Cybersecurity management postgraduate personal statement example

Personal statement example

For the past five years I have worked on a service desk, and much of what crosses my screen is security work that nobody calls security work. Someone needs access to a shared folder today because a colleague is on leave; a laptop has missed three patch cycles because its user is always on the road; a broker forwards an email asking whether the invoice attached is genuine. Individually these are small tickets. Together they describe how an organisation actually behaves, and they are the reason I want to study cybersecurity management formally rather than continue picking it up in fragments.

My first degree was in business information systems, which suited me because I was never drawn to technology in isolation. My final-year project looked at how a small local charity stored and shared personal data about the families it supported. I expected to find ignorance and instead found reasonable people making reasonable trade-offs with almost no time or money: a single shared login because staff turnover was high, spreadsheets emailed between volunteers because that was the only tool everybody could use. Writing up that project taught me that recommendations are worthless unless they survive contact with how the work is really done. I have thought about it often since.

At the insurance broker I lead a team of four and sit between users and a small infrastructure function. Two years ago I was asked to take ownership of our joiners, movers and leavers process, which existed on paper but not in practice. I spent several weeks mapping who actually granted access to what, then rebuilt the process around a single request form and a quarterly review with department heads. The immediate result was unglamorous: we found sixteen active accounts belonging to people who had left, and one supplier account nobody could explain. The more useful result was that managers began to see access as something they owned. When we later ran a phishing awareness exercise, reporting rates were noticeably better in the teams whose managers had been involved in that earlier work. I do not think that was a coincidence, and I would like to understand the evidence on security culture properly rather than relying on one workplace observation.

To prepare for returning to study I completed an introductory security certification last year, mainly to fill gaps in my vocabulary and my understanding of cryptography and network controls. I followed it with a short course in risk management, which was where I realised how thin my grasp of quantification was: I could describe a risk clearly but had no defensible method for comparing two of them. Reading around this, I found Ross Anderson's Security Engineering useful for its insistence that incentives, not just controls, determine outcomes, and I have been working through published guidance on risk frameworks to see how organisations of our size are expected to apply them. I am particularly interested in third-party risk, since a broker depends on insurer portals and software we neither choose nor control.

Outside work I am treasurer for our allotment association, which involves reconciling small cash accounts, chasing plot fees and explaining decisions to members who did not attend the meeting. It is modest work, but it has made me more patient about governance: rules that nobody understands are not followed.

Studying part-time alongside my job will be demanding, and I have discussed the timetable with my manager. I want to move from running processes competently to being able to design, justify and defend a security programme, and to be the person who can explain to a board why a control is worth its cost.