cyber-and-careers

[pseudo creek]

No I'm good

So you want to go to a community college to avoid taking a test? I mean that's not a bad plan but it still may not me as easy or as cheap as you think

[warm hinge]

dumb question

so....

@pseudo creekcan i get an associate degree from university? or it is a degree only from college?

[pseudo creek]

Only from community colleges

[warm hinge]

so bachelor/master only from univeristy then

[pseudo creek]

An associate degree is basically a general studies degree with a few specific classes thrown in

[warm hinge]

for me could be worth it? i mean where to start since i have 0 basics

[pseudo creek]

Kind of... in the US, there are 4 year colleges that arent community colleges

[warm hinge]

don't confuse me pls

[pseudo creek]

General studies are also required for the bachelor's degree

So basically no matter your route, your first 2 years of college are general studies. History, English, math, science, social studies. Then the last 2 years of college are specific to your degree

Lots of people fulfill the first 2 years at a community college

[warm hinge]

hem....

bachelor takes 4 years at leats but if u go for associate first it will take only 2, based on points x h

[pseudo creek]

well because associate is the first 2 years of a bachelors but a bachelors is required at the minimum I believe for immigration to the US unless you pursue other means

and an associates isn't really valued much in the US, it is better than a high school diploma but it is also very generic

[warm hinge]

In terms of education, an associate degree falls between a high school diploma and a bachelor's degree

it is a pre-degree

[pseudo creek]

yes

[warm hinge]

we don't have that here

so at the start it hit me like tf is this?how to learn this etc

i was shocked

[pseudo creek]

like an associates seems equivalent to the UKs 16-18 year old education

[warm hinge]

UK is different from USA?

[pseudo creek]

GSECs is what I think they call them?

[pseudo creek]

very much so

[warm hinge]

don't ask me that😂

i don't have any idea

[pseudo creek]

nah just statement

[warm hinge]

also...

how to get associate degree? i mean about grades

they have GPA scales, but we have like number grade e.g 7/8 etc

do i need to meet the minimum req to earn an associate/bachelor?

user comment: Otherwise, if you are going to invest 2 years, you may be better off taking a masters degree in your present field or get an MBA. Though you generally need a GPA in your bachelors of 3.0 or better.

[pseudo creek]

you do, generally its a 2.0 out of 4.0

but if you plan to go for a masters, you'll need better grades than the minimum

[warm hinge]

lets do in my grade to undertsnand better😅

imagine i have 6 out of 10 in my diploma ok? will it be enough to go to a college/university in USA?

[pseudo creek]

no

but you'd have to talk to someone who specifically knows about how grades are done in your country

[warm hinge]

wdym how they are done?

6 out of 10 is.... 60 out of 100

[pseudo creek]

which is pretty bad in US terms

[warm hinge]

GPA 1😐

but

in EU is not bad also

in USA there are people who are bad at school but then go to university

[pseudo creek]

that is why I'm saying, maybe college admissions would look at you differently being from Switzerland

[warm hinge]

i don't have idea

my grades are not very high in my school

[pseudo creek]

this is pretty much why someone would go to community college, so that they could get good grades / second chance and go to a University / 4 year college... if they got bad grades at the community college, they still couldn't go to a university

[warm hinge]

ah so

u mean going for a associate degree (community college)

2 years to try to be good

because community college accept everyone while university not

[pseudo creek]

kind of, but you don't even need an associate degree, you just need to meet the requirements of the university

[warm hinge]

u mean this righT?

[pseudo creek]

so a community college accepts everyone within that community

[warm hinge]

you just need to meet the requirements of the university........ wdym? if i go to community college and get average grades...it will count college grades not EU grades i got

[pseudo creek]

yes, but you need better than average grades

but basically a university can still reject you if you go to a community college

[warm hinge]

based on what? they need proof to reject

[flat sedge]

Community college also has a different goal than a 4 year university. Community colleges focus on vocational training, not preparing the student for further academia.

[flat sedge]

They don't, actually. Candidates can be rejected for not meeting minimum academic standards, but even good grades isn't a guarantee of admission. Most universities have a limited number of new students they can bring in each year.

[pseudo creek]

you would need to talk to the community college to figure out your best options for transferring... they should help guide you

but you should also target a community college in the state of the university you want to go to

[warm hinge]

in switzerland we have 12 univerisity, in USA more than 4k

[pseudo creek]

and universities have quotas for foreign students / students on a student visa

we also have 330 million people

[warm hinge]

that's most for private univeristy, i want to go to public ones

[pseudo creek]

our universities aren't empty

[pseudo creek]

you gonna tell us US university requirements now?

[warm hinge]

what

[pseudo creek]

public universities reject thousands of people every year

[warm hinge]

imagine privates

[warm hinge]

US citizens or foreign students?

[pseudo creek]

both

[warm hinge]

because?

bad grades?

[pseudo creek]

not meeting academic standards, the university being at capacity, and for foreign students, there is a hard quota of how many students they can accept

people can have great grades and a crappy entrance essay and be rejected

[warm hinge]

then mostly won't go to university....

[pseudo creek]

yes and most don't

[warm hinge]

so

i should have been born in USA

....

[pseudo creek]

even that won't guarantee you entrance to a university

[warm hinge]

....

so half of US citizens aren't graduated?

i mean most of them

don't have any degree

[pseudo creek]

yes most of them don't have a college degree

[warm hinge]

college? u mean associate degree?

[pseudo creek]

but there are various options available, non traditional schools as an example or for profit schools which are less academically inclined if you pay $$$

[pseudo creek]

any college degree

[warm hinge]

so, they just ended high school like i will do?

normal diploma i mean

[pseudo creek]

some don't even get that

[warm hinge]

$$$? 3 times bro i feel bad

i think $ is most important xD

[pseudo creek]

there are 2 options in the US... you can 'test out' and get an equivalency diploma

[warm hinge]

they can close an eye

[warm hinge]

which is the 2 option?

[pseudo creek]

you graduate from high school

but lots of people drop out of high school and test out either when they are young or later on

[warm hinge]

wait

ur saying i should leave my high school rn to go to finish in USA?

only 1 year before my diploma?

[pseudo creek]

oh no no no

you still need to get a student visa

[warm hinge]

...mhh

my parents will do that

i just have decide what i want to do and how

[pseudo creek]

I mean you have to meet requirements to get a student visa

why do you want to come to the US?

[warm hinge]

why not,, i like the country

and i would work there

[pseudo creek]

have you been here?

[warm hinge]

there are US citizens who comes to study here, why i can't go there then?

[warm hinge]

never

[pseudo creek]

I mean I'm just asking, lots of people have an idealized view of the US

[warm hinge]

@pseudo creeki would work here (dm)

u can get idea maybe

[pseudo creek]

I told you not to DM me

[warm hinge]

ok

https://apply.intelligencecareers.gov/job-description/1192843

i thought i couldn't link

instead i can

[pseudo creek]

oh sweet summer child

[warm hinge]

😐

[pseudo creek]

in order to work for the Gov, you'll need to be a US citizen and go through extensive background checks. Now switzerland isn't a frenemy country but still ties to another country make it tricky to work for the NSA (CIA, FBI, etc)

[warm hinge]

nah

most of whistleblower where from usa

e.g snowden

they do a background check etc

polygraph exam

[pseudo creek]

ok if you know more than us, go for it

[warm hinge]

if it is all correct, why would be a problem?

[warm hinge]

.

[warm hinge]

are u from usa?

[pseudo creek]

yes

basically the background check includes finding out if you have ties to other countries...

[warm hinge]

if u don't have nothing to hide

it is ok

[pseudo creek]

no you don't understand

but look, I'm done

[warm hinge]

pls no

[pseudo creek]

a foreign national with an aim to work for the NSA is a big red flag

[warm hinge]

ah

i can get what u say

but if i will live there etc, won't be a red flag right?

once u get US citizen

[pseudo creek]

it will take years to become a US citizen but even not all US citizens are eligible for clearances / working for the gov

[warm hinge]

if u think am crazy or smtgh, i dont get it as an offense

[wintry saddle]

hellooo

[cobalt reef]

so i've almost finished a ba of IT, thinking of shifting towards security engineering.

any recommations for certs/courses i could pair with the ba with a sec ops/ security engineering focus?

was thinking CISSP is probably the one i've heard of the most hoping for some extra input tho or if the extra certs even worth chasing up

[stoic cave]

I don't even think you can be a naturalized citizen and work for the NSA. You have to be born in the US or born to US parents living abroad while they themselves are on assignment.

Foreign Nationals can get low level clearances but it's an extremely difficult process.

You'll also have to renounce your citizenship to your home country and you're going to put your family through a lot.

[warm hinge]

can't have dual citizens?

[stoic cave]

No

You have to swear your allegiance to the US. That goes for just getting a citizenship without a clearance too

I can tell you right now, you're not working for the NSA

I'm not trying to be rude, just realistic

[clever rain]

@cobalt reef You might not be aware but there are experience requirements to get the CISSP (https://www.isc2.org/Certifications/CISSP/experience-requirements#:~:text=Candidates must have a minimum,year of the required experience.), even if you pass the test. Have you thought about what exactly you might want to do within security engineering? (Cybersecurity is a very broad field)

[stoic cave]

You need 4 years experience, since you have a degree, in an appropriate domain in order to get the title of CISSP. Even if you have passed the test. Otherwise, you're an Associate of ISC²

[cobalt reef]

was under the impression security engineering was its own field of cyber and covered the implementation of security solutions or does that fall under the roll of an analyst still

[clever rain]

Bigger companies will have the role more defined; smaller companies likely will not. For example, I've held the title "security engineer" but also had to do GRC (Governance, Risk, Compliance) activities. In the real world, it really depends on the organization but the CISO mindmap by Rehman might help visualize the different areas: https://rafeeqrehman.com/2022/04/24/ciso-mindmap-2022-what-do-infosec-professionals-really-do/

[clever rain]

@cobalt reef (there will likely be varying, passionate opinions on this so heads up lol)

[cobalt reef]

thanks that's a huge help and makes sense i got place into an "it management role" recently but im essentially doing sys admin and web dev lol

[serene umbra]

Gave +1 Rep to @clever rain

[cobalt reef]

but essentially since i've done alot of programming informally before my degree and outside of work as well as a fair bit of penetration stuff simply for the fact i wanted to know how it worked was seeing if there was a way to combine them and from what i saw security engineering sort of fit that but ill look through the link you sent me

[clever rain]

Sounds like you have the right mindset! The only other thing that I'd add besides focusing in on the area that you enjoy, is making sure that whatever you are doing is providing value to the organization. This way of thinking can become muddy very clearly if you work in a large vs small vs finance vs NPO vs healthcare etc. Whether "right" or "wrong", if whatever you are doing is consistently perceived as "blocking" the business/organization, then there will be struggle/conflict. Of course organizational leadership could be hard headed and fine to accept organizational ending risks so we might have to stand our ground (or leave) but whenever possible, saying "Yes" with conditions will likely get you much farther than flat out "No! We absolutely cannot do that because of <insert valid reason". This becomes a lot easier to do if you working in a part of security engineering that you enjoy while understanding how the organization works. Good luck my friend!

[flat sedge]

Second this. A big part of getting sign-off for changes to happen is getting someone to be responsible, which can be a huge blocker. It is the job of security specialists to build the bridge for organizational change, not to put up the wall preventing money from being made

"Sure you can do <really dumb thing>. I need you to get sign off from your director all the up to VP for me to approve the change for SNMPv1 to be put on the public DMZ"

[clever rain]

@cobalt reef one more final thought...I have degrees and a bunch of alphabet soup and so do most of the folks in my team. However, I hired almost 10 security engineers this year and not once did I screen CVs for certifications/degrees or ask if they have a degree or cert. Obviously this is anecdotal but it "feels" like many of the "good" organizations to work at don't care about certs as much as before (just my observation, I have no data to back up my statement). I'm probably opening up a huge can of worms here so to clarify: I'm not suggesting that certs are worthless (you absolutely have to have them to work for the DoD or consulting for example) but maybe focusing on projects, networking (like TryHackMe forums), and experience might lead to better opportunities and certs are just icing on the cake. Not sure if this helps but food for thought at least. EDIT: Clarified by adding "...I screen CVs for certifications/degrees"

[cobalt reef]

thanks for the help everyone

ill keep those things in mind you guys have cleared up alot for me

[cobalt reef]

its more the fact that most my experience is informal atm that i was considering certs to make up for it, it was essentially the same reason i went for a degree haha maybe i just need to find better ways of presenting projects as formal projects but anyway i appreciate it

[stoic cave]

I would say that virtualjj's case is unique. I would consider getting your security+ as it will likely make things easier paired with a degree.

Also, idk how I feel about not reading people's CVs. Those people put time and effort into preparing the document and to me at least, not taking a look is kind of not respecting their time. I do however see the flip side of not wanting to introduce bias.

I'm also assuming you said CV meaning resume.

[cobalt reef]

it doesnt sound like a bad idea honestly i just wasnt sure what cert to go for which is why i said CISSP originally since id heard of it the most

but ill most likely get a security+ cert to pair with my degree

[stoic cave]

Yes, so I think i pinged you earlier, but Sec+ is a fundamental cybersecurity cert

[cobalt reef]

given CISSP needs the formal work experience

[stoic cave]

CISSP has the work experience requirement

[cobalt reef]

think i only saw the CISSP ping

[stoic cave]

Yes

Yes, that's the ping I was talking about

[cobalt reef]

oh okay

is there any other certs that i would need at this point or would a degree and sec+ be enough

[stoic cave]

I only had a degree* and a company took a chance

[cobalt reef]

oh okay awesome

[stoic cave]

But it would have been a lot easier if I had Sec+

• because I have a clearance

[cobalt reef]

yeah that makes sense

[earnest swift]

The CISSP is not not a very technical exam. I've heard it described as a "mile wide and an inch deep". I feel that the test teaches you language you need to be able to translate between management and security team. I think its a worthwhile certification and you will likely learn a lot, but I would look into it and make sure its the things that you want to be learning.

If you want see what training I used for passing the CISSP, check out the playlist below. FRSecure runs a CISSP Mentor Program every year and it is fantastic. https://www.youtube.com/playlist?list=PLETKkWHNA3qjMWR61bBseaI1J_3zP5tlp

[earnest swift]

If you are short on the required experience, you can still take the exam. When you pass you are an "Associate of ISC2" and when you get the necessary experience you will gain the title.

[stoic cave]

Yes, I know. My initial ping said that

[earnest swift]

Sorry, I didn't think to scroll up.

[clever rain]

apologies @stoic cave - what I meant to write was I don't screen CVs...for certifications or degrees. Of course I read the CVs!. I will edit my post. Doh!

