From the Classroom to the Cyber Domain

Why I Went Back

I didn't come to the University of Phoenix as a blank slate. I came in as a Computer Science teacher, an Army veteran, and a developer who had already earned a full stack certificate through Bottega University. I could build an app and teach a room full of students how to build one too. What I didn't have yet was the bigger picture: how the systems underneath that code are secured, administered, and kept running when something goes wrong.

My earlier college experience was inconsistent, and I knew going in that this time needed to be different. I started the Bachelor of Science in Information Technology (BSIT) in June 2025, transferred in credit from my associate degree and prior schools, and treated every five-week course like a mission with a clear objective. That mindset is a big part of why I'm finishing with a 3.95 GPA, a spot on the President's List for the second half of 2025, and the Dean's List for the first half of 2026.

The degree is information technology, but the thread running through it is security. That thread is what this post is about.

How the Program Is Built

The BSIT runs in five-week, three-credit courses. That pace forces you to learn fast and apply what you learn right away. The university describes the degree as building skills in operating systems, cybersecurity, and programming, and it lines up with industry certifications from CompTIA and EC-Council. Looking back at my transcript, security wasn't one class I checked off. It showed up in almost every part of the program, from the intro courses to the cloud labs at the end.

Here are the courses that shaped the security side of my degree:

Course

Focus

What I produced

CIS/207T

Computer systems, networking, digital safety

Grade A (no saved coursework)

CYB/100T

Defining the cyber domain and its layers

Grade A (no saved coursework)

CYB/110

Security awareness, threats, recovery

Disaster recovery plan built on NIST SP 800-34

CYB/205

Physical vs. cloud security administration

Vulnerability assessment, AWS controls matrix, BIA and risk assessment

CYB/320

Ethics and global data protection

Positive rights analysis, data ethics presentation, ethics policy portfolio

NTC/300

Cloud infrastructure and IT security

Hardening, Nessus, IAM, and troubleshooting labs

NTC/302

AWS networking and web services

VPC, CloudTrail, and GuardDuty labs for a case-study company

Laying the Foundation

CIS/207T Information Systems Fundamentals was my starting point. It covered how computers, operating systems, networks, and the internet fit together, and it introduced the digital safety practices that protect data and devices. As a teacher, I appreciated how much of it mirrored what I already cover with students, just from the angle of an organization instead of a single user.

CYB/100T Cyber Domain changed how I think about security as a whole. The course defines the cyber domain as the discipline of protecting information systems, networks, infrastructure, and assets from damage, unauthorized use, modification, or exploitation. The idea that stuck with me is that cyberspace is made of layers, and every layer has its own challenges. Security isn't a single wall. It's a set of layers that all depend on each other.

CYB/110: Planning for the Worst

Foundations of Security covered the threats most people hear about, like identity theft, scams, malware, hacking, and social engineering. The assignment that stayed with me, though, was writing a full disaster recovery plan.

The scenario was an organization whose local server room had been destroyed by a fire. Off-site backups prevented total data loss, but the incident exposed weak backup tools, unclear access procedures, and policies nobody enforced once employees had to work remotely. My plan was built around:

•     Two backup layers: a secure cloud backup for geographic separation, plus encrypted backups at a separate physical site for fast recovery when the internet isn't reliable

•     A 24-hour Recovery Time Objective (RTO) for critical systems

•     Access control and encryption as core protections, not afterthoughts

•     Redundant communication channels and a plan for remote work

•     An annual review so the plan doesn't quietly go out of date

I grounded the plan in NIST Special Publication 800-34, the federal contingency planning guide, and in EC-Council's Certified Secure Computer User material. I also wrote it from my own background. The military teaches you that readiness comes from planning for the worst before it happens, and I tell my students the same thing: systems rarely fail because of one catastrophic mistake. They fail because small risks were ignored.

Around the same time, I earned the Secure Computer User badge, issued through the University of Phoenix and endorsed by EC-Council, along with LinkedIn Learning certificates in operating system security and mitigating cybersecurity vulnerabilities.

CYB/205: Where Security Got Real

Infrastructure Administration compared security for traditional physical infrastructure with security in the cloud, and it was the most hands-on security course of the degree for me.

Reading vulnerability scans like an analyst

For the vulnerability assessment, I worked through findings from three different tools and made remediation decisions for each:

•     Nessus flagged an outdated Java Runtime Environment tied to several CVEs, and I recommended updating it within 30 days.

