From Community College to SOC Analyst at Sony

Karl Hubbard is a standout example of how Washington’s community and technical colleges can launch students into high-impact cybersecurity careers. In this enlightening conversation with Karl Hubbard, he describes 7 key strategies for success in cybersecurity. His example offers students and educators a model roadmap, marked by hands-on learning, self-driven projects, impactful internships, and strategic networking.

1. Start with Strong Fundamentals and Hands-On Learning

Karl began his journey at Whatcom Community College, studying IT basics, networking, and network security in a program designed with hands-on, team-based projects. Working with hardware gave him confidence and helped him realize his talent for cybersecurity.

"I had been a gamer but never took a computer apart before college. Once I started building things with my own hands, I realized I was good at it.”

2. Go Beyond the Classroom with Personal Projects

Karl's learning "exploded", as he put it, when he built his own server domain in his basement and enabled remote access to it through a VPN. Suddenly his knowledge moved from theoretical understanding to practical application. Besides that, he was passionate about it. He owned it (a blade server with 64GB of RAM) and anytime he wanted to modify something or spin up a new VM or virtual volume, he could "just do it." No need to pay a cloud service provider.

“There were times I had homework, but I was way more interested in my server setup.”

Karl couldn't help but talk about this passion project in his internship class at Whatcom Community College. As an assignment, he explained to the class how he built his home server network, teaching its technical features, cybersecurity aspects, and describing the troubleshooting process.

As part of the internship program, Karl was introduced to the PISCES program - or the Public Infrastructure Security Cyber Education System. This program provides security operations center (SOC) experience for students using real data from municipalities and small businesses that choose to participate. Karl worked with PISCES in the early days when it only had simulated data. Karl embraced the opportunity to learn analyzation skills using Elastic Stack. Curious to test it on "real" data, he connected the system to his home network to scrutinize it for potential signs of attack.

By the next year PISCES had real data to work with from real companies. Karl remained active on the platform and did make important discoveries. In one case, he noticed signs that a small municipality was being surreptitiously hijacked for mining bitcoin.

Karl credits the combination of hands-on technical training at Whatcom and his work with PISCES for helping him land his first cybersecurity job. The skills he developed—log analysis, threat hunting, use of tools like Elastic Stack—translated directly to his first role as a security analyst at a startup that provided security operations as a service to clients. The startup environment required agility and a deep understanding of core SOC tools and workflows, and Karl was ready.

3. Turn Internships into Career Gateways

Karl's first job opportunity came through a fellow classmate in this internship class at WCC. The classmate was leaving his old IT job for a better opportunity and recommended Karl to replace him. This shows that networking starts in school. Treat your assignments like a job - with professionalism, dedication, and passion. And remember, your job may come through a fellow student!

Passion projects and internships like Karl's shine brightly on resumes and provide exciting things to talk about in job interviews.

4. Capitalize on Real-World Experience

Karl's work on the PISCES project provided more than just experience and an initial job connection. His work was noticed in other ways too. Karl's discovery about crypto mining made it into the school newspaper and later into a conference poster that won 2nd place.

The conference poster was noticed by Michael Hamilton, Founder and Chairman of the Board of the PISCES Project, and CISO of Critical Insight. The internships at Critical Insight were full that year but, after Eric Fretheim (director of the cybersecurity program at WWU) spoke so highly of Karl's skills, Micheal devised a way to get Karl an internship.

5. Say Yes to Growth Opportunities

Karl’s internship at Critical Insight turned into a salaried analyst position. He volunteered for night shifts and moved to Ellensburg to help launch a new SOC—demonstrating his flexibility and excitement for new opportunities. Karl also has mentored Central Washington University students on using PISCES—paying his experience forward.

When COVID hit, he continued working remotely and transitioned into a more engineering-focused role, which helped him learn infrastructure and documentation, though he missed threat analysis work.

6. Network Strategically and Stay Persistent

Wanting to resume analyst work, Karl used LinkedIn and local events like BSides Seattle to expand his network and seek opportunities. After meeting professionals from Lynden Transport, he was introduced to a private Discord group that shared job leads. That’s where he saw a Security Engineer role at Sony PlayStation.

“I had the confidence that my resume and experience were a good match. Interviewers can tell if you're unsure of your skills - and they can tell if you're overconfidently bluffing. So be sure you have the right level of confidence.”

Months after applying, he landed a series of interviews. His honest, confident approach—sharing real experiences and walking through his thought processes—won them over.

Karl landed the job at Sony Interactive Entertainment managing people who had worked there longer than Karl had worked in cybersecurity.  Karl believes that his love for technology and his demonstrated drive to understand all layers of the hardware and the network played a crucial role in their decision to hire him.

7. Master the Tools and Be Ready to Explain Them

Today Karl interviews new job applicants for Sony. When reviewing qualifications, he looks for candidates who genuinely understand the skills they list.

“If you say you know something on your resume, I’m going to ask about it. I want to hear you explain it. Can you walk me through a real experience?”

He emphasizes that fluency in tools and processes is more important than just listing buzzwords. He wants to see that applicants have truly “internalized” the concepts. Only then can they apply the knowledge in real world settings.

“I need to know you’ve used the tools. Even if you did it in a lab or on your home network, show me how you think and how you analyze what the tools are telling you. What's your process?”

Karl also reflected on the changing nature of the SOC Analyst role. As automation increases, he believes that the nature of Tier 1 analyst jobs will change. Opportunities will still abound, but the job requirements will expect more from candidates.

“You need to be able to do analysis, to investigate and interpret what the tools are telling you. The job isn’t going away—it’s evolving. We're not just looking for people who can copy-paste scripts. We need you to explain your thought process and articulate why something is a real threat or a false-positive.”

Key Strategies for Student Success

- Build a lab at home. Even a modest setup can open doors.
- Engage with internship and mentorship programs early and often.
- Take initiative beyond the syllabus. Passion projects get noticed.
- Use LinkedIn and community events like BSides to expand your network.
- Be honest and human in interviews. Let your passion and mindset shine through.
- Stay curious and adaptable. Don’t wait to be “ready” to apply—try anyway.
- Master your tools and experiences—be ready to explain them in detail.

Karl’s story is proof that Washington’s community college pathways work—and when combined with drive, curiosity, and strategic networking, they can lead all the way to the top of the cybersecurity industry.