[proud tangle]

internally should be internal

[thin cape]

You are right but thats what i received by mail

[proud tangle]

Then I'm not sure what you're question is

[warm hinge]

The thing is, the CISSP title is what is most important about this cert, not ability to pass that exam. This is managerial cert, and 'associate of ISC2' does not do much for you really in this realm. If somebody wants some ISC2 certs, there are lower certs with lower experience requirement. Passing exam, and paying fees for years and not being able to use the cert is pointless imo, especially that it's not a cheap exam.

[pseudo creek]

(CISSP isn't a managerial cert in the US)

[warm hinge]

Well, yes, a lot of certs lost value in US :D Still, experience is most important part of this cert, and the title. What is the point of spending that money if you cannot even use the title?

[pseudo creek]

well I agree with that

CISSP in the US is good for people once they have been in cyber for a few years, want a promotion / higher responsibilities / etc

I don't recommend people get CISSP until they have the experience requirement

[warm hinge]

I know that some companies want it for entry level jobs, and I have no clue why. I think ISC2 needs to communicate better or something?

yeah, this

[pseudo creek]

you actually know they want it for entry level jobs or are you looking at mismarked jobs on LinkedIn/Indeed?

[warm hinge]

I saw with my own eyes CISSP for L1 helpdesk in big enterprise. I need to start taking screenshots. It's was definitely an exception, not rule.

I know that P&G demands having CISSP or doing it up 6 months from employment, regardless of the sec role you have there.

At least it's not prerequisite.

[pseudo creek]

well my company basically wants any mid level cyber person to have CISSP regardless of role

[warm hinge]

but yeah, mismarked jobs are the problem too

midlevel makes sense, it implies some decent exp

midlevel in sec is pretty far :)

[pseudo creek]

well like 5-7 years in

[odd sparrow]

about to apply to an infosec associate analyst job at a previous healthcare system I worked at, wondering what you guys think of my resume? i have a non-IT background and most my experience is in clinical pharmacy. currently pursuing other certs (Az-900, CySA, net+) and upgrading my computer to virtualize a home lab, but haven't started yet. if i should add, edit, or remove any sections to make it more impactful, any advice appreciated!

[warm hinge]

So, ok for cissp, exp fullfilled, but demanding it for entry roles or from people straight from college is not really great, imo. Idk... there are other certs to validate people's knowledge. Also, it's a different story when company pays for it too. Just people without exp, even if they pass exam, cannot call themselves cissp, so what is the point to require that?

I suck in resumes, so I back off in that. Check Blue Teams Labs Online, they have solid labs.

[stoic beacon]

i would remove tryhackme from the experience section, i don't think most places are gonna care about experience outside of a real world environment

[warm hinge]

but it may be worth to put into personal interests/projects

[stoic beacon]

that, and THM boxes are left insecure in some way so as to facilitate learning, whereas real life machines are much more limited in scope and rules of engagement. don't get me wrong, thm is a great resource for learning, but i don't think any company would consider it a valid reason to hire you

[stoic beacon]

that's at your (or their rather) discretion

[pseudo creek]

so your summary basically doesn't mention cyber until the last 3 words... Basically you should focus on saying you are looking at pivoting... like "Healthcare professional ... then you start talking about your interest in pivoting your career and focus on cyber after that or else you lost me"

"professional experience" - I would include some blurbs on how you work on a team, any leadership, etc. I'd drop the internship

"certifications and training" - keep security+ here but drop the other stuff and put in another section near the bottom

"skills" - I hate to say it but no one really cares if you can use Windows, macOs or office... if you can administrate that, its a different story. I'd build this out a bit include things like "vulnerability application testing using tools such as..."

"non-professional experience" - change this title to something like "personal development"

As you are probably aware, your resume is really lacking. Do you have a github or writeups or something you can share? Also, what is your overall goal, what type of position do you want?

[pseudo creek]

no one is arguing with you

[warm hinge]

Not a valid reason to hire, not, but it shows that you are interested in the topic and learn around. Of course it does not count as real work experience because it's a ctf, at the same time in 'personal development' it can help. It of course depends if hiring company cares about it. Imo, building virtualized environments, even small, treating them as real world projects, hardening and all, and documenting it well technically and from project management angle, may help.

[stoic beacon]

i agree here. perhaps note the doctors in Pharmacy but don't pad most of the resume with your experience in that field, you're going to want to focus on your cybersec knowledge/experience since that's what this resume is for. to be entirely honest, my eyes glazed over for a sec reading the professional experience section

[warm hinge]

I know :) I am just adding :))

[pseudo creek]

yeah I mean as soon as I got to the second line of the summary, I was throwing this in the (figurative trash)

[stoic beacon]

right. i mean don't get me wrong, it's great that you have a doctor's as it means you're willing to get down and dirty, per se, but you can definitely trim a lot of the fat from that resume @odd sparrow

another tip; i personally make my resume as modular as possible so it's easier to specifically tailor to any job listing i apply to

customer service? emphasis on customer service experience, resolving issues quickly and efficiently, etc. security? emphasis on security, monitoring cctv and security centers, etc

[odd sparrow]

I have a github, but only has a few simple python projects from guided videos and courses (like snake, pong, and jumper frog), nothing cyber related. Only writeup is a reddit post detailing how I passed the sec+

Overall goal is to pivot initially into an analyst role, and to work towards working in a blue team environment, specifically SOC, IRT, or forensics. I have an interest in cloud security as well

[warm hinge]

yeah, this is a solid advice

[stoic beacon]

thanks, most of it comes from personal experience so im glad it can be beneficial to someone 🙂

[serene umbra]

Gave +1 Rep to @outer swift

[odd sparrow]

would it be better to just remove the publications section since it's not IT/cyber related?

[pseudo creek]

I would keep that towards the bottom

[pseudo creek]

hmm reddit is iffy unless you have a reddit account dedicated to just infosec, I'd look at maybe transferring that writup to github

[warm hinge]

My 2 cents: Proficiency means high level of skill, basic or intermediate proficiency makes no sense. Also, don't mix systems and tools into one category. Pick few skills you know best, and focus on them. If you want to go to analysis, consider doing BTL1 - it has a practical exam. BTLO have a lot of investigations, and these are labs, not tutorials, so to some extent they show your skill too. Write few solid reports - employers love good documentation/report writing skills.
Check Jason's Blanchard (Banjo Crashland) job hunting videos on youtube. There is a lot of good advice there for people without experience.

[pseudo creek]

oh which reminds me... this is a pretty solid video on writing a better resume https://www.youtube.com/watch?v=uqhOlOdwavU&t=672s

[proud tangle]

Thanks for this! Been working on mine recently, could use some advice

[serene umbra]

Gave +1 Rep to @pseudo creek

[odd sparrow]

Thanks all for the insight, already modified the top couple sections to make it more applicable to the job and removed lots of fluff. Also touched up my github with an Azure Sentinel project I had worked on the side.

[mellow bobcat]

https://www.sans.org/scholarship-academies/vetsuccess/?utm_medium=Social&utm_source=Facebook&utm_campaign=VetSuccess 2022 has anyone applied and used this and if so what was your experience with this program

[clever rain]

@odd sparrow Many of the fine folks here have given some really good advice. Something else you can consider is that it might make sense to try and get a call/video conference with the hiring manager(s) to explain why you are pivoting before applying. Unfortunately, depending on the job description, hiring manager, and job applicant system, your CV/resume will likely get automatically tossed or passed over in favor of candidates that appear to be more qualified on paper. My take is you'd probably have a better chance by networking if possible. One huge advantage that you have is that you understand and have experience in the industry where in many cases, infosec folks do not. Without seeing the job description of the role you are applying for it's hard to give more specific advice but if you will be staying in healthcare, I'm guess showing/demonstrating that you are up to speed on HIPPA could get you far since healthcare is a highly regulated industry. If you haven't already, try to network with other infosec professionals working in the industry; perhaps you can share you insights on what it was like getting a phd and submitting peer-reviewed publications in exchange for the advice. (i.e. help others and they will be more inclined to help you) Just keep trying and don't get discouraged if folks say no. Just reading between the lines of your CV and what you've written here, you just need that one opportunity to get your foot in the door; if you can stick out a doctorate in pharmacy, I don't see you having much trouble being successful in cybersecurity!

[stoic cave]

Are you a veteran?

Or your spouse is active duty?

[glad dust]

I'm a bit behind in chat but I kinda agree. The whole point of CISSP is to say you have CISSP, which you can't even do until you have the x years of experience

[distant pier]

Also learning the concepts covered in the CISSP might have more value after a few years of enterprise experience and being able to apply these concepts into an environment you already understand practically. 🙂

[shy quail]

Hey everyone. I currently am in a job interview process for a junior penetration tester position and I have a question. Some backstory on me, I got into tryhackme a lot in the last 2 years and moved over into an IT position and started looking into getting some certs. Because I was hard focusing on certs I had to put offensive studying off for a bit. Fast forward to now and I now have my net+ and sec+ and am almost ready to take my cissp after studying for a while. Well as a shot in the dark I decided to apply for a penetration tester position at a company I would love to work for. I have gotten past the interviews to the assessment portion now. My question is, is it normal for a beginner to not be able to root an assessment given to you by a company? I have found a couple security issues and vulns but just can’t land an exploit to completion. I know I just need more training to get it but I just want to know if I’m just not ready yet?

[pseudo creek]

it really depends what they expect and are looking for. I would an assessment would be how you handle it, regardless if you got all the way. I would wait to see what they tell you

[shy quail]

Thank you for the reply! Makes me feel better about it and worst case scenario is I get my first experience interviewing and assessing as a penetration tester. Right?

[serene umbra]

Gave +1 Rep to @pseudo creek

[lean cypress]

I need some help. What are roles called when an consulting attempts to get into a companies data center or office in person ? I know this is consulting, but what is the title specifically ? Thanks !

[undone shore]

That isn't necessarily consulting.

The action is "physical pentesting", but like most other aspects, it's usually not a specific role. A physical pentester likely also has other, more-frequently used aspects to their job.

Physical pentests aren't massively common.

[lean cypress]

Thanks ! These roles seem intersting.

[serene umbra]

Gave +1 Rep to @undone shore

[lean cypress]

Anybody try Over the Wire ? Is it more advanced then most plaforms ?

[pseudo creek]

It is basic but fun

[hybrid orchid]

Then check out this as a template, and associated conversation below https://discordapp.com/channels/521382216299839518/707992725646999553/936122225369702461 It helped me a lot ❤️

[proud tangle]

Ah nice. I think my problem is that I have no experience, so I'm finding it hard to fill up space with useful things

[hybrid orchid]

https://www.youtube.com/watch?v=e2h_BreIxaQ

If you haven't had the chance to get that experience via a job so far, maybe you could "prove yourself" via home labs, walkthroughs, skill badges, course completions...

[pseudo creek]

what? is that really what he says because... thats a bit yikes

home labs are great, they can show interest but also home labs these days can be using a cloud environment or virtualization environment. Building a portfolio overall is useful, use something like github, put your write-ups there, put any scripts/stuff you create related to cyber security there

but skill badges? course completions? those are much less useful

do not waste precious resume space with those

[desert sonnet]

Network Chuck is a cool guy and I like his content, but it seems much more focused on learning for fun and enjoyment than learning for roles imho

Obviously that's not a bad thing, and it's good for getting people interested, but a lot of his content is like "look at this cool thing, isn't it cool, play with it!" rather than comprehensive teaching stuff

[cinder idol]

Hey guys new to the discord! RN looking to change careers into cybersecurity. I have an associates and bachelors in nursing. I have no experience in the field and just looking for info. Has anyone had success in teaching themselves without doing a boot camp and finding a job?

[rugged delta]

Cybersecurity is not an entry level field in the IT landscape but it is possible to learn a lot using TryHackMe and other resources like books and courses. If you go onto the THM blog, you can see lots of success stories of people migrating from other professional areas. A lot of people use THM to learn as they grow their skills and aim for certifications, either professional or academic but there are lots of paths to take.

Right now, there are two Humble Bundle collections of great cybersecurity books (linked below) that we frequently discuss in #bookclub, including the Tribe of Hackers collection which includes interviews with cybersec experts discussing their various roles and how to go about getting there. Cybersecurity is a fun journey and you should check out the links in #start-here and go on and try the Advent of Cyber, a set of beginner challenges leading up to Christmas

https://tryhackme.com/resources/success-stories
https://www.humblebundle.com/books/hacking-no-starch-press-books-2022
https://www.humblebundle.com/books/holiday-encore-become-cybersecurity-expert-wiley-books

[lean cypress]

A good start is to get some certifications. Might want to look into the A+ exam, then go from there.

[proud tangle]

Basically he says you should have a website to showcase personal projects, and provide the url on your resume. He recommends putting homelab stuff on your resume if you have no experience. The sample website he shows off had skill badges on the site. - Though, I'm not sure I'd even want to put skill badges on a website.

[pseudo creek]

The only time a hiring manager would look at your website is if they are really interested in you. It is good to have a portfolio because maybe there is something on your resume that makes them interested and they want to see how well you can write / present topics & ideas.

[wary siren]

I guess it wouldn't hurt to put certain courses on your LinkedIn, for instance. Maybe not every single THM room/learning path you have ever done, but there are some courses that can at least add a note to your resume that you are involving yourself with it.
Now, will this help with recruiters? Probably not always, but you may once in a while raise interest and get contacted. From there you might be able to score an interview and then you can use it to empower your own narrative.

What I think is even better: set up a blog, go through courses and write about it. It shows your active involvement with these topics and writing is a seriously important skill in the business world.

Oh, and don't hesitate to promote your blog posts on LinkedIn. That's quite literally what this website is made for.

[slate crag]

Hello, good day.
I am a student and will very soon graduate from masters of cybersecurity.

I've been self-learning and focusing towards SOC L1 to get a job in that when I graduate, I've finished CyberDefense and SOC L1 pathes in THM.
I've also watched CEH and Pen+ on Udemy just to get an idea while focusing more on defensive-side.

• I have 2 years work experience as IT Technician
• Have 0 work experience in cybersecurity

Since I've finished all the blue team paths in THM, where should I head now? should I start trying to get a certificates like CySA+? but then I've always heard "Qualifications before Certifications"

Thanks

[pseudo creek]

do you have any certs now? Like Security+? I'd start applying now honestly, I'd also look at the Splunk certifications as those will be of interest to defense/blue teams

[slate crag]

No I don't have the certificate Sec+ because it seems not to be needed here in "middle east" and I feel like having master's in Cybersecurity should just cover the need of it, but I've learnt it.
I've been applying recently, and yes I literally have the Splunk page open thinking to start with it.

