cyber-and-careers

[kindred mesa]

That’s cool man, I’m totally comfortable with self directed learning. I take my classes online now. Were you already in the industry? And have you found a cyber job since graduating

[hidden flare]

I got hired into a tech support role while I was finishing up the degree. After finishing the program, I asked my boss to let me take on more security-related projects. With my current experience and certs, I'm confident I could land a dedicated cyber job

[pseudo creek]

ahh ok, generally I would not recommend WGU for someone who doesn't have full time experience elsewhere but if you already have work experience elsewhere then it isn't a bad plan. Only thing is really a lot of the certs WGU does don't really matter much. Just based on what other people have stated. One thing with IT is that more certs doesn't make it better, a few select certs such as Network+ and Security+ can open many doors

if they offer the opportunity to get Azure or AWS certs, I'd go down that route as well as that is in high demand

[hidden flare]

Certs can definitely help get through the HR firewall

If you don't have a bachelors degree, having one on your resume can also help a lot, and WGU is an affordable way to do that.

I also learned more from studying for the certs than the non-cert classes

The capstone felt like a good project to showcase understanding of a problem of your choosing

[pseudo creek]

certain certs can get you through the HR firewall

Bachelor degrees are definitely helpful

[rugged delta]

You should still list the main skills you acquired in the cert/course, especially if it was a practical exam

[pseudo creek]

what? I mean you can list your skills regardless of certs in your resume, I wouldn't put down skills learned as part of a cert

I was just saying that certs like Project+, Cloud+, Linux+ really don't hold much clout. If you can show that you know how to work in a cloud environment, have worked on projects or know your way around Linux, then those are really all you need to show. Now on the flip side, if someone was going into project management, they should be pointed to PMP, if they want a cert that holds a bit of clout for Cloud, they would look at AWS Solutions Architect Associate, Azure Administrator (AZ-104) or even the Google Cloud Engineer and then on the Linux side, they'd look at RHCSA

that doesn't mean you don't learn things in the degree, that isn't what I'm trying to say, just that from what I've heard from people, it gets people certs that you would not otherwise recommend to people who are trying to get a job in the industry

and lastly 2-3 solid certs would help you get in the door

[warm hinge]

What is the best app or software to use for white hat hacking?

[rugged delta]

Definitely good points. I have heard mention in several places just this past week or so that it can be beneficial. Of course, if the cert is a well-known or expected one for a role there should be no need to expand on it

[rugged delta]

Can you expand on your question? Are you learning from basics? You should know some Linux, Windows, networking, perhaps have a little coding knowledge and then start on the basics. There's lots of free rooms covering these topics in THM

[pseudo creek]

honestly thats a big pet peeve of mine in a resume to see someone explain what a cert is

[warm hinge]

I meant not a site. It's okay, I think I'm getting ahead of myself.

Oop

[pseudo creek]

white hat hacking uses lots of various tools and techniques, it really depends on what you are doing

[royal zenith]

I am a beginner and a freshman comp Eng student. If I wanted a soc analyst internship as soon as poosible what are some things you would reccomend I learn?

And while attaining a bachelor’s should I aim to obtain certifications?

[pseudo creek]

splunk is always good, I'd look at the blue team path stuff on THM

[latent nacelle]

I am new to cybersecurity. I would love to get in and start a career out of it. How to get started?

[rugged delta]

You should check out THM and all the great resources available. Go to #start-here and read about how to get going

[frigid star]

Hey y'all, just reaching out to the community for insigts or tips on career opportunities in cybersecurity. I'm close to finishing my master's degree in strategic studies, with an undergraduate background in economics – so not exactly the typical path towards cybersecurity. But I became interested in this through studying cyberwarfare in my master's, and now I'm seriously considering a career in this field. I don't exactly have extensive coding experience, but I'm tech-savvy and confident in my ability to learn. Right now I'm using TryHackMe to learn and develop my skills and have found the experience really interesting so far. But given my non-technical background but strong interest and current learning curve, I'm just curious what my job prospects might look like in cybersecurity. I appreciate anything y'all might be able to provide.

[buoyant portal]

have any of ya'll recently taken the sec+ plus? gearing up to take it and any study recommendations would be awesome, thank ya'll!

[vestal egret]

i found some study group podcasts that professor messer has

[dense tendon]

Hello, I have a question, how long it took you guys have a job in Cyber?

[fringe spade]

Honestly, you don’t have to be educated in cybersecurity (or any other course) to work in cyber. It might help but it is not a “must have” requirement so I wouldn’t worry about that.

There is a lot of more and less technical jobs, because cybersecurity is directly connected to the business side of things. You’d have to first determine if you want a technical role (or not).

To list some less tech savvy roles: project manager, compliance officer, risk evaluation and the list goes on.

TryHackMe is a great place to start, so you shouldn’t have any problems with getting new skills here.

[fickle grove]

The Certification Station discord group would definitely have lots of resources to recommend.

[jaunty creek]

professormesser, jason dion

[fluid trench]

it takes everyone different times. Factors like the local requirements, luck, skill, learning abilities, etc all come into play

[fringe spade]

Yup, luck is also a big factor here, some people can’t find a job after sending 200 CV’s and some find it after sending a few, even though the qualifications are similar. It’s not worth comparing to others bc this reaaally does vary on multiple factors that are independent from your skill.

[sonic stirrup]

Hi all, I'm a cybersecurity enthusiast having internship experience. Actively looking for a full-time entry level role. I'm looking for a study buddy also

[shadow acorn]

hi security enthusiast from india

[sonic stirrup]

[shadow acorn]

i know we all are looking for entry into Cybersec domain. so how far have some of you guyz made.

@sonic stirrup so how much has internship helped you?

[distant pier]

@warm hinge Please don't post self-promotion in our Discord. It will lead to warnings and eventual removal from the server.

[paper cradle]

When listing things like THM on a Linkedin account or a resume how should we list it?

[rugged delta]

Mostly it should be listed under a personal development/hobbies section on a resume. You can list the certificates you received on your LinkedIn profile or as posts on your activity stream

[undone shore]

Just don't stick 'em in the certifications section

Certificate of Completion != Certification

"Personal Development" is a good place to put it though

[paper cradle]

Alright. Thank you.

