cyber-and-careers

[wicked oxide]

Since CEH its 1700$ i would try DCPT(Not know all over the world but here in brazil have a little and the course its just better)

[elfin spruce]

And to be truthful; recruiters won't care too much about "showing the positive things related to CEH" because their business and partners ask for certain certifications. If you don't have it, you won't be considered and if they go against their business often other recruiters will be asked / tasked with finding 'the right candidate'

[flat sedge]

CEH and CISSP fulfill very different niches within cybersecurity. IMO CEH is considerably worse than Pentest+ or PNPT... it sees fulfillment because hiring managers and HR don't know that there are better alternatives. Because when they were sitting for it, there were no alternatives

[fallen heron]

it basically seems like HR is 10 years or so behind the times

[elfin spruce]

"US" resumes and Resumes from people I've worked with and resumes ive seen from people around me are soooo vastly different. We put so much more text on paper on what we've done, what decisions we've made etc. Also we use photo's, LinkedIn and other personal information o there (which you want to hide when sharing here)

[flat sedge]

It's getting better. I wouldn't really consider OWASP top 10 a framework though. Consider looking at NIST CF and walking through all the requirements, starting with the domain you are most familiar with. Similarly, I don't consider ATT&K a framework so much as methodology of analysis

[wicked oxide]

I don't see how a multiple-choice cert could be better than a 100% practical with reporting one, i see those jobs just asking for CEH and i get pretty sad tbh

[fluid trench]

Should I just remove the framework line altogether?

[flat sedge]

If don't know frameworks, I would recommend it

[elfin spruce]

I am not disagreeing with you, but I am just talking in the POV from a recruiter / business side of things.

I couldn't have worded it better than how Juun worded it.

[flat sedge]

Similarly, top10 is the most common application vulnerabiltiies. It's not what any GRC or Operational Security team would regard as a framework

[fluid trench]

Got it, was told by a QA guy to put both of those as frameworks

[flat sedge]

"EC Council scandals" is a good place to start to why EC Council as a whole is not well regarded; the CEH content itself, I have been informed, is very out of date and isn't really reflective of what pentesting ought to be

[flat sedge]

I am a QA guy and I do not consider them frameworks, FWIW

[fluid trench]

interesting, okay. Good to know

I was also told by someone else just now to remove dirbuster and HTML/CSS

[wicked oxide]

I know I didn't say that because it seems to me to be an impossible market to enter considering that CEH, besides being expensive, doesn't deliver good content.

[flat sedge]

A framework is a set of requirements that have to be fulfilled; could be policy, could be technical, could be administrative. ATT&K is more like a huge flowchart to determine TTP that an ATP is currently using against your org. The Top10 are the most common vulnerabilities seen in the wild and while you could implement a set of controls based on them, no one says "OWASP 2022 compliant" as a selling point

[fluid trench]

so that would be like CIS20?

would be a framework

ISO whatever the number is

[flat sedge]

CIS Benchmarks is a good place to start.

I would recommend starting with PCI-DSS. While it's not a "great" framework and there are lots of weird things, it's relatively accessible and well organized.

[elfin spruce]

Only list relevant skills for something you're applying for. So I agree with removing HTML/CSS. Arguably HTML can be staying there but it's not considered business value

[flat sedge]

Once you think you have a handle on PCI, NIST CF and the NIST SP 800-53 docs are also really good to know

[fluid trench]

Got it. Any tools I can’t think of that I should add?

[flat sedge]

but I'm from the US, so NIST is pretty much the defacto standard for lots of things here

I don't know what tools you know

[elfin spruce]

Don't add stuff you're not (too) famillar with. If it's not on there you will not get questions about it.

[fluid trench]

of course I’ll only add them if I have experience with the tool, just curious if there are any big ones I should know that I haven’t listed, as well as tools I should probably learn to use

[elfin spruce]

If you add something and they deem you having no or little knowledge about a tool.. you're no longer considered.

[flat sedge]

Agree with that. If you can't speak extemperaneously about the item for at least 5 minutes, don't put it on the resume

[wicked oxide]

I don't see its a good investment pay about 1800$ and the thing don't show me good content and if i would pay an expansive one i just should go to OSCP since i guess has way way better market share and its a real thing

[fluid trench]

and that my good sir, is why I have not added SQL yet lol

Anything I should dive deeper into, or back out of in my CV that you can tell?

[flat sedge]

SQL is really easy; I would suggest relational algebra first, then apply that to a database like postgres or maria

[fluid trench]

yeah, at this point I only understand basic SQLi type strings, after my PNPT I plan to build a homelab using SQL to gain a better understanding

[wicked oxide]

Which job type i could get with security+? SOC things?

[elfin spruce]

I don't think you need to get certifications and it highly depends on what you're trying to get into. Getting into a SOC analyst role is "easier" than a pen test role.
If you're starting out and have no formal education in IT, try a helpdesk role and talk about certifications.

The thing is; if a 1800 dollar certification gets you a job, paying x amount dollars per month and a 1000 cert does not get you a job I'd say the 1800 dollars is a good investment

[flat sedge]

How was your python client/server a security tool? was it a C2? Was it something else? Saying it's a server doesn't mean anything. For your mock reports, how did you evaluate likelihood? Quantitatively or qualitatively? Did you assess the CVSS scores for the vulnerability from a single source or multiple? Did you discuss why you agree or disagree with the severity?
"Dissected" is not a word anyone associates with architectual blueprints of any kind. "Decomposed" has a specific meaning in the documentation world, and is probably more appropriate. Know what it means in this context before using it though.

[elfin spruce]

With some things, unfortunately you need to set your own "ego" aside. Ego isn't the right word but I hope you get what I mean

[flat sedge]

If someone had OSCP and no experience nor other certs, I wouldn't hire them for pentest. I might not even hire them for helpdesk; pentest is very risky and I wouldn't expect someone with just that to understand risk enough to not stray from the engagement scope.

Understanding when not to break stuff is way more important from the business perspective than being capable of breaking stuff.

[elfin spruce]

I agree with you here, but again. Talking from a hiring manager POV

[wicked oxide]

I know and tbh i was thinking in get a other IT career to "make money" to go just forward on OSCP
CEH probably would land me a job but not a job that i could pay the CEH in a year of working

[flat sedge]

If you can afford it, I recommend taking a year or two and getting an associates in some IT discipline.

[elfin spruce]

Try to find an entry level job where your company wants to invest in you getting certificates.

[flat sedge]

Often, vocational and junior colleges take cues on curriculum from industry, and many local employers will look very favorably on those graduates

Because they told the college what's important to them, and they exactly what to expect with a new hire with that degree

[elfin spruce]

Alternatively, getting an AD is a good options like Juun mentions. It also shows that you have atleast a certain level of academic level. (Which is communication + writing)

[flat sedge]

The big value in security is being able to write and communicate. All the technical skill and knowledge is useless if you are unable to effectively explain why a thing you saw is bad and needs to be changed

[fluid trench]

I will dive deeper into these points

Thank you!

[elfin badge]

A homelab can also be just a VM; id recommend setting one or two up asap and use it often to build familiarity in the environment

If you're on Windows, you can get pre made hyper V images

[fluid trench]

I’ve done that already, I just need to experiment with SQL specifically

it’s an area I lack in

[flat sedge]

Seriously, do the math first.

[fluid trench]

You said in Algebra?

[flat sedge]

If you just jump into SQL you will miss a lot of optimization type stuff with how to build and run queries

Relational Algebra.

[fluid trench]

Do you have any recommended starting points? Resources or stepping stones?

[flat sedge]

It's a specific thing within set theory

Relational Algebra is the branch of mathematics that all RDB engines are based on. Wikipedia is a great place to start

[fluid trench]

Sounds good. Thank you so much for your help!

[worldly whale]

Cpts also has free retake. Neither pnpt or cpts hold a lot of hr value. Cpts is the more difficult cert

[wicked oxide]

wich one do you recommend i tried to find some and all is 3+ years

[flat sedge]

That sounds like a Bachelors Degree.
An associate's degree is typically vocational training (or prep for a Bachelors) and is provided by a junior, vocational or community college.

An associates degree should be a 2 year program, at least everywhere I've heard of in the US

[wicked oxide]

I found a Data Science but its 2,5years

[wicked oxide]

Don't know if brazil has some type of associate's degree

[rugged delta]

Definitely enjoying the CPTS course. Don't forget to submit 'a' report or no repeat 😛

[worldly whale]

True 😄

I’m nearly finished with the path, but going over it again to take proper notes this time

But can’t really focus on it now, 5 sans courses offered by work came up instead

So took that opportunity immediately

[rocky bear]

I'm about 70% through the path, looking forward to the exam as well

Not sure if this is the channel to talk about it

[rugged delta]

Yoink on those! CPTS will be there after. It's basically a 20 day exam with a two week study break in the middle

[worldly whale]

Yup, I hang out in HTB chat quite a bit

Try to help in modules so the content stays somewhat fresh

[rocky bear]

Do you mind if we switch to #general to talk about the exam format? 👀 I thought it was a one week exam? Must've mixed up my info

[worldly whale]

It’s 10 days

[rugged delta]

Yep I keep an eye on that channel over there and help out when I can

[rocky bear]

Oh that's very nice

[worldly whale]

You need to get 12 out of the 14 flags within that time and write your report

But most people need the retake

[rocky bear]

Seems achievable

[worldly whale]

Hence why he says it’s a 20 day exam with a two week study break

[rocky bear]

I have heard its a tough exam

Haha interesting

[elfin spruce]

Just came across this.
Perhaps this is interesting to post here.
https://www.linkedin.com/posts/gothamjsharma_accesscyber-10000-cybersecurity-jobs-report-activity-7112495801959870464-0xdV

[worldly whale]

Yup

[rugged delta]

Quite a few have said it's tougher than OSCP but the course gives you all the info you need, keep plugging away

[rocky bear]

I'm taking it slowly, not in a rush or anything. Just something that seems fun to do down the line

[rugged delta]

I was all set to get some study in today but my laptop decided to have a fit while patching so I've spent most of the day troubleshooting and reinstalling instead. Now freshly reinstalled, that same patch did not cause any problems

[rocky bear]

Ouch. The joys of troubleshooting

[rugged delta]

Ah well, all set for more fun tomorrow

[fading robin]

Anyone who is an Aspie let me know. We have a Bug Whisperer group for collaborations.

[brisk iris]

i would think 99% of people here are haha

[dense dagger]

can cert chasing negatively impact someone when looking for jobs

like getting 3 certs within 6 months or something like that

[broken idol]

I'd say yes.

If you're going for multipe certs at a time, I'd think you're just firing through the certs to look good, without retaiing the knowledge learned from each cert.

[elfin spruce]

Definitely. Chasing multiple entry-level certs can be seen as "desperate" by recruiters. Immediately raising suspicion.
If you're doing multiple certs, ranging in difficulty, and you don't have the work experience to back it up that's also not too great.

[fallen heron]

gatekeeping personal improvement like that just astounds me

especially when it should be easy to find out if the person retained anything during an interview

[coral vault]

Jesus can't even strive to get as much education as possible

Without raising suspicion

[coral vault]

Exactly you try to see if someone is full of shit in an interview not during selection. Not all of us are in a position to gain experience for an entry level position

[fallen heron]

literally, I cannot comprehend that attitude

[coral vault]

I saw someone on htb discord say 'getting a master's degree straight after your bachelors can hurt your career chances'

Like bro wtf

[broken idol]

It can?

It can make you over qualified for some graduate positions.

Masters are for Supervisor type positions.

[dense dagger]

Yeah, there is some truth to that

[fallen heron]

the US is completely backwards it seems

[vernal sleet]

Depends on the country I guess but generally yes, if you have no exp and get a masters it can be harder to get hired unless you have connections

[elfin spruce]

This is not in the US only. There's 'dangers' for putting overly qualified people in place (unless you can explain why you don't think that's the case for you)
I know this is also broadly in Europe a thing.

[fluid trench]

I feel like the only valid reason I can think of is that they will plan to leave a position as soon as they are offered a higher position

[elfin spruce]

Others are, from what I have heard:

• Companies are afraid that people will get bored because they are overqualified
• Companies are afraid people will be or get lazy
  There's also some communicational fears, especially between someone who is overqualified and their 'superior'.

[fluid trench]

ah, that does make sense

[fluid trench]

I volunteer with a local security organization (almost like a local defcon) working with their website specifically, should I add that to my resume in any way?

[vernal sleet]

Yes IMO

Not under experience maybe but under like a "volunteering" or projects section

[elfin badge]

is an employer that worries about someone getting bored actually just not providing their employees with growth pathways? This sounds like it would be the biggest problem in small companies under 100 employees.

that's the other thing that's been super annoying. There's no clear pathway to some of these roles, job requirements list certifications of varying levels as all equivalent weight, some of the requirement sdon't prepare you for the actual job responsibilities etc...

the only way to know is to just apply for a job and ask the recruiter directly, maybe reach out to hiring team or recruiter on linkedin and chat with them directly to really know

[fluid trench]

not to mention the competition for these roles. Even helpdesks have had thousands of applicants

[wicked oxide]

Someone told me yesterday that i can buy one month of platinum (HTB) and 1 month of gold to unlock full pentester path

Someone can help me with that? The total cost off full path is 1960 and if i buy both (Platinum 1 month gold 1 month) i'll have 1500

[elfin badge]

that's crazy to me. on one hand, help desk positions tend to need more staff, but company never budgets enough for it. At one point 5 people quit where I work right now, and then we had a hiring freeze on top of that... "can't afford to hire" ??? we just had 5 peopel leave within a year, and all that work is solely on me, and my salary didnt change....so where did all the money go???

[elfin badge]

uh do you know who told you that? try pinging them?

[elfin spruce]

Don't look at the numbers on LinkedIn. There's a lot of people applying from outside of the USA, hoping to get a job there.

[elfin badge]

don't be discouraged from applying because there are so many applicants either; remember, if you don't apply, you have 0% chance

[fluid trench]

true

[elfin spruce]

Not enough growth pathways is a huge issue in a lot of smaller and medium sized companies.