[pseudo creek]

ahh ok, you mentioned CySA+ which I usually don't see comptia mentioned much outside the US. Also US based masters really wouldn't cover anything much in terms of an entry level cyber position but I don't know about masters outside of the US

[slate crag]

No my master didn't really cover the content of Sec+, I meant that Sec+ is kinda a start point and just learning it without getting the cert is enough, and that If I to get a certificate I should start higher on ones like CySA+ or others that on same level I don't know.

[pseudo creek]

that isn't a bad path if cysa+ is recognized in your country for jobs

[slate crag]

Ok thanks, I'll be looking to get started for either Splunk Certificate or CySA+/ISC2 certs.

[thin merlin]

I am alone anyone wanna come in my server

[hardy snow]

hey so I have just completed the eJPT certification and I was wondering what should be my next step, maybe eCPPT? OSCP? if someone could guide me a little thanks

[pseudo creek]

what are your goals?

[hardy snow]

probably pursue a job on pentesting? but not 100% sure, atm just want to keep learning

[pseudo creek]

what experience you have now? what country?

[hardy snow]

studying computer science, completed ejpt to focus on cybersec

oh, spain

[thorny turtle]

I would recommend doing ISC2 cert instead of CySA+. ISC2 is more recognized

[slate crag]

What about BTL1? I assume it's the least known?

[thorny turtle]

not worth

better if you get the Splunk

since a lot of SOC uses Splunk SIEM

[slate crag]

Alright, thanks.

[pseudo creek]

but the CySA+ cert is more recognized than the ISC2 cert... but not by much

[thorny turtle]

not in the recruiting standing point

most recruiting tools scans your resume, not read by the human eye

[pseudo creek]

uhh ok if you say so, I'm not in the middle east but I do participate in hiring/interviews of cyber peers

they will be looking for CISSP, not for a random cert that I can't even tell you what its called

[thorny turtle]

I mean, i guess it depends on the company

[pseudo creek]

whats it called? do you know? because you called it ISC2 cert

[thorny turtle]

most places Ive seen, they put SEC+ and ISC2

CySA+ is like rarely mentioned

[pseudo creek]

I know our automatic resume filtering looks for certs by name, not by the provider

but also, we hand look at resumes too even if they were rejected sometimes

[thorny turtle]

But i can tell you @slate crag if you do get an interview, make sure you know your steps for incident response

how you would go about dealing with phishing emails

KPI

just basic security stuff

if you take either Sec+ or ISC2, they provide those knowledges

CySA+ is more technical than memorization

[slate crag]

Thanks a lot, appreciate this.. noted.

[flat sedge]

which ISC2 cert are you referring to?

[thorny turtle]

SSCP

[flat sedge]

Thanks

[thorny turtle]

Do you have any certs in security? if not, i would first recommend SEC+

and then go for SSCP

SSCP is more advanced

Sec+ isnt too hard

[slate crag]

I have studied it but never done the exam, was aiming to start with a bigger one. Haven't seen anyone in my country who work in SOC have SEC+
So I thought to start with a bigger one

[flat sedge]

I have CISSP, thanks though.

[slate crag]

Most of them have certs from Microsoft/eLearningSecurity

[flat sedge]

I would not spend your own money on certs, unless it's to get a junior role. If you can, try to leverage your current job role and employer to pay for the certs so you can make the transition

[slate crag]

As mentioned above ^, I have 0 work experience in Cybersecuty (2yrs I.T Tech) and will graduate soon with a Master degree in Cybersecurity and have been self-studying on platforms like letsDefend/Cybrary/THM and now since I've finished blue team paths in THM recently

I was wondering my next move, was thinking of Splunk certificate

[flat sedge]

A M.Sc in CyberSec can actually be a detriment when you are starting out.

And will overqualify you for many entry level cyber roles.

[slate crag]

oh no

[flat sedge]

So you have 2 years of work experience in IT Tech? Can you elaborate on that

[slate crag]

I was in maintenance department for an I.T company, fix hardware/software for the company and clients..

Made sure everything is running

[flat sedge]

What does that mean? Did you do solder repair on broken boards? Replace malfunctioning equipment? Reinstall software? Write patches for software?

[slate crag]

yes except for writing patches

[flat sedge]

Ok, so that's a decent place to start from.

My advice would be to get an entry level sysadmin or network admin cert (CCNA, RHCSA, Linux+, et al) and transition to systems engineering or IT infrastructure

From there, it's a much easier transition to a security focused role than an IT site support role

[slate crag]

Ye that would be great, wish I had a sys eng job before now

[pseudo creek]

I have CISSP too and really SSCP isn't something we look for, I don't know why but its not, we look for Security+ over that

[slate crag]

would make it much easier I bet

[river cloud]

Hello everyone !!
I need some path guidance..
My goal is to go for bug hunting..
So, I have completed the Jr. penetration Tester and fundamentals
Now, Should I go into bug hunting ? or complete any other tasks/rooms on tryhackme ??

[next quiver]

Hello all! I am an army vet and currently in a DEVOPS pathway going for SEC+, CEH, and SPLUNK certs. I am looking to find a good entry level IT job that will apply the stuff I am learning in everyday use on the beginner level as I have no IT experience other than what I am learning now. Are there certain job titles that I should be looking for while seeking this? Thanks for any and all responses!

[pseudo creek]

assuming you are in the US, it varies widely but things like security analyst, security engineer are common titles. You could also look at things like SOC analyst, GRC analyst, incident response analyst

also part of the problems is job titles may be similar whether they are junior or senior so those job titles don't guarantee they are junior, just options that could have junior titles

[desert sonnet]

Question for my UK peeps: how do you tax bug bounties? I've not done any yet, but I've been looking at potentially trying some, for experience, but I can't really find any conclusive evidence on how you tax them if you get rewards. While I doubt that my novice self will get any payouts for any bounties I may find, in the event I do I'd like to know what I'm supposed to do with them.

[static tide]

simply do not tell anyone

[hollow plume]

Hello fellow British woman. It depends how much you earn in a tax year. If you earn £1000 or less from soley the service you provide as a bug hunter then you don't need to do anything.

But if you earn more then £1000 in a tax year you'll need to fill out https://www.gov.uk/self-assessment-tax-returns

[desert sonnet]

I am a woman, but thank you for the information. I wasn't sure it was so simple, because usually bug bounties are in $ and as I understand it foreign currency is taxed differently, but I'll give that a read to see if it answers my questions

I suppose if it became an issue I could talk to my bank, they should be able to advise (you would hope at least lol)

[hollow plume]

I made no error 😅👀

[desert sonnet]

You're fine

[hollow plume]

Mb but if in doubt you can just contact HMRC directly and they can provide advice

[desert sonnet]

That's true, I hadn't considered talking to them directly, just because dealing with govt offices is a pain

[hollow plume]

True nothing can be worse then student finance though.

[desert sonnet]

Please don't speak of student finance to me, I do not wish to be reminded of their existence \j

I have spent hours on the phone with them, they're ridiculous

[hollow plume]

Then they give you the wrong advice after all and its actually this form and not this one its just gr

[undone shore]

It goes through as a separate form. You need to register for self-assessment. Not sure about online but certainly if you do it on paper (don't ask) you have to print off another couple of pages. It's not a huge deal. Just a faff

If you happen to hold SC... good luck

[desert sonnet]

I don't hold SC currently, so at least that won't contribute to the paperwork nightmare

[little gust]

What are the recommended entry level certs? I mean I get that most times it's about what you are capable of and what you have done.

[stoic cave]

I'd talk to a CPA or whatever the UK equivalent is

https://tenor.com/view/irs-taxes-joker-money-im-crazy-enough-to-take-batman-gif-16368522

[pseudo creek]

what is your goal? what country are you in?

[little gust]

Always been a jack of all trades. I'd like to do start off with bug bounties and any type of hacking(red, white or blue)

[stoic beacon]

what do you know of computers already?

[pseudo creek]

well you don't need a certification to do bug bounties as that is free to anyone to do

and you didn't say what country as certain countries put certain weight in various certs, although for pentesting, OSCP seems to be accepted worldwide

[little gust]

I could work remotely but with right circumstances I would relocate to wherever

[pseudo creek]

thats not how working 'works'...

obtaining work in a country that you do not have the right to work in is insanely difficult and not worth it to most companies unless you have a very specialized skillset

[little gust]

I can design websites, graphic design, know a bit of python, intro to Dev Ops and I worked as help desk and field tech

[little gust]

Doesn't it depend on your skill?

[stoic beacon]

begin with THM's beginner path then

to build on your current knowledge

reiterate what you already know, etc

[pseudo creek]

not really, I mean if you have a unique skill like you are only 1 of 100 people in the world that can do xyz and a company needs someone that does xyz, that could change the tables but it is very difficult for companies to hire outside their country

[little gust]

Agreed, I have been building up. I'm currently level 7 and I'm learning new and old stuff I already knew just to get a different angle. Once my skills matrix is well rounded I will begin CTF challenges with other hackers

[little gust]

Some countries do not require a work visa like the uk

Well for people from my country

[pseudo creek]

it isn't that, it is because every country has their own labor laws, they have to be able to comply with your labor laws as well as their own

but like I said if you want a cert that is applicable worldwide, OSCP is a solid cert

[little gust]

Ex colony same laws

[pseudo creek]

?

[little gust]

Thanks I will look into it

[serene umbra]

Gave +1 Rep to @pseudo creek

[pseudo creek]

if you have the right to work there, then you are golden... it just isn't that easy to find remote work outside of your country (or outside of region where you have the right to work)

like even in the US, a lot of remote work is still tied to a specific region / timezone and most companies won't allow remote work from foreign countries (even for US citizens)

[little gust]

I'm too much of an optimist I guess 😂😅 it's probably because I managed to get a few graphic design jobs in the US and UK once in a while

I believe in being the best in the room and if I'm not I shoot the guy who is, jk 😂

[stoic beacon]

@little gust please don't send me unsolicited friend requests

[little gust]

Oh my bad, I'll cancel no stress bro

[stoic beacon]

it's in the rules

#1

[little gust]

Just networking and knowing like mind folks, no big deal. I canceled the friend request

[stoic beacon]

i understand the intention but just sending random friend requests isn't necessarily the way to go about it

[carmine jolt]

I'd recommend to read through the #rules anyway 😄

if you havent yet

[little gust]

Like I said no harm, no use further discussing it, no?

[little gust]

Yall are mean, I'mma tell my mom 😭🤣 thanks Dolphin, I appreciate that

[serene umbra]

Gave +1 Rep to @carmine jolt

[carmine jolt]

haha, it's just good to be aware 🙂 that counts for everybody here!

[little gust]

I got adhd too many rules for me to read through all at once. I'm new here, I'll get there eventually or just keep to myself 😊

Well it's actually ADD but ADHD is more well known

[carmine jolt]

your risk 😉

[little gust]

I have a condition, takes a while hope yall bare with me

[little gust]

Small suggestion, you should make the dyslexic and other impaired friendly version 😊💙

[carmine jolt]

I'll pass it on to the admin ✅

do you have any suggestions on what you'd want to see? I dont decide on this matter but it would be good for Hydra to have some suggestions. If you want, drop a msg in #general as this is not the right channel for these kinds of things

[little gust]

A short to the point list would work for me, video or audio too.

[carmine jolt]

phoenix please leave it 🙏 not everyone experiences things in the same way

[feral abyss]

Ty

[serene umbra]

Gave +1 Rep to @carmine jolt

[placid torrent]

Wasnt sure where to ask this,

but does anyone know how to add the profile embed into linkedin?

this : <script src="https://tryhackme.com/badge/664929"></script>

[flat mist]

Hell just put it in with the certs they let you link to anything in there. Pornhub doesn't work we tried, but yea according to hacker1 it's a best practices issue.

[placid torrent]

pornhub 😭 ???

[placid torrent]

yh but i want the embed

i need it to look good

[flat mist]

We were curious if they filtered anything TBH they blacklist instead of whitelist.

or should I use denylist instead of allowlist

https://www.reddit.com/r/tryhackme/comments/ntkp8i/how_to_insert_thm_profile_badge_id_to_social/

unless something has changed in the past year take a picture it will last longer

[placid torrent]

ty

[flat mist]

linkedin is all about who you know as well. Network with people. Join study groups. Branch out.

[misty musk]

The absolute hell would I write in these boxes as an unemployed person, with only customer call centre experience?

[static tide]

dealing with clients

[little gust]

Write as you if you have done the job you applying for as someone who does freelance work from time to time

[warm hinge]

hi

what's difference betwenn cyber defense and cyber operations?

[flat sedge]

can you relate aspects of your house husband life to the role? Ie, deadlines for chores, meal prep, child care and herding, etc

[clever rain]

@misty musk Call Centre experience is quite good since being able to talk to people is arguably more important than tech skills in some cases. Perhaps use examples of your experience that might help on the job. As for how to relate your current role...perhaps this is an opportunity to take a chance and show some humor and/or personality? Or, ChatGPT is all the rage so you could try playing with that for inspiration. I put in the question of:

As a stay-at-home dad, in two sentences please tell me how your current role relates to a job in cybersecurity?

and the answer I got wasn't terrible IMO:

As a large language model, I do not have a current role or personal experiences. However, as a stay-at-home dad, you can still play a role in protecting your family's online security by setting strong passwords, educating your children about online safety, using parental controls, keeping your devices and software up to date, and using a secure connection when accessing sensitive information online.

Edit: Formatting and tagging OP

[ancient quail]

Hi guys
Do you need to work as a pentester first to become a malware analyst?

[wicked hound]

It's a bit different fields.

[ancient quail]

But you need some sort of offensive skills right ?

[wicked hound]

1. I am helping people making informed decisions in IT, so I acquired good experience in consulting and broad technical knowledge.
2. IT consulting

[wicked hound]

As far as I am concern, you sit on the computer, open new malware samples in VM, run them through a few tests, also check something manually (F8, F8, F8, F7, F8, F8, like woodpecker), then make some signatures from malware behaviour and that's pretty much it. After this you open other sample and repeat it all again

What you really need is knowledge of ASM, patience and love for forensics. Otherwise, it will be boring as hell for you, because it's quite tedious - to check through so much obfuscation, antisandbox techniques etc. Some malware you will probably know "in face", some can be a bit sofisticated, APT-related, some you might even miss.

[wicked hound]

And if you are really into it, then just reverse, reverse, reverse. Learn ASM deeper, learn Anti-Debug and Anti-Anti-Debug techniques, learn your toolset, check out some courses, check new malware from "the wild"

[ancient quail]

Thanks

[patent kayak]

Good day All, when someone finishes a path for instance the security analyst where one would do the three course (pre security, SOC1 and Jr pentester) , what else should some one do before trying to get a starting job in cyber security? Looking forward to a response from who can answer

[hexed magnet]

The default answer is get certified

[pseudo creek]

you are talking about some dynamic analyst testing but that isn't all that is done, there is static testing and sometimes there is programming involved to interact with the malware

[warm hinge]

Hello pen testers, I would like to ask a few questions. What is your day to day like as a pen tester? What educational path did you take and how did it work out? What is college like for a computer science degree? And how much is entry level pay as a pen tester?
And another question, what is the day to day life in cyber Forensics?
I start college next fall and I would like to know what I will be expecting.

