The Dell Pro powered by Intel® Core™ Ultra with Intel vPro® adjusts power usage based on how you work, so your battery life never slows you down.

Explore More

Alright, let's have a yarn.

I've been doing this for a while now. Cybersecurity consultant, digital nomad, freelance operator. I've worked in multiple countries, sat on both sides of the interview table, and watched countless people bang their heads against the wall trying to break into tech.

And the advice they're getting? It's cooked.

You've got universities flogging degrees that cost $40,000 and teach you theory from 2014. You've got bootcamps promising you'll be a "cyber ninja" in six weeks. You've got LinkedIn gurus telling you to "just network" while they try to sell you their $997 course.

Here's what nobody's telling you: the industry doesn't need more people with certificates. It needs people who can actually do the work, show their working, and prove they give a damn.

This isn't a quick fix. It's a campaign. Let's get into it.

Let me hit you with some numbers so you understand exactly what you're walking into.

Australia is short on cyber workers. Properly short. The Australian Computer Society reckons we've got about 137,500 people in cyber and need another 54,000 by 2030 just to keep up. Jobs and Skills Australia data shows more than half of Australian Government agencies are already experiencing critical cyber security skills shortages. AI and machine learning were cited by 28% of employers as an acute shortage area, with cybersecurity at 26%.

That's the good news. Demand is real.

The bad news? Entry-level roles are still competitive as hell. Some job ads in the last couple of months are asking for three-plus years of experience for positions labelled "entry level". The bar is high because the market can afford to be picky — even with a shortage, employers are still looking for proof you won't be a liability.

Here's the critical distinction: there's a shortage of experienced cyber workers. There's no shortage of people who've done a Cert IV and think they're ready to be a SOC analyst. That gap — between having qualifications and being genuinely hireable — is where most people fall over.

So the question isn't "how do I get a certificate?" It's "how do I become the person an employer can't afford to pass on?"

Here's the thing people don't want to hear: you probably shouldn't start in cybersecurity or AI.

I know. I know. You watched some YouTube videos, you've got the hoodie, you're ready to hack the planet. Sit down.

The overwhelming majority of people who are genuinely successful in cybersecurity started somewhere in IT. Help desk. Service desk. Network support. Systems administration. These aren't glamorous roles, but they teach you how systems actually work, how they break, and how organisations actually operate. You cannot defend what you don't understand.

David Lee — that's me, by the way — has been saying this for years. If you look at the career paths of people who actually make it in this industry, you'll see the same pattern: they paid their dues in the trenches before they moved into security. The ones who skip straight to trying to be a pentester without understanding how a domain controller works? They struggle. Badly.

Search "IT support" on SEEK. There are hundreds of these roles. Remote IT support trainee positions paying 3,000 a month. Junior Service Desk Analyst roles. Traineeships that fund your Certificate IV or Diploma in IT while you work with real clients from day one.

The Australian Government's Tech Career Starter Program requires a Cert IV or Diploma in a related ICT discipline completed between January 2021 and February 2026, plus Australian citizenship. If you're eligible, that's a legitimate pathway.

But here's the key: don't just apply and wait. You need to be doing something while you're applying. Which brings me to the single most important thing you can do.

If I could give one piece of advice to every person trying to break into IT, cybersecurity or AI, it would be this: build something. Build anything. Just build.

A home lab is not a nice-to-have. It's the difference between being another resume in the pile and being the person who gets the interview. When I see someone who's built their own lab, set up a domain, configured a SIEM, run through some CTFs — that tells me more than any certificate ever could. It shows initiative. It shows you can learn on your own. It shows you're actually interested in this stuff, not just chasing a paycheck.

Here's what a solid home lab looks like for someone trying to break into cybersecurity. You'll want a few virtual machines — something like VirtualBox or VMware. Set up an Active Directory domain. Spin up a Windows Server. Create some user accounts. Then add an attacker machine (Kali Linux is the standard) and a SIEM tool like Wazuh or Splunk Free to monitor what's happening. The whole point is to simulate a real enterprise environment so you can practice detecting and responding to attacks.

For AI, your home lab looks different. You need Python. You need Jupyter notebooks. You need to be working through datasets — even small ones. Kaggle competitions, UCI Machine Learning Repository, whatever you can get your hands on. Build a model that predicts something. Anything. A model that predicts housing prices. A model that classifies spam emails. The domain doesn't matter as much as the process: cleaning data, training, evaluating, iterating.

