Mid-30s, established career, still want a PhD — realistic or not? Looking for peer advice.
Looking for genuine feedback:
I’m in my mid-30s and currently a Senior Manager in cyber defense. My background is mostly in incident response, threat hunting, SecOps, and defensive operations.
The longer I've been in this field, the more interested I’ve become in the research side. I’m especially interested in adversary behavior: how attackers make decisions, how their behavior changes during an intrusion, and how we can use that understanding to improve threat intelligence, detections, and defensive programs.
I don’t want to leave industry right now. I actually love the work I do. I just want to go deeper and eventually contribute research to the field, rather than only consuming it. Additionally, I would also love to develop cirriculum/ teach a course or two, and maybe pivot further into academia when the time is right.
A PhD has been a goal of mine for a long time, but I’m at a stage where leaving my career and life for a full-time residential program isn't possible with a house and heavy financial responsibilities. That has me looking at part-time, hybrid, low-residency, and online cybersecurity PhD programs.
And this is where I’m stuck.
I keep seeing people completely dismiss online or low-residency PhDs, and it’s honestly making me question whether there is any realistic path for someone in my position and if I should just give up on this dream.
I’m not looking for an easy degree or a credential. I want real research training, good mentorship, a serious dissertation, and hopefully publications. I just need a format that allows me to keep working.
Has anyone here actually done this while already established in cybersecurity or tech? Did the PhD format affect how seriously your research or degree was taken?
I’d really appreciate hearing from people who have been in a similar position. Thank you.
Current Ed stack:
- A.S. Cybersecurity
- B.S. in CompSci
- M.S. in Information Security