Podcast Interview with The Financial Coconut - How to Pivot Into Cybersecurity (Without a Tech Degree)

TL;DR

• Mid-career professionals (ages 25–50) in Singapore are pivoting into cybersecurity successfully
• CFCI CEO James Lim and graduate Wee Suan break down what it really takes
• You don’t need coding experience to start
• Wee Suan shares his real-life transition from public service to DFIR
• This guide explains the roles, mindset, training, and timeline involved

Introduction

If you're in your 30s or 40s and wondering if it's too late to pivot into something future-proof, you're not alone. Job stability, digital disruption, and retrenchment fears are nudging many professionals in Singapore to rethink their careers.

In a standout episode of The Financial Coconut, one of Singapore's top podcast on personal finance and work-life, hosts Dawn Cher and Alex Loh sit down with James Lim, CEO of the Centre for Cybersecurity Institute (CFCI), and Wee Suan, who was previously a Senior Manager (Ecosystem Development) at the Cybersecurity Agency of Singapore (CSA), before joining CFCI as a student and now aDigital Forensics and Incident Response (DFIR) analyst at ST Engineering.

This isn’t just another hype piece on tech. It's a grounded, practical look at what switching into cybersecurity actually involves.

We want to thank Dawn, Alex, and the TFC team for facilitating this honest and deeply useful conversation.

Table of Content

Cybersecurity isn’t just for coders or tech geniuses. James Lim explains that mid-career folks bring valuable skills to the table: communication, business understanding, and resilience.

In Wee Suan’s case, his background in logistics and strategic planning gave him an edge in stakeholder management and storytelling, both crucial in cybersecurity roles.

“At the end of the day, I felt like I'm still a generalist… I wanted to pick up a skill that could future-proof myself.” — Wee Suan

Wee Suan also made an important point about watching cybersecurity evolve around him while he worked at CSA. It wasn’t just about job stability, it was about being part of something meaningful, defending Singapore’s digital ecosystem.

With increasing cyber threats, companies are realising they need people who understand both business and risk. This opens doors for mid-career switchers across fields.

Nope, not necessarily. James breaks down the myth: not every cyber role needs a degree in computer science. Entry-level positions like SOC analyst or incident responder don't require you to be a coding whiz.

“Even my trainers who are 15–20 years in the industry are not strong in Python.” — James Lim

Wee Suan adds more nuance here. While he studied bioengineering, he had very limited exposure to programming. One module in C programming during his first year and he got a C grade.

Still, he explained that the ability to interpret code is far more critical than being able to write it. In his own words:

“You might not need to recreate something, but at least know what the attackers could do through a piece of code. That’s the baseline.”

He likens learning to interpret code to learning a new language. It wasn’t a walk in the park, but he rated the difficulty a 6 or 7 out of 10, manageable if you’re genuinely interested.

This is where the story gets real. Wee Suan spent years in the public service, including stints at EDB and CSA. But he began to question if he was just talking about the need for upskilling and transformation or actually walking the talk.

That led him to explore technical skills. He started in non-technical roles at CSA, gaining exposure to the cybersecurity landscape. Eventually, curiosity won over fear.

He took the leap, self-funding his first cybersecurity course. He admits the biggest cost wasn’t even the course fee it was the time. Over 300 hours of live instruction, labs, and personal projects while juggling full-time work.

“It wasn’t just about acquiring skills. It was showing the people around me - hey, I’m serious about this.”

Wee Suan then transitioned internally at ST Engineering. He didn’t compete with hundreds of applicants. Instead, he proactively approached teams, expressed his interest, and backed it up with training and practice.

“You need to sell yourself. Your hunger, your commitment, and what you’ve already done, even if it’s small.”

He took initiative, identifying gaps in his own knowledge and filling them with extra practice and lab time. One tip he gave: use free tools and communities to stay sharp, many cybersecurity professionals share labs, challenges and write-ups online.

Simulation labs were a game changer for him. He described the process of solving complex puzzles under pressure, debugging code, and documenting evidence for incident reports. These experiences helped build not just skill, but confidence.

He also credits a moment of realisation at CFCI’s free experiential workshop:

“That seven-hour session gave me clarity. It wasn’t rocket science. I thought, ‘I should’ve taken the leap earlier.’”

His transition wasn’t just technical. It was emotional. He admitted feeling impostor syndrome, especially being the “new guy” in a technical team. But he embraced a beginner’s mindset and relied on his communication skills to integrate quickly.

