Reflections on a year as an academic
I just finished my first year as a teaching fellow at the University of Warwick. Joining Warwick was certainly an unexpected career change - in effect, I started working as a lecturer only a few months after graduating with my BA from Cambridge, at a time when I would normally be applying for either graduate roles or masters’ degrees. I’ve learnt a lot from working at Warwick, both about cybersecurity and working as an academic. Hence, I’ve decided to share some of my reflections on my first year in academia for those who are interested in working as academics in the future.
As it turns out, my time here also went very well, as my position here was made permanent. :)
A home like home.
When starting out, it’s important to ask yourself why you want to work in academia. Academia is an incredibly prestigious sector and offers the chance to do world-leading research, but at what cost? Academic workloads are unreasonably heavy and mental health problems are commonplace. Career prospects are dire, and many academics work in fixed-term contracts with no certainty of where they’ll be in 2-3 years. And, for certain fields, industry offers research positions which pay better, treat employees better and are overall better in every way. So why become an academic?
For many people, what entices them is the sheer flexibility that academia offers. Researchers have the freedom to choose which research projects they work on, without having to worry about the project being profitable or their employer approving the project (although they will have to secure funding for their projects). They can work on multiple projects concurrently, and are usually also free to perform consultancy work or spin their research off into startups. Plus, in many fields, academia is the only way to become a researcher.
Academia also offers the chance to teach students, which for many academics can be incredibly rewarding. There’s a real feeling of accomplishment when teaching students (both undergraduate and doctoral) to a point where they start contributing to society, and in some cases you’ll even actively shape the way your subject is taught. Some students are also extremely talented, and working with them exposes you to new ideas and ways of thinking.
I suspect that personal glory is also a contributing factor for a lot of academics. Who wouldn’t want to become the world leader in their field? While it’s possible to make a name for yourself working in industry, working in academia makes it more likely the media will use your own name (rather than your employer’s) when reporting on your research. Being able to choose exactly what research to work on certainly helps too. Universities also support academics in building their personal brand by offering sabbaticals, which can be spent on writing books (among other things).
Doing industry first
Even if you want to become an academic long-term, it can be incredibly helpful getting industry experience in the field you want to work in. Of course, this isn’t always possible: if you want to become a syntactician or an 18th-century historian, you most likely won’t be able to find any jobs which will help. However, in cybersecurity (where I work), many jobs train skills which will directly help you should you later choose to pivot into academia. It doesn’t have to be strictly research-based either: if you want to work in software security, for instance, working in a variety of software roles will be hugely beneficial. Additionally, having industry experience gives you an intuition for which research projects are likely to help the community, allowing you to avoid topics which are highly abstract or unlikely to help.
Put simply: if there’s a way to gain industry experience relevant to your research interests, I would always recommend doing that, at least for a few years, before becoming an academic.
What it’s like being an academic
Being an academic is incredibly fun. It’s had its ups and downs (and ups and downs and ups and downs), but I’ve really enjoyed being at Warwick!
Perhaps the best part of my job is the impact that my job has on students. It’s been deeply gratifying teaching students from across the cybersecurity degrees and watching them become qualified cybersecurity experts, and being a part of that gives my job a sense of purpose. We get some exceptionally bright students at Warwick, and seeing some of the things they get up to (from their projects to their CTF performance) reminds me what a brilliant community I’ve joined. The fact that I was a student myself so recently definitely helped me empathise with their experiences a lot.
I also love developing degree modules. Because I’m responsible for the modules which I teach, I have a lot of freedom in deciding the syllabus. This allows me to design the modules according to the tools and languages I’m familiar with, and to design assessments in a way that not only tests the skills which students have learnt, but also applies it in a practical cybersecurity context. It’s also great contributing to the design of our degree programmes, and helping to run some of the strongest cybersecurity degrees in the world. I don’t know why, but the idea of developing a degree programme that competes with the likes of, say, SANS, is really motivating. There are some modules which I’d love to introduce, such as a practical lab in hardware security and a theoretical cryptography module.
I also get a lot of flexibility in doing this. Apart from my teaching hours, my working hours are incredibly flexible, and I appreciate being able to work from home (note: not all universities offer this. I know that it isn’t possible at Imperial College London, for example). This is a double-edged sword due to the workload, however (see below for more on that).
One thing I’ve noticed about academia is that the systems we work with usually don’t work as well as we hope. For example, the projectors might fail during a scheduled lecture, or a conference venue might become unavailable a week before the conference was meant to start, or the lecturer who specialises in a certain machine might fall ill hours before a practical experiment involving that machine was due to start. It’s much like the Scrapheap Orchestra: with enough of a “the show must go on!” mentality, it becomes possible to recover the event, almost no matter how turbulent things get.