[pseudo creek]

wow... that is a lot... it also varies by what country you are in, even pen testing in EU is different than US, degrees are different and all that and pay is drastically different

[warm hinge]

I am in the USA

[wicked hound]

My point was that it's not related to offensive part. But thx for addition, it's true.

[serene umbra]

Gave +1 Rep to @pseudo creek

[pseudo creek]

ahh so I can start with computer science degree (to an extent), there will be a lot of programming, but it basically builds a foundation for other careers which you may embark upon.

Entry pay in cyber security varies throughout the country but someone with a college degree is usually in the $60k-$80k range

I'll leave day to day life for pentesting to someone else although I work with pentesters and red teamers. I deal with them on the reporting and presentation side as well as prioritization of issues.

For forensics, it can depend on what type of forensics. I've done some intrusion forensics in the past and it is really tracking down what was done, when to what by whom. It can mean sifting through logs, it can mean evaluating system images and using various tools for that. It should be a team effort.

[pseudo creek]

yup, it is a definite blue team activity

[patent kayak]

thanks for the response, what security analyst certification would you recommend

[serene umbra]

Gave +1 Rep to @hexed magnet

[clever rain]

Humble question @warm hinge ...why are you thinking about being a pen tester and/or forensic analyst? Said another way, why do you think that those roles are for you?

[hexed magnet]

Assuming no exp/background in IT, you'll need CompTIA's Security+. But you also need to figure out what team/specialization you want to be in, Red/Blue. That will determine the next certs you'll need to get.

[warm hinge]

I have always wanted to be a ethical hacker since I was 10 years old. And I want to explore the opportunities in cybersecurity. I want to become a network engineer to learn more about networks, then a malware analyst to learn about malware and how it operates then digital forensics to investigate cyber crimes and learn what hackers are up to, then I will be a pen tester for the rest of my career. I will have a complete foundation.

[clever rain]

@warm hinge I see - sounds like you really love it! Okay, for your original question(s), you're going to get a lot of varying answers but here's mine, as a dude that manages 6+ pen testers. Typical day is going to be similar but very different depending on the organization. Educational path might be different too; many organizations require degree + certs, some don't. I got folks on my team with no certs and some with advanced degrees + certs but since you are just starting out, try to get a few foundational certs and keep networking and reaching out like you are now. But more than anything, make sure you have a solid understanding of business and can communicate well. Communication is super important when explaining what's on those forensic or pen testing reports. Doing what you love is one thing but doing what you love to make a living is another; Ideally you want to make a living doing what you love but you might have to take some jobs that aren't what you want but you need the financial support. If you end up in that situation, don't be discourage and still learn what you can. And it's okay if you get knee deep in forensics and/or pentesting only to decide that it isn't what you want to do for a living. If you aren't already, I highly recommend following what Heath is doing at TCM Security and keep hacking away here at THM. Good luck my friend!

[warm hinge]

Thank you, and that works perfectly because I am taking business as a minor.

[serene umbra]

Gave +1 Rep to @clever rain

[bleak pine]

How did u get started then?

[royal grail]

Consider what kind of freedoms each job has and whether there is room to grow or move around within each company.
During my first job as a sys admin (with 0 security functions in my job description) I went out of my way to suggest and implement various security controls every chance I could. That beefed up my hands-on experience (and resume) enough to land a full-time InfoSec job. If Cybersecurity is what you want to focus on, you'll find a way to make it happen.

[bleak pine]

How did u get started as a sys admin? Did u get a degree or?

[royal grail]

I got the job about 4 months before I got my degree. So technically it went Job>Degree>Certs. I did a lot of self-learning between courses, mostly from content creators like Professor Messer, ITPro TV, and TryHackMe. Between all of this, I was able to confidently hold technical conversations during interviews.

[bleak pine]

sorry if this is a dumb question but what degree was it?

[royal grail]

Just an Associate Degree focused on IT.

[bleak pine]

thank you!

[mellow ledge]

Looking for some help. Master in Computer Science with Security+ cert and top 1% on HTB. looking for a SOC analyst role. Currently bartending. Thinking about taking the CEH even though I hear the cert isn't great for anything except getting past HR. I have a small SIEM for my home network and my web server, but other than that I have not SOC experience. My IT experience was a job as a Systems Analyst that started as an internship and moved to part time when I was completing my Masters. I finished in 2018. There's a gap because I had a family member who was terminally ill so i took care of them. Moved cities and couldn't get hired so I've been bartending since about 2019. Any advice or is this a thing that's "damn, that sucks" kinda thing?

[clever rain]

@bleak pine I had certs and a degree, had been using computers all my life (e.g. building, fixing, etc.) but nobody would hire me because my professional experience was only in music and at the time, paper MCSE's (Microsoft Certified Systems Engineer) had flooded the market. This was during the dot com bubble. I had to take a job in accounting and others but kept applying, applying, and networking. I finally got a job as a sys admin for a school. Then moved up to help desk as a military contractor, then sys admin again and then networking, virtualization, and other jobs before I even started full time in cybersecurity. Everyone is different and of course things are different in 2022 (e.g. housing issues, crappy market, layoffs, student loans) but my path was not easy. It took me 10 years to pay off a student loan for a degree that wasn't even in IT. lol However, IMHO, the two things that haven't changed and likely won't anytime soon is communicating well and people networking. Those two skills help with any career and it's tough for techies like me that tend to be introverted. All the "crap" jobs I got (IMO anyway) were from applying online; all the fantastic jobs have been through people networking. (This is just my experience, note that I'm not saying that jobs applied for online are always crap)

[bleak pine]

Thank you!!
So what exactly would u suggest for a path for a person trying to become a pen tester? Would you say college would be better or certs or trying to go down a similar path with going through the online jobs like you did?

[serene umbra]

Gave +1 Rep to @clever rain

[remote gale]

@warm hinge

[grand phoenix]

My coworker is actually moving to a cyber job without a cert. It's not about the cert.. It's about your knowledge.

[undone shore]

Assuming you get a chance to demonstrate that knowledge.
You need a way past the HR gate. That either means knowing someone in the company who can vouch for you (i.e. good networking), or having certs / a degree / relevant experience to back up your CV during the application.

If you don't have any of those then you could be the most proficient cyber professional on the planet and still be rejected.

[grand phoenix]

Yep. I agree. I have a 2009 A+ cert.. and a lot of experience.. That's about it.. oh. and trade school.

Cert got my foot in the door into IT. That's it.

[undone shore]

Aye.
It's worth getting a couple of the entry-level certs if you're trying to move into cyber / get your first job in cyber. Provides a baseline proof that you probably know what you're doing

That ^^

[grand phoenix]

Can't complain there 🙂

Even if it's the most horrible company you've ever worked for in your life... I stuck it out for 2 years...

then cut

[undone shore]

Heh. That's where lots of certs come in handy
I got to pick and choose my grad job a bit.

[grand phoenix]

Rephrase on my "coworker without a cert" thing.. oh no.. he has several certs.. just not in cybersecurity..

[undone shore]

On which note, I should really get back to WUMED 😆

[grand phoenix]

Let me be very clear.. He has Azure, MS, AWS lots of things. lol.. just not related to cyber field.

[undone shore]

Tbf, proprietary cloud certs are pretty much all that's available for cloud cyber, so they're still very good / relevant if you're getting a cloud pentesting job

Heck, I'm working on the AWS stuff rn

[grand phoenix]

I mean.. I can probably hit him up on Teams to ask exactly what certs he has on Tuesday when we go back to office/remote/mostly remote/i have to go into the office that day.

[grand phoenix]

I'm still looking for good cloud pen relevant info. I cannot find educational material.. Maybe I'm just not searching the right terms...

[undone shore]

Nah, there are very few cloud pentesting specific courses / training

You need to get just the regular in-house stuff from the providers

AWS has a security architecture course iirc, for example

https://aws.amazon.com/certification/certified-security-specialty/

You'd be best doing the earlier ones there first though

@pseudo creek is also the person you wanna talk to about cloud security stuff. It's... far from my speciality

[grand phoenix]

Also interested in Azure

[distant pier]

SANS has SEC588. 🙂

[grand phoenix]

Logged

Oh.. Take notes on stuff. 🙂 good career advice.

nite all

[clever rain]

@bleak pine it depends. College first? Depends on the college and program as well as the cost of the school. Certs? OSCP might get you some interviews but depends on who is hiring and if you have limited experience (I know, I know...catch 22) you'll get filtered out at the interview. Applying to anything you can find online will be a numbers game however, will be good practice for interviewing and you'll eventually be able to talk yourself into a job. If it were me starting over today, I'd focus on getting any job in IT and I would be working on all college/degrees/experience at the same time...Get a few certs while you're in college (some schools like WGU I believe have certs as part of the curriculum) and apply for internships and/or jobs along the way. If you happen to find a job while you are still in school; take the job and finish your degree part or quarter time. Whatever you do, please do not go into debt for a degree for a career in cybersecurity. At the end of the day, you'll learn a lot from school and studying for certs but companies are hiring for these pentesting roles (and other cybersecurity roles) to manage risk and become/remain/increase profits/value which is why they tend to favor folks with experience. Remember @bleak pine I'm just some dude on the Internet and I don't know you so please take my comments with a huge grain of Himalayan salt but I do think that answers to questions like yours are usually going to be some form of "it depends" because there are just so many variables to consider and luck, for better or worse, is one of those variables in getting good, meaningful employment.

[clever rain]

I've held a few of the professional level AWS certs, the associates ones, as well as the security one. A friend had me consider interviewing for an AWS job and guess what? AWS didn't even care about the AWS certs. They were still going to have my take a basic IT skills online test and whatnot so I didn't even bother continuing. Note that this is in Asia; perhaps it's different stateside but from my own anecdotal experience, AWS didn't seem to care about it's own AWS certs so unless you are going into consulting or a role that requires these certs for AWS enterprise agreements ( need to have x number of professional level certified staff), I wouldn't lose sleep about not being certified. As a matter of fact, I'm letting all my AWS certs expire. (if you are just starting out however, they might have some value of course; my situation is different so huge caveat) If you haven't already and if you want to focus on AWS, check out the AWS Security Digest; there is usually a lot of information about AWS cloud pen testing: https://app.mailbrew.com/zoph/aws-security-digest-HrkhwqNrwBBk/97

[pseudo creek]

Black Hills InfoSec / AntiSypohon has some good (inexpensive) stuff on pentesting cloud. Basically, if you know security, you should be able to apply that to whatever technology. I have never pursued security focused cloud certs but just cloud certs. Cloud certs do go a long way in the Cloud Security realm if you can show you know security on some level as well.

I'd peruse the AntiSyphon site on various cloud specific security training
https://www.antisyphontraining.com/

[clever rain]

Wow - I've worked with Black Hills before (they are super awesome!) but didn't see Antisyphon. Checking it out now - thanks for sharing!

[serene umbra]

Gave +1 Rep to @pseudo creek

[fierce belfry]

so is it a good idea to go around small businesses asking if u can do a small assessment of their website to see for any vulnerabilities ( kind of like mini pentest) just to get some experience and so i can put that on my resume

and its also helping them as well

[rugged delta]

No, absolutely not. If you're conducting a security assessment, you're essentially performing acts that would otherwise be illegal and you might not be qualified to properly detail and agree the extent of a penetration test and the consequences of your actions. You would be advised to join an organisation who can arrange the penetration testing activities, as you would likely need the assistance of a lawyer/solicitor to define to what extent you are liable when you might make a mistake and bring down or otherwise negatively affect their service, gain access to information they were not aware was exposed, and you might also need help discussing/defining the scope, etc...

You might gain some experience by learning how to properly undertake bug bounties (don't expect to make a lot of money at this, at least initially, and join reputable orgs like bugcrowd/hackerone/synack, for instance)

[fierce belfry]

thank you for keeping me out of prison ( not being sarcastic, honestly thanking you) ❤️

[serene umbra]

Gave +1 Rep to @rugged delta

[rugged delta]

If you're learning to conduct a security assessment, you'd be expected to be part of a team who would have the knowledge/skills to conduct all of the task around it. A normal third party pentesting company would have expertise in the various aspects of performing a pentration test. I know you mean well by encouraging small companies to improve their security posture but it does take a large amount of effort. It's why a lot of companies recruiting cybersecurity talent are looking for you to hold professional certs like Security+, CISSP or OSCP etc., and why you gain knowledge and experience in a regular IT field performing security duties like secure coding, network security architecture (installing firewalls, IDS/IPS, proxies, systems security etc and the policies and procedures around these things.

There's a lot to consider and that's why, when you're doing cybersecurity work, it's good to have plenty of experienced people around you and a good legal team 🙂 When you're learning, you need places like THM, HTB, etc. to take care of all that for you and as your skills grow, you'll find other resources like PicoCTF or other platforms specialising in learning other aspects of cybersecurity... Plus there's all the books, courses, certifications to help you learn and demonstrate to employers that you are learning valuable skills. You're at 0x8 H4CK3R level on THM. You're doing well. Keep pushing and you'll get to where you want to be

[fierce belfry]

thank you my dude i think i just needed to hear that ❤️

[serene umbra]

Gave +1 Rep to @rugged delta

[clever rain]

I'm hesitate to suggest this but setting up a legitimate business (e.g. LLC), cold calling, and offering your services BEFORE doing any assessment is a great way to learn sales, communication, and business, so I'd say yes for that. Don't sell yourself short and offer "free" because free is typically associated to "no valuable". Set a reasonable price, be upfront with your potential customers of your intentions and emphasize the win-win, and work from there but be prepared for a lot of "nos" and/or "f* off", assuming you get a reply at all. You will need to learn about contracts and in your contract, you'll need to be very clear that your service is just a mini-assessment and is not meant to be used for the customer's 3rd party vendor contracts, assurance, etc. If what I just wrote doesn't make any sense at all, then I would avoid this route so that you don't end up feeling defeated or worse, sued. Doing an assessment without permission (even passive scanning) would be a big no no and will almost certainly put one in legal trouble so definitely not cool as already mentioned by @rugged delta Again, I'm hesitant to offer this advice but entrepreneurship and following through on your ideas is really, really valuable. If you try this route, please focus on really, really small companies and limit the scope of your service to something like DKIM, SPF, and DMARC because that's almost always a problem. lol @rugged delta just posted more good advice above, especially the legal team comment, so keep that in mind.