[vestal vector]

i saw some people put THM in their work experience field on linkedin 😂 , like adding the THM company as if they were working for them, but then writing "self-emplyed cybersecurity practitioner" or something

that's prob too much / not a good look, i'd just put like "THM top 1%" in your title or description, and list the certificates in the section of linkedin where you can add those

[fluid trench]

i wouldn’t do those either

[sleek sedge]

You will most likely be laughed at if you put "THM top 1%" in your title

[vestal vector]

i'd say it depends where you at in your career imo

[vestal vector]

lots of people have it 😂

i mean Linkedin title, not the cv

[sleek sedge]

Yeah, it's funny

[vestal vector]

like trying to look for a job in IT/csec vs already working in the field

[fallen heron]

Indeed they do, both on LinkedIn and some in their CVs, and it's laughable

[vestal vector]

why woud you think it's laughable

it;s better than nothing

[fallen heron]

Because it means and shows nothing, anyone can do it following walkthroughs and answer dumps while learning nothing along the way

[vestal vector]

obviously you don't bother to mention it if you're like someone with 5 years of experience in the field or something, but if you're new it could have some sort of value

[pseudo creek]

people put what they can get away with, I mean its not smart but lots of people have nothing else. If you look at LinkedIn, it says it was 2000 employees, mostly in India.

But you can put THM on a "Personal growth / Learning" section and be prepared to talk about it if you do. If you did 10 rooms 3 years ago, not so much but ya know

[vestal vector]

and people can cheat with the most acclaimed certifications exams and get certified while knowing very little

it's all relative but u gotta put something anyway

[fallen heron]

That's true, but an actual certification still holds much more weight

[vestal vector]

if the dude used answer dumps to get top 1% or whatever it's gonna show on the interview anyhow

[vestal vector]

wdym 2000 employees in India? 😂

[fallen heron]

I don't know, I personally wouldn't use it and don't take it seriously, maybe the people making hiring decisions see it differently

[pseudo creek]

I mean that people on LinkedIn putting THM as work experience, show up when you look at THM

[vestal vector]

ah

[pseudo creek]

I will say as someone who is involved in hiring, if someone puts THM on their resume, as a junior that is, it has some worth... its not the same as work experience but people who can dedicate time to learning outside of working is awesome

people who are striving for something is awesome

[fallen heron]

It makes sense to me somewhere under hobbies or personal development, mentioning you're active on platforms like THM, HTB, whatever, but the top 1% thing not so much

[pseudo creek]

no but also thats because the THM algorithm for top 1% and such is off, although I thought there were plans to fix that somewhat

[fallen heron]

They did implement something about that couple of months ago, didn't budge me from the 1% even though I hadn't been engaged seriously on the platform for months, I don't think it made much of a difference

[vestal vector]

what;s wrong with the algo?

i guess it doesn't count inactivity?

[pseudo creek]

it would count people who joined and didn't do any rooms

and yeah looks like I'm still in top 1% too

[fallen heron]

It didn't use to, now it does to a limited extent, but you only need to answer a few questions to get ranked

[vestal vector]

ah i see

that would be make it easier to be top %

[fallen heron]

yeah, I don't know the current active users count, but if it's 2 million, you only need to be in the top 20k, which is pretty easy

[undone shore]

I genuinely see that as a red flag for hiring

It's a pretty good indicator that you are focussing on the wrong things (the rank, which is objectively meaningless for a training platform, rather than the training itself), and also that you're likely to be in the wrong headspace for professional security testing.

[wind belfry]

to me it’s just a number. still trying not to do a box without a walkthrough. but my weakness is privilege elevation.

[vestal vector]

what do you mean wrong headspace?

[undone shore]

There's a big difference between training on a platform like THM, and working on a pentest. Training platforms are good for learning technical skills, but if you've invested yourself totally into one then chances are you're going to be stuck in a very CTF-y mindset.

For example, I've seen people who aren't comfortable testing a public resource because they've only ever worked in a VPN training environment. Seeing folk who expect to find a vulnerability in everything (i.e., because CTFs are designed to always have vulnerable components) is really common.

That's the big one actually. A real security assessment is about assessing attack surface and finding all issues present. Those won't always be big bad RCEs, or critical vulnerabilities. More often than not you're look at basic misconfigurations. Cryptography issues. Security headers. Exposed ports / segmentation flaws. etc, etc, etc.
It's common for people who've dived head first into the CTF rabbit hole to not even bother looking for these and instead just waste all of their time looking at the component that looks juiciest.

Oh, that and scoping lmao

(For the record, that isn't exclusive to THM obviously. Just an expansion on the meaning of "wrong headspace")

[vestal vector]

i see 👍🏻

[dense dagger]

Amen. Then also assessing whats the risk or if its even exploitable at all (a lot will just be false-positives in my experience)

I think the hardest part for me is trying to say its probably not vulnerable to stakeholders

[pine mesa]

Is BSCP (Burp suite cert) beginner friendly?

[trail knoll]

(Anyone has an experience) tell me , what is the first step should I take toward learning cybersecurity ?

Like be my guide...

[stoic cave]

You can go to #start-here

[trail knoll]

Ok.

[tender mountain]

@undone shore Does THM teach these misconfigurations?

[fluid trench]

from what I’ve heard, not really

it’s a very difficult certification due to the time constraint, mixed with the fact that it’s a lot of manual exploitation

but I haven’t taken it. Just word of mouth

[dense dagger]

You can take their mock exam if you feel like it!

Honestly it was so hard lol

[rotund valley]

What it means SOC analyst job 24/7 ?, Does it mean we can't sleep or what lol

[hidden flare]

On-call?

[royal zenith]

The 24/7 aspect refers to the overall operation of the SOC, not the schedule of an individual analyst. you probably are given a shift but the operations of the team are 24/7 .

[undone shore]

Bear in mind I haven't done any THM for a while, but not afaik. It's hardly the sexy side of cyber.
I tried to cover it a bit with Hipflask, but even that doesn't cover every issue with the box -- just gets you thinking about more than just the killchain

[hearty tree]

a buddy of mine actually put that in his resume & he landed an internship 🤷‍♀️
it was brought up in the interview

[hearty tree]

so you don't recommend that we invest into just one training platform?

I'm trying to get experience as soon as I can (even while in school),
and I'm not sure what I could really do outside of training / a couple of practical certifications while working towards that,

or really what anyone in my position could do differently 🤔

[dense dagger]

Networking with others is good

[hearty tree]

I think that's one of the biggest benefits of attending in-person college,

gaining experience & networking / meeting people are some of my main focuses atm

[undone shore]

I would recommend that you use the resources on offer, and that you keep an open mind about your expectations for industry. Networking is good. Talking to people is good. Don't just dive headfirst into INSERT_CTF_ PLATFORM_HERE.
They're good for training technical skills in a lab environment, but if you can demonstrate that you understand the difference between that and IRL -- even if you don't have experience of industry testing to back it up -- you're in a much better position.