The role is also a ton of work. Soon after I began at Warwick, it became clear that I would need to step in to lecture three modules (2 BSc and 1 MSc). My first year in particular was also very stressful as I was on a fixed-term contract and it wasn’t clear whether my contract would be extended. Thankfully this worked out positively in the end and I continue to teach here.
The job benefits are surprisingly good as well. While they aren’t quite as good as they are in industry (eg. Arm offers a £4500 FlexPot which can be spent on wellbeing and/or personal development, and or donated to charity), Warwick does offer benefits such as health insurance, funding to attend external training/certifications and conferences, and salary sacrifice schemes for bicycles and electric vehicles. A full list of benefits can be seen here. Plus, there’s the USS pension scheme, which, although it’s not as good as it used to be, is still extremely good (you currently contribute 9.8% of your salary, while your employer pays 21.6%), pretty much second only to the Civil Service Pension Scheme at 4.6% and 26.6% respectively.
One thing which Warwick has taught me is that there is a stark difference between teaching and good teaching. At Cambridge, academics are chosen exclusively based on their research ability, and teaching is left as an afterthought. The result is that Cambridge gets a lot of lecturers and supervisors who are exceptionally strong researchers, but aren’t particularly good teachers and may not have received teacher training. Even with the lecturers who love teaching, it is difficult to find the time to teach, and in practice teaching always ends up becoming as low-effort an activity as possible. Indeed, the university has insisted on using exams wherever possible simply because they are easy to mark and easy to timetable.
As cybersecurity is a highly practical subject, we aim to teach our students skills, tools and knowledge that they can apply immediately once they enter the workforce, meaning that we cannot rely entirely on lectures (and exams are off the table entirely). When we say that we teach students about the incident response process, or IDA, or security controls, we don’t just expect them to know them at a conceptual level - we actively expect them to be able to use these tools and methodologies to solve problems in cybersecurity. Hence, we must also develop labs so that students can learn about them from experience. The assessments we design must also test their ability to use the tools and techniques we teach them, and we take great pains to make the assessments as realistic to work scenarios as possible while not being unreasonably tedious to mark. After all, why give students a written exam on incident response when you can task them with responding to an actual (simulated) cyberattack?
In addition to taught modules, I also supervised students for their final-year BSc projects. I found the projects very fun to supervise as they offer the opportunity to work closely with each student to produce a significant (and often unique) piece of work. The students who proposed their own projects (rather than asking for my suggestions) were a particular joy to supervise, not only because it showed that they were motivated enough to develop their own project ideas, they also knew the ins and outs of their project proposal.
Of course, it’s important to remember that the students we get at Warwick are incredibly diverse (and at all universities). Some students are exceptionally bright while some of them just about get by. Some of them learn visually, while others learn auditorily or from experience. A lot of students are neurodiverse or otherwise have special learning needs which we need to accommodate. All of this means that we need to ensure that our teaching is inclusive towards everyone in the cohort. After all, diversity is a hugely important asset in cybersecurity, and improving the diversity of the cyber workforce is something we all strive towards.
Versus being a PhD student
While teaching fellowship positions normally expect you to have a PhD (or industry experience), they aren’t impossible to get without one (otherwise I wouldn’t be here!). Thus, while difficult to find, they are a viable alternative to applying for PhD programmes.
Whether it’s preferable to be a teaching fellow or a PhD student depends on your personal circumstances, as teaching fellows and PhD students have very similar levels of responsibility within their department, and both will typically (but not always) converge onto an academic career path. There are a few differences - I wouldn’t say that any of these should be a deciding factor in choosing between the two, but I did find them curious.
Obviously, PhD students specialise in research - that’s the reason for the PhD degree! They can also engage in teaching (for example, by assisting the teaching in a course or by lecturing individual sessions) but are unlikely to run entire courses or design the teaching materials or syllabus (that takes too much work). Meanwhile, teaching fellows are the opposite. While they are unlikely to lead any research projects, they are responsible for all aspects of teaching, from lecturing to developing the syllabus to writing the assessments, and will likely lead multiple modules.
Both teaching fellows and PhD students have a level of responsibility and trust within the department beyond what undergraduates get. For example, both would be involved in staff meetings, discuss student welfare, and attend staff socials and training sessions. However, teaching fellows will typically get more departmental responsibilities, likely to take up any spare workload.
