This as-told-to essay is based on a conversation with Tannu Jiwnani, a 33-year-old principal security engineer at Microsoft in Redmond, Washington. It has been edited for length and clarity.
In June, after seven and a half years at Microsoft, I became a principal security engineer. When people ask what I do, I tell them, ‘I fight threat actors.’
I respond to threats like credit card fraud or phishing scams. As thousands of people get phishing links in their inbox every day, I work at scale, taking the scams down.
Whenever something critical goes down, I run the incident response. I make sure the right people are in the room, all the processes are in place, and the fire is put out so the systems can get back online. Then, I work to ensure that your credit card, email, and social media accounts stay secure.
Entry-level security roles typically start in the $105,000 base salary range, with total compensation higher once stock and bonuses are included. If you would like to break into cybersecurity yourself, there are five things you need to know.
1. Be prepared for the day-to-day changes
My day-to-day always looks a bit different, so be prepared for the unexpected. It depends on the activity of threat actors. For example, imagine it’s Thanksgiving and people are shopping online. If someone tries to steal a cent out of every transaction, that’s where we step in.
Our first task is to put out that fire: contain the situation, remove the bad actors, and ensure systems are running smoothly again. At the same time, we need to ensure that good people can still do their jobs — like a doctor accessing patient records in a hospital — without being hindered.
Related stories
Business Insider tells the innovative stories you want to know
Business Insider tells the innovative stories you want to know
After we take them out, we have to figure out what alerts, detections, and monitors we should put in so that it doesn’t happen again. We have to ask ourselves, how did they get in? What are our learnings to make sure this doesn’t happen again?
2. Start learning early and get hands-on
If you’re early in your career, research and educate yourself through courses, lectures, podcasts, and YouTube videos. I’d highly recommend checking out TLDRSec, which curates excellent security content. Certifications can also be a helpful way to structure your learning and build a strong foundation.
Beyond that, you can also get hands-on experience by playing games. Tools like Capture the Flag exercises let you practice in a gamified environment, exploring dummy websites or simulated systems.
AI has streamlined many parts of cybersecurity by automating detection and analysis, but it has also introduced new risks as attackers use it. My advice is to build strong fundamentals first and then explore AI tools to augment, not replace, your skills.
Networking also matters. Attend meetups, conferences, and internships whenever possible. If you’ve demonstrated potential in any role, reach out to people in the field — connections and proven capability can open doors, even if you’re just starting.
3. You don’t need a traditional path to get here
I started my career as a business analyst in the airline industry and then moved to a data analyst role for anti-money laundering. After that, I moved into processes and then into security — but not as a cyber incident responder at first — more on developing tools in cybersecurity. I eventually landed in an incident responder role.
I wasn’t specifically trying to get into cybersecurity; I just knew I was good at IT and program management and wanted a new challenge. Then someone trusted me and said, “How would you like to join our organization as an early-career security person?” It was challenging, but focusing on delivering results in ambiguous situations is what got me here.
There are more common routes into cybersecurity. Someone might pursue a degree in cybersecurity, computer science, or information systems, and complement it with courses in threat intelligence, digital forensics, and detection engineering.
4. You can be remote, but community helps
Where you work often doesn’t matter at all. Most of my team is in Dublin, Utah, or a small town in the UK. However, it does help to be in a place with others doing the same job as you, especially if you want to network and learn hands-on.
There are some late nights. You might be in the middle of the fire working till 3:00 a.m., and in those cases, it’s good to have that community feeling.
I love coming into the office because I love to meet people, see if I can joke a little bit about it, and try to solve the same problem together. It’s amazing to be able to work from home, but sometimes it’s nice to be together.
5. You must be able to handle high-pressure environments
When you have a job like mine, you need to know how to maintain calmness in a room full of chaos. It’s important to make sure everyone else stays collected and does their job because the moment you lose that, nothing gets done. That ability to create clarity in the middle of chaos isn’t something you learn in college — it’s something you practice and develop on the job.
It’s also OK — and important — to know when to ask for help. One mistake people make is that they don’t ask questions. Everyone is on edge when something goes wrong, but that’s exactly what you should do. Be the trailblazer.
One thing I love about my job is the immediate impact. You might think to yourself, I saved someone’s email inbox from being hacked and got it back to them. Although it’s high-pressure and can be chaotic, the perk is that you get to see the impact of helping someone right away.