[pale glade]

Good afternoon people hope you’re all well, this is a random question but I wanted to ask what’s the job market like in Canada for cyber careers?

[river wyvern]

Hello!! I am Nishchal, student of computer science and engineering.

I will be out of university in an year, looking to get into cybersecurity(VAPT and analyst side). any advice to make myself more valuable??
I am preparing for CEH(I know its controversial but compulsory for college credits). Looking for internships without any luck. what should I do to make myself ready for my first job in cybersec (already grinding DSA for coding interview apparently nowadays its the only way to get me shortlisted other than that useless.)

Are there any projects, Certs or something to standout I have exactly 1 year before i start looking for jobs.

[hasty willow]

oscp is always good to have on hand when trying to get employed

[onyx brook]

We got a situation that's way too similar

although I'm preppin for OSCP

[river wyvern]

And how much time would i need to prepare for it??

[hasty willow]

I'm pretty sure it is 6 weeks

[river wyvern]

After CEH thats my next target

[onyx brook]

You're from?

[river wyvern]

what about CEH, i am thinking to grind it for 20 days from the study metrial and then give the exam, will it be enough??

[hasty willow]

isn't CEH fairly easy?

[river wyvern]

thats why 10 days prep, 20 modules

[river wyvern]

recently shifted to pune, what about you??

[onyx brook]

CEH masters is not that easy if what you know is 90 theory 10 practical

CEH though is basic theory

[river wyvern]

I have to prepare for 125 mcq hoping it to be easy

[onyx brook]

Up Northeast

Punjab

[river wyvern]

Nicee

[onyx brook]

depends on how much you already know

[river wyvern]

I also want to know that🥲

[onyx brook]

Should still be fairly easy if you dedicate enough time, but 10 days still fall short imo

you paid what? 60k?

[river wyvern]

i will keep the timeline flexible then

[river wyvern]

25K, college discount

[onyx brook]

fair, still not enough roi here

[river wyvern]

I recently gave an interview for an internship, he asked me what all venerabilities you know i could only think of "SQL injection" and after the interview i could name countless in my mind.

[onyx brook]

happens

[river wyvern]

After talking to people I undersrand it now

[onyx brook]

but not a complete waste, Indian companies , all of em, recognize CEH and would be willing to offer you a shot

dunno beyond that

[river wyvern]

Yess and its famous among recruiter's for some reason

[vestal egret]

That’s nerves for you

[river wyvern]

i hate online interviews

[vestal egret]

I hate them too

But it’s got to be done

[river wyvern]

necessary evil

[grim jackal]

What do you guys think of the Google Cybersecurity Professional Certificate offered on Coursera?

[faint abyss]

Hey can you get in a job if you have learned cybersecurity from courses?

[river wyvern]

Beginner level cert, basics and all

[pseudo creek]

it gives you 50% off Sec+ right? that seems like biggest benefit

[pseudo creek]

create a portfolio that shows what you know

[faint abyss]

Is it possible tho?

Even without a university degree?

[pseudo creek]

depends a lot on what country you are in, how much emphasis on degrees there are. It may require taking super entry level jobs and working your way up

if you get involved in the community in some way (conferences, meetups and such), you may be able to network your way into a position

[river wyvern]

and certs you would recommend @pseudo creek

[faint abyss]

What if you have the skills, you know how to speak like a salesman when you explain what skills you have in your job interview (not like a nerd)

Can u land a job like that

[pseudo creek]

it depends on what your goals are and certs are country dependent

[faint abyss]

Bcs most of tech ppl look like geeks tbh

[river wyvern]

@pseudo creek advice?? I am from India

[pseudo creek]

what? I know a variety of tech people, they come in all looks

[fluid trench]

excuse me…

[pseudo creek]

what country are you in?

[river wyvern]

India

[pseudo creek]

ahh I'm not too familiar with India but your plan sounds good from what I've heard

[faint abyss]

Hah its a joke dont take it serious 😅

I didnt say all of them but some

[river wyvern]

Where are you from?? I have working abroad on my mind too

[pseudo creek]

again I'd say you could be involved in the community and network

[pseudo creek]

US

[river wyvern]

what's the cybersecurity industry like there??

[pseudo creek]

thats a broad question

you know this is the careers channel?

[fluid trench]

oh shit no I didn’t

my bad

[river wyvern]

On' entry level

for someone fresh out of college

[pseudo creek]

it is competitive, people really have to have worked various skills while in college as well as gotten internships/work experience

[river wyvern]

Thats the same for all around the world ig

same here in india

what's your experience level?

[pseudo creek]

very 🤣

[river wyvern]

10/20 years??

[pseudo creek]

25

[river wyvern]

damnnn

you are a pro

[pseudo creek]

ha maybe, maybe not

[river wyvern]

you are guiding us so definitely yes

[pallid apex]

rare to see females in IT

lol

[pseudo creek]

not in the US

[river wyvern]

True According to my college sx ratio

[pallid apex]

yeah me too

only 10-15 doing CT (computing tech)

rest are like a 100 or so guys

gf hunting be hard sometimes

[pseudo creek]

like my org is about 40% women, 60% men

[river wyvern]

i feel you bro

[pallid apex]

doe thats not my objective of joining college

so idc

[pallid apex]

modern lgbtqia+ feminist org

[river wyvern]

and yet every internship mail i get from college says "For females only"

[pallid apex]

female privelege

smh

[river wyvern]

No comments but its really frustrating

[pallid apex]

yeah well im doing foundation rn p

doesnt seem like there is discrimination

[river wyvern]

foundation??

[pallid apex]

im only 16 mane

[river wyvern]

oooo

i am 20

Bachlors

[pallid apex]

i start my 3 yr degree next yr

ill do cyber sec or dig forens

[river wyvern]

good call

I am doing btech not so good

[river wyvern]

Is it similar all around US in IT or just your org

[desert linden]

Well you are right, me too am just from an IT Degree but am also struggling to learn Cybersecurity

[pseudo creek]

so I'm going to make a statement here, please read the #rules Including rule #1. specifically regarding discrimination about women, discrimination of women in tech, etc, etc. We do not tolerate sexism here

[desert linden]

Well they are there, i have seen many and they are good at it

[desert linden]

Noted

[pseudo creek]

I dunno about the stats, I work for a large multinational company, my org has thousands of people in it. I've been to lots of tech conferences and collaborated with people in other companies and women are not rare in general. If you don't see women in a largish org, that is pretty much a warning sign to me

[desert linden]

Yeah thats true

[river wyvern]

Okayy, I have not been exposed to the Corporate world yet so no idea about here, 1 year 4/5 months more to find out

[pseudo creek]

usually it starts with recruiting practices, I worked with someone who had a very male dominated org and gave them tips on how to recruit that would get more women applicants, and it worked and they started to see more women apply

[river wyvern]

okayy one day(after few years) i want to start my own business in cybersec gonna ping you help help with that 🙂

[pseudo creek]

and I'll say it is illegal in the US to specify a gender for a role. An Indian based company just got dragged for saying "males only" in a US job listing and immediately pulled it. But if you see such a listing in other countries, know that there may be reasons for doing so. And yes it may be frustrating for you as an applicant but understand there are lots of roles out there that may not even consider a woman because she is a woman.

