How to get an interview when changing or entering fields

How do you get onto the first rung of a new career ladder?

A common (and entirely reasonable) complaint from people trying to achieve this is that it often seems like you need five years’ experience just to get a junior position. This article hopes to improve your chances of entering a new field by avoiding common and hidden pitfalls. It is based on my experience of running the MWR intern and graduate program, but the tips and advice here can be applied to almost any field.

Like any good exercise, the first step is research:



Know the industry, organization, and/or role you’re applying for. The actual day-to-day work (and therefore the skills of someone suited to it) may not be obvious.



Read widely on the industry. If you're excited to be joining the field, you will hopefully have done your research already, but you should know what people are talking about and the key debates. Reddit, Twitter, and conferences are good for taking the pulse of an industry.

Speaking of conferences, you can also use them – or social media – to chat to someone from the organization. Reach out. Many people are happy to have a coffee or beer bought for them or be contacted on LinkedIn. Ask them to tell you about the industry, its latest concerns, and who the significant people to know are.



Every organization is different and has its own culture, which it will be proud of. It will have its own stories, legends, and identity. Read the corporate webpage thoroughly, as well as blogs by the chief executives and key players. Watch interviews or listen to podcasts. How do they portray themselves? If they were trying to convince a customer to choose them or someone to work for them, what is their pitch?

What are their people like? Professional? Academic? Driven to win?

As mentioned above, this is also an opportunity to use public events like conferences to meet someone from the organization (or maybe a competitor). Chat to them about what the organization is about. How are they seen by themselves and others?



Do you know what you are signing up for? For many industries, the day to day of a junior role can be different to how it might be perceived. MWR's juniors (even those who studied Security/Hacking at university) often comment that the things that are really important aren't what they anticipated. For example, writing clearly and concisely will get you far as a junior, deep knowledge of crypto probably less so (unless coupled with great writing).

Many organizations have "day in the life" blogs or videos. These can be useful, but so can using social media, your network or public events to ask people what the job entails and what you need to be good at it.


The process

Different organizations have different hiring processes. Some will have thousands of applicants for a few positions and will automate the first stage. Others will outsource the first few stages. Some will have a number of stages, including assessment centers. (Spoiler: MWR is normally a manual paper sift, phone and in-person interview, all by people in the role being recruited).

The nature of the process affects what you have to do to shine. If the first stage is an automated sift, you need lots of buzzwords or terms from the job spec so that whatever is being searched is found in your CV. Some organizations (especially larger ones) have hard requirements for potential employees, such as certain degrees or qualifications. Regardless of how good you may be, if you don’t have the specified qualifications your CV might not even make it to the team doing the recruiting. Smaller companies often have softer requirements regarding qualifications and degrees (cough MWR cough).

The CV

The CV can be quite hard to get right and, to be blunt, few do. But get it right, and you leap to the top of the pile.



In any situation where there are a good number of applicants, those sifting paper don't have a huge amount of time to make a decision. You need to grab their attention early and hard.

Most organizations hiring entry-level positions aren’t looking for evidence the person has done the job before; they’re looking for potential to be really good at the job. They will know what sort of qualities indicate potential and the job spec will either state it or will at least hint at it.

Start with a blank sheet of paper (except for your name and contact details at the top).

You need to carefully populate this blank piece of paper with only things the sifter will be interested in. In terms of length, your CV can decrease with seniority. When you're a junior, two pages AT MOST. One is good. As an experienced hire, one page. As an industry legend, your business card will become enough to get an interview (although this may not be true at many large organizations where all applications will need to be supported by a long list of qualifications).

“In 4 years and several hundred CV's viewed, I have never had school results influence a hiring decision.”

Consider losing normal sections you might put in. If your "projects" make you stand out more than "previous employment", lose previous employment. I would recommend keeping school results off – in four years and several hundred CV's viewed, I have never had school results influence a hiring decision.


What goes on there?

How does the organization differentiate themselves from their competitors? That’s how you need to differentiate yourself from yours.

Are they super slick and professional? You need to be. Are they eccentric and creative? So are you. Do they pride themselves on their research (cough MWR cough)? Your research needs to shine through.

Make no mistake – you also have competitors, and you need to help the sifter quickly see why you alone should go to interview. A common mistake is a CV that hangs on the university and course you did. This is subconsciously saying that anyone from that course and university is equally suited to the role, so how do you stand out from your course mates?


