The 90% That Saved My Cybersecurity Career

The 90% That Saved My Cybersecurity Career

By Kopal · Build With Her Magazine

I had skills. A lot of them.

That was never the problem. The problem was that I had no idea which of those skills actually mattered — and I didn't find that out until I stopped guessing and started measuring.

For months, I was circling cybersecurity without landing anywhere inside it. I'd tell people I was "into security," and when they asked which part, I'd say VAPT, or maybe ethical hacking — because those were the names everyone outside the field recognized. They sounded like cybersecurity. They felt like the obvious front door.

So I applied. I tailored. I waited.

And I didn't get a single interview.

Not one callback, not one recruiter screen, nothing. And the strange part was, it wasn't because I lacked skills. I had certifications, projects, hands-on practice — enough that on paper I should have been in the conversation. But I kept getting silence, and silence is the hardest rejection to learn from, because it doesn't tell you what you got wrong. It just tells you to keep guessing.

So I did what most of us do when we don't know what's wrong: I tried to fix everything at once. More tools. More topics. More breadth. I thought the issue was that I didn't know enough. It never occurred to me that the issue might be that I knew a lot, but not the right things, for the wrong roles, and nobody was telling me that directly.

The turning point wasn't a mentor or a course. It was something almost embarrassingly simple.

I took my resume and a DevSecOps job description and ran them against each other to see where I actually stood — what an ATS would surface, which skills lined up, which didn't, and what the real match looked like. I wasn't expecting much. I'd run this kind of check before on VAPT and ethical hacking roles, half-heartedly, and the numbers had always come back mixed — close enough to feel hopeful, never close enough to feel certain.

This time the score came back at 90%.

Ninety percent. Not a vague sense of "I think I'd be good at this." A number, sitting right next to the exact line items that were pulling it up — automation, cloud security fundamentals, the kind of engineering-adjacent security work I'd been doing without fully naming it. For the first time, I wasn't reading a job description and hoping I fit. I was looking at evidence that I already did.

That 90% did something my certificates and my confidence never could: it gave me a reason to stop spreading myself across three sub-domains and commit to one. Not because someone told me DevSecOps was trendy, and not because it sounded impressive at a meetup. Because the match was sitting right there in black and white, and it was the highest I'd ever seen.

I want to be honest about what that moment actually was, because I think it gets romanticized. It wasn't a lightning bolt of clarity. It was relief. The relief of finally having a filter — something that could tell me "spend your energy here, not there" — after months of not having one. Up to that point, every sub-domain had looked equally plausible and equally out of reach. The score didn't make the work easier. It made the direction obvious, which is a different and arguably more valuable thing.

Looking back, I think the real lesson isn't "use an ATS checker," even though that's the literal mechanism. The real lesson is this: skills without a target are just potential energy. They don't move you anywhere on their own. I had the skills the whole time I was getting silence. What I didn't have was a way to see which target they were actually pointed at — and once I had that, the rest of the path got a lot less foggy.

I'm in DevSecOps now, doing the cloud security and automation work that resume match was pointing me toward. I didn't get here by being more talented than I was during the months of silence. I got here by finally measuring instead of guessing.

If you're early in security and you feel like you have the skills but not the interviews, my advice isn't to learn more. It's to find your number first. Find the role where your existing skills already score highest, and let that number — not the noise of which sub-domain sounds the most impressive — decide where you aim next.

Ninety percent didn't just match a job description. It saved me from quitting on a field I was actually built for.

Kopal is a Senior Information Security Engineering Analyst working in DevSecOps and cloud security, and the founder of the Behind the Firewall Podcast.