From classroom to consulting: A student’s first year inside the cyber industry

Cyber security is often introduced to tertiary students through its most visible and exciting elements. Capture-the-flag competitions, penetration testing labs and attack simulations dominate coursework, student societies and online communities. Much of the conversation in university environments still revolves around a red team vs blue team narrative - offensive security on one side, and defensive roles such as SOC, incident response or digital forensics on the other. These are the parts of cyber security that translate well into competitions and demonstrations, and they shape how many students imagine their future careers.

But what happens when students reach their penultimate year, start applying for jobs, or enter the workforce for the first time? Many encounter a disconnect between what they expected cyber security work to look like and the reality of how organisations actually approach security.

This disconnect is not because the industry is less interesting than students imagine. Rather, it often stems from a narrow picture of the field that forms during university. Cyber security is frequently imagined as highly technical, hands-on work focused on attacking or defending systems. In practice, a large portion of the industry operates within a much broader organisational context.

Over the past year I have been navigating two environments at the same time: studying cyber security and business full-time at university while working in the industry as a security analyst intern. Entering the field, I expected the transition from university to industry to feel relatively natural. Instead, I quickly realised that much of the day-to-day reality of cyber security work looks very different from how it is presented to students.

Many roles in the field are less about breaking systems and more about understanding organisations. Much of the work involves identifying how technology, people and business processes intersect, translating technical issues into business impact, and helping organisations make decisions about risk. These dynamics rarely appear in university labs or CTF environments, but they shape how cyber security functions in practice.

One example of this gap is how certain roles are perceived within student communities. (GRC) work is often reduced to "policy writing" or seen as less technical. In reality, these roles require significant breadth. Practitioners need enough technical understanding to assess controls, enough risk fluency to prioritise what matters, and enough organisational awareness to translate security issues into strategic decisions across the business.

At the same time, students frequently feel pressure to follow a narrow path in order to be considered employable. Certifications, competitions and technical portfolios are often treated as the primary way to stand out. While these activities can be valuable, they can also reinforce the idea that cyber security careers exist only within a small set of technical roles.

This session reflects on the experience of navigating university and industry at the same time. It explores how student expectations about cyber security careers are formed, how those expectations shift when entering the workforce, and why understanding the broader organisational context of cyber security is essential for building sustainable careers in the profession.