[fierce belfry]

thank you but i think doing all that and setting up a legitimate business is kinda out of my scope right now( im still new to all this)

[clever rain]

No worries! I'm sure you'll be successful. You seem to be hungry which is good! I'll be rooting for you fine sir!

[rugged delta]

Basically, everything we do outside of our learning environments (our own personal labs, THM, etc.) requires some legal expertise, whether it's vulnerability assessments, pentesting, storing information for a client, hosting a server, etc) These days compliance is a huge aspect of everything we do. In my prior job, we couldn't even discuss some activities in relation to the workplace without first having our boss get a representative from legal to review and approve the topic, for our own, and the org's protection

[undone shore]

Oh Dear God do not offer to do technical assessments without legally binding authorisation documents.

No matter how small a scale. You will end up sued.

Or otherwise prosecuted. Doesn't have to be the business complaining about it -- computer misuse laws still apply.

Also, cold calling is just shitty smfh

Pretty decent way to make sure you end up on do-not-hire lists if you make a name for yourself by pissing folk off

[fierce belfry]

was going to my old bosses( really chill ppl btw) and ask but following @rugged delta advice and not going to jail seems pretty nice 😂

[undone shore]

Yeah, maybe avoid going to jail. That's another thing that can often put a dent in your employability...

[fierce belfry]

idk, free boarding, free meals, networking, seems kinda nice

sorry going off topic but yea @rugged delta and @clever rain are right not work the legal trouble and not really there yet but i will get there 😄

[clever rain]

@undone shore nobody has offered advice to do assessments without authorization, and I don't think that was the OPs intention. "You will end up sued" is not an absolute but yes, point taken that it's risky which is why I wrote "hesitant to advise" and other caveats, specifically contracts. Yes, cold calling sucks but there is a right and wrong way to do it. You do understand that businesses have to find customers and sometimes that means reaching out. As a CISO, I have to deal with cold calls every single day and the ones that are honest in their intentions, usually get my time, even if it doesn't lead to business. As for this case, yes, probably not a good idea, hence all the caveats. As for do-not-hire lists, sure, if one is a complete a**hat in their approach (e.g. annoying, persistent, dishonest) but as I mentioned, the OP is probably going to get rejected anyway however, if his approach is good, he might have some contacts for later down the road when he is ready. Anyway, I think the conclusion is clear that for the OP and agreed by the OP, this is definitely a no-go so the world will be fine!

[undone shore]

Learn about contracts
Does not a lawyer make
Hence the "legally binding" caveat.

That said, you have more patience than I do for cold callers. Personally, if you're calling me to sell me something which I do not want and haven't requested then you're taking up my time, and interrupting whatever I had my mind on before. i.e., you're a nuisance, regardless of how respectfully you're doing it (though respectfulness would certainly play a part in no-hiring, fair). Although I do agree there are better ways and worse ways to do things... email, for example.

[fierce belfry]

it wasnt really going to be cold calls, it was going to be ppl that i know and are willing to help out, im not randomly choosing ppl out of google maps or anything, it was going to be ppl i trust and have known for a good while. sorry for not clarifying

[undone shore]

Aha, all good -- I think we're on the theoretical at this point 😆

[clever rain]

@undone shore man the times have changed. When I write "cold call", I was actually referring to emails. Nobody calls these days. lol Regardless, good discussion points and I think these points will help others! Thanks again for the points!

[serene umbra]

Gave +1 Rep to @undone shore

[undone shore]

Bahaha, well, that's fair. I think we're in agreement then

And same to you 🙂

[clever rain]

@undone shore now if we are talking about actual phone calls...then let's not talk about recruiters. lol

[fierce belfry]

if were going theoretical then im definitely cold calling bill gates

[undone shore]

Christ, yeah...
Between recruiters and PPI firms...

[fierce belfry]

PPI firms??

[undone shore]

TL;DR:
https://www.financial-ombudsman.org.uk/businesses/complaints-deal/ppi/ppi
Was a big thing in the UK

In theory the claim backs have finished, but I still get the odd call about it. The calls are just scams at this point though

Oh, and injury compensation calls...

[rugged delta]

True about the lawyers When doing my cybersec postgrad I had to do a project on the GDPR during my Law and Ethics class. I did tell my solicitor about it at a family gathering and she said ' better you than me', but I'm by no means a solicitor. The only legal advice I'm qualified to give is 'Im not a solicitor, go consult your own one to continue this conversation'

[fierce belfry]

@undone shore but ur car warranty is about to expire

[undone shore]

Yeah, that 😆

[clever rain]

In Japan it's a bit more tricky as the "law" in regards to cybersecurity is well....tricky. On one hand, things are really relaxed but on the other hand, you can get smacked unreasonably hard. My meetings with chief legal counsel are often hazy on what is okay vs not okay. And then there is the language component of interpretation, intent, etc. I love this country but man, lots of mental gymnastics sometimes. lol

[rugged delta]

In many pentesting exercises you would tend to plan out the extent of your actions, down to the commands and switches you're going to use, in a lot of cases. They'll all end up in the report afterwards if you do the report correctly but it's generally part of the legal agreement of any pentesting activity that the scope of the test is part of the legal agreement and the procedure should always include having a 24/7 contact with your client and gaining specific, signed approval for the activities you're undertaking. This could also include stop-and-confirm steps in the process, whereby, after you have gained signed approval, you would still pause the testing and contact the client, getting further written verification (such as an email from an approved individual) to proceed with an activity.

Your intentions are generally to not interfere with the normal functioning of an operation but some of the techniques used could potentially cause a Denial of Service (intentional or unintentional) by interfering with network operations or bringing a server down or other production interference. This is something you try to avoid. A lot of pentesting work can be conducted on pre-production systems and red teaming is usually attempting to be discreet as well but you would only conduct that level of assessment in an organisation that already is expected to have a mature and refined security infrastructure in place.

This is why THM is such a great platform, you have the ability to conduct your activities to any extent on your assigned targets and can learn the effects of your actions in a controlled environment where the worst that can happen is you'll need to terminate and launch a new copy of a target you've broken

[clever rain]

Very true however, this is not necessarily done across the board in my experience. I'm currently responsible for a number of pen testers (e.g. in house and outsourced) and I've of course used external pen test services from the likes of Black Hills etc. Correct me if I'm wrong but your points are related to outsourced, external pen test organizations providing services to a customer, correct? In that case, the methodology is applicable to Japan as you highlighted but mainly because I know it's the right thing to do (hence one of the reasons why my org pays me a paycheck every month). However, believe it or not, for my internal pen test team, a lot of what you wrote is not necessary or required to explicitly be written in legalise; I don't require full blown reports but I do require tickets and walkthroughs with the affected teams. Of course many of the fundamentals still apply–don't disrupt business for example–but in regards to an internal pentest team, they have the luxury/privilege of actually understanding the intricate details of our service as well as how our teams work so the reporting requirement has been loosened and other requirements to stop-and-confirm are universal for all teams. I'm actually lucky to even have an internal pent test team so there's that. lol THM is absolutely fantastic however, and again using my own anecdotal experience, none of the THM exercises that I've seen so far are applicable to my business and tech stack so while great for training and indemnification for legal action, much is out of context. Huge caveat, I'm only here for Advent of Cyber and to make sure I don't lose touch on much of the technical stuff. If I find things relevant I will work with my team but I think the biggest value here is the mindset of solving problems.

[rugged delta]

Oh of course if it's an internal pentest, you won't need to go into all the ins and outs of the legalese in every encounter. There'll be rules and processes and definitions already in place and in-house legal will already have an understanding of the extent of your activities and its impacts on the business, there'll be a chain of reporting up through risk management and legal and up to the CISO and other executive officers, since cybersecurity should be an executive concern. I'm sure the involvement of the pentesting team is part of the development/production process and yes I hope they would be familiar with the infrastructure to a great extent, and possibly a greater extent than the administrators in many cases. How you manage internal assessments has a great deal to do with the internal culture of the organisation, and the security environment and it seems your work is we-embedded in that.

I'm sure as you go along you'll find more things relevant to your specific environment, there are about 600 objectives on THM and yes, the mindset is a very important aspect of learning this skillset. The AoC is great, especially from a beginner perspective and much of the content on THM is aimed to get people interested in cybersecurity from a basic level up to a moderately competent level where they can understand and pursue certifications/careers and potentially up to an advanced level. It's a great community to learn various skills and competencies and many go on to other specialist environments too based on what they learn here

[flat sedge]

Oh, that's not true. I have recieved multiple cold calls from vendors to do an assessment for the org to purchase their products; however, I have not been in the role they thought I was for 4 years.

[grand phoenix]

Thanks for the info @pseudo creek and @clever rain . Bookmarked both sites and will check them out.

[serene umbra]

Gave +1 Rep to @pseudo creek

[clever rain]

The lol I wrote was in jest; of course there are still actual phone calls, just not as much as before.

[peak crater]

Hi

[short pike]

Heyo! Which path is the hardest/most directly relevant to a career in security? I'm graduating soon and wanted to brush up and maybe learn some new helpful topics to prepare for some new grad roles in security

I started the red teaming path yesterday and so far it's been pretty helpful but I wanted to check in and make sure that's a good path to pick

[grizzled onyx]

Probably not a good fit company, but either just that (unemployed and service). Try to relate the exp to the role. Or, ignore the details and put hobby exp.

[glossy tree]

try to learn networking basics and do fortinet courses for new technologies such as SASE, ZTNA, WPA etc

[dusk fulcrum]

Hello everyone Namaste
I'm beginner in cyber security and I'm having lots of problem while starting and don't know how to start and what to learn . So is there anyone who can guide me to learn the cyber security ?? I really wanna study it but having lots of problem

[short pike]

Awesome thanks for the advice, I'll look into the different techs! Haven't taken a networks class but have learned a lot from my other CS coursework so I'll try to review and solidify that stuff before interviews this break

[serene umbra]

Gave +1 Rep to @glossy tree

[warm hinge]

Hello Computer geniuses, I would like to ask a few questions and this is for the experienced. What is one class you regret not taking in college and why? What classes should I pay attention to that are important that most people don’t? For example an analogy “before I can run I need to learn to walk”. What advice would you give to someone going to college for computer science? What was your biggest mistake in college and how did it affect you? What would I expect in computer science major? And what is the hardest class that most people hate that has the best outcome and how could i prepare now? I am in high school I start college next fall so I want to be prepared.

[pseudo creek]

hardest class that has the best outcomes is probably algorithm theory...

I wouldn't worry too much about undergrad, try to choose classes you think you'll enjoy. In the end, it is the degree that matters because Comp Sci programs are pretty standardized. There is some variation but not a lot. Take chances if you can to learn more about networking and operating systems.

[warm hinge]

What books do you recommend?

[gritty flicker]

Todd Lamle for networking

[sinful cipher]

I'm also studying for the CYSA+ -- any recommendations of TryHackMe rooms for practical experience ... already tracking NMAP...thanks much!

[rugged delta]

The Introduction to Cybersecurity, Pre Security, SOC Level 1 and Cyber Defense paths should be on your radar if you're working towards a SOC/Analyst role and the Investigating Windows series, which can be found in the Practice area of the Learn section

[kind glade]

Any toughts on Red Team Certified Operator by Zero Point?

[rugged delta]

I've heard really good things about the certs. From several reviews, the training is quite high quality. The guy who created them intends for them to be affordable certifications for people learning the trade. There's a few people here who have done one or both of the certs

[vital epoch]

just a quick question : What is the better qualification , CPENT Master or OSCP ?

[rugged delta]

OSCP

[vital epoch]

thanks

[rugged delta]

Unless you're in India, you should probably avoid EC Council altogether. There are problems with that company and there are much better organisations out there

[vital epoch]

I am in zurich

[rugged delta]

Then best bet is probably OSCP. Search on LinkedIn and other job sites and see what companies are asking for. Sec+, CISSP and OSCP are generally the 3 most requested certs where I am

[warm hinge]

Anyone with network+ can give me a basic idea of what the test asks you and how it’s like?

And some important things that are recommended to know?

[rugged delta]

Check out professor Messer's content for Network+ and a few other certs

[kind glade]

OSCP is awesome, if you have the time and the money you will not regret it

[odd sparrow]

Could healthcare informatics or EHR analyst roles be considered IT experience? Also if I keep my full time non-IT job, could a per diem/weekend helpdesk job still expose me to IT concepts and experience that could get my foot in the door to go full time for cyber or a senior IT role?

Don’t think I can take a pay cut going from my current pharmacy job to full time help desk due to mortgage and family. So was thinking of keeping pharmacy full time and help desk per diem, or vice versa if the total income is good enough. Then would pursue full time IT/cyber once that salary is decent.

[flat sedge]

In my opinion, your best bet to get into a cyber role is to leverage your understanding of HIPAA/HiTRUST and medical compliances into a GRC role.

Understanding how to maintain compliance is huge and a very valuable skillset to have

[rugged delta]

Some of the ISACA certs like CRISC, CISA or CISM can really help, the remuneration for these certificate holders tends to be about 150k and the exams are reasonably priced

[odd sparrow]

The idea of GRC sounds great. What should I aim to get out of a grc role if I want to eventually work in a soc/MSSP/blue team environment?

[flat sedge]

That would be a transition into technical work - that requires a much deeper understanding of the tech stack than you would need for GRC. GRC is just as well paid (often moreso) and honestly, going into the SOC from a GRC is more than likely at least 2 steps backwards

[odd sparrow]

Interesting. What roles should I expect to work up towards if I happen to break into GRC?

[flat sedge]

Compliance Analyst is a good one, and can cover a huge variety of controls.

A large part of that job is checklist management, ensuring that the organization has appropriate controls for framework requirements and that evidence is gathered and stored for ongoing and future audits

[warm hinge]

Anyone here that has taken the network+ can give me a idea of what’s it like?

Or what they ask you?

[warm hinge]

Oh thank you I didn’t see this

[serene umbra]

Gave +1 Rep to @rugged delta

[warm hinge]

I will check him out

[odd sparrow]

The certs sound great, although I don’t think I would meet the work experience required atm, but I’ll definitely keep in mind for the future

[thin whale]

Hi,

Anyone with resources on OSINT or any Career roadmap on Cybersecurity (Grey team)?

[pseudo creek]

grey team? what is grey team?

[thin whale]

Oh. It's Pentester.