[elfin spruce]

This is what I always do

[wicked oxide]

@worldly whale Sorry to ping can you help me with that?

[worldly whale]

You get cubes back for completing modules

[wicked oxide]

Ok ty, when i buy it with cubes i can see it lifetime or just a year too?

[worldly whale]

With cubes you have it forever

If you get yearly sub you only have it forever if you complete it

[fluid trench]

this isn’t necessarily the right channel for that

[wicked oxide]

i'll see the book content of CPTS and PNPT and pick one to get

[worldly whale]

Yeah it started with cpts cert, hence the discussion about the modules there, which are a necessity to take the exam 😅

[fluid trench]

ah, okay

[fluid trench]

PNPT is a good cert

[worldly whale]

I recommend to just ask in HTB server if you have other questions @wicked oxide

[fluid trench]

haven’t looked into CPTS

currently PNPT has a bit more weight to it though

[worldly whale]

Cpts is more difficult than pnpt

[worldly whale]

Yeah I guess it’s coming up a bit more, but still nothing compared to oscp I guess

[elfin spruce]

If you're using it to land a job, check the one mostly asked in job listings.

[rugged delta]

A lot of college students go into college around 18 and come out 5/6 years later with a Bachelors & Masters. It's absolutely normal for those people to want to do a starter role for the first year but to quickly progress, They're not starting in senior roles but they are the ones being plucked by larger organisations and put on a career path. They'll usually be aiming for the likes of PwC, EY, Boeing, Booz Allen or Lockheed or Raytheon etc

Graduate positions are mostly for allowing both the recently qualified and a potential employer to get on the same page and see if they suit each other. During a graduate year you'll most likely be doing small projects and contributing to larger ones, shadowing full-timers/seniors, learning how to follow processes, maintain systems/documentation, how to follow project planning and communicate with other departments to fulfill projects, breaking lots of things in dev/testing and eating lots of free pizza etc...

[fluid trench]

neither have OSCP weight

[wicked oxide]

tbh in brazil any of them has market share

It's like 0

[worldly whale]

Correct👍🏼 I’d say cpts better prepares you for it though, it’s the more advanced cert of the 2. Those who took oscp after cpts, or the other way around, all said oscp was easier compared to it

[fluid trench]

I’ve heard the same about PNPT tbf

[elfin spruce]

Contact companies that are in the field, connect with recruiters on LinkedIn in your area. Check what alternative pathways they see in terms of certificates etc instead of only OSCP.

[worldly whale]

I’ve heard pnpt helps with the ad section

[fluid trench]

but I’ve also heard OSCP is pretty gimmicky though

less realistic, more of a CTF type of test and less of a pentest

[worldly whale]

I’ve heard oscp was just a matter of finding versions, googling cve, adjust payload and run

[fluid trench]

I haven’t taken it, just word of mouth btw so take my word with a grain of salt

[worldly whale]

And I’ve heard people say the ad for 40 points was doable with cme only lol

[elfin spruce]

You're likely better off networking, IRL and online, than to get a certificate that's not recognized in the business
Try to see if there are Meetup groups that host events

[fringe spade]

There are multiple AD environments so not really

[worldly whale]

?

[wicked oxide]

They ask to much for CEH

[fringe spade]

Exam environments for OSCP change each time you’d take the exam

Same goes for the AD section

[worldly whale]

That’s true

[fringe spade]

So even if one person could use cme to exploit it, others would have different exploits etc

[rugged delta]

OSCP is the most widely known pentesting cert by far, to the point someone with CPTS and OSEP couldn't get a job because they didn't have the OSCP. I've spoken to potential employers at BSides and recruitment fairs who want to see that OSCP cert but also want you to be able to discuss the tech and workflow, want to see your dedication on platforms like THM/HTB etc. And I've spoken to hackers who just want to know the cool stuff you're doing, the actual, hands-on work

[elfin spruce]

I mean, you do you. But if CEH is the "standard" certification in your area and gets you a job quickest then that's not a bad path to take, despite the certification having less weight internationally.

[fringe spade]

The thing with OSCP is that some clients of pentesting companies require OSCP (or CEH sometimes lmao)

[rugged delta]

OSCP is widely recognised because everyone in the industry has accepted it as the beginner's standard you have to reach. All these other pentesting certs still have to prove themselves to the hackers running pentesting outfits.

[elfin spruce]

Also; back then the people starting out only had OSCP, so that's all they know. Those are the people that are now the hiring managers and team leads.

[wicked oxide]

i'll try cover other IT area and do some security certs in that time, like i have a solid work that i can keep it for years rn so i don't have to rush it like crazy i can do some "cheaper" certs and get knowladge and when i had the money i go to OSCP

OSCP with other certs i think probably will land me a job

[dense dagger]

I think this is the biggest factor tbh

Not just getting an interview

[wicked oxide]

even if they're "cheaper" or less knewn

[wicked oxide]

Here has some companys that require CEH

But at the same time has lot companys that just want to see that you have a cert

In the field

[rugged delta]

OSCP used to be the affordable cert because nobody could realistically afford SANS courses without an invested employer or significant loan debt. In recent years, because of the volume of newcomers, Offsec have had to up their price to deal with the volumes of potential students and it's become a highly profitable venture as a result. The other certs that have been coming on the market in recent years, like CPTS, PNPT, CRTO, CRTE, CRTP, etc are doing a service to OffSec by reducing their applicant volume slightly but most of us going for those certs will likely also have to take the OSCP at some point

[fluid trench]

I have no problem getting OSCP eventually, just no way in hell I can afford it OOP

[elfin spruce]

I mean, that's 'standard' capitalism.

• Business creates a demand
• Demand becomes high due to a requirement
• Demand exceeds supply
• Increase prices
• Because it's a business requirement it will be sold to plenty of vendors and individuals, so it sells itself

[rugged delta]

Yeah I know what you mean. When I'm back actually working, I'll hammer it out in a few months I expect, even if I have to pay for it myself

[fluid trench]

yeah. my issue is not having a high paying job, being married, about to have a kid, paying for an almost 2k dollar cert is out of the question

[rugged delta]

Absolutely, it's a recognised benchmark now. All these other certs are looking for traction in that industry and there is 'some' movement on it but clearly not enough because it's a badge of honour

[rugged delta]

Yeah I hear that. It's hard to change careers when everything else is changing around you. As long as you're not also moving house on top of that you'll be alright for a while!

[wicked oxide]

Almost same as me, that reason i want to start with CPTS, PNPT or even eJPT if that land me something

[dense dagger]

I don’t see the reasoning though why one wouldn’t rather hire a junior and then just have them take OSCP than just outright hiring OSCP

[fluid trench]

hehehe, I move in December lol

[fringe spade]

It’s because there’s so many OSCP’s right now that it’s just easier and cheaper lmao

[fluid trench]

you can pay a junior way less and they’ll be thankful

[rugged delta]

Lots of companies don't want to pay upfront for a notoriously challenging training facility. They want you to pay for it with a promise they'll pay you back or preferably make that a prerequisite of the job

[elfin spruce]

Because there's a risk of someone not passing the OSCP, might still take months for that person to have the 'required' level.

[fluid trench]

if I had a guaranteed job after paying OOP for it, I’d make the investment, but I can get the cert and still struggle to find a job

[fringe spade]

Although I’ve seen some offers with the requirement of “Willing to pass OSCP in the near future”

[dense dagger]

Ain’t it cheaper to have them take a lower salary then have them take OSCP

[dense dagger]

That’s what technical interviews are for

[elfin spruce]

And there's also people who join a company to get a certificate and leave immediately after because they can get better salary and conditions elsewhere.

[rugged delta]

They don't want juniors on pentesting teams who don't know how to do a pentest and submit a report. OSCP is a recognised minimum standard in a lot of cases

[fringe spade]

Depends, some time ago with OSCP and soooome experience in other branches you could apply to mid-level positions and now it’s pretty much treated as an entry point for juniors

[fluid trench]

yeah, that makes sense. But people like me learn hands on. I’d learn much more sitting with someone for a week to a month, then years of schooling

[dense dagger]

That’s what bonds are for

[fluid trench]

I’m hoping PNPT gains traction since I’ve paid for the voucher already lol

[dense dagger]

and frankly, its an employee’s right to find better compensation if their company doesn’t match the market

[fringe spade]

It’s expensive for the company, because whenever they have interns or juniors the mid/senior has to take their time and introduce the new hacker into the projects

[fluid trench]

Usually companies make a contract requiring you to stay with them, otherwise you get the bill as you leave

[rugged delta]

But the learning experience for pentesting is a solo journey. It's challenging. There's no hand holding, except the training manual and the target machines who'll only give up the goods when you're good enough to take them

[fluid trench]

I’ll take 37k a year and work as a junior if anyone wants 😂

[elfin spruce]

But that still costs the company more money because they need to restart the hiring process.

Hiring process is EXTREMELY expensive

[fluid trench]

yeah, that’s the thing, so I’m hoping that the PNPT can prove the self learning

[dense dagger]

Then they should pay their employees their equivalent price

[rugged delta]

That was the salary for a junior SOC analyst in my town a few years ago. Now it's over 50k

[fluid trench]

since it’s much more affordable

[dense dagger]

I don’t mind not leaving a company if they properly compensate me

[fringe spade]

That’d a mid/senior salary where I live lmao

[elfin spruce]

For a software dev it often takes anywhere from 6 months to 1 year for someone to "up to speed"

[fluid trench]

literally that is what I make now, if I can keep the same wage and get my foot in the door, I’m totally fine with that

[elfin spruce]

You don't know how much effort some people take into prepping for their technical interviews, where they pretty much learn entire books front and back. Assessments are often used for that regard.

However, if you got 100 applications,You want to ask 10 people for an interview for the first round and 10% has OSCP, then that's a fairly easy seleciton.

[fluid trench]

or even take a slight pay cut

[rugged delta]

I've done some of Heath's courses on YT and Udemy. They're high quality stuff and lots of people know his reputation these days

[fluid trench]

yep, I feel it’ll gain traction, more of a when

[fluid trench]

where I am that’s not much more than a mcdonald’s employee

[rugged delta]

Do the SOC stuff on THM (I hear L2 isn't far off) and then keep pushing

[wicked oxide]

btw PNPT has more chance to get traction than CPTS?

[fluid trench]

unknown

[elfin spruce]

No one knows, it depends on the business

[fluid trench]

we can only guess

[rugged delta]

Considering their clients include a bunch of TLAs, gov and large orgs, I'd say it won't be long

[fluid trench]

PNPT course is more my learning style, the HTB academy is hard with my adhd brain to stay focused and retain info

[wicked oxide]

Wich certs could be land an easy thing on SOC? Sec+?

[elfin spruce]

Again, check job postings. We can't speak for your area.

[elfin spruce]

Considering that 31k a year is the average salary here ;p

[fluid trench]

USD?

[elfin spruce]

EUR, so like 32k USD

[fluid trench]

here is 63k USD average salary lol

[dense dagger]

Ah, I wanna work for international clients so I can finally ditch my shit pay

[rugged delta]

HTB is widely recognised as a great learning and community environment. TCM is primarily learning/cert focused and got into the cert sphere a little bit sooner but it could go either way. There's now lots of people doing great things at the lower price niche, the sub $1k branch and it's turning out lots of good people. So that just means the bar will be raised at the next tier to maintain that barrier for entry

[elfin spruce]

I mean but it won't cost me a kidney if I'd break my leg over here 😂

[fluid trench]

yeahhhh lol

Im looking for a job with insurance too if I can

[rugged delta]

Sec+ is widely recognised for starters in cybersec but also OSCP and CISSP (for some reason frequently requested from juniors, even though it requires 5 years experience or 4 years and a degree)

[fallen heron]

I would say yes because HTB gatekeeps the cert behind the learning path, it simply cannot gain traction quickly because there's too few people with the cert to make any kind of difference

[dense dagger]

I'd say the HR doesn't really know what they're asking for

OR

The higher management for security has a different take

[elfin spruce]

What I heard from a lot of recruiters and hiring managers so far is that they think that people should stop seeing cybersecurity as an entry field.

[dense dagger]

Cause usually, HR would ask the security head what they're looking for and they'll just slap in some certs they know without actually being immersed that anymore into the field (since they've been in a management role)

[elfin spruce]

I wish you all the luck! Where I am from companies stopped off-shoring for the most part and either want to have more internal teams or near-shoring.

[rugged delta]

Well they're stuck between a rock and a hard place. How do you show that your cert isn't just a cash grab? Make people pass a continuous assessment to show you already know everything, because the aim is for you to treat the exam like a real pentest

[fluid trench]

I cant even get a helpdesk job because too much experience wanted!

and if it doesn’t require experience, there are thousands of applicants

even locally I’m 1/500 applicants

[dense dagger]

It's nice to find start up consulting companies and their CEOs still delving into the world of cybersec so they keep it fresh

[fallen heron]

if you have the confidence and knowledge you can take any cert without completing its course 100%, including OSCP, PNPT, CRTO, etc.

[dense dagger]

There was a job posting on LinkedIn that were looking for people who had CPTS, CRTO, CRTP, and PNPT besides OSCP

[dense dagger]

Yeah but that means your level is above those certs, right?

[elfin spruce]

Majority of the applicants will be non-US.
But with the current economic recession, even if it's 'minor', a lot of companies have laid-off personel. So the the supply (people applying) is higher than before. So companies get to make more choices in regards of new hires.

[fallen heron]

sure, but without a cert, no one will look at you

[dense dagger]

That is also somewhat true

[rugged delta]

HR are just people who take suggestions from the teams and also check with professional bodies to make sure the qualifications are legitimate. Cybersec doesn't have a licencing authority like in medicine or law or accounting, at least not yet so the industry kind of builds its own standards. Those are frequently CISSP, CISA, CISM, OSCP and Sec+ in general. CISSP because you need to maintain it to show your professionalism, the rest because they're recognised tests of your effort and abilities

[fluid trench]

making it almost impossible if you don’t have experience

[rugged delta]

Most of us in cybersec don't see it as an entry level field. That's why even on THM you're encouraged to learn a minimal standard of Linux, Windows, Networking and other skills as you go. Most cybersec professionals have lots of knowledge in various IT/software engineering roles and cybersec is the next progression. It's not an entry level field. You need to know how computers work deeply and in the real world

[elfin spruce]

Making it definitely more difficult.

