When Mercedes Subhani (SPA, CLEG, `20) arrived at American University, she was determined to study and practice immigration law.

“I have wanted to be a lawyer since I was a little girl,” she recalled. “Though I was exposed to the criminal justice system, due to family circumstances, at a very early age, I got the benefits of discovering my purpose early in life: [I wanted to] be the bridge between a client and the law and provide them equal access to justice.”

While Subhani remains on the legal track (she is currently 3L at the University of Maryland Carey School of Law), her SPA experience introduced a significant detour. As a communications, legal institutions, economics, and government (CLEG) major, with the flexibility to count a wide variety of classes, she took Professor Sasha O’Connell’s Intro to U.S. Cyber Policy on a lark in her senior year.

“It is safe to say that Professor O’Connell’s class completely changed my career trajectory,” said Subhani. “I’d had no clue what cybersecurity was, let alone how it intertwined with policy and public interest. She was so passionate about and well-versed in the subject matter that I was completely entranced.”

The course covered the concept of cybersecurity policy, the array of related career paths, the vernacular, and its relationship with the public interest. Subhani recalls an assignment to contact and interview a cybersecurity professional and then present it to the class.

“In the moment, I hated that assignment,” she said. “I was extremely shy. However, it was a perfect exercise. . . It taught me how to cold email professionals. It forced me to start building a network of cybersecurity professionals and translate everything I learned in class into real life. Finally, it refined my confidence in my public speaking and subject matter expertise. Now, when I present, on any subject matter, I know now that I can hold my own.”

The class also helped Subhani recognize her true passion: data privacy law. “Privacy rights are one of my generation's pivotal civil rights issues and I wanted to be an active part of the change.”

After her AU graduation in 2020, Subhani headed to law school on a full scholarship, where she pursues her J.D. on the intellectual property track and a certificate in cybersecurity and crisis management.

“As a low-income first-generation Latina, my family taught me proactiveness and determination,” she shared. “Coming into law school, I knew I didn’t have the same network as my peers. However, through persistence, I created my own network, by cold emailing Maryland Carey Law alums and cybersecurity professionals. This incredible group of mentors nurture my ambition and help guide my career.”

She also embarked on a remarkable series of varied and rewarding internships. After her first year, she was appointed as a PepsiCo Larry D. Thompson Fellow, where she focused on privacy, cyber, and IP, eventually presenting a ransomware hypo to PepsiCo's North America General Counsel. In her 2L summer, Subhani split her time between two internships: Baker & McKenzie LLP, which made her a post-graduation job offer, and the Google Legal Summer Institute program.

“Google is a trendsetter when it comes to data privacy,” she explained, “which is incredibly complicated, delicate, multifaceted, novel, and fascinating. It requires multidisciplinary approaches, open-mindedness, creative solutions, and many passionate individuals (like me) to join the fight.”

She also accepted a year-long internship with the prominent D.C. think tank Future of Privacy Forum, focusing on biometric issues, which in turn alerted her to an unthinkable opportunity. Earlier this year, Subhani was named a Science, Society, and Policy (SSP) intern in the White House Office of Science and Technology Policy (OSTP).

“I work on legal and policy issues that relate to privacy and intellectual property, . . . utilizing my legal skills and policy background on behalf of a President that truly cares about U.S. citizens’ data privacy rights,” she said. “I couldn't have asked for a better internship to end my academic career.”

Subhani also served as one of four student panelists for the inaugural White House Office of the National Cyber Director (ONCD) “Women in Cyber" webinar event, held March 30, 2024. The event convened nearly 800 people from 34 countries to discuss the empowerment of the next generation of women in cyber, particularly those from non-traditional backgrounds. While women comprise 49% of the U.S. workforce, they make up just 26% of those employed in the cyber field.

“The White House recognizes the importance of supporting young women in their pursuit of cyber careers and making it possible for [them] to make their fullest contributions to this field,” said National Cyber Director Harry Coker, Jr., via the White House press release.

“The webinar gave students a voice—an opportunity to share career insights with their peers from around the world,” said Subhani. “I shared how my discovery of cyber changed my career trajectory.”

Subhani’s advice to SPA students considering careers in cybersecurity? Don’t self-select because you lack a tech background.

“The popular misconception is that you need technical skills to make an impact in the cybersecurity field,” she said. “However, tech is only one of its many sectors. You can be a coder, ethical hacker, academic, cybersecurity consultant, cybersecurity policy advisor, cybersecurity lawyer (like me!), etc. Your unique perspective, skillset, and passion have a place in this world.”

Subhani notes multiple, overlapping inequities: Latinx workers hold just 8% of jobs in the tech field, and Latinas make up just 2% of the legal profession.

“I know that my people are especially needed in this field, and we have a long way to go,” she said. “By breaking down this myth that you need technical skills, the cybersecurity field can start to reflect the society it serves.”

Finally, she encourages students to prepare for curveballs.

“I've learned that you can plan your trajectory as meticulously as you want (believe me, I tried),” Subhani said. “However, life will have other plans for you––some greater than you could ever dream of. I knew I was passionate about privacy, cybersecurity, and intellectual property: everything else was spontaneous and unplanned, which I am so grateful for.”

For more information on degree programs and certificates in cybersecurity at SPA, email spacybercert@american.edu or visit https://www.american.edu/spa/cyber/.