[pseudo creek]

In terms of OSINT, someone recently mentioned this course being really good https://inteltechniques.com/training.html

[pseudo creek]

I think you are mixing terms, generally pentesting is considered red teamish although red team is a specific term

I'd look at the junior penetration testing path and then the red teaming path https://tryhackme.com/paths

[thin whale]

Guess so, but I saw a documentary recently that classify those in the pen-testing team as grey. 🤒

[pseudo creek]

no, they must not know pentesting

so there is the idea of a black hat hacker, someone who hacks for various reasons but does so illegally, then there is white hat hacker, someone who hacks legally and professionally such as a pentester... then there is grey hat hacking, someone who skirts the edge of legality

[grim lichen]

Hi guys. I'm looking for a team in workspace on the tryhackme. I want to improve my knowledge in the team, and maybe even create my own project. Who does not mind write to me in private messages!!

[rotund cliff]

Aka the NSA

[pseudo creek]

no

[rotund cliff]

I mean the stuff I did there on some teams was pretty cooked lol

Was referring to the part about Grey hat hackers.

[pseudo creek]

so am I

[rotund cliff]

None of them are black hat.

[pseudo creek]

so things you do on behalf of a government should still be in line with the legality of that country, that isn't grey hat hacking

[rotund cliff]

It is because it's from the other perspective

[pseudo creek]

and various government entities would be allowed to do some things that citizens of that country would not be able to do

when we talk about grey hat hackers, we are talking about individuals

[rotund cliff]

Yes and they still are

[pseudo creek]

if you are doing something on behalf of a country, that isn't being grey hat

if you are off doing something on your own without authorization, outside of scope, etc, that would be regardless of employer

[rotund cliff]

Sure it's legal to do it in in the country but it isn't persay legal to execute in the target country

[pseudo creek]

yeah but still thats not being grey hat

[warm hinge]

https://www.linkedin.com/in/telma-tavares-30897225b/ Let's connect ❤️

[undone shore]

Grey hat is illegal hacking with a "moral" justification -- also referred to as "hacktivism".

It's no less illegal than black hat activities. The "hat" a state-actor wears depends on your perspective. In their home country where it's legal they are undoubtedly considered to be white hat. Their targets undoubtedly consider them to be black hat.

When it comes down to it these are very loose terms to quantify human behaviour -- they don't matter. The actions are what matter.

[faint ice]

maybe shadow has a job as a candy taste tester in their future

which would fullfill the human behaviour of wanting to eat sweet tasting things

[cobalt escarp]

Referencing you in my report, hold up

[flat sedge]

I can't wait to see the grade you get including an informal discord screenshot as a citation reference

[cobalt escarp]

I'm just going to insert the message link in the middle of the sentence

[faint ice]

well that is going to be fun

[cobalt escarp]

According to #cyber-and-careers message (Muiri, 2022)

[undone shore]

You outright know my real name lmfao

[cobalt escarp]

Yeah but if I'm going to be unprofessional, might as well go the full length

[undone shore]

BRB, will put that in a blog post for ya

[odd sparrow]

Does this job sound like it could be used as IT experience? Pharmacist: Supply Chain and IT

[redacted] is recruiting for a Pharmacist to assist the Supply Chain and Pharmacy IT needs with data base management, information technology and automation. In this position, you will also help to optimize medication purchasing, inventory, supply, distribution, and control processes.

Principal Duties and Responsibilities:

Support the creation, management, maintenance, and troubleshooting of all formularies and databases
Support data extracts including requests regarding medication usage, location of inventory, monthly cost transfers and systems activity
Primary pharmacist involved with checking medication output distributed from, the Pharmacy Consolidated Service Center (PSCS) including PillPick®, Boxpicker® and other automated devices as well as technician prepared kits and/or packaged medications

Serve as the resource for requests related to pharmacy system changes to find opportunities for optimization, including participation in drug shortages, formulary maintenance task force and pharmacy event review team
Coordinate the assembly and configuration of the new automated dispensing cabinets (ADC) upon arrival as needed
Assist in configuring and optimizing new ADC hardware including which drugs should be stocked, how the drawers should be arranged, setting up max and pars and assigning medications as needed
Assist with the testing automation changes to hospital applications that affect pharmacy
Perform drug stability evaluations or reviews as needed
Assist in creating satellite and office practice inventory ordering procedures and templates

Assist in monitoring, adjusting and follow up of refrigeration equipment and events
Ensure all hazardous medications are being handled correctly in accordance with policies and procedures as it pertains to the PCSC and Pharmacy Supply Chain
Collect and document system problems identified by staff and refers to Supply Chain Leadership for direction and resolution
Communicate, plan, and implement utilization strategies to prevent excessive stock and reduce expiring medications and coordinate with formulary maintenance task force as appropriate
Participate in tasks relating to drug shortage mitigation
Help to determine appropriate outsource supply options to ensure the availability of needed medications, to reduce cost and/or to improve medication safety
Serve as a resource for supply inquiries involving drug utilization, availability, or alternatives
Coordinate pharmacy waste program in collaboration with Public Safety, Nursing, and Occupational Safety
Serve as a backup pharmacist for controlled substances ordering

(Sorry for the huge wall of text)

[quick forum]

@odd sparrow you've missed a redaction of the company name btw

[odd sparrow]

Oh

Not sure what you’re talking about 👀

[grizzled onyx]

I thought hacktivism was still blackhat because it is illegal entry. Grey would be using an emulator for a sega Genesis game, but you own the game. Technically legal, but right on the line.

[grizzled onyx]

It says it wants a pharmacist, which I think means it would require cert/degree.

I think you can use almost anything as IT experience. People post some wild stretches, like IT support if they do any job but have ever fixed an issue themselves that other teammates would make an IT ticket for.

I think you would have to stretch if you wanted to call that an IT job, but that it wouldn't be hard. I see data entry, possible database, but a lot of logistics. Kinda looks like a misc bucket of tasks and likely a place that wants a lot more than they are willing to pay for, but I could be wrong. Can you share the pay range and the requirements/softwares mentioned?

[undone shore]

Naw, and pretty sure that's a ToS breach (i.e. theoretically prosecutable) as well.

[odd sparrow]

Sorry, forgot to mention I’m a pharmacist pivoting to IT/cyber. lol

I’ve been looking into GRC and entry level help desk lately and this job popped up at my older job so was just curious

The job uses swiss log and the supervisor told me the job would be in charge of more buying and inventory of medications and supply in the hospital’s logistics center. Realistically not as technical as help desk, but on paper could it be perceived otherwise?

My wife actually works at the hospital and she said I might be miserable at the job, so I may pass anyways.

[pseudo creek]

reading about it, I wouldn't say it is technical at all... I dunno sounds just like what you said, in charge of buying/inventory

[grizzled onyx]

Anything could be stretched to look IT. But I was thinking just on the desc, that it was 3 or more jobs dumped in one. Those usually pay poorly and have unreal expectations.

[warm hinge]

For those who’ve taken the PNPT, how long did you study/practice before taking it?

[jovial anchor]

What's the best certi to do for Active Directory after you pass OSCP?

[warm hinge]

https://www.linkedin.com/in/telma-tavares-30897225b/ Let's connect ❤️

[dense sundial]

[kind glade]

Im not the best to answer but maybe CRTO, CRTP or OSEP

[undone shore]

CRTO is a good bet immediately after OSCP.
That was my path:
OSCP -> CRTO -> OSEP. Gives you a nice smooth development path.

[kind glade]

Can I send you a PM?

[undone shore]

For what purpose?

[kind glade]

A question about career and certificates

[undone shore]

Aye go for it

[kind glade]

Thank you! It seems we need to be friends first

[serene umbra]

Gave +1 Rep to @undone shore

[undone shore]

My DMs are on for this server -- that will be at your end 🙂

[kind glade]

Working now

[warm hinge]

Would it be a good move to niche out in this field and focus exclusively on Cloud Security?

[rugged delta]

Cloud security is in huge demand. As well as the major cloud orgs' security certs, learning other cloud skills is very important

[pseudo creek]

I don't think cloud security is niche anymore... I've being doing cloud security for 6ish years although we still do struggle to find all the people we need... most of our security people in general are expected to know some cloud

in saying that, I think its a great move to learn it

[warm hinge]

As someone in the field, how do you recommend for me to get started? I’m currently working on the CTI side but would like to transition

[pseudo creek]

I would pick a cloud and learn it.. I started with AWS which is still a solid start and look out for various job listings and see what they are asking for.

[warm hinge]

Also, how are you liking it so far?

[warm hinge]

Got it, thanks!

[serene umbra]

Gave +1 Rep to @pseudo creek

[pseudo creek]

we have all sorts of need for cloud security people from those that are building automation, to those that are designing cloud solutions, to those that are doing pentesting on cloud, etc, etc

I love doing cloud stuff, it is so easy to prototype and try things out and better than working with outdated systems

[warm hinge]

Thanks for all of your input @pseudo creek

And you as well @rugged delta

[rugged delta]

There's a lot of good resources these days for learning cloud skills. The major clouds have some good resources available. There's other platforms that are reasonably priced. I used A Cloud Guru but there are others. All the major cloud platforms give you access to a free tier of their service so you can learn and play around with their tools as well. There's lots of books but the cloud cert tracks tend to move a little faster than the books. There's also tonnes of documentation online for a lot of the theory you'll need.

Helps to have knowledge of networking and operating systems when going in but you can learn these as you go as well.

[warm hinge]

I’ll get started checking those resources out, thanks!

[rugged delta]

Cool, and ask any questions that might pop up

[jovial anchor]

What do you think about the CRTP and CRTE? I am keeping CRTO in mind however. I still feel like I suck at Active Directory.

Also btw. I love the rooms you make/co-create @undone shore. Thanks for all your work

[serene umbra]

Gave +1 Rep to @undone shore

[undone shore]

I haven't done either of them so I can't really comment I'm afraid

[jovial anchor]

Ah. Thank you anyway. Have you tried your hand at OSED btw?

[pseudo creek]

Muiri is doing it now cuz he crazy

[stable oasis]

Hey guys, just have a small doubt is professional certification mandatory for a entry level cybersecurity job

??

[stoic cave]

Professional certifications are used to quantify knowledge learned in a degree or on the job. In order to get into cybersecurity, you're likely going to need a degree, some professional experience, or a mix of both. Cybersecurity itself isn't exactly an entry level field within the computer industry.

[stable oasis]

Can you recommend some professional certification for a 3rd year btech student.... Like i have no experience I'm still learning so

Can you please tell me how to prepare for the certification too @stoic cave

[keen compass]

@stable oasis If you are looking for an entry-level cybersecurity certificate, I would recommend CompTIA Security+ as a good starting point. It may not be the most highly sought-after cert, but its comparatively cheap, covers a lot of material and the process of getting it is a valuable learning experience.

There are lots of ways to study for it, I’d recommend buying a Udemy course that goes through it, take practice tests, and book an exam date early so you have something to work towards.

[stable oasis]

Thanks a lot

[serene umbra]

Gave +1 Rep to @keen compass

[timber ocean]

👍👍

[pseudo creek]

Although based on your terminology, I'd guess you are in India? I'd double check with professionals in your area and/or job listings to see if Security+ is an accepted cert. in India, CEH seems to still be very popular as a cert for cyber jobs

[keen compass]

It still recommend Security+ as a good thing to do even if it isn’t recognised where you live. Its cheap enough that the knowledge you can gain from it is worth the cost IMO, even if it doesn’t land you a job.

If you are a student, you can also get a discount on CompTIA certs. I imagine you can with other providers too but I wouldn’t know first hand.

[stable oasis]

Yeah I'm from India .... Yeah comptia is accepted here

So ceh is hard right ... So where can I get some good training for that

[pseudo creek]

It's nearly a months income for India, but lots of providers have special discounts for India since their income is so low. Comptia may be one

[red hornet]

What is the best way to get your first IT job.

Everything on Indeed in my area wants years experience.

[sharp leaf]

hiii teammm

[rapid ice]

Apply anyways. Wants are always hopefuls for the HR team to post. Also A+ cert will get you in a lot of doors, even if the cert is extremely overrated.

[bleak pine]

What are some entry level positions in IT?

I mean like jobs can gou use to gain experience or pivot to cyber security without a degree?

[odd sparrow]

Anyone have any experience working or hearing about Allied Universal soc analyst roles? Feel free to DM me if you can’t discuss publicly

[rugged delta]

Most people start working in tech support or QA or similar but you should apply to jobs you're interested in or feel capable of doing. If a company believes you'd benefit them they might give you an interview

[red hornet]

Thank you for the advice. I have an eJPT and just scheduled my first A+ exam. Hoping that's enough to get an interview. Certs look nice but don't compare with experience.

[serene umbra]

Gave +1 Rep to @rapid ice

[rapid ice]

I completely agree. A+ and Security+ do provide some knowledge but really they are just to get past HR. That can be said about diplomas too though.

[red hornet]

A+ and security + show up the most on jobs in my area. Rest of comptia certs very rare to see.

[solar patrol]

What if I did a complete FullStackDev training (Zero2Mastery) and then applied to Cyber jobs... is that a thing? And land a job? I see a lot of CS grads landing jobs in Cyber because of the coding experience they have through the degree ... why not just go through a code camp and apply to cyber jobs?

[pseudo creek]

Comp Sci isn't coding experience, it is laying a foundation of what computing is, often with coding behind it... having said developers can often move into application security easily enough

no one is going to see a coding bootcamp equivalent to a comp sci degree though

[solar patrol]

Copy that - just a gnarly thought I could be on to something there

[merry hatch]

Maybe off topic but I'm making a personal website. Is it better, as a cyber security professional to use a specific platform? I.e. Squarespace, wordpress etc.

Would a hiring manager or recruiter deduct marks if you were using a wysiwyg platform like squarespace?

[plain vault]

Hello

[stable oasis]

Hello guys can you tell me which certification in comptia is good and has value for students who are yet to get jobs

[plucky fog]

Could you please pass me the link 🙂

[cunning shadow]

:hammer: CryptoH4ck3r#8692 has been banned.

[quick forum]

Please don't ask for pirated books

[warm hinge]

The most basic will Security+ and the Network+, in case if you wanna start with something easy and then you can go further advanced.

[stable oasis]

Did you do any of those certifications, if so can you share how you prepared for them

[warm hinge]

I am currently pursuing the Security+, and in that you can starting learning from mike chaple from linkedin learning and the professor messer is also a good one.

[stable oasis]

thank you

[serene umbra]

Gave +1 Rep to @last monolith

[pseudo creek]

professor messer on youtube is very popular

[stable minnow]

Hi, anyone know what CREST is?

Im looking at jobs and I need a CREST Certificate?!

[stoic cave]

Have you done a search using your favorite search engine?

[stable minnow]

no sir/mam

[quick forum]

Yes.

