couldn’t ignore the lack of snow and warmer days anymore. The weather was just too hot and oppressive for the first time that whole summer.

So, why is TX first? Well, it’s known for being cheap compared to most of the country, meaning more savings for me. TX also offered a healthy and growing tech scene. Although in hindsight, ending up in WA is a blessing in disguise. The weather in WA is ideal from a temperature perspective. It’s far more mild than NJ. Not too hot or cold. You probably won’t sweat from a summer afternoon walk in Seattle. Tourists visit Seattle during the summer in droves since it’s incredible here (in the low to mid 70s often). Although, weather is gloomy for around 9/12 months and still I’m acclimating to the lack of sunlight ☀️.

I wanted to live in a city as I love walking so I decided to go car-free. I knew going car-free would help me be more frugal and stay healthy. There’s a lot of fun stuff to do and people to meet in cities. Chosing a place to live is all about trade-offs. You usually can’t have it all and WA checked the most boxes.

Conclusion 🚀

I’ve learnt a lot from time in security but only scratched the surface. There was a ton I could’ve learned, ranging from how bug bounties were run at big companies to how incident response teams handled critical issues. If you take anything away from this, consider sometimes your journey isn’t always a straight path. It took me almost five years to achieve my goal of working at a big tech company as a software engineer, in a way I never imagined. I was and still am figuring things out as I go along.