[fluid trench]

yep. job hunting right now is depressing

[elfin spruce]

Agreed. I am a full-stack dev looking to transition into sec

[rugged delta]

Yes but if you have the knowledge, why are you taking a cert. OSCP demands that you buy the course, not that you complete it. OffSec advertises themselves as a training company, not an exam company

[dense dagger]

Yeah, I agree with this. The easiest way one could understand this is "How do you how to secure something if you don't know how it works?"

[wicked oxide]

think i'll follow riboo idea, will try contact some recruiters to ask them certs or something like that i would had to plan it

[elfin badge]

damn maybe i should put my assembly / mips knowledge on my resume if that's the case lmao

[fallen heron]

I mean there's plenty of people in the industry who collect certs and compare them and those are the types of people who can make a difference as to what their company looks for in candidates, if your cert is behind a path that takes 6 months to complete, there's no hope for traction

there's people like that who've said they'd hire someone with CPTS over OSCP, but that means nothing when there's like a 100 people with the cert

[fluid trench]

mhm

so many people have gone for PNPT and are going for it, so I feel it’ll help

TCM is a very credible organization as well

[rugged delta]

Exactly, although it's possible to learn how to hack a Windows or Linux machine and take advantage of it without knowing everything about it, you really should understand a good deal about it

[elfin spruce]

Agreed. The learning path makes it hard to gain traction. In order to get traction it needs to be able to be examed at will.
No company is going to put a person forward to do a certificate that takes 6 months (unless it's like an MBA/Leadership thingy)

[elfin badge]

im honestly about to call the $300 i spent on ejpt a loss and move on to prepping for OSCP at this point lol, havent seen a single employer mention ejpt

I should have done that research first, but I saw sooo many youtube videos reccommending ejpt i thought it would have been good to get employed

[fluid trench]

I have seen some posting mentioned eJPT

but really not much

[wicked oxide]

my initial plan was eJPT than PNPT or CPTS

[dense dagger]

Nah you only need either PNPT or CPTS

[rugged delta]

The cert is geared to be done on a full time basis over about 40-something days, or 6 weeks full time work, if you have the devotion. In the past, lots of people have said that someone knowledgeable in cybersec should be able to complete the OSCP course in about 45 days at 8 hours per day, or 90 days if you have a full time job doing about 5 hours per day. Obviously if you have other commitments it's going to take you longer. OSCP has plenty of traction because of what you have to go through to achieve it. It's not gate-keeping to have such a challenge. It's why things like the bar exam in NY or medical school are so challenging. If you can't reach that level, you probably shouldn't be doing the job

[wicked oxide]

Yes, that just came in my mind and i was like "i will learn everything that have on eJPT on both of them so why eJPT?"

but eJPT its growing slowly here in brazil i can see some jobs with him rn tbh

[fluid trench]

eJPT is almost useless if you plan to get a heavier cert right after

[fringe spade]

It csn be great to show progress

For example in 2023 you’ve completed eJPT and then in 2024 you did OSCP

[fallen heron]

how many people exactly have the possibility to do certs full-time, I'm not saying it shouldn't be a challenge, I'm saying the exam shouldn't be inaccessible without 100%ing everything, let people fail and be humbled

[rugged delta]

CPTS has been on the market for a year at this stage. It's very challenging and they're still expanding but they are making progress in sales and speaking with plenty of companies and colleges etc. They'll get there

[fringe spade]

Looks good on your resume, because it shows the employee that you’re dedicated to the craft

And constantly learning

[dense dagger]

Eh, i wont pay $300 for “progress”

Because you can say the same with PNPT and CPTS

[wicked oxide]

I think CPTS could be better for my personal thing because they let me pay for like a platinum plan than take part of the course buy gold and do some more and than buy just the vouncher and try it

but its like 386(CPTS) to 399(PNPT)

[rugged delta]

How do you become a recognised training body without demonstrating you're up to the standard? It's just their method and they have a video on YT about their reasoning. It's just their way of doing things

[dense dagger]

But that is just my rationale. I only see certs as tickets to get into better career or better at my work. If a cert doesn’t have any ROI, I won’t be taking it.

[flat sedge]

Seconded, the valuable part of the pentest is in the report. There's a lot of risk in pentest, having juniors who don't understand risk appetite can't be trusted to know where the line is

[rugged delta]

You can do the CPTS with one month Platinum, one month Gold and the voucher. I don't like their pricing structure. They like being 'gamified' but the whole coupon thing is a terrible practice. I think it's one of the big reasons PNPT is selling faster

[dense dagger]

I AGREE

ITS SO WEIRDD

Why is it like badges and cubes and whatnot

[elfin badge]

i initially thought eJPT would be worth because it'd help me get a job, but that doesn't seem to be the case in my area.

it's definitely OSCP as a minimum. I'm hoping because of my documentation and training experience and 7+ years in IT and Help desk will mean something and I can get hired and do OSCP for the job after

anything other than OSCP or PNPT at this point for pentesting seems like a waste. all other prep materials are essentially free

[wicked oxide]

I think my personal case definitely it's about 1.5++ year because I need to grow up network on LinkedIn I need get knowledge for lot CTF on thm and htb vulnhub etc I need to do lot of things qnd study lot but basically I need a cert that probably land me something

[rugged delta]

The badges are a standard on platforms like THM and HTB because it lets you see things you've achieved at a glance. The cubes thing is the stupidest concept borrowed from video game marketing. It really devalues the platform. If the training wasn't good I wouldn't have paid for it

[wicked oxide]

I personally like learn something and then put it on practice to fix it in my mind don't just like learn all of an pathway and go to other

[dense dagger]

Especially the module tiering

I would be expected to actually HAVE ALL THE MODULES for their highest tier

[wicked oxide]

You have done CPTS course? Pentester pathway?

[dense dagger]

not buy it

[rugged delta]

eJPT is eLearnSecurity's attempt to get more new pentesters into the cert track ideology cos their eCPPT needs to compete with OSCP. They were gathering steam but INE seems to have bought them just to turn them into another cert stamper and still OSCP is running away with it

[rugged delta]

I would recommend sticking with THM and doing as much as you can on both walkthroughs and challenges. As you progress, add PicoCTF (it's built by Carnegie Mellon who win the world's biggest CTFs on a regular basis) and then choose your certification path.
https://www.youtube.com/watch?v=6vj96QetfTg

[rugged delta]

Yeah I think a monthly or annual fee like they have for every other part of their platform would be a much better deal

[rugged delta]

I'm in the middle of the pentester pathway and enjoying it but not ready to do the exam, maybe in another month

[dense dagger]

Yeah, heck I’d pay $40-60/mo for full access

[worldly whale]

You don’t even need the cert tbh, if you do the cpts path on academy and then buy oscp, you’ll be fine as well

[rugged delta]

I think it's certainly worth doing the training for CPTS or PNPT in prep for OSCP but you definitely need the skills and mentality more than the cert itself. That race never ends

[wicked oxide]

Has a good Brazilian cert that provides some job offers and they said it's a good start point to OSCP methodology thinking don't know if this is the right way to describe it

But they say this and they have lot of practical lab and the last lab for you try the cert it'd a practical thing too that you will have do from scratch and report it to the course team

I think it's almost same price as PNPT (converting USD to BRL)

Little be expansive to be honest is about 595$

But that could land be a real thing here lot employers ask and accept him as a reference

Maybe one cert like that and one like oscp could be a good CV or not?

[fluid trench]

Someone told my boss I was trying to shift into Cyber Security, so now I’m training my replacement… As soon as he’s trained, I’m almost certainly being laid off, and I don’t have a job yet. Stressing tf out

[broken idol]

you've just learned a lesson? I guess.

[fluid trench]

yeah i’m fine learning a lesson, even though I didn’t tell anyone. It was my wife talking and someone overheard her

now that has the potential to screw over me, my wife, and our coming child

[elfin badge]

hopefully you can get severance? have you been there a while?

[fluid trench]

“expressed interest in leaving” can make me disqualified, as well as I’m under a year slightly

[elfin badge]

did anyone even have a talk with you about it? because sounds like they just assumed and took action...you might be able to file unemployment at the least

[elfin spruce]

Is it legal in your state to this? I know there's some states where that's not allowed from reading Reddit.

[fluid trench]

it is. We are an At Will state, allowing employee or employer to end the job without notice

[elfin spruce]

It's always worth to check your rights in this regard. And if you're laid off, chance on severance / unemployment?

Oof :/

[fluid trench]

can try, but the law here is a year before you can claim

so, really hoping some jobs get back to me 😅

[elfin spruce]

So take your time training that replacement :p

[fluid trench]

that’s my plan for now

[wicked oxide]

but you don't have interest in leaving you're just studying some thing

you can't keep stand still on same thing forever

[flat sedge]

Stay in an IT role at least 1 year. 2 years is better.
Reason is, first year is just learning how to do the job. 2nd year is finding all the edge cases that make the job tough. 3rd year is optimizing your workflow for efficiency.
If you don't stay 1 year in the role, you haven't really learned the role yet.

[elfin spruce]

Someone overheard Derek.

[fluid trench]

I gotta get into an IT role first, that’s my struggle

[fluid trench]

they actually overheard my wife telling her mom at a local fair

[elfin spruce]

A co-worker overheard that, right?

[fluid trench]

yeah

[elfin spruce]

It was probably salvagable, but the fact your employer was relatively hostile, if I heard it correctly, made it worse

I assume. Probably could've gotten away with "doing self study and trying a new field as a hobby"

[fluid trench]

yeah, but when he confronted me I kinda froze and gave it away

I’m at fault for sure, I should’ve had a defense ready

[elfin spruce]

How confrontational were they?

[fluid trench]

He went into the meeting planning to fire me on the spot

i was able to salvage my job for a bit by offering to train whoever he hired

[elfin spruce]

I'm sorry you had to go through that.

That must suck :/

[fluid trench]

yeah, so fingers crossed I hear back from something. If anyone hears of entry level openings, lmk

if it goes much longer I’m just going to have to give up on the industry for a bit

[elfin spruce]

Not that I can help too much, unfortunately. But is relocation possible? Is there any larger consultancy firm around you offering traineeships in IT?

[fluid trench]

relocation is not an option for religious purposes (long story), Ive looked local, and worldwide remote

[elfin spruce]

Worldwide remote entry level is veryyyy tough.

[fluid trench]

yeah, I’ve noticed that. 5k+ applications

just would rather take a shot at that with every other application I’ve sent in

[elfin spruce]

Do you tailor your applications? Lik somewhat tailored CV and cover letter?

[fluid trench]

Yeah, usually

Cover letter 100% of the time

CV I change if the job I’m applying to changes

[elfin spruce]

So, I always check if the job I am applying for is requesting for skills that are currently not included in my CV.
If I feel comfortable enough I make sure to add it specifically.
Cover letters are tailored, but lately with a little bit of help from regenerative AI

[wicked oxide]

Guys i live in brazil and Comptia has that Emergent market price,
Brazil are included on that emergent market?

I googled it and says brazil is one of them but i don't know if comptia accept this

[elfin spruce]

Contact their support / sales I am sure they are happy to help you out

[warm hinge]

Are SANs practice test just like the actual test?

[worldly whale]

They are similar to the actual exam yes

[stoic cave]

I think it's going to depend on the exam; mine felt quite a bit harder than the practice. I believe they say you should have an 81% on the practice exams before taking the real thing

[warm hinge]

Got it, I’m currently taking the GSEC and got 88 on the practice exam currently

[wicked oxide]

Do you think its valid i pay platinum or gold sub to start it for try the cert in the future? i'm thinking about CPTS or PNPT but its kinda hard to choose one

I'm seeing their material content to see if there is any plus on each one

but can't choose one

someone can help me with one thing? I'm trying to figure out wich one of both maybe some recruiters can accept, can i just dm them on linkedin asking or have something that i should do first (Honest question, never had this linkedin thing before)

[elfin spruce]

You can just contact recruiters and chat with them.

You can also contact hiring managers/other people from companies in your area.

I added and messaged some people telling them I am looking to switch into the field of cyber and asked them if the ycould tell me a little bit about their job activities, what they liked about it and what not. And also about their employer, to see if it's a nice place to work at.

If they decide they're not interested they will let you know or they won't accept. Which does not hurt you at all.

[rugged delta]

Well HTB Academy has a load of free entry level courses. The Information Security Foundations path is seen as a prerequisite for the CPTS and their other certs as you need an understanding of Linux/Windows/Active Directory/bash etc. They also have a module called Learning Process, which is about learning how to focus and prioritise your learning journey.

TCM has a free 15 hour hacking course, two videos which teach you a good chunk of the PNPT basics. His classes are always interesting and he gives great advice

[broken idol]

How much of PNPT streamed on Twitch?

[sweet stratus]

linkedin is like the opposite of tinder for cybersecurity. throw some good experience on your profile, indicate you're looking for work and you just get spammed by recruiters

[elfin spruce]

Make that any IT role.

[sweet stratus]

i hear SWE has had it rough lately

[fallen heron]

as far as I know that's outdated by now, but the 15 hours on youtube are up-to-date

[elfin spruce]

Depends on your experience and stack.

[broken idol]

Was it not only last year?

[fallen heron]

a lot of the course has been updated since then

[elfin spruce]

Junior (0-3): You're having it rough
Medior (3-5): Not as it used to be but still active.
Senior: you'll be spammed

Also; If you're junior Java you'll still receive more requests than when you're a Go developer or FE dev

[broken idol]

Ah, I see.