Specifically, what goes on there?

You need to make sure you are hitting all the points from the job spec, even if you have to think laterally to do so. For example, you may not have experience doing a particular task, but perhaps you have done all of the elements required as part of other experiences.

Seed your CV with things you want to be asked at interview. MWR's interviews often focus heavily on drilling down to these details – fill your CV with things you are proud of and be well versed enough to survive a technical grilling. Bear in mind, not all organizations do this and many will have mostly competency-based questions.

Make sure that what you put in your CV is specific and measurable. Anyone can write "passionate", but without evidence, it is fairly meaningless. "Passionate: Attended X,Y,Z conferences in my spare time " is much more persuasive.

Show you know the industry and role. Anything you can put in that shows you know what makes someone succeed in your chosen industry is good.

People may Google you, so lead them where you want them to go. Consider a Github page, ResearchGate or Twitter link. One CV we received didn't jump out at all and it was only a Github page that detailed a list of impressive projects that prompted us to offer an interview.

“How does the organization you want to work for differentiate themselves from their competitors? That’s how you need to differentiate yourself from yours.”


Traps to avoid

These are some common errors we see on CVs that are worth making sure you avoid, as they can kill an otherwise good application.

Spelling mistakes. The CV is arguably the document that has the biggest impact on your life by word count. The care spent on it needs to reflect that. Once you’ve completed a good first draft, take a break and review it later with fresh eyes, or ask a friend to proofread it.

"Attention to detail". We paper sifters and interviewers aren't necessarily good people. If someone lists "attention to detail" in a CV I make a point to find a grammar or punctuation mistake. Rarely is there not one. Leave this out.

Big block of text. Remember the sifter might be reviewing hundreds of CVs. A CV that is just a wall of text will make the sifter mentally have to work harder to find what they’re looking for. Make it easier.

Statements without evidence. Filling a CV with meaningless attributes like "team player", "effective", and “hard working” need to be evidenced or they'll be ignored.

Unfounded assessments of skill. In a rush of enthusiasm it can be tempting to over-rate your skills. Be reasonable with where you are. If you put "expert" or "highly experienced", then you should expect to provide evidence. A regular example: people who put "highly experienced with Metasploit" but cannot say which language it's written in.

Generic, untargeted CV. A CV that has been made to apply for thirty jobs stands out – and not in a good way. I would recommend crafting each CV for the job advertised, tailoring the experiences you want to highlight to the job specification. You will have more success spending a week properly applying for three jobs than you will sending one CV to thirty.



Entering a new field can be daunting, but it is definitely possible. Know what you're going after, know how you stand out, and develop yourself if you want to stand out more.

Companies are hiring entry-level roles. A huge number of MWR's senior staff started at entry level. Our UK Managing Director started as an intern, as did the Associate Director running our U.S. division. Two of the directors of our South Africa office started as juniors, as did many of our people you see presenting at conferences (including myself).

If you want to stand out, you need to make it as easy as possible for the team reviewing applications. We try, but we're only human. Help me to hire you.



Accreditations & Certificates

MWR is an accredited member of The Cyber Security Incident Response Scheme (CSIR) approved by CREST (Council of Registered Ethical Security Testers).
MWR is certified under the Cyber Incident Response (CIR) scheme to deal with sophisticated targeted attacks against networks of national significance.
We are certified to comply with ISO 9001 and 14001 in the UK, internationally accepted standards that outline how to put an effective quality and environmental management systems in place.
MWR is certified to comply with ISO 27001 to help ensure our client information is managed securely.
As an Approved Scanning Vendor MWR is approved by PCI SSC to conduct external vulnerability scanning services to PCI DSS Requirement 11.2.2.
We are members of the Council of Registered Ethical Security Testers (CREST), an organisation serving the needs of the information security sector.
MWR is a supplier to the Crown Commercial Service (CCS), which provides commercial and procurement services to the UK public sector.
MWR is a Qualified Security Assessor, meaning we have been qualified by PCI to validate other organisation's adherence to PCI DSS.
As members of CHECK we are measured against high standards set by NCSC for the services we provide to Her Majesty's Government.
MWR’s consultants hold Certified Simulated Attack Manager (CCSAM) and Certified Simulated Attack Specialist (CCSAS) qualifications and are authorized by CREST to perform STAR penetration testing services.