Googling "crest certification" is all you need here - it spells them out exactly

[rugged delta]

CREST is an organisation that performs security certification in various areas; pentesting, threat intelligance and incident response. They're recognised globally by various organisations. You should check out their website and yt channel and the various other yt channels that discuss them. There are a lot of training and certification options available in the industry but it is usually a good idea to pursue qualifications that are highly recognised in your region

[hollow magnet]

Hello everyone, Im currently taking classes for my bachelors in digital/computer forensics. Does anyone have any recommendations on what courses to take? Or what else i can add to resume for internships would look my way?

[hexed magnet]

Anyone here taken ISC2's CC and Sec+? How do the exams compare to each other?

[ashen cairn]

Any specific of area of Cyber you're looking to get into? Putting in your work on THM/HTB would be a good way of showcasing your dedication to self-learning outside of traditional education. HR will typically screen resumes for specific certifications/experience and that would depend on what area of Cyber. Security+ is a very broad security certification that's often required (Even the US government require it to work on some projects I believe).

[wheat bison]

Is network+ worth getting? just got my security+ and wondering if I should aim for something higher security related (sscp?) or do my network+ first.

[pseudo creek]

depends on your goals, experience and where you are located... I personally wouldn't recommend SSCP, I'd recommend something like an AWS or Azure cert over that or even something like Network+ but again depends

[rugged delta]

CC is just a very basic entry level intro to cybersec knowledge. It's free to take the course and exam because they want to push you towards the SSCP, CCSP and CISSP eventually. As @pseudo creek says, Net+, Sec+, and some cloud certs from AWS or Azure or GCP can go a long way. Depends on where you see yourself

[hollow magnet]

Well my bachelors degree that I will get this year is Computer Forensics & Digital Investigations. What is THM/HTB?

[ashen cairn]

TryHackMe/HackTheBox - Essentially you'll want stuff on your resume in addition to your education that show's your willingness for self learning. I would imagine that's especially important if it's an Internship. Maybe focus on some general Cyber certifications like Sec+, then look into some specific Blue Team oriented certs since most Computer Forensics teams will operate under SOC/CSIRT. Along with your degree you should be able to walk into a job with all of that.

Do some research of Internship/positions that you'd like to hold in the future. The majority of the time they will tell you what certifications, skills and experience is most desirable to them. Some of it may be difficult to get without the job itself, but the beauty of the cyber security industry (and the majority of IT in general) is that almost everything is available to learn on the internet, and a lot of it for free.

[calm harness]

hi everyone I wanna make the switch to cyber security and the field I liek the most is pentesting and malware what are some of the best advice tips you can give

[hollow magnet]

Thank you for all that information. It really does help! Just been lose, I've applied to internship but they always turn me down because of no experience. So I was looking to put more experience on my resume so company's would be willing to give me a shot.

[serene umbra]

Gave +1 Rep to @ashen cairn

[stoic cave]

If an internship is requiring industry experience, I would say they are doing it wrong. Also, none of the things mentioned would be considered professional experience. Professional experience is gained through working in a professional environment/or jobs requiring a W2 or 1099 (or foreign equivalent). As an intern, I wouldn't expect you to have any certs either. I saw earlier that you mentioned you were receiving your degree this year. That would put you in your senior year, which is too late for the majority of internships as they are meant for current students(there are always exceptions and doesn't necessarily apply if you're going to postgraduate).

With that being said, and if my assumption of you being in your senior year is true, I would look for full-time employment. Open up your search to IT/Helpdesk positions or really any computer industry position in order to get a job. That will allow you to start building your professional resume and gain that professional experience. Once you have some experience, look at jumping into the field you want to be in.

[hollow magnet]

Yup I should be graduating half way through this year. That's the crazy part, I have been looking for internships since the beginning of last year and they say I'm not a great fit. I applied to internships because I have no real world experience but I get turned down because I have no real work experience. I will take a look at IT/Helpdesk positions, would you still recommend taking courses in TryHackMe/HackTheBox to build up more experience?

[stoic cave]

THM and HTB are extracurriculars to show you're self learning. They are not experience.

[hollow magnet]

So i should be looking at it/helpdesk jobs to start adding it as experience? Do you recommend any other kind of work that would fit for a beginner? Only experience I have under my belt is construction so there's no correlation with my major.

[minor echo]

Guys, got an Associate of Science Degree in IT, and now pursuing a bachelor’s degree in IT, and also plan to go for a master’s degree in CyberSecurity, are there any ways to get straight into Cybersecurity jobs?

[pseudo creek]

What country are you in? Best way to get into cybersecurity is generally to get certs as well as build up an online portfolio

[minor echo]

US

By building up an online portfolio in cybersecurity, what do you mean by that?

And what could you say about getting started with internships at university?

[hexed magnet]

Thanks. I'll still want to take because of thr novelty of the thing. I still have plans to do security + in a few months anyway.

[wheat bison]

Is network+ and security+ and 1-2 years support engineer (helpdesk) experience enough to get a junior / entry SOC analyst position?

[pseudo creek]

possibly, maybe, yes? sounds like a solid foundation to me

[vernal comet]

Hey what if I don't go for job right now and select to do my masters in cybersec would it be helpful to land me a good job in this field?

Like I wanted to study abroad for masters in cybersecurity as in my country I'm not seeing that much opportunities/good packages for this field

[rugged delta]

Some universities have internships as part of their cybersecurity programmes and other courses. You're generally expected to be doing one of these when you apply to a company's internship programme. The US has by far the largest cybersecurity industry. There are a lot of opportunities for certification and learning. Looking on job sites like Indeed and LinkedIn will show you the certs in demand in your area. Lots of people here will give advice on what certs they have or are popular or usually considered a good thing to have for an application. Maybe check out the Tribe of Hackers books, they give good advice on how to starta career in various areas of cybersecurity.

[stoic cave]

I would not do a masters if you don't have professional experience. It prices you out of entry level positions.

[minor echo]

@rugged delta Thank you for replying, bud. Also, I also struggle with the question, what If I get my certification(Sec+, Network+, etc.) now, and get a job later, will those certs still work for me and my employer? For example, they might say that I passed the exam 1 year or so.

[serene umbra]

Gave +1 Rep to @rugged delta

[minor echo]

Or they are just curious about the knowledge that you took from those certifications?

[rugged delta]

Gaining the certification is what matters but they will ask you to demonstrate that you didn't just cram for an exam and actually know what you're talking about. CompTIA certs are aimed at people starting the IT profession and it's generally expected that you still have some way to go to be considered an expert in your field. HR will recognise your cert but as part of any interview process there's going to be a technical test, especially at entry level or if you don't have the professional experience to perform those tasks yet

[flat sedge]

I'll tack on to that, that having too many certs without relevant experience isn't a good look from technical managers or recruiters. Having a huge letter salad of certs only brings value if the candidate can relate it to work experience and what they want to accomplish in a given role

[rugged delta]

Absolutely great point, and an applicant should tailor their resume/cv to the role/org they're applying to where relevant

[strong steeple]

hey guys so im already a month of learning with tryhackme, i did : intro to networking, intro to cyber security , pre security, bash scripting , and im half way on Jr pentesting . a friend that working on the industry for long time told me i should split my study method to half learning with tryhackme and the other half to already start doing CTF's , so i wanted to ask what you guys think about it and also if anyone have a good resource for beginner CTF's ?
ty in advance 🙂

[dense dagger]

picoCTF is a good beginner CTF resource

[midnight birch]

hey just a small question... how can i get an unpaid internship either remote or in my location?

related to cyber sec ofcourse

[pseudo creek]

This would vary by country, I know in the US, unpaid internships arent a thing

[midnight birch]

India... I don't even know where to look

[pseudo creek]

Yeah I have no insight to India, do you know any cyber professionals there? Are their Indian LinkedIn groups you could ask?

[midnight birch]

prolly imma look

[pseudo creek]

I'd take that with a huge grain of salt. Generally if you have the funds, certs are going to get you much farther than doing things like but bounties which aren't looked at as experience on a resume. Some people spend time doing bug bounties when their time could be better spent. Now this does vary by country because poorer countries, sometimes bug bounty hunting does make sense.

(Also I had to verify who the interviewee was, and confirmed it is someone who was not a hacker for the nsa but may have been involved in some work there for a very brief period and overstates their qualifications)

[vernal comet]

Well for professional experience I'm doing internship at a company as a security researcher

[stoic cave]

Still not enough to consider a masters

[vernal comet]

So like is it okay to join as a software developer for 2-3 years and then go for cybersec? Cause that's only field I can get from on campus placements

[stoic cave]

Masters typically make sense around 6ish years into your career and only if you're receiving an education stipend

[vernal comet]

Ohk...

[loud marsh]

I have crowdstrike interview tmr. I wonder if anybody here have experience with them?

Couldnt find interview information anywhere after hour of searching

[stoic cave]

I interviewed with them for an internship. It was a pretty standard interview format, but make sure you know whatever you applied to back to front

[loud marsh]

How many round?

[stoic cave]

Internship might be different, but it was a phone screen and then a technical interview

[loud marsh]

i'm applying Security Research full time. Yeah it can be different

when you say technical interview

Is it practical or verbal ?

Are they give you a problem to solve on your PC or it is just technical knowledge?

[rugged delta]

Usually both a verbal and practical part. you have to be able to comfortably talk about numerous topics you have experience in and also answer technical questions verbally, in writing and perhaps in a practical demonstration

[short iron]

Hello everyone, I am a high school student working on a project and I am looking to interview someone in the cybersecurity field, such as a security engineer or penetration tester. If you or someone you know would be willing to participate in an interview, I would greatly appreciate it. Thank you.

[cobalt escarp]

Sorry, we don't help with schoolwork here

[short iron]

It isn't just for school work, It's something I was planning to do for my self as well.

[cobalt escarp]

as well?

[short iron]

But okay I understand thank you

[serene umbra]

Gave +1 Rep to @cobalt escarp

[loud marsh]

is it like a QA interview?

[short iron]

Yes

[next quiver]

Random question, I am studying for my CEH cert. Someone near me has a Matt Walker practice test book and study guide. Would they still be relevant to the new test?

[swift mist]

It’s good but
Try to read multiple resources… this will help u much more to pass the exam

[next quiver]

Thanks! Yea I have several, just wanted to make sure it was going to be relevant.

[serene umbra]

Gave +1 Rep to @swift mist

[bleak pine]

Hey I have a question, how hard is Security+ and is it worth and how far can you get with it

[fallen cipher]

Hi there

[pallid barn]

Exam is all multiple choice and pretty much a slightly harder Sec+. Go through a few study guides and some material im sure youll pass

[hexed magnet]

You can get some practice tests from Dion on Udemy or Professor Messer

[warm galleon]

Don't do CompTIA certifications

Ine is better

[undone shore]

Don't do INE certifications

SANS is better

[violet mountain]

Don't hear about unkown people

do what you want

[dreamy kelp]

Anyone wanna help me in CTF?
Have found the target but having trouble in getting the foothold

[carmine jolt]

Youre in the wrong channel, but we dont help with CTFs generally. If you need help for a thm room, please move over to #room-help

[rough loom]

Can i delivery a Message for the tryhackme owner its urgent

[broken idol]

Uh..

@cobalt escarp ?

(Not the owner, but probably the best person to ask for your to converse with)

[cobalt escarp]

Send me a DM please

Thanks Scrubz

[rough loom]

Thanks

[serene umbra]

Gave +1 Rep to @broken idol

[pallid barn]

not what we were talkin ab.

[warm galleon]

Nah

[warm galleon]

i was saying in general

[undone shore]

Precisely

[undone shore]

No really, there are issues

[stoic cave]

Yeah, Comptia has its issues, however, I don't think ive seen corpo or fed asking for INE in my area

[pseudo creek]

yikes

INE as a company has gone down the drain along with their reputation, I'd avoid at all costs

Comptia is well respected in the US and various other countries

[rugged delta]

Yeah currently I suppose the best cert vendors currently include:
CompTIA (particularly for new entrants to topics),
SANS (for people who have employers or other revenue to pay small fortunes),
OffSec (cos their whole Try Harder mentality is a big selling point and the knowledge gained is on point),
ISC2 (cos according to hr, all beginners need a CISSP and a million years experience to have a job, or else get Sec+)
And CEH if you're in India... There are alternatives in other countries

Then there's a bunch of other cert providers popping up and gaining some level of relevance in niche spaces with good reputations:
TCM's PNPT, Zero-Point's CRTO certs, Security Blue's BTL certs and others... There's several options these days

[distant pier]

Cisco for networking (CCNA, etc.), AWS for Cloud, ISACA for management (CISM). SANS related certifications would be from GIAC. 🙂

[pseudo creek]

Azure for cloud is good too and a lot of good free resources on learn.microsoft.com

[paper stratus]

Hello all, any recommendations for ICS Pentesting besides SANS?

[rugged delta]

Perhaps take a look at OPSWAT Academy... https://opswatacademy.com/

[sterile kelp]

Anyone taken SecOps certs?

@pseudo creek you know anything about this?

[pseudo creek]

Why you asking in multiple places? SecOps is a vendor?

[sterile kelp]

I meant to ask it here

https://secops.group/certified-appsec-practitioner/

Never seen these certs mentioned before

[pseudo creek]

well there are a few things, random companies do make up their own certifications and it is also in the UK, but yeah that is one I've never heard from our UK folks either

[half bough]

I’ve not heard of that in the UK, common ones over hear are GIAC, EC Council, OSCP

[quick forum]

Mostly CHECK approved ones

CSTM, CREST

[minor echo]

What could you say about the Security Blue Team cert? BTL-1, BTL-2

And I think they plan to start BTL-3

[rugged delta]

Some people here have done some of them. Plenty of chats mention it. You can find them clicking search

[alpine marsh]

Love the btl1 cert, it taught me a lot actually

[haughty swift]

Hi everyone i wanted to ask a question for you people.If somebody like me who wants to be a penetration tester (in future possibly red teamer) what would be the first job that i should get in order to achieve my goals.

[warm hinge]

Hey guys! I started my first job in October as a Detection and Response Solution Engineer (ik HR went a bit crazy with that title) out of Uni (BSc CompSci & MSc CyberSec). My manager wants me to become an expert in EDR and told me to take one of the SANS certifications, with regards to EDR, but also what I want to do later on in my career. My current work is doing field work for the ppl that write the detection rules: looking at what data is available, providing some use cases and PoC. It's not an operational role and I feel like I'm missing out on "getting your hands dirty". That's why I would want to do a course that involves this aspect.
I'm currently looking at:

• FOR500 (Windows Forensics)
• SEC560 (Enterprise Penetration Testing)
  Any other recommendations for EDR or thoughts?
  Thanks!

[distant island]

I have.... a very long response for you. Lol. It's Sunday, I've had my coffee, and figured why not take some time to share what I've learned in my previous research and also life experience regarding your question.... hang tight. i've got an essay coming your way

Begin giant response:

I'm a software engineer, but have studied how to become a red teamer.

