Written for a different country

This is not a complaint about Americans. It is a complaint about the assumption, held by an enormous amount of well-meaning content, that the cybersecurity job market is one market.

It is not. The UK has its own employers, its own regulators, its own qualifications, its own salary structures and its own routes in. Someone following American advice in Britain will spend money on the wrong certifications, format their CV in a way that signals unfamiliarity, and prepare for an interview process that is not the one they will sit.

Some specifics, because vagueness is the problem here.

Certifications. The advice to get your Sec+ then go straight for CISSP makes sense in a market where CISSP appears on junior job descriptions. In the UK it appears on senior ones, and you cannot hold it without five years of documented experience anyway. Meanwhile BCS CISMP — which barely registers in American guidance — appears constantly in UK public sector and consultancy specifications, costs a fraction of the price, and is achievable in weeks.

Clearance. Enormous swathes of UK security work sit behind BPSS, SC or DV. Nobody writing from Virginia is going to tell you that a role you are qualified for is closed to you until you have been resident for five years, or that some employers will sponsor clearance and most will not.

The CV. Two pages. No photograph, no date of birth, no marital status. The American résumé conventions that leak into UK applications are noticed, and not favourably.

The interview. If you are applying into the civil service you will meet Success Profiles, with named behaviours and a scoring rubric that expects your examples to be structured against them. That is not a thing anywhere else, and walking into it unprepared is a straightforward, avoidable failure.

The frustrating part is that none of this is secret. It is simply not written down in one place, for this country, by anyone who has sat on the hiring side of it. Which, eventually, is why I wrote a book about it.