Start for the Passion, Improve for the Money, Stay for the Challenge
Cybersec Café #93 - 06/09/26
I’ve watched too many people get into cybersecurity for the paycheck and quit three years later - burnt out, bitter, and blaming the state of the industry for their shortcomings.
The ones who stayed, fought through the adversity, and actually became good got in for a different reason entirely.
They got in for the passion. Upskilled and improved for the money. And stayed for the challenge.
That’s the only sequence I’ve seen work, and the exact sequence I’ve lived over the last six years.
And anyone expecting the same results but approaching it in a different order will find themselves eventually washing out.
So whether you’re just starting in the industry, are a few years in, or are thinking about breaking in - make sure you have the correct mindset before you do.
- Today’s Sponsor -
Reading about cybersecurity won’t get you hired. Practicing it will.
That’s what Defend the Org is built for - writing the detection, triaging the alert, leading the incident, running the threat hunt.
Hands-on labs designed, custom engineered by professional blue teamers, around the exact skills you’ll use on the job.
Whether you’re pivoting into cybersecurity, landing your first role, or upskilling up in your current one - DTO is where you get reps in.
Get in for the passion
Passion is an entry-level requirement in this industry. It’s not just a tiebreaker for recruiters like you might find in other industries.
I didn’t get into cybersecurity because someone showed me a salary chart. I got in because it sounded badass.
That was the whole reason. It doesn’t need to be something deep.
The way cybersecurity got framed in media was what had me interested. A lot of marketing makes it look sexy and mysterious.
You’re the people who outsmart the bad guys.
This obviously is very far from the truth of what professionals do in their day-to-day, but at this point I had zero hands-on experience. The mystique got me interested.
But underneath the mystery I also had something more durable: I already loved technology.
I was studying computer science and interning as a software engineer right before I made the switch.
And before all of that? I loved video games. That was the original on-ramp (shout-out Watch Dogs) along with the curiosity about how things work, why systems behave the way they do, and what’s happening underneath the screen.
When I stumbled onto cybersecurity, it wasn’t a cold-start passion. It was a passion for technology that found its sharpest expression.
I get to set up the defenses. I get to outsmart attackers trying to break in. I get to think strategically against a real adversary.
That was enough to light the fuse.
And the fuse had to be lit, because this field will burn you out otherwise. Here’s what nobody tells you when you’re being recruited into cybersecurity by a TikTok salary screenshot:
The field moves faster than almost any other in tech because malicious actors don’t sleep.
You will always feel dumb in some corner of it. Cloud security, malware analysis, IR, detection engineering, identity - there’s always a domain that’s not yours.
Threat actors don’t clock out at 5. Working after hours is part of the job - forever.
Without passion, all of that can feel like punishment. With it, it feels like the reason you showed up.
The burnout pattern is predictable. People who entered for comp tend to plateau around year three. They learned enough to be useful at one job, but they can’t summon the energy to keep learning.
Passion isn’t what makes you stand out later. It’s what gets you through the part where you’re still bad.
Improve for the money
Your compensation growing is the consequence of getting genuinely good.
The people clearing the top of the band became a valuable asset: a mix of general cybersecurity knowledge mixed with deep domain expertise. The money chased them.
Here’s what “improve for the money” actually looks like in practice:
You’re reading threat reports to stay up to date with the state of the industry.
You’re standing up lab environments on weekends to practice writing detections.
You’re threat hunting at 11pm because something didn’t sit right.
You’re not chasing certs - you’re chasing skills.
Three or four years of that behavior compounds.
You’re not interchangeable anymore. That’s where the money lives — not in the title or the certifications you have.
Your expertise has become irreplaceable.
I’ll be honest: money was a major motivator for me to keep pushing once I was in.
A promotion dangled in front of me was all I needed. Titles never moved me - but the dollar amount attached to a title? That made me move with a purpose.
And that mindset is completely okay to have.