As far as your first job that you should get, it depends on your experience.

If you have no IT experience, then helpdesk is the traditional rite of passage. It totally sucks, and you'll be helping customers with basic computer issues, but it will introduce you into the first level of knowledge and pain associated with IT, haha.

If you need to get your foot in the door, CompTIA A+ certification will help. Once you've gotten a helpdesk job, I highly recommend studying for CompTIA Network+. It will cover baseline knowledge you will require throughout your career as IT and then pentester / red teamer. The cert isn't very marketable if you're already in helpdesk from what I understand, but get it if you want.

One thing to point out - it doesn't look good if you've been at helpdesk for more than 2 years. Most people try to get 1-2 years experience with helpdesk maximum while they build their skills and then move into a sysadmin position.

After helpdesk, the next best role is sysadmin. This will get you familiar with maintaining servers and also possibly networks. I highly recommend learning as much as you can about Active Directory, as this is critical for most corporate networks. Linux is also important for web and other types of servers, so spin up a virtual machine at home if work doesn't provide access to Linux servers. While you're working as a sysadmin, I highly recommend studying for and obtaining your CompTIA Security+ certification. This will give you baseline security knowledge and also allow you to work government jobs that require DoD Approved 8570 baseline certifications.

After you've had your fill of sysadmin, I recommend getting a job as a SOC analyst. This will expose you to probably more than what you would have seen as a sysadmin, in terms of security alerts. From what I understand, you will basically triage, process, and escalate security alerts all day that come in from a variety of sources, and learn about all sorts of real-world attacks. While you're doing this, I recommend studying for and obtain your CompTIA CySA+.

Note: You might be able to go directly from helpdesk to SOC analyst, or even no experience to SOC analyst if you know what you're doing and can market yourself.

You can then work your way up the SOC chain (tier 1, 2, 3) while learning and practicing pentesting. CompTIA Pentest+ is basically the same material as CySA+, from what I understand, so I figure it's worth tacking onto your resume once obtained. Once you have a good reputation as a SOC analyst and have proven yourself in the blue team, I think it makes you way more marketable as a penetration tester. You can then start applying for jobs. Seeing that you have SOC experience with side projects at home on TryHackeMe or HTB, alongside a variety of relevant vendor-neutral security-related certifications will demonstrate that you're capable of being a penetration tester.

At this point, you've gotten a penetration testing gig, and are learning how things actually work at that level. You'll probably gain a ton of experience and hopefully pick up your OSCP cert along the way. After years of penetration testing, and you've become an expert with senior-level knowledge, I think that is when you can become a red teamer. When you're not just smashing tools against a server, creating tons of noise, but actually crafting specific, quiet, custom payloads with misleading meta data, on the bleeding edge to carry out a campaign over months against high-value clients.

Hope this helps! 🙂 (I wanted to become a red teamer, but now am more interested in appsec and reverse engineering malware. But, I have the blueprint for you!)

[quick forum]

Note: That advice is US specific, it will vary country-to-country

[old furnace]

I would just like to commend you for your thorough and detailed response. 😉

[dreamy whale]

I just wanted to let you know that I think you gave a very solid response. I was also wondering if you or someone else could provide some more information about career paths in the field of cybersecurity in India. I am currently a junior software engineer and am interested in transitioning to a role as a security engineer. Do you have any recommendations or advice for how to pursue these types of careers in India?

[haughty swift]

Damn man you really helped me a lot i cant even tell you how much you helped me beacuse i was so confused about all types of jobs that cyber security offers and what to look for but you really explained me that very well so thank you very much for that!

[serene umbra]

Gave +1 Rep to @distant island

[marble pagoda]

I’m a senior at university, I’m getting my B.S. in CS, I hear that the pay isn’t very good in cyber security. Is that a myth? I’m in the US.

[rugged delta]

Cybersecurity pay in the US is quite good, depending on your position and experience, the organisation you're with and the skills you bring to the table. You can check out salaries on places like Glassdoor. One of the most important things to learn in any computing role is how to use a search engine.

[pseudo creek]

cyber security pay is really good, but where you may see discrepancies is really good software engineers can earn quite a bit more than a really good cyber security professional...

[warm hinge]

I am doing B.Sc in CS

[elder crater]

Henlo people! Does degree in psychology bring any value in this field?

[dreamy whale]

It could be used with social engineering attacks, manipulating human behaviors and kinds of stuff. But technical knowledge is a must in this field. That is computer science and Information technology.

[distant island]

You're welcome! Glad I could help! 🙂

[distant island]

Thanks, I appreciate that! It definitely took some time! 😉

[serene umbra]

Gave +1 Rep to @old furnace

[distant island]

Thanks for the compliment! Unfortunately, I'm not familiar with cybersecurity pathways in India. Maybe someone else can help though.

[warm hinge]

Hey. Shot in the dark but is anyone available for a few quick questions and has been working in industry for 3 or more years? Its for a scholarship & no I don't need any information about you.

asked azure!

[silk crag]

hi

[pseudo creek]

I'm in the US, based on the fact that you posted this at 2am my time, you might not be but I could potentially? I'm not a pentester but work in cyber

[cerulean zodiac]

im watching tcm on yt

good so far

[simple crater]

Hello everyone, any information would be much appreciated. I am planning to interview for a entry-level incident response position, the position is a federal position. My questions is, what was your experience with an entry level incident response interview? Were you stumped by any particular technical questions? I feel like it should be pretty basic general cyber-related principles, incidence response cycle for an incident, etc.. was just curious if there was anything that anyone in here thinks I should look at or work on before the interview. Thanks in advance.

[pseudo creek]

I'm not actually officially part of TCM, I am on their discord, I am mostly just trying to be funny

[pseudo creek]

I would focus on what is on the job listing. They will most likely ask you basic cyber questions, ask you about past experience (team work and such), any internships, etc. you might also want to look at DFIRDiva, she might have some info there

https://dfirdiva.com/

[simple crater]

Awesome, thank you. This will be the second interview so I assume this one will be a little more geared towards the technical questions, but who knows. I'm assuming they will ask about some SIEM tool experience and the general ones that you pointed out. I really would be more worried if they were to ask forensics questions as I don't have a lot of experience in that realm. This site seems to have some good info though so this should help. Thank you again for your response.

[serene umbra]

Gave +1 Rep to @pseudo creek

[warm hinge]

Hello, I am conflicted on whether going cyber through the military or going the college route. Looking for opinions

[pseudo creek]

are you in the US?

[warm hinge]

@pseudo creek hi! are you still available for those questions?

[pseudo creek]

sure

[clever knoll]

I figured id get this question out pre-age but is there any reccomendations on wether to focus on blue teaming or red teaming for careers in the future

[flat sedge]

That's up to you. What do you enjoy, where do you think you can bring value.

Both parts are essential, in my view, to a supportable and informed security posture.

[pseudo creek]

I wouldn't worry about it too much, do some studying, figure out what you like then focus a bit on that

nothing you do will be set in stone

[clever knoll]

I enjoy both but would prefer to stick loyal to one company rather then doing contracting, does this restrict me to either of the sides?

[flat sedge]

So this is just my opinion, take it for whatever you think its worth: Being loyal to a company is bad. The company is not loyal to you. You can feel obligated and loyal to people that do right by you and have earned it, but don't feel loyal to a company because the company does not feel any obligation to protect you or to return that loyalty.

[warm hinge]

yes in the us of a

[clever knoll]

Ah oki well ty for all the help i much appreciate it

[serene umbra]

Gave +1 Rep to @flat sedge

[clever knoll]

and you to thanks for the help!

I appreciate it both of you :)

[warm hinge]

azure is big cool

[pseudo creek]

so first thing that you know is all recruiters lie... they can tell you that you'll totally get a cyber track within the military and then you don't. So you are locked into a few years of the military not doing what you want or possibly what even helps you afterwards.

[warm hinge]

no I would actually get it

Im already in the service

[pseudo creek]

oh! ok

so can you switch to cyber?

or is it part of the reserves?

[warm hinge]

yeah, I can do that

I would go active cyber

[pseudo creek]

well also you will be paid vastly less in the military than you can be paid on the outside, you might want to join VetSec, usually the question you asked is asked by people who are thinking of joining

https://veteransec.org/ they also have a discord, I'd look on disboard for it

[warm hinge]

I do want to work for the government doing hacking, but if I went NSa they would pay far less then military

[warm hinge]

Thank you

[serene umbra]

Gave +1 Rep to @pseudo creek

[pseudo creek]

you might know that NSA has gov contractors, direct hires as well as military assignments

I know someone who was in the Air Force (and actually in the Air Force...) and worked at the NSA on assignment

but the NSA cap is less than private industry and I think even contractors working at the NSA have to keep to that cap

[clever knoll]

I kinda wanna do cyber usa

I swear they dont have to move round like cybersecurity military here

[pseudo creek]

I dunno, the person I know who was at the NSA was rotated out after a while

but I know someone in the reserves working in cyber and their job seems to be site located

[clever knoll]

All the website i read on the uk said they will stick me in some random base

[pseudo creek]

that is the same for US military

[clever knoll]

ah i thought it was like just

chill out at your local base

[pseudo creek]

(reason to choose Marines/Navy/Coast guard as you will be at a coastal location... ) (don't shoot me other branch people)

[pseudo creek]

no, you get moved around

[clever knoll]

I might still try it but i need to do the fitness along with it🥹

[pseudo creek]

once you get there, won't be too hard I don't think

[clever knoll]

Uk navy is deadly my brother send me videos of him doing it💀

[pseudo creek]

getting fit / passing a fitness test seems daunting but lots of people have done it

[clever knoll]

fair enough

I just need to get myself prepped and i might give it a shot

its been alot of help speaking to someone in that position tho

ty :)

[warm hinge]

i think im going to go the civilian/contractor side

I really want to go to CMU

[dreamy whale]

Hey everyone! I was wondering if anyone here has recently taken and completed the Certified Appsec Practitioner (CAP) exam from SecOps? If so, I would love to hear about your experience and whether you think it was worth it! Thank you in advance for your insight.

[wet spire]

is there a good certification to get to make it easier to get a entry job or intership? i looking to try to find one soon

[stoic cave]

Are you currently in a college/university?

[wet spire]

i graduated on CC last year, have been working as a developer for sometime and now want to go to infosec, i am trying to enter on a pos gradeation degree on it but i not enrolled yet

probably will be later this year

[stoic cave]

So, it's not typically recommended to go for a post grad while also trying to get a an entry level job. Doing so will price you out of entry level salaries.

Should also be known, that typically in order to get an internship, you need to be enrolled in an undergraduate or postgraduate program.

Am I right in assuming that when you say you've been working as a developer, you're doing it for a company?

[wet spire]

yes

local company

[wet spire]

because it will be just later this year that i may enter on a pot grad, i was looking some certifications to boost a little bit my resume

if i enter in it, i would apply for intership

[stoic cave]

I don't know that it will be advantageous to enter a post grad just for an internship

[wet spire]

so what would you recommend?

[stoic cave]

Postgrad is typically designed for those who have some level of industry experience and need it to advance past mid level positions

In previous posts, others have recommended looking for security roles that incorporate what you've been doing as a developer. I cannot speak to this personally though, as I went into security straight out of undergrad.

As far as certifications, Security+ is the fundamental cybersecurity cert in much of the world. India does its own thing, afaik

[wet spire]

well this already helps, thanks brother

[edgy torrent]

hi guys. I checked a few messages here in order to figure out where I can move from SDET position. And since I have some IT background - the best option, as i understood will be SOC. Is that true? Another question - I have tried to find wages for this position and I am not sure if those numbers are realistic. Can you please share from your experience - which salary I can expect as Jr for SOC position (I have 6 years as SDET)?

[pseudo creek]

You are gonna have to provide specifics like what is SDET and what country you work in

[edgy torrent]

oh, sorry. SDET - software developer in test. I am working remotely, so basically going to work in Europe

[pseudo creek]

ahh you'd probably still have to say where in Europe you have the right to work, I don't know about European wages

[edgy torrent]

actually, any country is suitable, as I am going to move to USA. So I belive i am most interested in USA

[rapid zenith]

Wages in europe are highly dependant not only on the country of where the position is offered, but also on the city. A place with higher cost of living in general will have a higher pay

So if you are wondering if X EUR is realistic, it depends

The US is probably similar. Zojj should know

[pseudo creek]

well the US is tricky as a lot of cyber positions are US citizens only and a company that would take you on with a green card may pay you less, sadly. Pay varies greatly but for a US citizen for a junior pentester, I'd say 70k to 110k...

[loud marsh]

You got this brother

[edgy torrent]

Thank you for your reply. So it looks like security is not as highly paid as people used to think. I have that money now, and after switching positions, it will be downgraded.

[serene umbra]

Gave +1 Rep to @pseudo creek

[edgy torrent]

thank you a lot for an answer

[rapid zenith]

You'd be entering a new field in an entry position after investing multiple years in other career path

Highly likely it would be a pay cut

[pseudo creek]

and generally, software development is a highly paid field

[rapid zenith]

Good luck with the move, though!

[drifting swift]

Hello how can i become a pro hacker

[warm hinge]

Anyone have a good quiz to see where you best fit into Cyber/determine a Cyber path?

[austere fractal]

Not sure "how good" the quiz is, but at least there is one 😄
https://tryhackme.com/room/careersincyber

[drifting swift]

.

[rugged delta]

#start-here

[mighty solar]

Hello, I'm going to have my first interview for a cybersec intern at a bank. What are the best ways to prepare for cyber interviews?

[rugged delta]

Congrats on getting that far. As it's an internship, the bank will most likely be interested in knowing how far you've progressed along your path to a career in cybersecurity and where you see it taking you. You'll need to understand at least some of the concepts that the bank is hiring for in the job description they had that you applied for, but the purpose of an internship is also to give you an opportunity to learn about a role or the organisation themselves.

If you're in a college/university course, be able to talk about the subjects you're learning, the ones you feel the most important to your path and where you might like to go with those skills. If you have projects completed, be able to talk about them and your experiences. You might be asked about specific technologies being used or roles the bank offers but in most instances you probably won't have to know much about the technologies in use in a SOC or what a specific product does as part of an Identity and Access framework or what skills you need as a cloud security engineer.

The main thing is to just be able to talk about technologies in general (mainly operating systems, networks, applications, security systems, programming/scripting), security skills and technologies (If you've read the Sec+ it would be a great help), skills and challenges you've encountered in THM, college projects, any other certifications, books on the subject... Show enthusiasm and professionalism and a willingness to learn

[mighty solar]

Thanks so much! I was worried about needing specific software knowledges but I'd consider my general knowledge (and also the concepts in Sec+) pretty solid, and also I do have a class project that I have experience for, so I'll try to discuss those as much as possible.