The skills that actually transfer: what to learn for a long career in IT

When you're trying to break into a specialized IT role from scratch, "what should I even study?" is a hard question. I was there myself.

I started as a network engineer and now I do vulnerability assessment. After moving across roles a few times, one thing got clear: skills split fairly cleanly into the ones that transfer and the ones that don't. Here's how I tell them apart.

The hot tool ages out faster than you think

When you're job-hunting, it's tempting to chase whatever is most in demand right now. The tool names that show up in every posting, the framework everyone's talking about. I get it.

But a thing that's popular is, by definition, a thing that gets replaced in a few years. You learn it, and by the time you have it down the next one is already taking over. Chase only that, and you're chasing forever.

What lasts is the ability to understand how things work

The opposite of that is foundation, and foundation lasts. For me it was networking.

Back as a network engineer I spent my time in Wireshark, looking at traffic one packet at a time, reading what was actually happening on the wire. It was tedious, and at the time I half-doubted it had anything to do with security. But when I moved into vulnerability assessment, that foundation was exactly what carried over. Tools change; the ability to read what's riding on a request and a response doesn't.

You can always stack tool knowledge on top of a foundation later. Going the other way is much harder. So if you're going to spend time early, spend it on the foundation.

Pick "boring but durable"

The skills that transfer are usually boring. How communication works, OS basics, how data moves. There's no flash to them, and while you study them you don't get much of a sense that they're paying off.

But you can carry that understanding across roles and across whatever new tool shows up. The only reason I could move from networking into assessment was that the foundation came with me.

If you're starting out and stuck on what to learn first, I'd pick "the thing that'll still exist in ten years" over "the hottest thing right now." It looks like the long way around. It isn't.

The full route I took from network engineering into vulnerability assessment is something I've written up at length elsewhere. If this was useful, follow along.