[river wyvern]

What is frustrating is that my college only finding opportunities for female which nobody have a problem with but the problem is we paid the fee and they should also bring opportunities where we also get a chance. My frustration is with the college management

[pseudo creek]

yes definitely your college should be able to work with you to find opoortunities

[river wyvern]

anyways i will have to work hard and find opportunities myself no one is just gonna hand it to me

[normal ferry]

Hey y’all! I’m new here, I’ve been studying on TryHackMe for about 6 months now and I have a basic knowledge. I’m a sophomore in college and I’d love to get a cybersecurity internship to expand my knowledge but every internship requires that you already have an intermediate to advanced knowledge on cybersecurity. Does anyone know of cybersecurity internships in the US that are willing to employee new people in the field?

[rugged delta]

Internships are generally posted on places like LinkedIn or Indeed or other recruitment sites. Whatever internships you're interested in, just apply if you're doing a college course. Most of the details they spell out in job applications are things they'd like you to have so just apply for anything that looks interesting

[vagrant finch]

Hey guyz...Need an advice...
I want to grow in this cybersec/offsec industry. However, unable to get a job in security.
I have been selected basically in Technical Support Role, because that is the only experience I have. That is either customer support or business support.

What do you guyz think, does that gonna help me anyhow when it comes to my actual goal?

[rugged delta]

Most people start out in a helpdesk or IT or QA role before moving into cybersecurity. While in IT, get to know the systems you're working with intricately, knowledge of Windows, Linux, networking, maybe some python, etc and keep practicing on THM. Build VMs of systems you want to learn and understand. Do things like the free Professor Messer courses on Sec+, Network+, etc. You might consider some certifications or doing a college courseor similar to be able to demonstrate the experience and knowledge you've acquired

[royal zenith]

Is it likely for someone to be able to land cyber security internship then job during college

If knowledge and certification is there

[rugged delta]

Most internships require you to be a college student so that's the time to apply. Some courses ask you to work during your college term, some afterwards

[royal zenith]

My uni doesn’t have a cyber degree and I’m not doing It

I’m doing Comp Engineering

At what point should I start applying

[pseudo creek]

today

[royal zenith]

Well I don’t have much for my name and it’s first semester

I’m on dns module of pre security

[rugged delta]

Most internships require you to be doing a degree with some cybersecurity training at least, but apply anyway. The worst that happens is they'll say no. You can just apply to regular jobs as well

[inner bramble]

Qq about working in the field. I want to understand the value of the oscp cert more. Does having it automatically means that you wont have problem getting a job as pentester?

[rugged delta]

I would suggest reading a few of the interviews in the Tribe of Hackers books. They're usually pretty cheap

[fringe spade]

No, it won’t guarantee you getting a job, but it will be a boost to your CV

[rugged delta]

No. It is the most widely recognised pentesting certification and the most likely way to get an interview as it's widey recognised by hr departments and teams as a worthwhile measure of junior-intermediate level ability but you will absolutely need to demonstrate your abilities in other ways (hacking history like in THM and other places, CTFs, college courses) and they will ask you to perform a pentest on a box of their choosing usually, and to produce a report as part of a technical test

[inner bramble]

I see, the problem im facing is that im changing my career and last career has nothing to do with the tech industry in general. So its kinda tricky to have a good CV

[royal zenith]

Do you tell them you used THM and did CTFs ?

[rugged delta]

Well it does take time. OSCP isn't an entry level certification and the course for it has a reputation for needing a lot of extra work on your part

[inner bramble]

I had just mentioned in my CV that i was using those platforms. Now im documenting the machines i pwn for my CV

[rugged delta]

You can put details about specifically what CTFs and your progress in THM in a personal development section

[inner bramble]

Yes it was very hard at first, now im used to it and but its hard to show that in CV

[rugged delta]

No need to document the machines you've achieved. Just mention paths you've completed and if they ask, you can send them the URL for your public profile or even include that on your CV.

[inner bramble]

Some people told me that its just good self PR but tbh i hate doing it

[rugged delta]

The OSCP is considered a junior level pentesting cert. If you work hard you should be able to get it in 3-6 months, depending on your abilities already. You would be expented to understand Windows/Active Directory, Linux, Networking and perhaps some Python and learn these as you go.

[rugged delta]

Someone in hr an interviewer won't want to see a list of machines you've completed on your CV. It wastes valuable real estate space. Just mention the major achievements

[inner bramble]

Makes sense. Thanks

[serene umbra]

Gave +1 Rep to @rugged delta

[vestal vector]

my understanding as far as Splunk SIEM is concerned is that there's Splunk Cloud (cloud platform) and Splunk Enteprise (to run on-premise), what i'd like to ask is if most companies use one instead of the other, or if one is expected to know both (do they work the same way / same dashboards - query language?)

like when i see on job postings "splunk knowledge required" should i assume it's both of them or it's just like Splunk Cloud because most people use that.

I know it might differ greatly based on location/companies etc. but i'm asking if there's a general consensus, like "80% of companies use Splunk Cloud so you should learn that vs Enterprise"

this related to SOC analyst jobs

[pseudo creek]

I mean the interfaces don't have differences from what I remember, so they effectively work the same. They aren't asking for a splunk administrator, which is where the differences would be. Plus if there are any differences, they would be fairly small

[fringe spade]

well, that could sometimes be determined by the job posting and the skills required, if on top of Splunk they require cloud experience like “Azure administration” or from any other cloud provider, then you’re most likely to be using Splunk Cloud

just like Zojja stated, these versions are really similar, so it’s more useful for you to know how to create queries in the SIEM and how to utilize the tool to catch “the bad guys”

but it won’t hurt you to try and set up Splunk Enterprise in virtual machines, you can do that for free and it would definitely be a nice thing to talk about during the interview for this role 🙂

[hearty tree]

The resources on offer? I'm sorry but what do you mean

Thank you for the rest of the insight though, it really helps. I'm just trying to absorb advice & information while I'm in school

[serene umbra]

Gave +1 Rep to @undone shore

[wraith ledge]

Hello I'm Nightmare From Pakistan I'm new to the group

When I'm Installing Scrcpy in kali Linux I'm getting error

Unable to locate

[undone shore]

Training / Challenge sites, blogs, books, networking, etc, etc, etc. You're in school, so possibly teachers.
Anything you can learn from.