[fluid trench]

meanwhile I haven’t gotten a single recruiter reach out to me

[rugged delta]

Better off to just go searching for the roles you like and apply directly in a lot of cases, though a recruiter is someone who often has a working relationship with an employer and if you get on good terms with one of them, it can be like having someone on the inside. Though you also have to understand that a lot of recruiters are just looking at job postings, the same way you are and have no professional relationship with the employer and are merely looking for a referral bonus when you pass your probation

[sweet stratus]

specialize and you can usually skip the line

for me: reverse engineering and embedded systems is almost always in demand

[elfin spruce]

Specializations are important, but some people specialize too quickly imo.

"T-shaped" > "I-Shaped" to put it in business terms

[sweet stratus]

idk, all of the roles i've accepted were through recruiter outreach, majority of my bad interviews were in roles i applied directly to, as if they didn't even want to do the interviews

not saying theres a direct correlation as the recruiters and the hiring managers and interviewers are obv different people, just my experience

[fluid trench]

maybe you should hook me up with your recruiter

[elfin spruce]

A good recruiter cares about both parties, because if a person is for a longer time with a company they get paid more. Therefore it's important for them to also check culture fit etc.

[rugged delta]

Yeah that's fair, like I said, some recruiters have a working relationship with some employers and if they're referring you, they think they can get you into that job

[sweet stratus]

market is a bit stingy atm, but fall is traditionally when security teams do a bunch of hiring. Maybe not this year due to budgets tightening, but maybe next year or sooner

[fluid trench]

well next year is going to be harder for me

I’ll have a newborn baby distracting me

[sweet stratus]

as soon as budgets loosen a lot a bunch of teams are going to be looking to backfill those who left during this time

[elfin spruce]

I've learned that fall and winter are tougher months because budgets are relatively "done".
In january there's often a lot of new hires due to budgets being released for the next calendar year.

[sweet stratus]

fall is when i see most of my colleagues job hop for better pay

might depend on location though, i'm in the bay area in california

[fluid trench]

Riboo is Netherlands iirc

so it could be different

[elfin spruce]

I'm Dutch, yeah ;D

[wicked oxide]

Linux/Windows basics i already did on THM but obviously i don't have a problem learn something new, i pretend to try learn also the bash and shell script on THM since i already did Python basics and python for pentesters but i'll check all free resource obviously any kind of good knowladge its worth to do it

Its a good way put the things that i've done on thm on my linkedin account?

[rugged delta]

Yeah it's good you're going through those resources but at least make sure you understand all those topics well

[rugged delta]

It's good to post the certificates on your profile feed but don't count them as qualifications. They act as indicators to employers that you're studying but don't necessarily confirm that you understand the topic

[wicked oxide]

Where do i get my certs on thm?

[rugged delta]

You get certificates for completing the Learning Paths

[wicked oxide]

for example i've complete linux and windows fundamentals for that ones i don't get any right?

[soft ivy]

Do certs from tryhackme have values in job market

[fluid trench]

Not really

[soft ivy]

Anyone here willing to provide internships

[elfin spruce]

If there were any they would be on #jobs-board

[rugged sable]

Does anyone have like a quick guide (10 mins or so) to the rough idea of security compliance regulations (SOX, SOC2, NIST, PCI, ISO)

I do not need to be an expert but a very rough guide like "generally they want to make sure you have an approval process for pull requests" would be handy 😄

[stoic cave]

Aren't each of those fairly different?

Like I understand there is overlap, but for example, NIST is tailored to US agencies and their needs while ISO is international in scope

NIST is also voluntary, compared to PCI which is mandatory (not by regulation, but by industry when dealing with PCI data)

[flat sedge]

You got time to jump into a voice channel? What you're asking doesn't align exactly with what you have listed

[rugged sable]

gonna be honest i read this in a job advert i am applying for and i do not really know these well at all

[rugged sable]

i am in bed sadly

[flat sedge]

Not exactly; PCI is not regulatory, PCI is industry specific. If you want to process or store PCI data, then PCI certification means that card companies will let you pay for the means to do so

[stoic cave]

Yeah, I could have worded it better. I'll fix it

[flat sedge]

Ok, I'll be around tomorrow. I think you have some faulty assumptions about what frameworks, compliance and regulatory requirements are

I think I should be available from 8PM GMT, ping me after that when you're ready to have the convo

[covert cobalt]

Hi guys,
I know that Cybersecurity is a very big field. Are there any cybersecurity/infosecurity positions that:

-No night shift, No on-call duties (Heard most blue teams have this issue)
-No need to constantly deal with convincing Director/C-level people to enforce policy(Heard this is what GRC does? I'm not very good with talking to people especially with C-levels)
-No heavy coding(some minor scripting is fine)
-Preferably able to do it remotely after gaining a couple of years of experience

Please advise. Thanks

[dense dagger]

This all depends on the seniority of the position

Usually, the senior or head will do the convincing, not the junior

The junior just provides data and the senior validates it then the head pushes it the next meeting with directors

In my work as a security analyst, there is no heavy coding at all. Only light scripting from time to time

[stoic cave]

I'll provide my two cents:

1. It's going to depend on the org. SOCs are typically shift work and the younger/newer positions are typically the ones that man the less desirable hours.
2. Cybersecurity requires you to have soft skills and deal with people. Whether it's C-Level, your contract customer, your in-line boss and/or team lead, you're going to have to interact with them in a positive way in order to get things done.
3. It's really going to depend on the position and/or org. You should be making things to make your job easier if the environment allows
4. Again, going to depend on position and/or org. If you're doing government work, depending, you're likely not going to get much if any telework.

[flat sedge]

Agree with both responses, so far. My thought is that "heavy coding" is very different for different people; what I consider a fun hour of writing code, someone like Moose may start chewing tables and take a week or more to do. As far as GRC policy enforcement goes, that's a top down initiative and culture set by the leadership. If leadership doesn't care about enforcement, no one else will do it. If leadership does care about it, it's a cultural enforcement.
Tech writers, some DFIR, and compliance analyst roles all are mostly so-called "day shift" although depending on what the actual workload is that may be more like 8-6 instead of 9-5. Taht's pretty normal, and I have usually been willing to give an hour or two a day extra to ensure the work is timely and we didn't fall behind.

Not everyone can or is willing to do that, and that's also fine - my managers have always been really good about making sure I have comp time when I worked the extra hours.

[rugged sable]

sure, thamks!

[elfin spruce]

Just got feedback from a junior (they listed 0 exp required) position with 3 years IT experience as a dev..
"not enough experience"

[fluid trench]

😂

welcome to my last 3 months

[covert cobalt]

@dense dagger @stoic cave @flat sedge Thanks everyone for your valuable replies 🙏

[serene umbra]

Gave +1 Rep to @dense dagger

[cobalt escarp]

Let me get this straight.
He was head of cybersecurity for one of the biggest gaming companies, but he needs help finding a job?

[elfin spruce]

Sounds a little fishy

[distant pier]

Since you have not made many posts in our Discord, and your career post being quite an unusual request, I'm going to preemptively remove it for now. @karmic hare

[karmic hare]

That’s okay Tim. If you need any proof just DM and I can provide you all the info needed

[fluid trench]

Us being a hacking server, we’ve just gotta be careful with suspicious requests 🙂

[karmic hare]

I think I should help him because I have a strong professional relationship with him

[white bolt]

Can I get some interview tips?
I have a pre-interview. It's a video recording pre-screen that the hiring manager sends out to selected individuals. It gives 5 random questions along the lines of "When confronted with a problem that requires quick decision making, how did you approach it?"

Each question you have to record a video of yourself answering it, the video has to be 2-3 minutes long per question and you have 60 seconds to think of an answer for each one

And once you finish all the questions and the 2 memory games at the end, an AI will review each question/video answer and score you, scores of 80-100 get auto pushed through to the manager, scores of 70 or bellow need to be manually pushed through

And the position has been open for months because the hiring manager has refused every candidate due to: Not having enough energy in the videos, Not enough detail/too short of an answer, failed the simple memory games, showing little to no expression or emotion in the video answers, and much much more

Oh and you're not allowed to have headphones or earbuds in during the video pre-screen and you're judged if you look online for help

[rugged delta]

I'd ask for the manager's version of the videos that show the exact way they want the questions answered, with enthusiasm

[fallen heron]

that doesn't sound like a place I'd like to work at tbh

[rugged delta]

Also, in the EU, the GDPR allows you to request that your interview process isn't reviewed by an automated service

[white bolt]

The manager won't give them, they want to see people at who they really are without knowing what they're going to be faced with

This is also the US and if you refuse AI grading then your application will be refused

[rugged delta]

The manager sounds like an awfully nitpicky micromanager I wouldn't want to work with

[white bolt]

It's an extremely competitive position for a company that has the highest ratings I've ever seen and they're atmosphere is compared to googles laid back/relaxed and supportive atmosphere

[rugged delta]

Unless he's paying over $150k I wouldn't be bothered with a process like that

[white bolt]

Well, they're paying 50k a year and this is a starting base level position

[dense dagger]

Not worth it tbh

[flat sedge]

I would absolutely laugh in that managers face if they tell me that's the process

[white bolt]

So I'm doing it either way because I need to work to live and passing this opportunity would give me a life-long career, despite the start not being the absolute best

[flat sedge]

I wouldn't be willing to do that for $200k, AI is not going to understand context

[white bolt]

This position by the way, is a help desk analyst/smart bar analyst

So, it's basically the lowest... position

[dense dagger]

I can't really think of any interview tips for this

[rugged delta]

You should do an AWS Solutions Architect Associate exam and get a high paying job right away. For Solutions Architect Pro you can be looking at $150k to well over 200k... You'd do those in a couple months

[stoic cave]

Yeah, that's a no from me

They're either training their AI model or they're looking for a "unicorn"

[rugged delta]

Exactly. The fact they haven't hired anyone in months for a junior position stinks of dodgy dealings

[dense dagger]

Yeah, this type of position should be filled up quickly. Senior positions would take more time to be filled out than help desk positions.

[white bolt]

I do need a job basically within the next 3 weeks or I'll be evicted and out of the over 50 jobs applications I've sent out I've had 8 interviews and I have 3 second round interviews done for 3 companies who are not guaranteed and 2 of which said I had too much experience listed on my resume

[rugged delta]

I'd ask them directly why they haven't filled such a position, and it can't be because the manager doesn't like how every candidate expresses themselves on video...

[white bolt]

So, I'm willing to do this to avoid homelessness

[rugged delta]

It's not a casting call for a Spielberg movie

[white bolt]

An AWS test that takes a few months to do, is a little out of my time-frame

Maybe once I get hired

Oh and this is also the only manager who uses this AI service and the only one who interviews this way

[dense dagger]

Can’t really think of any interview tips against AI services

[white bolt]

I looked up interviews from executive positions to analyst positions and none of them say anything about this process

And all the interviews I looked up, are for this company

[rugged delta]

That sounds really sketchy. You should ask to speak to their hr department about the non-standard processes and things you've heard... Most decent companies have a standard hiring process, 2-3 interviews, maybe a video interview over Teams or Skype or something

[stoic cave]

Idk what your exact situation is, but there are other jobs that are immediately hiring outside of the cybersecurity space. You could use those as a stopgap while looking for a role

[rugged delta]

I know for a lot of positions, Google has 7 interviews

[dense dagger]

Yeah, I agree with Moose. One could speculate they are training their AI

[white bolt]

This is one of the jobs, but if I can get a link to jobs immediately hiring then I'll take it

[stoic cave]

Putting this limit on yourself isn't a good thing

[flat sedge]

That's google, definitely not standard

[stoic cave]

It's making you consider a role, that everyone has said isn't a good thing

[rugged delta]

Yeah totally, most would be 2-3. Google isn't a normal place to work, according to everyone I know who's worked there

[stoic cave]

It's going to suck, but FedEx is always hiring package handlers.

The hours suck, the work sucks, but the pay is actually decent

[white bolt]

The only limit I put on myself is "Staying in tech"

[stoic cave]

When you're looking down the barrel of homelessness, that shouldn't be in the criteria

[white bolt]

I've been unfortunately job hunting for 3, almost 4 months now

And I've been applying to basic level IT positions just to get a job

Most of them don't even respond or answer follow up calls/messages

[rugged delta]

Take anything you can get and then plug away at getting an IT position

[white bolt]

I've also had a couple scams

[stoic cave]

You need to "stop the bleeding" so to say

[sleek sedge]

apart from it obviously being FAANG, whats the major differences?

[fallen heron]

it sounds like you're depending on getting a job that no one's been hired for in months

[stoic cave]

Even if it means taking a position outside of tech

A job, any job, at this point is your clotting agent

[white bolt]

This is true but where should I look for jobs that are hiring immediately?

[stoic cave]

Target, Walmart, FedEx, any restaurant, etc etc

[dense dagger]

Construction also if you can do physical work

[white bolt]

I've applied for think geek positions paying $15 an hour, they even asked me why I was applying there because I'm over qualified, and I ended up not getting the job

[stoic cave]

I can 99% guarantee FedEx is hiring

[rugged delta]

The whole culture, the work and productivity thing, they pioneered a lot of the things the rest of the tech industry only caught up on years later. They decided in the 90s that all their processes were going to be run on distributed containers and developed a system to do this called Borg. Borg led to the development and release of what we know and love as Kubernetes years later. They came up with Site Reliability Engineering years before DevOps was a thing.

