Cyber Security Analyst desperately looking for a similar job in Japan

4 comments

1. This is a copy of your post for archive/search purposes.

   —

   **Cyber Security Analyst desperately looking for a similar job in Japan**

   Basically, I currently work as a Cyber Security Analyst for a large company in my home country (no international offices). I have a Bachelor’s degree in my field, and some certifications, and a couple years of other IT experience.
   I have a dream of living in asia and my top locations are Japan, Thailand, and Singapore. I’ve been applying effortlessly for jobs in these locations, but so far I’m not having so much luck.
   My Japanese is still quite weak, but I do know around 200 Kanji and a couple hundred vocab words, slowly but progressing.
   I’m looking for any help I can get to make this dream a reality, if you know of any roles or can point in the right place please do let me know.
   Thanks guys.

   *I am a bot, and this action was performed automatically. Please [contact the moderators of this subreddit](/message/compose/?to=/r/movingtojapan) if you have any questions or concerns.*

2. You’re going to have to control that desperation because this is not going to be a fast process.

   Especially now because it’s been a very bad year for hiring, and a lot of cyber sec people have been laid off making the market extremely competitive in Japan.

   The vast majority of cyber sec jobs also require JLPT N2 level Japanese at minimum, so your best bet is to keep upskilling in the language.

   Keep applying though and consult some recruiting companies, Robert Half Japan has a decent team that covers this industry so reach out to them for second opinions.

   Good luck, and again please relax, you will get in here but it’s going to take time.

3. If you’re coming from an environment with moderate to high InfoSec maturity, prepare yourself for a shock. Japan’s InfoSec posture is arguably the most immature in the developed world.

   There are a multitude of factors contributing to Japan’s poor InfoSec posture, and I could go in detail on that area if you’re curious.

   However, to get to the point that you actually care about, you’re going to have a rough time for a few reasons:

   * InfoSec salaries in the west are in an insane, unprecedented bubble. People in their 20s making 250k-500k USD at tech companies is a current norm. Salaries in Japan are still very good by national standards (12M-18M JPY for a great role), but please understand that they’re not going to be competitive with the salaries to which you’re accustomed.

   * The technical standards that matter among hiring managers in Japan are not consistent with what matters in the west. This is going to sound critical, which isn’t my intention, but I do want to set realistic expectations: there are few institutions in this country that have the slightest comprehension of the current threat landscape, what constitutes an acceptable risk posture, and which controls modern organizations are leveraging to satisfy that risk posture. The practices that I see across Japan are reminiscent of what I saw back home in my consulting days in the ~2010 era. Instead of needing to answer questions about topics that _actually_ matter (e.g., modern detection engineering, response automation, containerization), you should instead expect questions as if you were taking a SANS exam in 2013.

   * You should expect the processes and “chores” of a job to matter much more than the actual security outcomes. I’ve seen companies still opening port 3389 to the internet for single-factor auth into prod system, but their “managing director” is convinced of their masterful InfoSec posture because they have a dozen full-time staff dedicated to manually scanning every new USB stick with antivirus software before letting them be used in their corporate fleet. You will not be exposed to novel attacker techniques from which you can learn, and you will not develop on-the-job skills that’d make you competitive in the InfoSec workforce back home. That’s not so say that you can’t develop those skills, but that’ll need to be 100% on your own time.

   * You don’t speak Japanese. Consequently, your options are heavily limited relative to the rest of the job-seeking InfoSec demographic.

   I’m not trying to be a downer, but I do think it’s important to set expectations in this space. If you can deal with the entry hurdles, the on-the-job frustrations, and the lack of professional development that you’ll experience, then by all means go for it.

   However, speaking candidly, here’s my advice: Singapore is more aligned with your needs. In terms of InfoSec, nowhere else in Asia is going to be as good a fit. If you’re not getting any traction from your job applications to companies with a Singapore footprint, then that’s unfortunately a you problem; **getting traction in Japan will not be easier**.

4. infosec isn’t really a thing in the Far East outside of a handful of companies, and all of them require you to speak their language (Chinese / Korean / Japanese.)

   Being underpaid is just the norm here so I won’t go into that, but overall I honestly don’t think you should come to the far east at all if you’re serious about career progression. I’m a fullstack dev with many yrs of experience coming from the US and the only reason I’m still here is because of my girlfriend.