Black screen. Green text falling down it. Someone typing at the speed of ligh, who after ten seconds announces: "I am in."

Ask what does a cybersecurity specialist actually do and that scene is the picture most people have. It describes maybe one percent of this industry. Maybe they have gadgets like that somewhere in a three-letter agency. The rest of us do not.

If you are considering this field, you should know what the work looks like before you spend a year studying for it. Here is the honest version - a real day, the five career paths that exist behind the job title, and the parts nobody puts in the recruitment brochure.

Where the myth came from, and what it costs you?

Film and television did this industry a disservice. Every Hollywood thriller with a laptop in frame paints the same picture: a brilliant loner in a hoodie taking over critical infrastructure in three minutes.

The result splits people into two groups. Some conclude the field is impossibly hard and reserved for geniuses. Others - and this is worse - conclude it is non-stop excitement, then quit eight months in when they discover most of the job is patient, methodical work.

The truth lies between the two. Less cinematic than Hollywood, and still genuinely absorbing.

Take penetration testing, the role closest to the movie version. Yes, you attempt to break into a client's environment. You also produce a mountain of paperwork wrapped around it, before and after. Someone can handle the pre-engagement paperwork in sales. Documenting what your test actually found is your job, and there is a lot of it, because the client paid for the report, not the thrill.

The days when hacking was cheerful and consequence-free are gone.

What does a cybersecurity specialist actually do on a normal day?

I am a cybersecurity engineer, blue team by default, meaning the defender's side. I work remotely with a handful of Microsoft 365 clients.

Morning: I check alerts from Defender and Sentinel. Most are false positives - someone signed in from a new phone, someone clicked a suspicious link and automation caught it. Occasionally one genuinely needs attention, and that is when the day changes shape.

Then the news. Not general news - news from this small corner of the world. Sometimes a single headline ruins the morning. Instead of making breakfast you are urgently preparing and deploying a patch, because someone somewhere published a zero-day and the clock is now running.

That is the rhythm. Long stretches of methodical work, punctuated by moments where the priority list gets rewritten in five minutes.

Five paths, and they are genuinely different jobs

When you ask what does a cybersecurity specialist actually do you have understand that there's no simple answer. This matters more than most career advice admits: cybersecurity is not one job, it is a family of jobs. A role that suits you badly for one reason may sit right next to one that fits perfectly.

Blue Team - the defender. Monitoring, alerts, incident response, hardening environments. This is my daily work and a good start for anyone with an administration background.

People underrate this, but a large share of attacks can be avoided, or their reach dramatically limited, purely by having an environment that is patched and where permissions are properly assigned. Nobody running as global admin on their workstation all day. That is the most basic example of asking for trouble.

Red Team / Pentester. Closest to the film version, and in practice extremely methodical and documentation-heavy. You find holes before attackers do.

Watch the boundaries. It is very easy to get into trouble by testing beyond the agreed scope and hitting production systems you were never authorised to touch. Breaking in is satisfying. If it was not what the client signed up for, there are consequences.

SOC Analyst. Security operations centre work. Team-based, often shift-based, a high volume of alerts. A strong entry point because you learn a great deal very quickly.

Compliance / GRC. Governance, risk and compliance. Zero code, a lot of documents, audits and frameworks - ISO 27001, NIS2, GDPR. For someone who likes order, process and law. Very necessary and very underappreciated.

Honestly, this one is beyond me. Too much paperwork by my standards. Which is exactly the point - if paperwork is where you are strong, that is a whole career other people are avoiding.

Security Architect. Designs what security should look like across an entire organisation. Requires substantial experience, and this is where the best rates sit.

It is also my favourite type of work. The dream scenario is a clean environment with nothing configured yet, where you get to design everything from scratch the way it should be done.

What you do not need to know to start

What does a cybersecurity specialist actually do and what really is needed? First of all, you do not need to program. It helps. It is not required, especially at the start and especially in blue team or compliance roles.

You do not need expert-level Linux. Fundamentals are enough.

You do not need to be a mathematical genius.

What you do need is narrower and harder:

• Understand how networks and systems actually work
• Enjoy solving problems, including boring ones
• Be comfortable never knowing everything

The best part and the worst part of what does a cybersecurity specialist actually do

The best part is the feeling when you find the answer. When you stop an attack, or work out how to update dozens of applications across an entire user estate without touching a single machine by hand.

That gives me enormous satisfaction. It is also, for a lot of people, the reason they leave. It sometimes takes brutal patience to work out why something does not work. You can spend hours or days on it, and at the end discover it was something absurdly small that made a supremely complicated problem vanish instantly.

The hardest part is that you never get to be finished. In this field, and honestly in all of IT now, you cannot declare yourself trained and stop. You are learning constantly, and AI has intensified that rather than relieved it.

Which means choosing carefully matters more than ever. The volume of available topics is enormous and nobody can learn all of it. Pick a direction and go deep, slowly.
torosoft 365 deliberately. Partly because I was already in that environment, and partly for a practical reason: Microsoft makes access to its stack relatively easy. If you wanted to learn CrowdStrike or a comparable platform, you will not easily get a version you can install and experiment with. Some of those tools are better than what Microsoft offers. Very few of them let you practise.

The incident that taught me what this job really is

You could ask give me an example, what does a cybersecurity specialist actually do. Ok, so here's the an example from last week. A client called one evening. He had an alert - someone was signing into his account from China.

It was not a spectacular attack. It was an old password, no MFA, and an account shared between two people. We fixed it in 40 minutes.

No green text. No hoodie. But he slept well that night, and that is the satisfaction they never show in films.

Bottom line

Cybersecurity is a job for people who like solving problems, learn quickly, and understand that defence is where most of the work and most of the value actually sits. The movie version is a recruitment poster, not a job description.

I write weekly about M365 security for SMBs - join the newsletter on LinkedIn → https://www.linkedin.com/in/tomasz-szulczewski/