•     SonarQube static analysis flagged more than 2,000 potential SQL injection findings (CWE-89). I weighed a phased cleanup against a "fix new code only" policy.

•     OpenSCAP found telnet server packages on Red Hat hosts, an insecure service that shouldn't be there.

•     A discovery scan turned up a device that wasn't on the hardware inventory, which is its own kind of red flag.

As someone who writes and teaches code, the SQL injection piece hit close to home. It's one thing to explain to students why you never trust user input. It's another to see thousands of those mistakes show up in one scan.

Security in the cloud: responsibility moves, it doesn't disappear

Next, I built a security controls matrix for an organization moving to Amazon Web Services. I mapped CMMC Level 1 controls, including access control, identification and authentication, boundary protection, flaw remediation, and malicious code protection, and decided who owns each one: AWS, the organization, or both. Then I listed the actual tasks IT staff would handle, like configuring IAM, managing VPC firewall rules, monitoring with CloudTrail and CloudWatch, and encrypting S3 and EBS storage.

Responsibility does not disappear; it simply moves to a different layer of the system.

That line from my executive summary is the biggest thing I took from the course. AWS secures the cloud itself. The organization is still responsible for everything it puts in the cloud.

Business continuity

The course ended with a Business Impact Analysis and a Threat and Risk Assessment for a fictional company. I rated six systems, from customer-facing web apps to the VPN server, against a 12-hour RTO and a requirement of zero customer data loss. I then proposed redundant cloud infrastructure with load balancing, automated backups and replication, and a documented incident response plan.

CYB/320: The Human Side of Security

Global Cyber Ethics reminded me that security decisions are also people decisions. The course looked at classic ethical models and how they play out on a global internet where every country has different laws and values.

Over the course I:

•     Compared five rights, including privacy of correspondence, government transparency, and control of personal data, across the United States and other countries like Sweden, the U.K., Canada, and the EU under GDPR

•     Built a presentation comparing U.S. and Indian approaches to data ethics, covering data classification, access control, and storage and retention

•     Applied the codes of ethics from EC-Council, GIAC, ISC2, ISACA, and ACM to real scenarios

•     Wrote two organizational policies for user monitoring and access control, built on least privilege and complete with reporting steps and tiered consequences

•     Connected those policies to India's Digital Personal Data Protection Act of 2023 and ISO/IEC 27001

This course is where I started seeing security as governance and trust, not just technology. You can have the best firewall in the world, but if your monitoring policy isn't fair and clear, you've created a different kind of risk.

Taking Security to the Cloud

NTC/300 Cloud Technologies put the concepts into labs. I worked through identity and access management, including account lockout policies. I hardened systems by disabling unnecessary services and accounts, setting password policies and access control lists, configuring Windows Firewall, and looking at DNSSEC and intrusion detection. I also ran Nessus vulnerability scans and practiced network troubleshooting from the command line.

NTC/302 Network Web Services focused on AWS. I built a Virtual Private Cloud with subnets, security groups, and network access control lists, and worked with VPC peering and VPN connections. I set up monitoring and threat detection with CloudWatch, CloudTrail, and GuardDuty. I applied all of it to a recurring case-study company, "Get-Sole Shoes," and recommended how they should architect and migrate to the cloud.

The Code Side Supports the Security Side

My programming and systems courses weren't labeled "cyber," but they made me a better security thinker. PRG/211T sharpened my debugging and logic skills. DAT/210T covered SQL, Python, and Java for working with data. DAT/305 covered data structures and algorithms, and its catalog description includes cryptographic hash functions. BSA/375, BSA/385, and CMGT/410 taught me how systems are planned, tested, and delivered, including writing a software testing plan. Knowing how software gets built makes it much easier to see where it can break.

What I'm Taking With Me

I want to be honest about where I am. This is coursework, not years of professional security work. I haven't been a SOC analyst or a penetration tester. What I do have is real, graded work: vulnerability assessments, recovery plans, cloud security controls, and security policies. I can explain the thinking behind every one of them, and I can already see how it fits my background.

It also changes how I teach. When my students build websites and apps, I now push harder on the questions that come after "does it work?" Who can access it? What happens if the server goes down? What happens when a user types something they shouldn't?

I expect to finish my BSIT in November 2026, and I've already enrolled in the University of Phoenix Master's in Cybersecurity. The bachelor's degree gave me the foundation. The next step is going deeper.