Innovation in that place for all kinds of things was crazy. Not that their general business wasn't just about being marketers for just about anything, based off of data hoarding but I know lots of people who worked there long term who found it mostly a great place to work

[dense dagger]

i like the free lunch and food when i watch "day in a life" videos

top tier

[stoic cave]

Can't forget the grandad, chroot

[rugged delta]

Yeah that would be a great benefit, like literally any time you want. Most large orgs these days at least provide a subsidised menu, the occasional night on the beer and an occasional pizza party

[dense dagger]

i think my biggest factor when looking for jobs is if its remote or not

the time i lose in commutes range from 5-6 hours every day

[rugged delta]

I would prefer plenty of remote work. Commuting is dumb and expensive, especially if it's not practical. Companies are renting huge offices though and they want people in seats. Office parks are the High Street of the business world though. The internet has provided a more practical solution

In my last job, my work desktop was a virtual machine on a server in the US and my work laptop was a very basic machine with a VPN program. I don't need to go to the office to use that

[flat sedge]

One of my cousins was a dev and PM for google, her experiences changed drastically from when she started to when she left

[dense dagger]

I agree, the commute itself is not expensive (unless you are travelling by private car or Uber whatnot), its the stupidly expensive stuff around the office

[rugged delta]

I have no doubt things swung in plenty of different directions and it's not as rosy as it's often portrayed

[dense dagger]

What security work is required to be physical

[flat sedge]

her husband was a chef in the execute cafeteria, his experience was absolutely terrible

[dense dagger]

I can think of maybe... auditing data centers?

[rugged delta]

I'm much happier in my home office with my own food and water and a bit of quiet

[rugged delta]

Wow that's awful! I'd hate to work in a place that made me feel that way

[white bolt]

Apparently the pre-interview screening is being done by Hirevue before it gets pushed to the hiring manager

And the company I'm applying to, isn't Hirevue

[rugged delta]

So why hasn't the hiring company picked someone, apart from not liking how uncomfortable they look being surveilled by Skynet?

[white bolt]

I have no idea

This is through a hiring agency as well, so if they don't know, I don't know unfortuneately

[rugged delta]

That sounds like a company propped up to invent a problem that didn't exist before

[white bolt]

And the company I'm applying to through this company, hasn't responded to any of my attempts to reach out

They're an analytics company, think data scientists and such

And I may as well do this and give it my best, I have the interview screening link so not doing it would be more of a hinderance than doing it

[rugged delta]

Well data scientists don't need to do that kind of work. HR are alreadyincompetent enough to mismanage a company's staff turnover

You should do it but if you don't get the job, tell them you want your data returned to you and deleted from their systems and a letter from them stating that was done

[white bolt]

That's fair, although I don't know what I'd do if they just said "no"

[rugged delta]

Declare copyright ownership and threaten to take complete ownership of the platform and ongoing royalties in perpetuity

[white bolt]

That.... Sounds a little uhmm

[rugged delta]

First, get a job in a pizza place or delivering packages. Not with Amazon though

[white bolt]

A bit much, I also don't know if I can claim copyright ownership without a registered claim

Even if it is of myself, as it was my choice to take the pre-screen

[rugged delta]

If you created it you automatically own it

[dense dagger]

I think you should read the terms and conditions, privacy policy, data policy, etc. of the company

not lawyer advice tho

[stoic cave]

I'm going to guess that by accepting the interview and using the platform, you're consenting to you being recorded and the data gathered.

They also aren't creating anything, they are using service created by a company and their platform is creating the content

[rugged delta]

They're specifically asking him to create and submit the videos. Copyright law trumps a contract in this case, contracts aren't above the law. In the same way YouTube doesn't own its content, except what it creates; and as a US judge declared recently, the output of an AI doesn't have copyright protection (creative works can only be produced by a person); so I don't think the creators of this tool can claim copyright ownership of their content.

If you write a poem, you own the copyright of that poem automatically. You register a work under copyright with a government authority in order to ensure protection of your work, but the work is yours, unequivocally. There are things that can't be copyrighted, like recipes and some other things (which is why you always see recipe books and websites full of stories and pictures) but you can protect things like trade secrets, designs, books, etc. The documents themselves are automatically copyrighted (unofficially or not) but many things can also then be trademarked (like Big Macs in the EU aren't) or patented, once they demonstrate a certain level of complexity and uniqueness. (I'm only qualified to speak on this to the extent of my cybersec postgrad module but you'd need a lawyer to square it with the proper authorities)

[river scaffold]

What is PNPT?

[rugged delta]

PNPT is a penetration testing certification produced by TCM Security. It's intended to teach you ethical hacking and penetration testing through their course and exam process

https://certifications.tcm-sec.com/

[river scaffold]

Thank you for this, I will check the attached link, I just joined this discord through TryHackMe to develop my Cyber Security skill. Hopefully I can come across company recruiting for entry role.

[serene umbra]

Gave +1 Rep to @rugged delta

[rugged delta]

We're happy to discuss how to progress, the skills you need to develop, the resources that can benefit you, certifications you might benefit from. PNPT has a growing reputation but isn't widely recognised yet by a lot of recruiters. Similarly the HTB CPTS, Zero-Point's CRTO and others at a similar price point; gaining traction among learners but not yet by employers to a great extent. OffSec's OSCP is more widely recognised but is also increasingly expensive.

Unless you're focused on pentesting as a way of life, you shouldn't be considering it as a job just yet. You have a long road to get there, requiring many hours learning a variety of technologies, tools, techniques and processes. Keep practicing on THM and growing your skills as you go. You can verify your account through the below link if you want to

!docs verify

[dire rivet]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/en/articles/6495858-discord

From TryHackMe with ❤!

[river scaffold]

I just completed 16 weeks boot camps, pass my CompTIA Security plus and ISO27001. I have THM account which is helpful. Thank you for the info.

[serene umbra]

Gave +1 Rep to @rugged delta

[rugged delta]

Cool, keep plugging away and best of luck

[river scaffold]

Thank you

[elfin spruce]

Do you have any IT experience? Working helpdesk, (professional) development etc

[river scaffold]

Yes please

[river scaffold]

Service Desk

[south monolith]

Woow crazy congratulations

[river scaffold]

Thank you mate

[serene umbra]

Gave +1 Rep to @south monolith

[mystic lava]

@river scaffold where are you based ?

[tender mountain]

What are good internship positions to get experience in infosec whilst planning to move forward to pentest/redteam?

[stoic cave]

So, I have read your response but I am not at a computer to effectively respond. I will do so when i am able. I went back to the original question and their explanation neither confirms they're uploading videos they recorded themselves nor does it confirm that a platform is recording them.

[rugged delta]

This is the initial post on which the discussion was generated #cyber-and-careers message
It details that it is a video recording prescreen the participant has to record of themselves and that an AI will be used to interpret the responses. I look forward to your insights

[stoic cave]

Yep, that's the message I went back to

[pseudo creek]

pentesting internship would be great but really.... no internship < any IT internship < any cyber internship

[fluid trench]

that’s how I feel for a job rn. Even helpdesk will get me there better than my current job

[urban zephyr]

Hi, I’m new to cyber security
I just need a friend to put me through 🤨

[fluid trench]

don’t gotta send it 20x

[sturdy scarab]

Hi guys, can I please have some feedback on this? I'm going to start applying for graduate roles soon. what should I change

[tender mountain]

Wheres the line for IT and cyber internship?

[fluid trench]

what jumps out at me most is the “built a SIEM…”

almost feel like you should use the bold as a title, like “Custom SIEM made in Azure”

[elfin spruce]

So what I immediately see is that you mention webdev and secure software development but you don't have the projects or work experience that backs that up.

Everything you put on your CV should be 'proven'

[sturdy scarab]

That was done in uni

[elfin spruce]

Check :) If it's in the official curriculum you're fine on that regard then. Just double checking with you

[pseudo creek]

one includes cyber responsibilities as a major component of the job and the other doesn't

[tender mountain]

Ah okay, I'll look out for the responsibilities and not just the job titles, thx man

[serene umbra]

Gave +1 Rep to @pseudo creek

[river scaffold]

Based in UK

[mystic lava]

Get on Linkedin , a major skill gap in the UK currently , tons of vacancies to be filled ,you'll get something 👍

[river scaffold]

Thank you, I am already in Linkedin.

[serene umbra]

Gave +1 Rep to @mystic lava

[stoic cave]

Sorry it took so long, finally got a computer. The view I am looking through is that they are using a web portal provided by the company to complete the interview.

As always, IANAL.

I'll start with what is not copywriteable:

Copyright does not protect ideas, concepts, systems, or methods of doing something - Copywrite.gov

The next thing would be what does the terms of the interview say? Anywhere in the EULA/TOS/etc does it say that the copywrite is transfered? Here is current guidance, not legal precendent or law, from the Copywrite Office as well:

The U.S. Copyright Office will assume that the interviewer and the interviewee own the copyright in their respective questions and responses unless (i) the work is claimed as a joint work, (ii) the applicant provides a transfer statement indicating that the interviewer or the interviewee transferred his or her rights to the copyright claimant, or (iii) the applicant indicates that the interview was created or commissioned as a work made for hire. 

After that, we do have legal precedent set by organizations conducting interviews for publication, which sided with the Interviewer. I have listed a couple of cases, each with varying outcomes:

Rosemont Enterprises v. Random House (1966), Quinto v. Legal Times (1981), and Taggert v. WMAQ Channel 5, Chicago (2000)

Taggert specifically stated that the interviewees quotations were not subject to copywrite because they were not "expression", but ideas. I am also not going to delve into State Law, because that opens another set of worms.

At this point in time, my current assessment (couple of hours reading) on the matter is that the interviewing organization would hold the copywrite to the interview. Here is why:

1. The platform in which the interview takes place (assumption). For this counterpoint, it is being assumed on my part that the interview is being conducted on a web portal owned by the company. Personal annecdote, I have used one of these platforms before and the platform does all the work. It provides the questions and also makes the recordings. Using a platform like this also comes with a TOS and there could a section on copywrite written in.

2. The questions generated by the company for the interview are copywrite of the company.

3. In this case, I am not sure the interviewees responses would be condsidered "expression." If they were, at a minimum they may be able to claim copywrite via the dual approach. However, in my personal opinion, responses to generic technical interview questions would not be "expression", but "idea" and or "methods of doing something."

4. At least from the information presented, AI is not being used in the direct interview, but in the analyzation of the data. This removes the "you can't copywrite AI stuff" from the cards.

This is all I have for now, spent way more time than I expected. Will probably dig in to this more later because it was kind of fun doing the research.

Dammit, forgot to fill out 1. Give me a minute. Fixed

[rugged delta]

Excellent points. The hiring manager did make boundless claims to a lack of expression by other interviewees, as in, their performance was not up to standard. It may well be the case that the platform has certain caveats and terms favouring the interviewing org and/or the system creators. It still sounds like the intention is to get data to train the AI, rather than hire someone to do what appears to be a junior position they're having trouble filling. Based on the remarks of the hiring manager and a lack of evidence of attempting to hire someone for a position, it looks like they're trying to get free labour to produce performant data to train an AI application, and therefore, they're misleading the performers and stealing their works (which are defined as works of performance by their remarks on such)

[stoic cave]

I just want to clarify, I'm using expression here in the legal context and not the "you're not being expressive" meaning

[elfin spruce]

would you mind reposting a screenshot or screenshots?

[sleek sedge]

@lean cradle you sure you are comfortable with posting your phone number + email?

[lean cradle]

Sorry

IT was a mistake

[sleek sedge]

no problem, I posted a screenshot of the rest of it for you

[fluid trench]

I was about to comment on the CCNA cybrary, then I realized it said coursework, not certifications

[elfin spruce]

Did you have any internships?
If this is an international CV for remote work or work outside of Egypt. Whats "good" behind your education?
What year did you start?

There's a * at experience that's blank.

I'd much rather see the skills, relevant courses and projects you've had at university over free / paid courses on Coursera and Cybrary.
Your bachelor gives you a good baseline, stronger than listing free courses or coursera courses (or Udemy for the matter)

Free courses and free certifications (like LinkedIn) show that you're interested in your field but nothing more. It does not add a lot of business value.

Are you familliar with ALL skills you're listing and can you talk for 5 minutes or longer about ALL of them. Use cases, when not to use, downsides etc?

Make sure to have proper capitalization. You write "Junior cybersecurity Engineer" and "Cybersecurity Engineer" in the same line. Also SIEM instead of Siem and problem solving without the -.

What's the difference between eJPTV2 and eJPT, it's the same but updated right? What does your certificate list? eJPT or eJPTV2?

[fluid trench]

eJPTv2 is the name of the newer certification

with updated material

[elfin spruce]

Gotcha :) Just making sure.

[fluid trench]

that is good as it is listed

[elfin spruce]

And if you want to be more nitpicky; List your proficiency with your languages. Not just Arab, English. Arab (native), English (Proficient or Fluent)

[lean cradle]

Thanks bro

[flat sedge]

This coursework section is not.... good. "Coursework" without an accompanying degree or accreditation is pretty worthless. As you've listed these, it's basically a participation ribbon: might be pretty, but has no weight.

[elfin spruce]

I tried to say that a little bit less direct :p

[sturdy scarab]

can I please get feedback on this

[elfin spruce]

How proficient are you with all of these technical skills? Can a technical person ask you about any of these skills where you are comfortable explaining in detail what they do and why they perhaps should not be used in some cases?
There's a , at the end of the last skill.
List CompTIA Network+ with the "proper" name.

And List AD as a skill since you've mentioned it quite a few times.

[lean cradle]

Okay

[hollow drift]

If I've gone through the training for a certification but haven't actually tested for it, do I include it in my resume

[stoic cave]

Personally, I would not. Things can always happen and you haven't passed yet, so you haven't earned the title

[worldly whale]

Unless it’s a sans course without cert I guess

[stoic cave]

Right, but that's different. They're asking if they can put the certification on their resume before they pass or even sit for the exam

[hollow drift]

That's fair, I want to somehow demonstrate that I have the knowledge attributed for them but right now getting the certs wouldn't make any sense for me

[worldly whale]

Ah yeah don’t do that

[worldly whale]

You can demonstrate it by passing the cert, or pray you get an interview and show it there, or post blogs I guess

[elfin spruce]

It's weird seeing CEH a lot more in the Netherlands as a requirement. But it's listed in the same list as OSCP and OSCP is fair bit harder right?

[dense dagger]

CEH is multiple exam with the option to get CEH Practical which is an 8 hr (?) CTF which gives you the title of CEH Master

Which is fairly stupid considering CEH is their entry level cert

But yeah, what you are saying is correct. I just wanted to rant about CEH

[elfin spruce]

Gotcha.