I’m a naturally frugal person in many aspects of my life. Spending money on myself has always felt hard.
So at first, it was difficult to spend money on things that would develop my expertise faster: lab platforms, courses, mentorship.
But I had to reframe my mindset. I had to stop calling it spending, and start calling it investing.
And flipping the script made it stop feeling like an expense, and more like it was capital I was putting to work.
And every dollar I put in has already come back tenfold.
But this only works if the underlying passion is there. The chase is brutal otherwise.
Work-life balance in cybersecurity doesn’t always exist. You’ll work more than 40 hours a week. You’ll work 12-hour days. You’ll work weekends when an incident hits. You’ll be studying after work.
It’s nonstop.
If the only thing you came for is the paycheck, you won’t find the joy, and the math stops working pretty fast.
But the way the world is moving - AI increasing attack surface in an unknown way, adversaries benefitting from AI, and defenders struggling to keep up - the cybersecurity industry is going to be more lucrative than ever.
The money flows most to the person who would still show up if it didn’t.
How to Stand Out in the 2026 Cybersecurity Job Market
The Cybersec Café is now more than just a newsletter. Check out the partner content on the platform of your choice - YouTube, TikTok, Instagram or X.
Stay for the challenge
There’s a third trap nobody warns you about: people who got in for the passion, got good, and made it to senior comp still leave the field.
Not because the money dried up but because they forgot to find the joy in what got them in.
The danger zone is somewhere around year five to seven: Comp is solid, the work feels easier, and the after-work labs have declined.
But the fire starts to dim because of those long hours, weekends worked, and difficult work.
What pulls you back is the part that’s actually unique about this field:
No two days look the same. This is not just a marketing line, it’s actually true.
There’s a real adversary actively trying to outsmart you. Almost no other job has an opponent like this.
The problems are constantly evolving. New TTPs, new attack surfaces, new tooling, new defensive paradigms. It never stops moving.
For me, the things that keep me engaged are the same things I sometimes hate in the moment.
Take incident response.
I sometimes hate being in the middle of one - the late Fridays, the early mornings, the weekend pages.
But when I stop to actually look at what I’m doing? It’s a game of mental gymnastics. I’m trying to decipher what an attacker was thinking, how they got in, how they moved, what their goal was.
That’s challenging, and honestly fun.
Detection engineering hits the same nerve.
After every incident, the question becomes: how do I detect this (or any derivative of it) if it happens again?
It’s like coaching a football game. When an attacker calls a play, did I watch enough film to recognize the formation before the ball is snapped? In other words, did I build the right detection?
Threat hunting is its own joy. 99% of hunts turn into nothing. But the 1% that does? The thrill of catching a real adversary red-handed before they’ve acted and spinning up IR to box them in before they realize you’ve seen them - there’s no money that buys that feeling.
That’s the part you have to protect.
Take the project nobody understands yet. Lead the incident nobody wants. Build the detection nobody’s tried. Hunt on that hypothesis that probably goes nowhere.
The challenge is what kept you here in the first place. It’s also the only real moat against your skills going stale.
Join a growing community of cybersecurity professionals who are serious about leveling up. Connect, collaborate, and grow your skills with others on the same journey. Engage in real-world security discussions and live events (coming soon!).
This is where the next generation of defenders can connect. Join for free below.
Approach it the Right Way
Cybersecurity rewards the people who would have done this work for free, pays them more than they could imagine, and hands them a new problem worth caring about every morning.
Get in for the passion. Improve for the money. Stay for the challenge.
That’s the only sequence that lasts.
Securely Yours,
Ryan G. Cox
P.S. The Cybersec Cafe delivers Deep Dives on a cybersecurity topic designed to sharpen your perspective, strengthen your technical edge, and support your growth as a professional - straight to your inbox.
. . .
For more insights and updates between issues, you can always find me on Twitter/X, Instagram, TikTok, YouTube, or my Website. Let’s keep learning, sharing, and leveling up together.