“If you do not give me an opportunity, how will I gain experience?”
There are things we hear during our lives that, for some reason, we never forget.
This is one of them.
Some time ago, I heard a story about a young woman looking for her first job. During an interview, the recruiter explained that they wanted someone with experience.
Her answer was as simple as it was profound:
“If you do not give me an opportunity, how will I gain experience?”
That sentence stayed with me.
Perhaps because I faced similar difficulties at the start of my own career. I knew what it felt like to want to work, learn and show what I could do, only to find doors closed precisely because I had not yet had the opportunity to prove myself.
It is a contradiction we continue to sustain.
We want experienced, competent, independent and capable professionals. Yet too often, we expect someone, somewhere, to have taken responsibility for training them first.
What if nobody does?
Recognizing this reality led me to a decision I try to uphold at Cyberprotech®: whenever the conditions allow it, give a genuine opportunity to someone who wants to learn, grow and build their professional future.
Not out of obligation. Not to complete a formality. Certainly not to find cheap labor.
Because I believe someone has to open the first door.
And because, one day, someone opened it for us too.
1. The industry needs more than additional professionals. It needs qualified professionals.
For years, news stories, studies and reports have highlighted the need to strengthen the cybersecurity workforce.
We need more specialists, analysts, engineers and professionals capable of protecting businesses, institutions, public services and critical infrastructure.
I agree.
But there is one word I always add to that discussion:
“QUALIFIED.”
We need qualified professionals.
Qualification is not simply a diploma, a certification or the number of courses completed.
Those achievements matter and deserve recognition. But there is a considerable distance between knowing a concept and applying it to a real problem.
Knowing what a security incident is does not mean having taken part in analyzing one.
Understanding network architecture does not mean understanding the consequences of a misconfiguration.
Studying a monitoring system is not the same as building one, interpreting an alert, distinguishing a false positive from a real threat and deciding what to do next.
And knowing a standard or regulation does not, by itself, mean understanding the effort required to turn requirements into effective operational procedures and implement them.
Experience has to be built.
With time. With practice. With guidance. With responsibility.
And, inevitably, with mistakes.
If we want professionals who are ready for the challenges ahead, we must give them opportunities to learn today.
2. A safe-to-fail environment does not mean anything goes
Recently, I read a Computerworld article about building a safe-to-fail culture in IT teams. [1]
The expression caught my attention, but it made me think about a more specific group: interns.
People starting out. People changing careers. People arriving with theoretical knowledge, curiosity, ambition and, often, the fear of not being good enough.
How can we expect confidence if we do not create an environment where they feel safe to learn?
At Cyberprotech®, I believe an internship should offer precisely that: room to ask questions, test hypotheses, try solutions, make mistakes and, above all, understand what happened.
But one point needs to be clear.
Safe-to-fail does not mean abandoning rules, discipline or responsibility.
Quite the opposite.
In cybersecurity, an experiment must not put personal data, production systems, customer services or an organization's continuity at risk.
Freedom to learn must therefore coexist with clear limits.
Laboratories, isolated environments, test systems, controlled permissions, supervision and documentation exist precisely to make experimentation possible while containing the risks.
An intern should be able to configure a server and understand why the service stopped responding.
They should be able to implement a rule, discover that it does not produce the expected result and investigate the causes.
They should be able to test a solution, discover its limitations and propose an alternative.
And they should feel safe enough to say:
“I do not know.”
Or, perhaps more importantly:
“I made a mistake. I need help.”
That is where some of the most valuable learning in any career begins.
Hiding an error out of fear can be far more dangerous than the error itself.
Professional maturity means acknowledging, communicating, correcting and learning from mistakes.
3. Every intern is a person, not simply another resource
Anyone running a business understands its daily demands.
Customers need support, deadlines must be met, projects completed, costs controlled and responsibilities fulfilled.
Finding time to teach is not always easy.
Explaining something again when it has become almost automatic for us is not always simple.
And we do not always have as much time as we would like.
But we should remember that something we now do almost without thinking may be a significant achievement for someone learning.
A configuration completed successfully.
A problem solved without direct intervention.
A more rigorous report.
An investigation that finally starts to make sense.
