From outreach to early career: What works in building sustainable cyber security pathways

Australia’s cyber security challenge is often framed as a skills shortage, yet many capable individuals struggle to enter the workforce. This tension points to a deeper issue: not a lack of talent, but a lack of connected, sustained pathways from first exposure through to meaningful employment. 

In this session, we share insights from national research examining cyber security pathways across three stages: school outreach, university education, and workforce entry. Drawing on interviews with outreach practitioners, educators, university stakeholders, and individuals at the workforce entry stage, we present a rare end-to-end view of what works, and where pathways break down. 

At the outreach stage, engagement is driven by interactive learning, storytelling, and relatable facilitators. These approaches build confidence and interest, particularly among diverse cohorts, including young women. However, most programs are short-term and disconnected from longer-term pathways, limiting impact beyond initial engagement.

At the university and education provider level, individuals develop strong technical, interdisciplinary, and professional capabilities but often lack visibility of career pathways and structured transition opportunities. Pathways are diverse yet frequently under-recognised, including research, industry-embedded projects, work-integrated learning, cyber clinics, and engagement with entrepreneurship and startups. These experiences build real-world capability and industry readiness, positioning universities as key connectors within the cyber security ecosystem.

Despite this, a significant bottleneck persists at the workforce entry stage. Limited entry-level roles, unclear expectations, and a preference for experienced hires create substantial barriers. As a result, individuals successfully engaged through outreach and education may still struggle to transition into roles, risking both lost talent and disengagement.

While professionalisation initiatives help define roles and recognise capability, they largely focus on those already entering or within the profession, with less attention to earlier pathway stages.

The core issue, therefore, is not a pipeline shortage but a pathway continuity problem. Outreach, education, and employment efforts are often disconnected, with limited coordination across industry, government, universities, and communities. We also identify gaps in how success is measured, with most initiatives prioritising short-term engagement over long-term outcomes such as workforce entry, career progression, and contribution to national cyber security capability and resilience.

This session offers practical recommendations to strengthen cyber security pathways through a connected, ecosystem-based approach. For industry, this includes rethinking workforce entry through greater investment in entry-level roles, internships, and alternative pathways. For government and community stakeholders, it highlights the importance of inclusive, scalable outreach and sustained engagement. For universities and education providers, it reinforces their role as pathway connectors through authentic learning and strong industry partnerships.

If we want a sustainable cyber security workforce, we must move beyond isolated initiatives and work collectively to build connected pathways from first exposure through to meaningful careers.