[thin oasis]

Hey There All 🤗
I'm new here and wanted to be An Ethical Hacker. I need guidance in starting my CyberSec career.

[elfin spruce]

#start-here

[worldly whale]

It’s listed, but to my knowledge oscp is more valued

[vague apex]

in your professional opinions, what holds more value: cybersecurity certificates (Sec+,CISSP,etc) or a cybersecurity degree?

I currently have a BS in Computer Info Systems and have been a cybersecurity analyst for abt a year. Im debating on going back to school for an associate or masters in cybersecurity, or continue to study for the Sec+ or other security certs.

[dense dagger]

If you are already in the industry, I'd say focus on certifications.

[elfin spruce]

experience will even out with university pretty soon if not make you grow faster. if you're in the industry focus on certifications.

[vague apex]

Okay, thank you!

[sand terrace]

are there any free threat intelligence courses with labs

[sturdy scarab]

what shuld I change

[late raptor]

every now and then i'm looking for cyber security jobs in germany (pen tester, but really looking for everything) but i can't seem to find any junior positions. I'm currently a software developer. any tips on where to look/how to find anything in germany?

[broken idol]

LinkedIn?

[elfin spruce]

Are you in contact with recruiters on LinkedIn? Also junior positions are very hard to get at the moment. I'm in the same boat in the Netherlands. Also a software dev switching :)

[light dove]

Good LinkedIn tip. Find the companies you want to work for. Go to their about page and scroll down to ‘I’m interested’ and select it that alerts their recruiters that you’re interested in working for them without reaching out to dozens of their internal recruiters hit and miss. Also optimise your profile with relevant keywords and a good summary. Don’t spray and pray be more selective 👍🏼

[vestal egret]

Would putting a few of my retail experiences on my cv be a good thing. some jobs do ask for it and shows i know how to deal with any customers

[late raptor]

i dont have a linkedin. not a huge fan. but i might need to create one :/ then i need to get professional photos done

[elfin spruce]

I'm not a fan of LinkedIn either. But for business practices it's standard nowadays for anything "higher education".

[elfin spruce]

If you have no IT experience, definitely put it on your CV.
When I was looking for my first and 2nd dev job I'd put my experience working in restaurants on there.

[vestal egret]

I have 10 months experience in ai but when i worked at tesco i gained some leadership skills so was wondering if that would be good to put

[elfin spruce]

Definitely good to put it on there.

[waxen hearth]

Any IT Risk Analysts in here? What do you do?

[burnt sonnet]

Anyone have advice on how to get a cyber security job? I have 5+ years of IT systems engineer experience, 2 years of Incident response / general cyber security experience too. I've been applying my face off all over linkedIn and directly on websites and I am getting nothing but denials ( no reasons given). Any help will be appreciated! ty!

[worthy shoal]

Could be you are over qualified for what you are applying to as you do seem to have quite a lot of experience. It could also be a bad resume or just a resume that is not good at getting through automatic filters

[fallen heron]

Best to post your resume with redacted PII for feedback

[tender mountain]

What does iso 27001 certified mean?

[warm hinge]

In summary, that the company has established and maintains the requirements set forth in the ISO/IEC 27001. Which means that they have implemented security controls and procedures to ensure CIA (confidentiality, integrity, and availability).

[fluid trench]

misread the question, sorry

I wasn’t trying to be a jackass

[stoic cave]

If you post it as an image, you'll get more responses

People don't want to download things from a hacking server, even if it's ethical

[burnt sonnet]

gotchya, and thanks for the tip!

[serene umbra]

Gave +1 Rep to @stoic cave

[tender mountain]

Ah okay thanks so its not like a certification a person can have right?

[serene umbra]

Gave +1 Rep to @green quiver

[stoic cave]

Starting at the top:

This is personal preference on my part, but I don't like paragraphs in resumes. Others disagree here, but imo, that is what a cover letter is for.

If the IR position is your current role, put present and not the year. 2022-present

I would drop down to 3 bullets for each job unless you really really think you have a greatest hit at that position that would add to the resume.

Right hand justify the dates on the same line as the company name.

Say what your degrees were in education.

Go side to side with your skills and separate them out into programming/technical/etc

Soft skills don't belong in skills. Every skill you list make sure you can talk, in detail, to every item for 20 minutes or more. SOC Engineer and Helpdesk are roles, not skills

[warm hinge]

Correct, it's for businesses to show they meet those standards set forth. I have not looked into certs for it, most of what I've came across is auditor certs that cover it. I believe there are some places that provide just ISO 27/31k training though. For GRC/auditing I could see it being vital.

[tender mountain]

I see, thank you

[serene umbra]

Gave +1 Rep to @green quiver

[elfin spruce]

Honestly, waaay too much text. Look for a more modern template, those work wonders.

And what kind of jobs have you been applying to? I think that's also pretty important.

Switching fields means often a cut in salary. Even if there's plenty of overlap.

[pseudo wing]

Do internships generally have you work towards a certificate?

[fluid trench]

they may, it really depends. I’ve seen one that gets you certified specifically in something Microsoft Support, but it just depends on the company and the internship

[stoic cave]

Internships are a trial run for you and the company, doing actual work. If they're having you do certificates, I would have questions. Same for certifications, unless they're having you do the certification alongside regular work duties

[pseudo wing]

I saw one that's just mostly certificate work and a bit of the actual work duties, i'm considering applying for one but i'm having doubts

Its this one btw https://www.megt.com.au/jobs/rms/jo000076294-0

[austere fractal]

@mystic lava We don't do such inquiries here 🙂 So please refrain from that.

[mystic lava]

Where can I post it then ? 😂

[fluid trench]

Not in the server

[mystic lava]

It's a legitimate Career proposal ...

[fluid trench]

Because there’s no accountability, no proof of a legit proposal, and kinda sketchy

Sketchy as in, not an official job posting

[mystic lava]

If you say so ... Upwork is a legitimate freelance platform and I got a publicly visible profile there where you can see all the projects I finished and my earnings ..

[flat sedge]

You are better off just pinging a mod.

[flat sedge]

If it's legit career opportunity and not hustle culture bullshit, you can talk to @distant pier about verifying your corporate email account to post in #jobs-board

[mystic lava]

Thanks mate 👍

[serene umbra]

Gave +1 Rep to @flat sedge

[sturdy scarab]

can I please have some feedback on this? applying for graduate positions, ideally in cyber sec

[elfin spruce]

Try more modern approach to your resume. This is wayyy too much text

Hiring managers and recruiters don't want to spend more than 2 minutes looking at your resume these days

https://www.canva.com/templates/?query=resume for example @sturdy scarab

[sturdy scarab]

im sorry but you are the first person ever to say its too much text

its the bare minimum

1 page

[elfin spruce]

I had way less text than you and I had multiple recruiters give me a tip to use less text ;p

[gleaming nexus]

Hey guys, I wanted to share something with you all. After spending a considerable amount of time in TryHackMe and Hack the box, I tried to do bug Bounty. It seems that this is an incredibly difficult gig to execute, or am I just lacking methodology or knowledge?. I don't know how many times I will fail in submitting my first valid bug. I want to know your stories if you ever did bug bounties, what was your first experience like. I totally don't think I am the only one struggling. Any feedback and stories are appreciated.

[rugged delta]

You should check out the #bug-bounty channel, but yes, bug bounties are going to be challenging, since you are performing a penetration test in a public environment usually. Bug bounties can be an educational experience, but you must make sure to stick to the scope. There are a lot of bug bounty programs you can join, through the likes of HackerOne and Bugcrowd and others. You'll need to work hard to get your standards up, don't consider bug bounties a reliable source of income, at least until you're familiar with them, just use them to learn more effective web pentesting skills

[gleaming nexus]

👍🏼

[gleaming nexus]

I just get demotivated when I see the app behind cloudflare and akamai, it's like a dead end to me, can't think straight after seeing them

[sleek sedge]

cloudflare isn't going to stop a logic bypass

[undone shore]

I would disagree. Formatting looks good to me.
Rule of thumb is that they won't look past the first third of the page. Seven seconds or so is your average time available to hook them before they discard.
You definitely need to consider design and how the document flows (I.e. you want to force them to use those 7 seconds on things you want them to see), but the whole point of a CV is to convey information, albeit succinctly.
A page of text is good. Mine is a page and a half, and has got me every job I've applied to so far (four and counting).

Although in that specific case I would say that the section order is wrong. Education below experience, missing a profile at the top, and I've never been a fan of "skills" as a section personally (although opinions differ there).

Also not a fan of how wordy a lot of the bullet points are (or the long form for the projects, ew). Make every word count. Lots of words, fine, but only if they're actually making a point. Space on a CV is at a premium. Don't be flowery.

cc @sturdy scarab

[sturdy scarab]

thank you very much, I'll make some changes

[rugged sable]

looking for conferences happening in Q1 next year.

this is very much a case of “i am looking to basically go on holiday”

any suggestions?

[flat sedge]

Zero Trust World looks like it might have some interesting talks

[quick forum]

Education below experience if the experience is more relevant

[undone shore]

Indeed, which in this case I would say it is

[static tide]

december 2021

ya donut

[undone shore]

2020 actually

[static tide]

oh ye

[undone shore]

God I need to rebuild this blog

[midnight oyster]

Hi everyone
I'm 22 years old and have 3 years of experience (and counting) as an IT support specialist. I'm currently studying Computer Science in a university and I'm thinking about dropping out and doing certs instead.
I'd love to hear your opinions if it's a good idea or not.

Pentesting sounds like something I'd like to do and I'm already looking into certs in the cybersecurity field.
It may sound lazy, but I just feel like my studies take too much of my time for things I couldn't care less about, I'm a technological person but I'm not really into programming and can't stand math. Besides, when looking at people around me in my current job, a lot of them only have certs and they're doing fine. Even my department manager.
However since cybersecurity is different from IT support I don't know if certs would be enough for that.

[dense dagger]

What year are you in?

[midnight oyster]

Finished my first year a few months ago

[elfin spruce]

If you have the possibility of growing into an info sec role at your workplace and have your employer to pay for your certificates that's amazing.
However, it's tough to break into the field with certificates alone. Either previous work experience at higher education equivalent ability or a degree is necessary.

[glossy dock]

Hey guys, what do you think of this?

https://youtube.com/shorts/Kqapw1ggc2Q?si=lHA4tA7m8M9VaJjP

[stoic cave]

Not sure what to think, but I would lean towards that not actually being an internship

Or in anyway a replacement for professional experience

[fluid trench]

just stuff to add to the project section at most

I feel accounts like this want to give spoon-fed type answers, without them being viable. If people get hired with their advice, they lose their audience

just my view on the whole thing

[glossy dock]

@stoic cave @fluid trench thanks for your input

[serene umbra]

Gave +1 Rep to @stoic cave

[elfin spruce]

There's just no way it can cater let's say 1k people with personal guidance.
It's a virtual internship, a simulation as they put it. There's no way you can use this s as actual experience.

[lofty elm]

Hey guys I have a question. I want to be a red teamer. I'm doing Jnr penetration tester path. But I'm having trouble grasping the full concept. So can I do security engineer and coc path first practice it a little then come back to penetration path.

What I'm trying to ask is that can I become a red teamer later by first learning blue team

[dense dagger]

Yes, there are blue teamers that also pivot to red teaming

Its possible. There are even jobs that specifically look for people that have had prior blue team experience for their red teams

[lofty elm]

Would there be any discrimination. Like most red teamer start with red team directly. And will I still be able to do oscp

[dense dagger]

That depends. There are jobs which will ask you to get OSCP while working under them or would require it (or other relevant certs) as a prerequisite before hiring you.

I don’t think there would be any discrimination.

When I do say red team, what I mean here is jobs under red team so that also includes pentesting.

[toxic gull]

Oh my God! This is HUGE! Is this Forage Plattform new? This is exactly what students/young professionals need in the early career or for a career switch. Thanks a lot!

[serene umbra]

Gave +1 Rep to @elfin spruce

[elfin spruce]

I don't think it is :)

[toxic gull]

What do you think are the downsides? I like that it offers practical experience with tasks straight from the industry.

[elfin spruce]

It's just as practical as THM arguably.
The major red flag is that they offer it as a virtual internship, yet there's no personal contact between you and company. Which is impossible since thousands of people can do the simulation.
Hell, you can't even be sure it's actually from companies like PwC.

So in the end it's just a simulation of possible cases you can face whilst working in the field.

Which you cant even fact check.

[undone shore]

Many people come to pentesting and red teaming through blue team. It's one of the most common career progressions in the industry from what I've seen.
So no discrimination -- quite the reverse, it will probably work in your favour.

There are no job restrictions for offsec certs either

[faint ice]

shadow wanna keep the red teaming as a hobby and do blue teaming as a job

dunno how possible and achieveable that is but eh

[undone shore]

I would suggest you don't do red teaming as a hobby. Something something rules of engagement something something prison time.

[faint ice]

ah... meant it as doing ctfs on tryhackme that are more focused on a redteaming or pentesting approach

worded that porly above

[undone shore]

Good luck with that. I can think of very few that are useful for pentesting, and even fewer that are useful for red teaming lmao

Techniques, sure

[faint ice]

fair

[flat sedge]

I can't even imagine what a CTF would like that that wanted an actual red team skillset

closest might be something like the social engineering village contests

[faint ice]

hmmm closest shadow can think of is red team capstone

if we are going by the ones shadow has done

[undone shore]

Right?
It's pretty much impossible to get the scale of the environment right, let alone the thousands of moving parts that make the exercise worth doing in the first place.

[fluid trench]

The only thing I can think of would involve manual answer checking, like they have to write a report and it get graded

maybe asking them to find vulnerabilities and grade them based on CVSS

[undone shore]

That would be as well being a pentest

[fluid trench]

oh shoot y’all said red team. I was thinking pentest for some reason

yeah Idk honestly

unless you had paid actors pretending to be a company for the purpose of a challenge lol

make it a paid and scheduled CTF haha

[coral vault]

If you are Dutch the government has a permanent RD

[flat sedge]

And, how would flags be gathered? Unlocked files at specific time intervals, assuming the connection hasn't been killed by the automated blue team defenders?