[toxic ridge]

Just started my career in OT/IACS Cybersecurity as a consultant.

Just got started with my first job in cyber and will be more happy to chat and share the experience 😌

[hearty tree]

You're awesome for sharing advice. Thank you!!! 🙌

[serene umbra]

Gave +1 Rep to @undone shore

[undone shore]

Np 🙂

[stray sky]

can I ask what qualifications you showed the recruiters? (if you don't mind sharing) congrats btw

[wintry shard]

is it a good choice to go both the security analyst and penetration tester route to get the best chances to land my first job in either position? i currently see only security analyst/ engineer job postings, haven't seen any for pen-testing, but i'd slightly prefer pentesting path more. i only started to learn so im trying to plan into the future a bit.

[vestal egret]

You won’t find a first job in pen testing without experience. You’ll need to start on blue team and work to red team

[wintry shard]

Oh thats good to know, thank you!

[serene umbra]

Gave +1 Rep to @vestal egret

[undone shore]

Not strictly true. It happens, albeit not very commonly

[vestal egret]

Yeah I’ve seen one very level pen testing job but that’s it

[undone shore]

Issue with that kinda thing is you often need networking to do it.

e.g. I went straight into the "red" side of things. My first job was with a Government org which only hired from my uni course. My current job was after an internship with them.

[fluid trench]

yeah my mentor when straight to pentesting, though from being a federal officer with a TS clearance, he said the jump was way easier for him then it would be for us

plus he was a computer(?) engineer, and has his masters in something

[broken idol]

It's not impossible, but it's not always easy.

[vestal egret]

Yeah. If you’re determined you’ll find a way like I’m going to try and do

[sleek sedge]

I've done it, but like everyone else said very uncommon

And as Muiri said a lot about networking

[flat sedge]

One thing to keep in mind, pentesting is not the super fun job everyone imagines it to be. Most of the job is writing reports, and senior and lead testers end up doing mostly scope and client remediation negotiations.

Enjoying CTFs and THM rooms? Awesome, keep on it, but that kind of activity is only about 1/3 of my time on an engagement.

[sleek sedge]

My mindset has changed since I've done it

[pseudo creek]

(I think pentesting is boring, but also I work with pentesters that are like 'yay yet another outdated system that hasn't been patched' 🤣 )

[dense dagger]

the meme “pentesting is just a glorified nessus scan” is too real

[rocky bear]

i funnily enough had the opposite experience, in that i ended up liking it more than i initially thought i would. report writing fun

[sleek sedge]

I guess if you like report writing it would be

[flat sedge]

the fun part of the report is explaining to someone all the ways they are failing

[rugged delta]

It's important to know how to write a professional report too

[sleek sedge]

💯

Only thing that the client sees at the end

so gotta make it count

[fringe spade]

Your technical skills are still more important than the report. If you can’t identify those vulnerabilities, but you are able to produce a great report, that document is still worth nothing.

But if you are an amazing hacker that is able to perform some more sophisticated attacks, then even if the report is mediocre, it’s still worth more than a nice looking report from someone with no technical skill.

[rugged delta]

Unless you accidentally break something, but you'll have plans for that

[rugged delta]

True, but you won't be getting on the team without having the appropriate technical skills

[rocky bear]

Yes hahaha

[rocky bear]

The best part is when they ignore the reproduction steps which you painstakingly wrote, they say they've fixed it, and then you go through the reproduction steps and it takes 2 minutes to verify that they have not, in fact, fixed it

[young heath]

can you guys rate my cv ? tell me what i might need and what level of job am i up for

i cant submit pdfs here , is there a way to put it ?

[rotund valley]

anyone know where can I learn cloud security and computing for beginner, like is there a courses or YouTube channel

[orchid crater]

hmm gov. signed a few things today - looks like a few companies will soon need to hire some people " Under this new law, insurance entities would have to conduct a cybersecurity risk assessment, develop cybersecurity protocols, and report breaches to the Pennsylvania Insurance Department. "

[orchid crater]

whats wrong with https://tryhackme.com/hacktivities#learning-paths

oh cloud .. hmm

[rotund valley]

I already completed some of the learning path, but Attacking and defending AWS seems interesting

[orchid crater]

working in aws i can see more than a few places where admins could mess up configs

but thats human error - AWS security is fairly solid , to the point where i think the bug bounties for acctully getting through a properly setup network is quite high. -> https://hackerone.com/amazonvrp?type=team

bah thats just amazon not aws - sorry

[rugged delta]

You need to verify your account before you can upload files. You should hide any PII and send a screenshot. People here are unlikely to open unexpected document files
https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

[young heath]

oh ya ofcourse

[young heath]

my token is on another account that i lost

[rugged delta]

You can ask a mod to assist you with that when they're online later

[royal zenith]

Salam alaykum habibi

[young heath]

walikom el salam baba

[royal zenith]

One thing I noticed off the bat was the grade section

“Very good with honors” should be edited inshAllah

[fringe spade]

I wouldn’t really list TryHackMe as “certifications”

[young heath]

i just graduated from college and went into military i worked as as system admin there along with deployment of security resolutions after i learned them i though putting the presecurity would make a little impact on the cc

[young heath]

what do you mean ?

[fringe spade]

Those are certifications of completion, not issued by an accredited body (the other ones you listed are fine)

You could create a “Professional development” section for example

[young heath]

might be a good idea , i just dont want go into a 2 page cv while i am still a fresh graduate

yes i got some experince in military but idk if it would be recognized

[royal zenith]

should give a number or the name of the honors you graduated with

"very good" can mean different things for different people

so give your grade being the gpa and the name of the honors you got if your university has that

[young heath]

in Egypt the grades are excellent , very good , good

[royal zenith]

actually?