“You don’t need to pretend to know everything. Ask questions. People respect that more than trying to act like an expert.”

Cybersecurity isn’t a single job. It’s an entire universe of roles, from digital detectives to compliance whisperers, from red-team hackers to blue-team defenders.

Here’s what James and Wee Suan say you can expect in real roles:

Security Operations Centre (SOC) Analyst
This is where many start. You'll be monitoring logs, alerts, and system activity to detect anomalies. Think of it like being the watchtower for digital threats. You learn to distinguish false alarms from real incidents, and know when to escalate.

Incident Responder
When something goes wrong, a breach, a malware infection, suspicious traffic, you’re the person who investigates, contains, and reports. Wee Suan describes this as “being in the thick of things,” where every second counts.

Digital Forensics & Incident Response (DFIR)
Wee Suan’s own role is a blend of proactive and reactive work. He dives deep into system logs, network packets, and artefacts to reconstruct what happened in an attack. It’s like CSI, but for cyberspace. You’ll analyse memory dumps, trace IP paths, and write reports for both technical and non-technical teams.

“You never see the same case twice. That’s what makes the work exciting.” — Wee Suan

Threat Hunter
This is a more advanced role, but it involves proactively scanning for signs of compromise. You set traps, look for patterns, and challenge assumptions. It’s part intuition, part analytics.

Penetration Tester
Also known as ethical hackers, these professionals simulate real attacks to find weaknesses before the bad guys do. It’s the cool job everyone imagines but it takes time and serious technical depth to reach.

Governance, Risk & Compliance (GRC)
Not everyone wants to be knee-deep in logs. GRC roles are about writing policies, running audits, and ensuring that cybersecurity practices meet legal and regulatory standards. It’s ideal for those with business or legal experience.

Across all these roles, you’ll need some core skills:

• Reading logs and identifying patterns
• Understanding how networks, systems and applications work
• Communicating findings clearly
• Thinking like an attacker, while acting like a guardian

The tools vary from Wireshark and Splunk to Python scripts and PowerShell but the mindset is universal: curiosity, vigilance, and integrity.

Wee Suan shared how, in his DFIR role, he uses a combination of manual analysis and automated tools. Sometimes, it’s about digging into obscure registry files. Other times, it’s scripting a parser to handle thousands of event logs. And always, it’s about documenting everything with clarity, because those findings inform real decisions.

“You need to connect the dots, and then explain it simply. Because someone’s business decision depends on your analysis.”

If you’re considering this path, take heart: you won’t start with the hardest cases. But over time, as your technical muscle grows, so will your responsibility. The diversity of roles ensures there’s a place for every kind of learner.

It’s not about being the smartest. It’s about being consistent, teachable, and committed. If you’re doing it for passion and purpose, not just the paycheck, you’ll thrive.

James notes that companies are trusting you with sensitive data. That trust has to be earned.

“You’re not just applying for a job. You’re asking someone to trust you with sensitive company data.”

Wee Suan adds that communication is your power move.

“You’ve got to know when to speak tech, and when to speak impact.”

If you're serious, you can become job-ready in 9–12 months.

• 0–2 months: Attend a workshop, explore roles
• 3–6 months: Start training, build technical skills
• 6–9 months: Practise in labs, create a portfolio
• 9–12 months: Apply or make internal moves

Wee Suan did it while working full-time. He said it’s about managing energy, not just time.

“When the goal is meaningful, the sacrifices are worth it.”

Wee Suan and James both emphasised: don’t chase brand names. Look for:

• Hands-on labs
• Instructors with field experience
• Career support
• Real feedback and projects

Flexibility matters too especially if you’re working or parenting. Find something that fits your schedule and gives you room to grow.

Here’s how to begin:

1. Try it first: Join a free experiential workshop
2. Chat one-on-one: Book a consult
3. Read next: Why Cybersecurity Stands out in a Stagnating Job Market

Can I switch to cybersecurity without an IT background?
Yes. Many roles are open to non-IT professionals with the right training.

Do I need to learn coding?
Not for most entry-level roles. Understanding basic code helps, but you don’t need to write it.

How long does it take to become job-ready?
Around 9–12 months if you’re focused and consistent.

Are cybersecurity jobs stable in Singapore?
Yes. There’s growing demand, especially in sectors like defence, finance, and healthcare.

What’s the minimum I need to learn to break in?
Learn the basics of networks, security principles, and how to investigate incidents. Build a portfolio to prove your skills.

‍