The most notable difference, however, is the funding for each. In the UK, PhD students are (unfortunately) still treated as students, and so pay tuition fees by default. They can apply to research bodies (such as UKRI, AHRC and the ESRC) for funding, or the position might already have funding attached, but the amount of funding will typically be much lower than can be found in industry (and is unlikely to be much higher than minimum wage when considering the number of hours worked). By comparison, teaching fellowships are treated as full-time (or part-time) employees and are paid equivalent. To give an idea, the current UKRI stipend is £18,622, while the current lowest pay scale for teaching fellowships at Warwick is £33,966 for full-time employees.
My department also offers academic staff the chance to do a PhD part-time with the university, in which case the PhD will be funded by the department.
If you’re considering doing a PhD, you might like to consider doing a PhD in mainland Europe. PhD students in Europe are generally treated as employees, and, in some countries (such as Germany, Switzerland and the Netherlands) are paid very well.
The cool factor
Being an academic is very cool (especially given that I have neither a master’s degree nor a PhD yet) and more than a few of my friends are envious about it. Admittedly, I’m a bit biased because Cambridge holds academics in incredibly high esteem and permanent academic positions are very difficult to come by, but it’s extremely cool that I’m working in a position which I’d normally need several more degrees to get.
PHD Comics - "Exam View"
In theory, the working hours as an academic are flexible. For example, at Warwick, I am allowed to work remotely whenever I’m not teaching, and I have no set working hours: so long as I get the job done, I can work whatever hours I want. This is very helpful when I’ve got friends or family visiting Warwick, or when I just need a three-day weekend after a difficult week at work.
Unfortunately, in practice, the job never really gets done. Between curriculum development, answering student emails and an unending amount of admin work, there is so much work that it’s virtually impossible to end up with an empty workload (and, when you do, the workload returns quickly afterward). I’ve been blessed with colleagues who offer to take on my workload when I need it and I offer the same to them from time to time, but the academic workload remains cursed (yep, it’s not only students who get it badly I’m afraid). I’ve frequently worked on evenings and weekends, and my workload is sometimes worse than it was at Cambridge.
Politics is sadly an issue in academia. It isn’t reserved to Warwick either, and I’ve seen or heard of it in many universities. Like a friend of mine once told me, “Do you get politics in large corporations? Yes. Do you get politics in academia? #!?$ing yes.”
All I can say is, try not to get too involved in anything that goes on and try not to burn any bridges, as office politics can become very unpredictable.
The UCU, or Universities and Colleges Union, is the trade union representing most university staff in the UK. At least from what I’ve seen, the UCU demonstrates a lot more competence than most student unions, even if it hasn’t been especially successful in improving the working conditions and pay for its members. Perhaps its greatest claim to infamy, however, is its willingness to participate in industrial action: university staff have participated in strike action almost every term since 2019, and, from March to September 2023, lecturers boycotted all marking and assessments, which prevented finalists at most universities from graduating.
I’m torn about the industrial action. I sympathise with the academics who are affected by the low pay and awful working conditions (I’ve been affected by both myself) and I agree that working conditions urgently need to be reformed, but I also believe that we share responsibility with university leadership for preventing students from graduating. I particularly empathise with PhD students, who might be hoping to proceed into postdoctoral roles after graduating.
Any particularly memorable times
My first lecture (which was a discrete maths lecture) was the first time I’d taught an entire cohort of students, which made it a slightly intimidating experience! I ended up teaching the content too quickly for the students to understand anything, but they told me very quickly afterwards which helped me to improve for subsequent lessons. After I improved my pacing, the module went very well (and the student feedback set me up for future lectures as well). Teaching that very first module taught me that, while knowing your topic of expertise may be important, what’s equally important is enthusiasm, and being willing to listen to student feedback. Thanks guys!
As an academic, I’m able to take part in graduation ceremonies as part of the academic procession. I really like the graduation ceremonies at Warwick - they combine witty humour, upbeat music and wild celebration to really give everyone a cause to celebrate. The choir also sings at the graduation and, halfway through, an honorary graduand is presented. (In contrast, Cambridge had a very quiet, solemn graduation ceremony.) Plus, it’s brilliant watching the students receiving their degrees and celebrating their hard work.
Would I recommend it?
No, not at all. But, if you want to become an academic, I know that you won’t follow this advice. :)
Who knows? Cybersecurity is an incredibly diverse field and there are a huge number of opportunities out there, both in academia and industry.
In the long term, I’d love to go into cybersecurity research - it’s a great opportunity to work at the forefront of technology while helping the security community better protect cyberspace. I don’t mind whether I go into research via a PhD or by going straight into an industry research role - both are very good, and I may well take each step as it comes.
But, for now, I’m content with staying at Warwick and helping to train the next generation of cyber warriors.