Unsecurity Episode 226: Infosec Buy In with Victoria Fogarty

### Overview In this episode of the Unsecurity podcast, hosts Brad and Megan Lenz are joined by Victoria Fogarty to discuss career transitions into information security during Cybersecurity Awareness Month. Although the episode title references "Infosec Buy In," the discussion centers on career pathways, overcoming the lack of a traditional technical background, internal career mobility, and navigating certifications and training programs.

### Key Topics - **Non-Traditional Career Paths**: The participants contrast their divergent entries into tech and cybersecurity. Victoria started without an IT background, earned a master's degree in information security, joined FRSecure as an associate consultant, and transitioned internally into an associate penetration tester role. Megan transitioned from an art and graphic design background into a hybrid IT/design position before focusing entirely on security. Brad began with an early interest in computers, worked non-technical jobs, earned networking certifications (MCSE, Novell CNA) through night school, and later formalized his security experience with the CISSP and CISM. - **Navigating Training and Education**: The group addresses the high financial and time barriers associated with breaking into cybersecurity, such as $5,000 to $10,000 boot camps and the $700 CISSP exam cost. They highlight free and low-barrier resources, including FRSecure's CISSP mentorship program, YouTube recordings of past sessions, Discord communities, and organizations like Women in Cybersecurity (WiCyS). - **Technical vs. Governance Roles**: The hosts and guest examine how diverse personalities fit into infosec, from hands-on technical penetration testers to governance and compliance specialists who rely on foundational principles and asking the right questions rather than direct configuration.

### Technical Details - **Hands-On Skills Development**: Victoria highlights the difference between learning policy/management in academic degree programs and executing technical tasks. She notes that applying commands without understanding their impact is dangerous, and mentions hands-on platforms such as Hack The Box and OffSec for building technical competence. - **Foundational IT Knowledge**: Megan and Brad emphasize that general systems administration—understanding workgroups vs. Active Directory domains, group policy configurations, standardized patch cycles, and network segmentation—translates directly into foundational security practices. - **Certification Progression**: Rather than jumping directly into comprehensive, difficult exams like the CISSP, the speakers discuss starting with entry certifications like CompTIA Network+ or Security+ to build grounding and validate technical knowledge.

### Takeaways - Prioritize researching accessible training, communities (such as WiCyS and online forums), and free mentorship opportunities before investing heavily in expensive boot camps. - Organizations that provide internal mentorship and take calculated chances on passionate employees enable successful transitions into specialized technical roles like penetration testing. - Exposure to broad frameworks (like the domains covered in CISSP training) helps newcomers discover which infosec niche—technical, consulting, or governance—aligns best with their interests.