A question showing that someone has moved beyond memorizing answers and begun to understand the problem.
These small victories deserve recognition.
At Cyberprotech®, I try to value each intern as an individual.
Everyone brings a different background, abilities, difficulties, motivations and expectations.
Some learn quickly through observation. Others need to repeat a task several times. Some have an extraordinary aptitude for technology but struggle to communicate their conclusions.
Others surprise us when given a task that initially seemed too demanding.
And small gestures should not go unnoticed.
The extra effort to finish an exercise. The dedication to understanding a complex problem. The care taken to document work. The initiative to help a colleague. The determination to look for an answer before giving up.
Even an additional hour voluntarily spent exploring a topic out of genuine interest deserves recognition, without ever becoming an expectation of unpaid work.
Effort has value, even when the result is not yet perfect.
Naturally, not everyone will follow the same path.
Not everyone will stay with the company. Not everyone will choose cybersecurity as a lifelong career. And not everyone will reach the goals they first imagined.
That is part of life.
It does not mean the opportunity was wasted.
If someone finishes an internship with more knowledge, stronger critical thinking, greater confidence and a clearer view of their future, something important has happened.
An internship's success cannot be measured solely by completed projects or the prospect of a job offer.
It is also measured by the person and professional we helped develop.
4. The knowledge that does not appear in manuals
Professional experience teaches us things we rarely find in a book, course or certification.
This is the knowledge acquired through years of decisions, difficulties, successes and failures.
Know-how: the kind of understanding that comes from years of doing the work.
Recognizing an anomaly before it becomes obvious.
Realizing that a technically valid configuration may cause problems later.
Knowing when to stop, seek a second opinion or question a decision.
Explaining a technical problem to someone without a technical background.
Beginning to picture a solution as an alert arrives or someone starts describing a problem.
And understanding that every system has people, organizations and real consequences behind it.
Much of this knowledge is passed on through working together.
By observing someone more experienced, joining a meeting, accompanying a customer visit, helping resolve an incident or hearing the reasoning behind a decision.
This is also how we develop what are often called soft skills: communication, collaboration, critical thinking, empathy, ethics, prioritization and responsibility.
These abilities do not appear automatically after a training course.
They need practice.
I strongly believe in passing knowledge between generations.
Experienced professionals have much to teach, but also much to learn from newcomers.
Younger colleagues bring different perspectives, new tools, other ways of approaching problems and questions that make us reconsider what we took for granted.
A healthy learning environment works both ways.
Those who teach also learn.
A company that enables this exchange is developing more than its interns.
It is developing its own culture.
5. Artificial intelligence can accelerate learning. It must not replace the ability to think.
We are living through an extraordinary period of technological change.
Artificial intelligence can perform tasks that would have required far more time and resources only a few years ago.
It can help write code, analyze large volumes of information, identify patterns, prepare documentation, interpret events and support decisions.
It is a powerful tool.
And I believe future professionals should learn to use it.
But there is a concern we cannot ignore.
What happens when someone knows how to use a tool but does not understand what it is doing?
What happens when an automated system reaches the wrong conclusion?
When a security tool stops working?
When AI suggests a technically plausible action that is inappropriate, unsafe or incompatible with our ethical principles?
When a critical alert goes unnoticed because everyone assumed the platform was monitoring everything?
Technology does not remove the need for human knowledge.
The more we depend on complex systems, the more important it becomes to have professionals who understand their limitations, verify results and intervene when needed.
AI can offer solutions extraordinarily quickly.
It can help us see possibilities we had not considered.
But we must not confuse that ability with moral awareness, professional accountability or a commitment to human well-being.
AI systems do not replace our obligation to establish principles, supervise decisions and answer for the consequences of using them.
This distinction matters particularly in cybersecurity.
The same technology can protect or compromise systems.
The same knowledge can identify and fix vulnerabilities or exploit them maliciously.
Training professionals must therefore go beyond teaching tools.
We must develop critical thinking.
We must teach people to ask “why?”, as well as “how?”.
We must pass on the importance of ethics, privacy, proportionality and respect for people.
We must prepare professionals to work with AI while retaining their own judgment.
Automating a task is not the same as understanding the responsibility that comes with performing it.