[young heath]

yaaa

[royal zenith]

someone else more experienced can help you then inshAllah

[young heath]

for more info in what i was doing , okay so at the start i started with doing computers maintaince and trouble shooting i fixed computers hard ware software and i documented those so my team can be at the same level as me since they were not good at fixing computers and software , i solved computer related problems in the company at a crisis time where no mistake was allowed then i was allowed to access the active directory to maintain the users policies , mac filtlers and updating them to the nessecsaary needs and fixed any misconfiguration or exposures that i would find and report them , then i collaborated with implementing kaspersky on the network server we installed it on a separate machine on a server 2016 and deployed the endpoints on the user clients to protect the network from viruses and unwanted behaviour and find any vunrabilites we found some so we used another open source security tool called wazuh we installed it on a linux server and deployed the agents on the enpoints

we found that the wazuh SCA score was 33% we configured the policies and did the nessascry fixes and elevated the score to 81% and we used the wazuh to monitor any changes on the network sharing folder that was used to share nessacry documents , then i was tasked with deployment of a domain and kasperky and wazuh on a new 110 devices with a network share to provide resources accessibility , in the deployment of the new devices i worked alone without my senior i made a created domain on a new server device for the devices and adhered the necessary polices to the domain made the tcp/ip static since i was provided a default gateway of a firewall that took network from an external source the firewall was not good enough since some users were using vpn to access blocked sites so the deployment of kaspersky was necessary to block all this actions and treat end point software vulnerabilities decreased the vulnerabilities from 4590 to 1239 adding an antivirus to the network for malware incidents which took action on all the viruses with a rate of 100% mitigation and an allow firewall for site accessing was established along side to block any unnecessary use of the network then wazuh was deployed to monitor the devices and check the SCA score of the devices

i want know where do i go from here

[dense dagger]

security consultancy / security architect / security engineer seems a good area for your experience

[young heath]

Yes i was considering either a system administrator or a security engineer

But it seems to me I'm still unhirable

So what should i do next

[dense dagger]

How long have you been employed and what are your credentials (certifications, education, etc.)

[young heath]

I wasn't employed it was my military service and i was lucky to be put in a place where i could use my knowledge and increase it

[orchid crater]

well getting laid off sucks - dont suppose anyone needs a sr. linux admin with experience in just about everything (30yrs)

[young heath]

I wasn't laid off 😂 it was my mandatory military service for a year

And am 23

[orchid crater]

no i just was lol - and im saying i got 30yr exp - but you should be able to get something - military are normally easy to hire (well in the us , you said mandatory so , india? )

[young heath]

Egypt , and no I am not going apply there

[orchid crater]

just need to get your foot in somewhere as desktop support , or hardware install , running cat 5 cable is also a good way to get started

it's how most IT get started

[young heath]

Though with my current experience i could get a better job but i guess everyone has to start somewhere

[upper haven]

hey guys, Im sort of confused rn for my next steps into cyber security. I currently have my security+ but I dont know what to do next. I have basic knowledge of networking but should I go back and do network+ or ccna or should I go ahead and move onto Cysa+, ejpt, or blue team level 1. Im trying to go into blue teaming.I worry because although I have a bit of knowledge In networking, Im not sure just saying it on my resume is enough without a big certification

[mossy tangle]

Same boat. I was naive and went straight to the Security+. Going back for the Network+.

[hidden flare]

Certifications get you past the HR firewall, they don't get you a job.

[upper haven]

Thanks I might just go do network+ as well

[serene umbra]

Gave +1 Rep to @mossy tangle

[upper haven]

yeah Iv heard that alot so currently Im thinking of doing some projects on the side like running and learning a siem

[hidden flare]

That would be something great to talk about in an interview to make up for a lack of professional experience

[hushed escarp]

I have net+ and quite liked it But most people advise going for Ccna as it’s better bang for buck. My work paid so didn’t bother me.

[rugged delta]

True to a great extent. Some certifications are good for bypassing the hr filter, some actually teach you how to do the job but hr doesn't recognise them and some are requirements (professional or regulatory) or good indicators of ability. It's a big mixed bag. Obviously it's important to find out about the value of various cert and pick the ones most appropriate to your budget and where you want to be.

[rugged delta]

If work is paying, definitely take them up on it. CCNA is more indepth than Net+, but very Cisco focused, obviously and great if going into networking, as most places use Cisco kit. For cybersecurity, the content in Net+ is sufficient to learn what you need in most cases

[upper haven]

oh ok. thank you. I think I will take the network+ because it holds value and will teach me alot of things for cyber security.

iv been contemplating on this for like nearly a week but I realized I was rushing a bit

Im currently a student so would you recommend rather than paying for the cert I just learn the contents and move on or take it right away. I do have enough budget for it but it will affect me later on a bit.

[hidden flare]

When do you plan on applying to a job that would use that knowledge?

[flat sedge]

if you're a student, the degree usually substitutes for entry level certs, assuming you are in a comp sci or IT related degree program. I wouldn't worry too much about spending money on certs to get an internship.

[mossy tangle]

I wish I would have gotten a network cert first.

[rugged delta]

Just read the book or do Professor Messer's free course on net+

[mossy tangle]

Yeah I have been using him and mike meyers on Udemy. I’m almost all the way through and by taking practice quizzes I am sitting at right around 70%

[rugged delta]

Oh you should be fine with a little more practice. Find your trouble areas and get to work

[mossy tangle]

Thanks. I have been in my head about it because a couple years ago I took it and failed.

[upper haven]

I was hoping to apply for internships for this upcoming summer

[royal zenith]

I’ve been wondering . I just started and my degree is unrelated to Cybersecurity. (comp engineer). What’s the best way to get myself ahead of others and be a good candidate in the most efficient amount of time

For internships etc

[leaden cypress]

Do any of you do bug bounty ? Are they worth it ? How to get into it ? If I accidently found a vulnerabilty on a site. Do I report it to owner or can I be paid by going trough a bug bounty ? Tanks.

[cobalt escarp]

#bug-bounty

[leaden cypress]

tanks

[deep canopy]

Someone can tell me if this is the place for tips and get hired or get a job?

[crystal scarab]

I think it is here tech and careers

[coral vault]

Hi all, would the SANS courses SEC275, SEC401, SEC504 count as a relevant basis?

[worldly whale]

Basis for what

[coral vault]

I am currently working towards developing myself towards ethical hacking and want to do so in the future in a technical capacity.

These are the first few courses my employer offers for personnel who want to enter the specialist roles in the future

[worldly whale]

If your employer offers them, take them

[coral vault]

I dont really have a choice its mandatory. I was just curious what they add... Does it teach useful stuff in general or is it more of a hr filter thing

[woeful grail]

anyone else here from Canada? just wanna know if the job market has been brutal for anyone else

[pseudo creek]

I think the job market is just brutal in general

also job hunting in the last quarter of the year can be difficult, keep your head up

[worldly whale]

Well you should be happy lol, they’re very expensive certs to get yourself

It’s mostly basics

[pseudo creek]

275 and 401 are very basic and give you a general intro to security. 504, which is one I've taken, will give you some info regarding incident handling BUT its still basic, you'll need some hands on to really make it so you are qualified

[orchid crater]

as a newly laid-off IT guy this is NOT the time of the year to be looking - im lucky in that i have severance etc so i dont "need" to look for anything right now - but ya if your looking for something it's hard - if you have some exp i would recommend talking to a recruiter/head hunter - combine that with world wide remote work and their are more jobs than you would think.