And document everything. Put it on GitHub. Write up what you did, what you learned, what broke and how you fixed it. Because here's the thing: hiring managers can't verify your skills from a certificate. But they can look at your GitHub and see exactly what you've built. That's proof.

One of the raw advice documents I found put it perfectly: "Creating your own home lab… and showing these skills off as experience on your resume followed up with huge amounts of passion and pride on your part will help to push you ahead in an interview".

This is the cheat code. There's no shortcut around it.

Right, let's talk certs. Because this is where people waste a lot of money.

Certificates are not a career. They're a filter. They get your resume past the first screen. That's it. After that, nobody cares whether you've got Security+ if you can't explain how a TCP handshake works.

That said, some certs are worth more than others. For entry-level SOC roles, CompTIA Security+ is the standard. For DFIR and incident response, GIAC certifications — GCFA, GCIH, GCIA — carry serious weight, though they're expensive. ISC²'s Certified in Cybersecurity is worth looking at because ISC² has been offering the training and exam for free.

For AI, certifications matter less. What matters is a portfolio. A graduate certificate in AI is enough to get your foot in the door if you've got the projects to back it up. But an eight-month piece of paper without anything to show? That's not going to cut it.

The Australian Government funds a lot of this training. Your eligibility depends on your state, prior qualifications, employment status and residency. Western Australia, the ACT and South Australia have active funding opportunities. Look into it before you pay for anything out of pocket.

But here's my real advice on certs: don't collect them. Use them. Pick one that aligns with the role you actually want, study for it, pass it, then move on to building something. The people who collect certs like Pokémon cards are usually the people who never build anything.

Blu Dot used Roku Ads Manager to drive incredible results for its furniture sales event. Its strategy hinged on custom audiences and retargeting, where intent was strongest.

“Roku has been a top performer,” said Blu Dot’s Claire Folkestad. “We have seen…CPMs lower than any other CTV partner we've worked with.”

Learn More

AI is the wild west right now. Which means there's opportunity, but also a lot of noise.

The University of Melbourne projects an estimated 200,000 new AI jobs in Australia by 2030. AI engineers are earning $145,000 to $200,000 or more in permanent roles. That's real money.

But you need to be realistic about how you get there. Most AI roles require a bachelor's degree or higher in computer science, mathematics or a related field. If you don't have that, you're not completely locked out — some employers explicitly say prior AI experience isn't expected and that "potential and curiosity matter" — but you'll need to work harder to prove yourself.

The pathway into AI looks something like this: mathematical reasoning for machine learning, hands-on model development, experience evaluating and improving model performance. You need Python. You need to understand probability, linear algebra and calculus — not at a research level, but enough to understand what's happening under the hood. You need to be comfortable with messy data, because that's what real-world AI work is: 80% data cleaning, 20% actual modelling.

The good news is there are free and subsidised pathways. The Institute of Applied Technology — Digital has been delivering free AI microskills courses designed for non-technical learners. The Australian Government has funded one million fully subsidised scholarships for an online AI microskill course. CSIRO's Next Generation Graduates Program welcomes applicants without a traditional STEM background.

But again — microskills and scholarships are the starting point, not the destination. You need to build things. You need a portfolio. You need to be able to talk about a model you built, why you made the choices you made, and what you'd do differently next time.

Your resume is not a biography. It's a marketing document. And most people's resumes are terrible.

Here's what hiring managers actually look for. Evidence. Not claims. "I have strong communication skills" means nothing. "I built a home lab with an Active Directory domain, configured a Wazuh SIEM, and documented three attack simulations with detection rules in GitHub" means everything.

Your resume should be two pages maximum. Australian government applications often specify a two-page CV limit. Structure it like this: a short profile at the top that states exactly what you're looking for and what you bring. Then your experience, listed in reverse chronological order, with bullet points that describe outcomes, not duties. "Responsible for help desk tickets" becomes "Resolved 40+ support tickets per week, maintaining a 95% satisfaction rating."

Then a projects section. This is where your home lab goes. This is where your GitHub repos go. This is where you show what you've built. And then a skills section — be specific. "Python (pandas, scikit-learn, TensorFlow), Linux (Ubuntu, Kali), networking (TCP/IP, DNS, DHCP), security tools (Wireshark, Splunk, Nmap)."