And when something goes wrong, we need people who can think, act and take responsibility for decisions.
6. Telling young people they are the future is not enough. They need a place in the present.
I would like to offer a challenge to businesses, especially those working in IT, cybersecurity, data protection and innovation.
Whenever possible, welcome at least one intern.
It may be a curricular or professional internship, or another properly structured form of learning.
It may involve someone who has recently finished their studies.
Someone changing careers.
Someone starting again after many years in another profession.
Or simply someone eager to learn who has not yet found a chance to show their potential.
There is no need to begin with a large program.
There is a need to begin responsibly.
Define a learning plan. Appoint a mentor. Set appropriate tasks. Establish safe conditions. Make time for guidance. Provide honest, constructive feedback.
Respect the time, dignity and work of the person learning.
An internship should not replace a job, offload unwanted tasks, fill operational gaps without supervision or impose responsibilities the person is not ready to carry.
There must be a genuine commitment to learning.
Not every business can host an intern at every moment. Recognizing that limitation is better than offering an experience without guidance or objectives.
But I believe many organizations can do more than they currently do.
Especially while we continue to say that we lack qualified professionals.
My question is simple:
Are we genuinely helping to develop the professionals we say we need?
If every company waits for experienced candidates, who will offer that first experience?
7. Line upon line, precept upon precept
There is a principle I find particularly relevant to learning:
“Line upon line, precept upon precept.”
Knowledge is built progressively.
We cannot expect someone to master a complex infrastructure before understanding its foundations.
We cannot expect an intern to manage a critical incident before learning to identify, analyze and interpret the simplest signals.
Giving someone access to advanced tools does not make them a good professional.
We start with the essentials.
We add knowledge, increase complexity, develop independence and correct what needs correcting.
Then we repeat the process.
Little by little.
That is how competence is built.
And confidence too.
Confidence rooted in the ability to keep learning, rather than the belief that we know everything.
8. A company's legacy also lives in the people it helps develop
At Cyberprotech®, we work with technology, security, data protection and systems that demand rigor, responsibility and specialist knowledge.
But I try never to lose sight of the human dimension of that work.
Tools change.
Platforms evolve.
Technologies we consider essential today may be replaced tomorrow.
That has happened before and will happen again.
Technical knowledge needs continual updating.
But the values we pass on can stay with someone throughout their career.
Curiosity.
Integrity.
A sense of responsibility.
The courage to acknowledge a mistake.
The humility to ask for help.
The willingness to teach someone who knows less than we do.
And the awareness that our work can have real consequences for other people's lives.
Perhaps an intern helping configure a small laboratory today will one day lead a security team, guiding others through the same process.
Perhaps someone struggling to interpret their first SIEM events will become an excellent analyst.
Perhaps someone doubting their ability will discover a calling they did not know they had.
We do not know.
And we do not need to know.
We only need to recognize that, without an opportunity, they may never discover how far they could go.
I continue to learn from everyone who comes through Cyberprotech.
From their questions, progress, difficulties and, sometimes, their mistakes.
We cannot always do everything as we would like.
We do not always have enough time.
And the results do not always match our expectations.
But I believe it is worth continuing to try.
Helping someone develop takes work, patience and dedication.
A company leaves its mark on more than the projects it delivers and the customers it supports.
It also leaves its mark on the people it gave an opportunity.
My challenge to our industry
If we want a safer, more resilient and responsible digital future, we must invest in the people who will build it.
That includes people who already have experience.
And those who are starting out.
Those who are starting again.
Those looking for an opportunity to show what they can do.
Let us create environments where people can experiment without fear, make mistakes without humiliation, learn with guidance and grow with responsibility.
Let us value both teachers and learners.
Let us recognize effort even before exceptional results appear.
And let us not allow technology to make us forget that genuine knowledge still needs people.
To every company asking for experience, I offer a question:
What if you were the ones to provide that first opportunity?
You may be doing more than welcoming an intern.
You may be helping develop the professional who will one day protect your own organization.
Or many others.
For me, that too is cybersecurity.
We prepare for the future by taking action today.
Line upon line. Precept upon precept.
João Pacheco — Founder & CEO | Cyberprotech®
Cybersecurity. Data Protection. Technology. Above all, people.