FYI im in the US

[woeful grail]

I've been job hunting since August. I'm currently employed in IT and not looking to quit without lining something up first. I've been applying to all remote and on-site roles but I'm just not a competitive candidate I guess

I'm gonna prioritize upskilling and projects, but I'm not gonna stop job hunting just because it is not a good time

[broken idol]

For moderation purposes, this server is an English speaking server.

[versed frost]

hi everyone i am hoping someone will reply to this so apparently i am intrested in the dark web first of all is it true that there are hacker orgs there and like in the movies are there hackers for hire? And are they really that good at hacking?

If it's true can i know how to enter in to one as a beginner and learn from there if possible?

[undone shore]

That is not a route you want to go 🙂

[versed frost]

Thank you for responding to my message

[versed frost]

Why not? Please tell me

[undone shore]

1. You've got a misconception over what "hacking" is. It's nothing like in the movies, for a start.
2. You may find hackers for hire on the dark web. You're just as likely, if not more so, to find law enforcement, who will happily throw you in jail for trying.
3. On a similar note, the kind of hacker you'd find there is not the ethical kind. i.e., you'd be committing criminal offences and very probably end up in jail

[versed frost]

I understand that hacking is not like in the movies as i have completed learning paths and thank you pointing out the law enforcement. The last thing i would like to know is if learning there and forming friends and networks with hackers ?

[serene umbra]

Gave +1 Rep to @undone shore

[undone shore]

Criminals tend not to be the friendliest with outsiders 🤷‍♂️
Stick to networking with ethical hackers

[broken idol]

They would just use you, as you're new

[versed frost]

I understand, thank you. I will avoid the darkweb

[coral vault]

Thank you

[serene umbra]

Gave +1 Rep to @pseudo creek

[undone shore]

Probably wise 🙂

[merry badger]

Guys I've got a question and hope you can help or support.

I'm currently in my early 30s and work on Telecoms. Always had a strong interest and passion for IT and learn bits over the years

Recently I have really been enjoying python and cyber security.

Realistically it's just a hobbies at this point but some transferable skills would be nice. I know I'm never going to become an infosec guy or a software engineer at my age and jist starting my real learning.

But what would you suggest focusing on as a more transferable skillet? My current role is around project managment is the telecoms sector. Should I spend more time with python or just stick with security?

[vast geode]

iam sorry

[broken idol]

No worries.

[woeful grail]

Why are you ruling out InfoSec entirely just because you are in your early 30s?

If you have been doing IT for some time you would have some relevant experience and skills. What exactly are you trying to ask?

[merry badger]

I would assume any more to infosec at this point or earlier would require a relevant degree in something like computer science.

Currently I'm just studying as a hobbie but moving into something that could use some of these skills would be awesome.

Basically I was asking if I was correct in my thinking and secondly if I was correct would it be more beneficial to focus on one programming language rather than cyber security.

[pseudo creek]

No, I would totally look at cyber security which is more apt to hire from different backgrounds. I would also although some telecom work wouldn't be transferable, some is. I would think programming is more difficult to get in

[vast geode]

guys can i get a job after just finish redteaming modeul ?

or i will need to more skills

or any thing else ?

[jovial cosmos]

Hey IT support technician skills translate good into cybersecurity blue team jobs right also maybe red ?

[orchid crater]

both really - most of the hardcore linux admins i know make great red team members - most windows admins i know make good blue team members 😉 - actully either can become either

[warm hinge]

Don't count yourself out just yet. Got my web developer role at 33 and been there for 2 years. Never to late

[warm hinge]

you need certifications not a module in a course completed

so many more steps you need to cover and thousands spent on tests to get the certification(s)

[boreal zephyr]

The quality of responses in this channel seems to going down.

but the questions arent much better

[boreal zephyr]

Yeah friend, you can totally change careers. Lots of people do it. I can't say that telecom is going to provide translational skills, it mostly wont from my understanding. Perhaps in terms of ICT it will, but I don't know enough to say for certain. I can say that you likely lack the foundational skill set necessary to succeed in cyber. An undergrad degree in comp sci as you mentioned would go a long way. There are other routes as well, self-taught foundations and technical certifications can get you there so long as you dont covet an "engineering" position. Analysts make very close to the same in my field and don't have undergrad degrees in an engineering discipline.

But you will need the foundational skillset and understanding to build from in order to be successful in "infosec" or any of the related fields. Its not insurmountable, Many people have gaps and several more dont go the traditional educational route, I didnt. There isn't anything wrong with that, but competency comes from more than just schooling. If you consider it a career path and work towards building a skillset you will have a much greater chance at success and you will be able to "talk shop", which I think is one of the most valuable skills you can have.

As others have said, its never too late. But it does take passion, and while the money does come, it isnt a great motivator at the start. You will be competing with people half your age and with twice the knowledge, so you have an uphill battle. Not to say it cant be won, but it isnt a quick career change.

If you have questions or would like additional guidance, please feel free to reach out to me over DM.

[merry badger]

Thanks for the response Octopodes. It was really helpful in its entirety ill drop you a dm.

[serene umbra]

Gave +1 Rep to @boreal zephyr

[tulip pawn]

Wow, are there really people in cyber that are 15 or so with large amounts of experience...

Makes me feel old then since I am late 20's trying to study and get into the field with realistically a helpdesk job since I fully doubt that there are any junior security operations analyst jobs just lying around.

[vital cloak]

Lol, I'm early 30's and I just got certified after moving from a non-technical projects background, to this. Does not matter when you get into the industry, as long as you get into it.

[hearty tree]

There are hundreds of thousands of unfilled cyber security jobs, and that number is projected to keep growing.

The caveat? They're looking for experienced people

[fallen heron]

Yeah, it's just interesting where all the experienced people are supposed to come from

[midnight rain]

how many years of experience are they expecting?

[tulip pawn]

I mean... isnt that the same song and dance for every role?