And here's something that a lot of people miss: tailor your resume for each application. Not just the keywords — the narrative. If the job ad talks about incident response, your resume should lead with your incident response projects. If it talks about cloud security, your resume should lead with your AWS or Azure experience. This takes time, but it's the difference between getting filtered out by the ATS and getting a callback.

Right, I need to talk about networking. And I know the word makes a lot of you want to crawl into a hole. I get it. I'm a bit of an introvert myself. But networking doesn't have to mean awkward small talk at industry events with people who are clearly just there to hand out business cards.

It means being present where the opportunities are.

The DC CyberSec Discord is a good start. There are people there who are actually working in the industry, who are willing to answer questions, share resources, and point you in the right direction. That's networking. Not selling. Just being part of a community.

Beyond that: go to meetups. Look up your local OWASP chapter, your local BSides conference, your local AI/ML meetup group. These are usually free or cheap, and they're full of people who are genuinely passionate about the same things you are. Talk to them. Ask questions. Not "can you get me a job?" — that's not networking, that's begging. Instead: "I'm working on a home lab project and I'm stuck on X. Any advice?" That's a conversation. That's how you build relationships.

And here's the thing that most people get wrong: networking is a long game. You're not going to meet someone on Tuesday and have a job by Friday. You're planting seeds. The person you have a chat with at a meetup might not have a role for you next month, but in a year, when they've moved to a new company and they're hiring, they might remember that curious person who asked good questions.

The Safer Internet Project — that's the Australian initiative I co-founded — exists precisely to help people navigate this. There are mentorship programmes to, community events, and resources designed to bridge the gap between where you are and where you want to be.

You've got the skills. You've built the lab. You've got the certifications. You've somehow managed to get an interview. Now what?

The interview is not a test of what you know. It's a test of how you think. Interview figureers are trying out one thing: can I put this person in front of a client or a system without having to babysit them?

So when they ask you a technical question, they don't just want the right answer. They want to see your process. If you don't know something — and you won't know everything — say so, but then say how you'd find out. "I haven't worked with that specific tool, but here's how I'd approach learning it" is a perfectly acceptable answer. Lying is not.

For entry-level roles, you'll get questions about networking fundamentals, operating systems, and basic security concepts. Know the OSI model. Know the difference between TCP and UDP. Know how DNS works. Know what a subnet mask is. These are the basics, and if you can't explain them clearly, you're not ready.

For AI roles, expect questions about your projects. They'll ask why you chose a particular model, how you handled overfitting, what metrics you used and why. Be ready to talk about failures. "I tried this approach and it didn't work because X" is more impressive than a perfect story with no obstacles.

And remember: the interview is a two-way street. You're evaluating them as much as they're evaluating you. Ask questions. What does the team structure look like? What does success look like in this role at six months? What's the biggest challenge the team is facing right now? These questions show you're thinking like a professional, not just someone who wants a paycheck.

If you have paid time left on an individual Granola plan, we'll match it with a Wispr Flow subscription that includes Notetaker and dictation, and add bonus time, up to 12 months total. Sign in or create a Wispr account and submit proof of your plan to check eligibility.

Try Notetaker Free

Here's the part nobody tells you: getting hired is not the end. It's the beginning.

The people who succeed in this industry are the people who keep learning. Not because they have to, but because they want to. Technology moves fast. What's cutting-edge today is legacy in three years. If you stop learning, you become obsolete.

So build the habit now. Read. Watch. Experiment. Break things and fix them. Follow the people who are doing interesting work — the security researchers, the AI engineers, the sysadmins who actually know what they're talking about. And when you get to the point where you can help someone else, do it. Because that's how this industry gets better.

The path into tech is not linear. You might start in help desk and end up in AI governance. You might start in AI and pivot to cybersecurity. You might do something that doesn't even have a name yet. That's fine. That's normal.

What matters is that you start. Not tomorrow. Not after you finish that course. Not after you've got the perfect home lab. Now. Today. Pick something small and do it. Set up a virtual machine. Write a Python script. Read an article about a recent breach and try to understand what went wrong.

Then do it again tomorrow.

The jobs are out there. The shortage is real. The demand is genuine. But the competition is also real. The people who get hired aren't the ones with the most certificates. They're the ones who can prove they can do the work, show their working, and demonstrate they'll keep showing up.

That's the game. Now go play it.