[sleek sedge]

right am I seeing things or does Muiris pfp keep switching between a butterfly and his usual one

[flat sedge]

I think it's just you

#hashtagnotgaslighting

[undone shore]

I mean, you'd probably need to go with the data exfiltration end goal, or possibly do it off event logs, if you wanted it to be vaguely realistic

[flat sedge]

Maybe; I think it depends on who the CTF is actually for. Is it for infra? Is it for monitoring? In my mind, red team is about emulation of a real threat. So evasion, persistence and pivoting ought to be the key skills. Contrast to pentest where the goal is validation of specific functional controls

[undone shore]

iirc the way the red team capstone challenge did it was clever

[flat sedge]

I haven't done that one yet

[undone shore]

Neither have I, but I read through the info on the flag system

[flat sedge]

Been busy doing nothing on vacation and sort of studying for CRTO and CSSLP

[sleek sedge]

twas a very good system

[undone shore]

TL;DR: once you pivot, connect back to a validation machine to prove that you did it

[fluid trench]

I’d like to do it, I have a business email, but it’s for a non profit org, so not sure they can afford business accounts lol

[flat sedge]

That's an interesting thought; that flags are granted by the C2

[undone shore]

Oooh, yeah, that's an idea as well

Personally I would like to see them granted by the EDR lmao

[flat sedge]

'your beacon from target 1 checked in, here's a flag.'

[undone shore]

Aye, absolutely

[flat sedge]

If the EDR grants the flag, doesn't that mean it's a red team failure?

[undone shore]

Yeah, was about to say, there's an issue with that one...

[flat sedge]

kek

[fluid trench]

What is the Canvas RTO exam consist of? is it practical? Maybe the CTF could resemble that in a way

[undone shore]

Having said which, doing it with the beacons and an outbound proxy could be very cool.

[flat sedge]

if you want to collab on a room like that muiri, let me know. I'm pretty new to red team but I think it would be valuable

assuming you aren't already so underwater that you don't have time

(also i will be away next week)

[undone shore]

Target system makes connection to X IP == owner of IP gets an automatic flag

[fluid trench]

https://badgr.com/public/badges/TgH86o9zQsSqDOJ5MLREIQ

[flat sedge]

Hmm. Hmmmmmmmm.

[undone shore]

Yeah, I'm pretty swamped I'm afraid, but will definitely keep that in mind 😁

[fluid trench]

I wonder how this practical exam does it

[sleek sedge]

If the whole CTF was a shared instance, what would be in place to stop the target system connecting to multiple IPs to get the flag for each of them?

[undone shore]

AD network with literal flags needing submitted.
It's a good AD / C2 challenge, but nothing like a red team op in terms of scale or environment. Not ZPS fault -- it would be virtually impossible to do that.

[fluid trench]

Ah, that sucks. Yeah, I see the issue there

[undone shore]

What, like one person compromising the machine and unlocking the flags for everyone else?

[sleek sedge]

yeah

[undone shore]

Nada... exactly the same as the protections against flag sharing around here lmao

If you wanted to stop them from doing something like a sweep across the client subnet (I.e. spoiling the thing by forcing the flags to open), you could do something clever like require outbound C2 connections to use a unique cert generated by the flag server and given to the user to import into the C2

That said, the other problem with this whole strategy is peer-to-peer C2 connections -- e.g., over named pipes. In that instance you don't actually have any direct connection from machine 2 to the C2 server -- it all goes through machine 1

[broken idol]

I liked the way the RTCC handled flags.

[rocky bear]

The CRTO exam is definitely more in line with what the networks in THM and the Pro Labs in HTB look like. It's just a bunch of machines grouped together in an environment, and you have to evade defender to get a shell/beacon

Just to add onto the exam discussion earlier

[wraith jasper]

Should I start looking to getting certifications? And which should I start with?

[rugged delta]

It really depends what you want to do, career wise; what your skills and interests are, how much you enjoy learning and studying, and what your budget is. You don't necessarily need to get certifications but they are a good way to show your interests and dedication

[wraith jasper]

@rugged delta yeah I just don’t know what to go into lol. I guess I’ll keep doing thm rooms and one will draw my attention

Thank you for the info

[rugged delta]

If you explain your skill level and what you like doing it'd help. Generally if you're going into cybersecurity, you'll need to have a good understanding of computers, Windows, Linux, networking, pick up a little Python or bash or PowerShell as you go, enjoy working with computers and figuring things out or finding answers either online or in books, enjoy picking up and reading cybersecurity books, practicing and playing around with the challenges on THM and reading the walkthroughs.

You might want to check out Professor Messer's free course for the CompTIA Security+ exam and maybe pick up a book on it. It will teach you a lot about how cybersecurity works and then if you want, you can do the exam. It is widely recognised. Other exams you might consider, if you enjoy hacking and think you might want to do that as a career or even to demonstrate your interest in the field, OffSec's OSCP is widely recognised by employers also but it is rather expensive. Other certs of that nature like TCM's PNPT or the HTB CPTS are good learning endeavours and more reasonably priced. Cybersecurity is an expensive field to truly pursue and it can help if you have an employer who will compensate you for these.

While those might be some of the options, there are tonnes of certs and courses and their value and quality vary wildly. The ones I mentioned all have a good reputation or they've been shown to at least be of high quality. I'd really suggest learning more about the field before you pounce but do ask any questions you might have

[wraith jasper]

@rugged delta I feel most comfortable using Linux and I know just the fundamental of python last project I made was a blackjack game with multiple players. I know very little bash. I mostly enjoy doing the CTF’s. I would say my overall skill would be beginner. Since I don’t really know networking and windows cmd

[rugged delta]

All good points. You don't need to know everything about how these things work at this stage, you'll decide to delve into what interests you most as you progress. Keep practicing, keep an eye out for interesting resources. for instance, Humble Bundle frequently has good book compilations on cybersecurity. We talk about those things in #bookclub

[wraith jasper]

@rugged delta thank you much for the guidance I will check out those books See you at #bookclub Have a good day

[serene umbra]

Gave +1 Rep to @rugged delta

[toxic gull]

Ooh on that side i am totally with you. Agree 100%. but let's put the word "internship" aside and focus on what it offers, which i t hink is great. Take a look at the Forage Platform, that's the name of the platform where you can do "job simulations". I think at the end, it is just a new way of finding new talents without any interview, assesment etc. 😉

[hollow crest]

Heyall! Newby here, super excited to join ye!
Had a (quick?) question about breaking into the game and remote work!
So I think I've gathered enough to understand that without a degree it will be hard to get a job in cybersecurity, even with certs everywhere.
So Imho I have three options here: 1: get A+, network+ get a helpdesk job and work up, right? Is this feasible? Is getting a job with just A/Network + likely? And to aim even higher: would remote be likely?
Or 2: is it better to do the cybersecurity as my evening hobby, and just continue trying to get into programming? No degree either, but loving it just as much!
3: move back to the city, get a degree, and go from there?
I am just torn! I love both programming and cybersecurity! I would love to work remote, as I live in the country with many (guard) dogs...

Any help is appreciated!
Love!

*edit option 2 added 'to get into'

[elfin spruce]

Not having a (CS) degree, nor certificates and wanting to do remote work seems like a stretch.
Hybrid seems to be more of the norm.
Note; especially as a junior in a field it's more beneficial for you as well to have a job that's not 5 times a day remotely.

[hollow crest]

Yeaa... I kinda figured.. I was hoping somewhere that I could have it all haha thanks for the response! Imma try and do this for fun while concentrating on software! I'm sure my programming skills will allow me to be with my doggies hehe
Thanks again! 😁

[serene umbra]

Gave +1 Rep to @elfin spruce

[toxic gull]

I don't know your situation but if you can, go for the degree. I myself have a higher state diploma which is quite nice but still, i see that with an engineering degree, everyone looks differernt at you. Besides the status elevation, the knowledge you get with a degree is way more in depth than with certificates. But still, your choice. You can't do anything wrong with doing certificates to shwocase your knowledge and willingnes to learn new skills.

[viral wadi]

What will you do? Went from sysadmin to soc engineer but not loving it.
Got invited for 2 interviews and although ive not gotten an offer yet, thinking what might be the best option in case i get an offer

JOB 1
Technical Security Consultant | Job description
As a (MS) Cloud Security Consultant at work in business, security and IT. You are the inspiration behind the (further) development of security portfolio and guide (potential) customers with complex Microsoft security issues in relation to Microsoft Azure and the Microsoft 365 portfolio. You also provide advice in the field of security solutions from Smarter365. In addition to advising customers, you guide them in the implementation of the security architecture and setting up the Microsoft security products from Smarter365. You are also busy creating security awareness, taking control and executing security awareness scenarios on a regular basis

JOB 2
Security Officer | Government job
1 Policy – advise, develop, implement and execute
We contribute to policy development and translate this into specific or additional policy frameworks and supervise the implementation and ensure that implementation is organised.
2 Risk management – inventory, analysis and selection
We work in a risk-driven manner and to this end we identify risks, analyze the identified risks and make decisions based on them. the analysis is a selection of risks that need to be addressed.
3 Measures – advise, describe and implement
We develop measures by contributing to the description and providing advice on measures to be taken.
4 Supervision – compliance, monitoring, evaluation
We supervise the implementation of the measures, monitor progress and evaluate the effectiveness of the measures. We also monitor compliance with agreed policy frameworks.

[burnt sonnet]

Eyo fam! I was floating the idea of making a change on my resume where I remove the "Professional Summary" at the top of my resume and instead put in my "professional development"
Open to ideas of changing the formatting/wording, or just not doing it at all. Ty!

[static tide]

you work(ed) in a soc

that’s good exp

put that at the top

[elfin spruce]

Don't think anyone can answer this but you.
Talk with both and follow your instinct/gut feeling.

[elfin spruce]

Your work experience is more important than your education at this point; put it on top.
A small summary of yourself really cannot hurt.
I like before more however get rid of all the "additional knowledge areas". Put them under skills or list them where you used them professionally or during educational purposes.
However, don't list things you cannot talk about for more than a few minutes and have an equal and in-depth conversation about

[hollow crest]

Thanks for the response! I know you are right, and a degree would be most beneficial, but I think I'll just do this as a side for fun 😉
Thanks again though!

[serene umbra]

Gave +1 Rep to @toxic gull

[lofty elm]

Well how will soc and blue team help me build a strong base for pentesting

[dense dagger]

knowledge on evading detections through learning how attackers are detected by blue team tools. give good recommendations on how to remediate vulnerabilities and lapses in detection, etc. in their blue team.

theres a lot more but those are just off the top of my head

[undone shore]

Attack and defence are two sides of the same coin. Creation and destruction. Attack and protect.
The better you are at one, the more you know that can help with the other.
A pentester or red teamer must always provide recommendations on how to fix things. To do that they must understand how those things work. Blue team helps to understand the kind of issues an org is likely to face, and also gives you experience with fixing stuff (if not directly then in co-ordination with development / adminstration teams).

[flat sedge]

That said, pentesters and red team recommendations may not be fully informed on the environment, and the recommended remediation may not be appropriate or effective due to things like a WAF or reverse proxy that may be invisible from the tester perspective

[lofty elm]

So it's only about fixing thing. Will I be able understand pentesting more easily.

[severe vapor]

is there any pro ethical hacker here if there is anyone pls dm me i need know how capable you are and your achievements to get an understanding of what is pro in Hacking field ,

[broken idol]

Why do you need a pro ethical hacker?

[severe vapor]

to get an understanding of what is pro in hacking field , to get understanding of how far i am from becoming an pro in that field, do you get my point bro???

[broken idol]

I do, but this is a server full of people with many different skill sets, you don't someone to DM you, just engage with the community.

[severe vapor]

Ohh... ok then i'll ask to whole community , so ..how Pro are you? are you from the top 1%

can you share your experience!

[undone shore]

You realise that "pro" is short for "professional", right?
I.e. anyone here with a job in offensive security is a pro hacker

[undone shore]

Eh, I would argue that an internal testing team should have a reasonable idea there, although yes, this is true.
Doesn't detract from requiring that technical knowledge in the first place though.

[fallen heron]

how pro are you is not really an answerable question, if you've got a job like Muiri said, you're a "pro", people specialise in different areas too, no one is an expert at everything, top 1% is a meaningless metric

[broken idol]

I'm in the top 1%, but that doesn't take much, it's not hard. I'm not a professional yet, I'm on my second last year of mty degree in Digital Forensics and Cyber-Sec.

[flat sedge]

I agree with all that. My point is more that as testers, we have to keep in mind that we don't own the system and even with the best of intentions and knowledge we probably don't have as deep a picture as the devs do. And our recommendations tend to be along the edge cases that they didn't think about, or an incorrect specification.

And often enough, the 'correct' fix cannot be applied because the application architecture simply cannot support it due to design flaws

[undone shore]

Ah, yes, fair enough. Agreed on that one!

[violet crag]

Hello, I'm an 18 year old boy and I'm kind of lost so I'm looking for help here xD.
I started university this year doing a Bachelor in Applied Mathematics. However, it wasn't my first option. I wanted to go into computer science but I didn't managed to get in because of my exam grade.
I'm a little discouraged because I feel like I don't need so much mathematics for my future and the subjects are also too complex, which makes it difficult for me to get a good average to get into the cybersecurity master's degree.
I'm trying to decide what decision to make within the following options: stop being a bitch, continue focusing on the Bachelor in Applied Mathematics, which gives me strong foundations for the master's degree in terms of reasoning and general knowledge as the course teachs about mathematics, physics and programming, however there's a chance I can't get the average I need to do a master's degree. The other option is to focus entirely on the only subject that is equivalent to the Bachelor in Computer Science and studying to repeat the CS candidacy exam and improve my English and programming/hacking skills since I will need them in the future.

Please share your thoughts and experiences so I can make the best decision! 😉

[vestal vector]

-- generally speaking, is there more demand for pentesters-redteam or SOC-blueteam, as far as junior roles go?

[fallen heron]

there will always be more demand for blue team roles

[vestal vector]

💪🏻

would a path like this make sense, if one is interested in landing a junior SOC analyst role?
Complete beginner > Pre security > SOC level I > (at this point I might try to send my CV for interviews for junior SOC analyst roles) > SOC level II

[vestal vector]

-- also, do the modules/courses on THM in regards to networking give a decent foundational knowledge? I'm studying for CCNA, but I don't think all the info from CCNA will be necessarily useful for cybersec (especially the cisco-specific stuff), idk though

[severe vapor]

Thank you for all of your Replies 👍

Got some clarity! ✨

Just now i understood meaning the word "Pro" is short form for professional

[severe vapor]

I Hope that if you are really interested in computer science a degree won't stop you from learning it!.. do whatever you like do not think too much , just my opinion 😅

[dense dagger]

I’d say a masters degree in cybersecurity is not something that’s looked at except for senior (?) or managerial roles. Masters degree and no experience may look bad on your resume when applying. Feel free to correct me if I’m wrong but usually in IT its either certifications and/or experience is what matters (along with soft skills).

You can do Applied Math for a bit and transition to Computer Science like you said, I’d say that’s more feasible. Computer Science is a subset of math so you’d pick up theory a lot better.

[flat sedge]

It's less that it looks bad, and more that it prices the candidate out of the lower level roles needed to gain the contextual experience of "doing" security

[terse yacht]

I am a beginner, how do i start?

[fringe spade]

#start-here

[violet crag]

In the country where I live, a master's degree is not expensive (It might even be free) and I'm at a good university so I think I would only benefit from a master's degree even though I know I'm losing a few years of "practical" experience. Even so, I think that the master's degree has partnerships with companies to do internships and I will try to contact companies to do internships during the summer holidays. So if I manage to get a master's degree, I'll do it, if not, I'll study to obtain certificates.

[lavish vigil]

There is different reasonings behind having a master degree and not, many employers dont really care about it specially, like already mentioned. Employers for "entry level" positions. With that said a master degree can also be one of the main reasons to even break into this field, this certainly was for my case.

My masters was very technical and theoretical however not in CS field at all.

[dense dagger]

I think you should reach out to people in your local area that is in IT/Cyber and ask them their opinion on masters in cybersecurity and how employable you are with it versus experience + certifications. Maybe reach out to a couple of alumni (maybe those with masters) or professors in your university, ask their opinion about it also.

Tech recruiters are also people can you reach out to.

[rugged delta]

Most people in Europe coming out of college with a BSc, Graduate Diploma or Masters will typically go through their college's recruitment path into a junior position for at least one year to learn the ropes. At that stage most reputable companies will encourage them to pursue certifications of various kinds

[heady axle]

You have all those certificates and you are worried they won’t accept you before you don’t have experience with Splunk?

[night halo]

ive applied to over 1000 jobs and this person is the first response ive had and it wasnt even from an app, it was from word of mouth, but also he asked me specifically what I knew about splunk and I said I had some basic experience with it but I was planning on improving and I want to do it immediately, I do nothing else but watch an anime here or there, give my plasma for money, and study (aside from beating my friends at Putt Party 💀)

also thank you for asking that, it is clarifying to see someone point out how odd it is

[heady axle]

I’d also be careful with the skills section. I’ve been asked some questions on my skills by interviewers to prove I know stuff like for example what port does dhcp uses ….

[night halo]

67 and 68?

[heady axle]

Or for the digital forensics for example on yours it’s whole discipline and you can get a university degree in that and by putting it as just a skill it can be used against you

[night halo]

and haha thanks for warning me

[serene umbra]

Gave +1 Rep to @heady axle

[night halo]

I see what you mean, it came from a lab we had to do for the degree at my school and I vaguely remember it

[heady axle]

Unless you feel comfortable in evidence acquisition and all the processes of storing evidence documenting it and doing investigations for which you can be asked in court and be prepared to answer all the technicalities I wouldn’t include it 😅😅😅😅

[night halo]

I needed to get past the ATS 😭

[heady axle]

There was an website but I can’t remember what was its name. You post the job advertisement text and it gives you keywords to include in your CV

[night halo]

I'll see if I can find it, thx again my brazzah

[serene umbra]

Gave +1 Rep to @heady axle

[vestal vector]

anyone for this?

[vestal vector]

also wondering if anyone in here took the google cybersec certification/course on coursera

seeing a lot of great reviews on youtube, but it might also just be that they want that affiliation money lmao

[indigo iris]

depends on client you are assigned to.
If role involves SOC+SD, yes. Just SOC, meh. But its always good to know extra skill

[vestal vector]

by yes you mean the info on THM will be enough?

[indigo iris]

Regarding CCNA you mentioned. THM may not be enough for interview but entry level usually doesnt require much as you will be trained for their actual process

Know basics and keep yourself updated with news

[vestal vector]

👍🏻

also some people consider CCNA the very basics, lol. I guess for a purely networking role they are vs more advanced cisco certs

[dense dagger]

That depends on how you would measure foundational knowledge.

CCNA would give you a stronger foundation than what THM provides. You don’t need to pass the cert if that is what you’re aiming at.

[steady urchin]

Hi I run a small cyber security services company, where I help compaines setting up SOC. Curious to know what kind methods to use to get new projects/clients?

[rugged delta]

CCNA is really good but you don't need to push to that level for most cybersecurity roles. Cybersec engineering, most certainly that and a little bit more, maybe cloud networking; but for the most part, the contents of network+ with a little os knowledge will get you most of the way

[vestal vector]

yeah but if I don't pass the cert what do I put in the CV? (to show that I do have the knowledge/have studied)

like "networking knowledge (CCNA training course)" or something? lol 🤔

[daring coral]

Does anyone know anything about physical security engineer? Any information would be appreciated.

[stoic cave]

If you have questions, just ask

[daring coral]

How can I start at an entry-level for physical security engineering ? I got interested.

[dense dagger]

Are you a student?

[knotty condor]

Howdy all, I recently left a role Project Services: System Technical Lead to finally take the plunge and pursue a Security role anyway just had my first interview for a C6bersecuroty Analyst role and found the technical aspect surprisingly easy, anyway things went well on all other fronts so I have another interview in two days which was scheduled minutes after hanging up from the first interview video call so I'mthinking I'm in with a chance. Is this how all first interviews go in Security?

[radiant pecan]

It all depends on if you know at least the basics in all or most of these fields:

Locks and lockpicking
Physical access control systems
Electronic security systems
Social engineering
Surveillance and counter-surveillance

[daring coral]

Absolutely!

[vestal vector]

no, why?

[distant pier]

@buoyant shuttle Please don't advertise services on our Discord. 🙂

[stoic cave]

Those roles are fairly rare and aren't typically entry level. I don't have first hand experience with that side of cyber, but I can surmise what might be required. Having a contact already doing the work would be the best way of getting into the space, excellent people skills are a must, the work is probably team oriented so you'll need a set of skills that rounds out that specific team, etc etc

[dense dagger]

What line of work are you in?

[true crag]

Just joined LinkedIn. lets connect ✌️ 🙂
|| https://www.linkedin.com/in/bhaskar-pal-9447ba296/ ||

[vestal vector]

not (yet) in IT, but i still wanna put IT stuff in the CV

[warm hinge]

Hey, I received my GSEC today, is there someone I can ask to add that to my profile here?

[dense dagger]

What are the roles you’re looking at in IT ?

[vestal vector]

right now mostly help-desk but wanna end up in a SOC/blue team eventually

[worldly whale]

Congrats! I passed mine last week

[warm hinge]

Nice work! What are you planning to take next?

[worldly whale]

Starting gsoc next week, and gcih in a month

[warm hinge]

I'm at a toss-up between pursuing the CTI one or GWAPT if I can

[warm hinge]

Sweet, good luck!

[worldly whale]

Thanks, you too!

[rustic field]

Any recommendations on what to look for after getting CASP+?
Unfortunately do not have lots of experience, but currently a desktop support engineer

[night ice]

Hello. I'm trying to get an entry level blue team job and was wondering if I have to be a sys/network admin before moving to blue team?

[vernal grotto]

I'm not too sure but I believe it would help I don't think it would matter as you're mostly trying to stop breaches and also harden the defenses I would look around on job posts as it would give you a better idea but I don't see them as a demanding one the ones I've seen. hope it helps. I would say though there is nothing wrong with understanding them roles as it would improve your knowledge and also help a lot with your career and having the ability to not just harden but also repair and help on new build one getting them to a higher level of deference right away

[fluid trench]

it would help, yes

but you don’t need to

[alpine marsh]

a lvl1 SOC employee is a great start in your career and can be your first job in IT even, we have a lot of students who do it as a part time job

[night ice]

I work helpdesk right but do a lot of HTB/THM ctfs and training. I wouldn't say I'm a pro but I certainly know a thing or two.

The reason I'm asking bc I thought I had to go through the typical path helpdesk -> sys/network admin > entry-level cyber

[distant pier]

Have you checked out the SOC Level 1 learning path? It gives insight into what foundational knowledge and tooling is included for a Triage Specialist:
https://tryhackme.com/path/outline/soclevel1

[daring coral]

Found one and got accepted!

[vestal vector]

anyways this was my initial question

how should i put the fact that ive studied networking with some CCNA course (without actually getting the cert) in my CV?

[vestal vector]

i'm trying to do the same but i need to study more first ,_,

and at least finish the soc level 1 path on THB as suggested\

[worthy shoal]

You could put it in a section called "personal development" or something similar and just mention the course name, but it probably isn't going to have much value being on the resume without actually obtaining the certification.

[night ice]

Will do

[night ice]

Just put that you have the cert and by the time they call you for the interview, you'll have it

For example, I'll take my ccna in December but in my resume I put that I got it this month

By the time I get interviews, I'll have it.

Saves time imo

It's not lieing btw. It's called being proactive 😃

[warm hinge]

Yeah, I would have to agree if your testing out before you have to show proof you should be okay. But if you end up failing that could backfire. Worst case I'd say I have the exam scheduled for it in that case.

[stoic cave]

I mean, it is a lie because you don't actually have the cert...

[vestal vector]

if you fail the exam though you gotta change that lol

i think most people in that case put the date of the exam

like CCNA (20/12/2023) or whatever

[vestal vector]

well if i study properly at least i'll be ready for possible networking questions in the interview, i suppose

[night ice]

but i'm gonna and it's not that far out anyways. Maybe if i was gonna take the exam in say, April, then yeah, I would not put it in my resume

[night ice]

That's true but i'm optimistic

but it's worth the chance I think

I also use it to gauge the market to see if having the ccna even makes difference in my job search

[vestal vector]

fair enough

[real dagger]

Any intermediate/advanced tips for work life balance, especially in terms of work from home?

Already work and play in a separate space, try to have my hobbies less influenced by tech, but with how much I love tech it’s still a lot to obsess about at times, especially lingering goals waiting for approval/review

Can be very hard to turn off at times, especially when my whole vibe was learning more about the tech I interact with prior to this

Meeting tomorrow may help, may finally get my AD Security/Modified MS Security Baselines project pushed through due to a meeting and confluence of events

[flat sedge]

Take more frequent breaks. Go out to eat, even if its just a salad or sandwich at a nearby park. Don't be afraid to take a 20 minute walk every so often

[real dagger]

Thanks, that is good advice!

I to take breaks somewhat but not so much like that

Often shorter and I’m a bit distracted and eager to get back to it/worried I’ll miss something lol

But yeah I don’t need to be so reactive, I’m level 2 basically and we have dispatch for a reason

[ruby venture]

Can someone recommend a headhunter for entry-level cyber jobs? Looking for remote work - I need to find something to get my feet wet. Most job boards are asking for previous experience. The only place I found to get experience is HTB and TryHackMe and Im not sure thats even enough to get looked at. I've hit a dead end and looking for other ideas to get noticed to get that first job in cyber security.

[rugged sable]

The only place I found to get experience is HTB and TryHackMe

ooh this is not true! but also i think you'll have more success getting out there. going to conferences etc, it'll suck but it's how it works :/

there's lots of things you can do to "get experience":

• make open source tools
• write blog posts
• Write tweets / linkedin posts
• bug bounty
• hack things and find CVEs (anyone can find CVE in some bad bit of software)
• go to conferences
• speak at conferences about your experience doing any of the above?
• thm and htb are good, how active are you in those communities? that helps a lot too!
• make youtube videos / twitch stream your hacking
• make friends in the comments of popular youtubers / streamers

[ruby venture]

@rugged sable - Thanks for the Tips - any advice on finding headhunters or trustworthy firms for job placement?

[serene umbra]

Gave +1 Rep to @rugged sable

[undone shore]

If I got that out of you in an interview it would be an instant rejection for dishonesty lmao.
If you can't be trusted to talk about your own experience without bullshitting, why the heck would you be trustworthy on a team?

[warm hinge]

Completely understand, I believe a large part as they said is testing the job market if the cert will even make a difference. Although, even something like "Studying for CCNA" should cast the same net?

[undone shore]

Testing the job market by outright lying when you're looking for a job isn't necessarily the smartest idea. Something something burning bridges, etc.

Yes. I keep the cert(s) I'm studying for in my personal profile at the top of the CV, personally. Just as a "currently working towards X, with future personal development goals including Y and Z". Something along those lines.
Shows a desire for continuous learning and is upfront about my current abilities.

[stoic cave]

https://tenor.com/view/simpsons-shocked-upset-stop-no-gif-5541443

The horse is already dead Muiri

No matter how much we say it, people are going to be like "no it's not" lol

[undone shore]

True that

[golden oar]

Is there any benefit to having a LinkedIn if I am just starting as a student with no portfolio? Or should I not bother until I have a portfolio to begin with?

[vestal egret]

It will be good to get connections for when you finish uni. The more you know in the industry the better

[golden oar]

What would I actually put on there though? I mean student, obviously, but anything else? I assume career goals?