[pseudo creek]

I don't know about 15 year olds but kids are starting earlier and earlier these days. The ages on TryHackMe tend to skew young so you will see 13 year olds (and suspected younger than that saying they are 13 to get around the discord age requirement). You aren't old by being in your 20s and realistically, you should apply for any and all job which you think you can reasonably do. Of course deciding that you can reasonably do it is the difficult part. Generally, in the US, the rule of thumb is that if you fulfill 50% of the requirements, apply. Other countries can vary and I can't speak to those

[pseudo creek]

So that number seems a little high and I'm not sure how they are pulling their data. If you are in the US (which I assume you are since you are using hundreds of thousands as an indicator), Cyberseek has some interesting data but I'm not sure how to see the raw numbers. I'm guessing they are looking at job listings that have the keyword cyber in them because the jobs with the highest number of openings appear to be:
Data Analyst
Software Developer
Systems Security Analyst

https://www.cyberseek.org/heatmap.html

So now the interesting thing, again, I'm not sure where cyberseek is getting their data and I haven't dug in to see if I can find it BUT, with them reporting there are 122k openings for a systems security analyst, I decided to search both Indeed and LinkedIn. In the entire country (again US), Indeed reports there are 4k job openings with the title "security analyst" or similar. LinkedIn reports 2k job openings.

And here is the thing, in the US and I'm sure other countries right now, companies are less inclined to hire in general. The job market is really tight right now. Companies sure would like to hire more cyber professionals but budgets are tight and they can get by with what they have. What companies do with unfilled positions is they don't do as many projects, they streamline, they figure out how to do more with less. So saying there are unfilled positions is true but its not at a point that they feel a need to do something different.

Now I know this can sound frustrating, but I know the job market will open up in the future, its just rough right now. Keep getting your skills, seeing what you can do to improve, get your foot in the door where you can, etc, etc.

and lastly, lots of companies throw around that cyber is in high demand, there are X number of unfilled positions, they often do that to sell you something. I mean news articles aren't much better because its more nuanced than saying there are unfilled jobs when its really to say companies would like to hire more qualified candidates if they could / were available.

[dense dagger]

they trying to sell their courses

zero to hero get a job in security take this 3 month bootcamp yada yada

[pseudo creek]

yeah pretty much and pretty much every single cyber bootcamp I've seen is an absolute scam

[tulip pawn]

At least in Australian it might be a different market as the goverment is putting plenty of funding towards cyber security education

[rugged delta]

Add to that the Google cybersecurity certificate. Fine for someone brand new to learn some of the lingo and basic Python and Linux but not good for anything else

[pseudo creek]

well the US has a variety of programs but still it is really getting the basics, basics. The problem with everything is that in the US, we have a very high educated workforce in terms of college degrees. So companies tend to want someone with a college degree or military experience. Now you can get beyond that in a lot of ways but its just working harder, working smarter, networking, showing off your skills, volunteering at cyber conferences, being active in local cyber communities, etc, etc.

[subtle charm]

I think the "hundreds of thousands" of open jobs are really more like tens of thousands

[pseudo creek]

Google probably got a grant to do that honestly

which is what I mean by cyber funding by the government only covering the basics of the basics

or maybe they didn't, maybe they did it because they wanted to introduce people to cyber concepts

[rugged delta]

Yeah Google isn't going to hire you to do cybersecurity just for having the google certificate

[pseudo creek]

and another problem is, IT is so fluid, it changes so much, that you have to keep up with it. Promising people jobs for doing xyz thing but then making them realize that their competition has degrees, a varied work experience and drive means that unless they really step up, they aren't going to get that job

like we are still dying to find people who know cloud and cyber and its really hard, what we end up doing is hiring existing cloud people into cyber positions

[dense dagger]

devsecops?

[rugged delta]

Exactly, but when hiring, they want people who can do the job effectively and it does take a lot of skill. Granted, most of the jobs have a set of grounding skills likeknowing how programming works or understanding operating systems or networks or the cloud, in general and then being able to build on those concepts to be an expert in whatever skillset they need

[pseudo creek]

not always, but thats part of it. We need people who have a solid understanding of cloud so they can help us figure out how to secure cloud services, how to figure out what security measures we should employ, etc, etc.

[tulip pawn]

A side question and maybe off topic.

How effective is engaging in ctf for career building or is it entirely just for confirming current skill level?

[pseudo creek]

"it depends", are there networking opportunities with the ctf? Generally CTFs are for fun only

[rugged delta]

I've spent plenty of time doing AWS courses on ACloudGuru, have reasonable experience with virtualisation (vmware ESX/vSphere & Openstack), and did a cloudsec module in my cybersec postgrad. There's a lot to learn so yeah it's definitely a challenge for people

[pseudo creek]

like if you go to a conference and do a CTF, usually there are networking opportunities as well

or things like KringleCon or even TCMs recent CTF, there were prizes that could further your knowledge

[subtle charm]

imo (as a 3rd year student) it feels like it would be better if you first worked in an IT field and after knowing the in-n-out´s you transition into security.. lets stay with cloud.. and then you dive into cloud security.. or automotive software engineering, when you know the basics you will then more start to worry about secuirty

There is just so much to learn and so different..

Programming, OS, Networking, Web, Cloud, Compliance & Law

Cryptography etc.

It feels like everybody expects you to be atleast intermediate but in all of them at the same time + be EXPERT in one

[tulip pawn]

I see.. so basicly it is more of a dont bother

[subtle charm]

Regarding CTF, I have gotten myself multiple job offers from participating in live events like small hackathons where they did some challenges

[tulip pawn]

Makes sense though, your either 100% and in first place to get noticed or your a nobody.

[pseudo creek]

That's what I mean, some do offer networking opportunities

[subtle charm]

I don´t know where you are located @tulip pawn but in Germany there are some companies that do live events (sometimes not directly security related) hackathons / thinkatons and often there are recruiters / HR people from that company at that event too.. so basically you can skip the application phase and directly go to interview if you made a good impression. Example companies: BMW, European Central Bank

[tulip pawn]

Thats good to know to look more at the live events rather then the online ones to get that networking presense as well.

[fiery furnace]

Hey all, ive been applying to jobs for the past few months and havent been able to land one (SOC compliance background, accounting degree, comptia trifecta & CASP+ certificates, Google Cybersecurity certificate, home lab, and portfolio on Github). Any recommendations? I am applying to entry level IT roles and security roles (helpdesk, IT Support, Sys Admin, Security analyst, SOC analyst). I am very passionate about security but cant seem to get my foot in the door 😦

[pseudo creek]

are you getting interviews at all?

[fiery furnace]

I had 3 in the past month but was not selected

[pseudo creek]

were they technical inteviews at all? were you able to reach back and ask for feedback?

[fiery furnace]

no just behavioral interviews. I reached back out and its always, we liked you but another candidate had more experience/was a better fit

[pseudo creek]

yeah thats rough, usually if you aren't getting interviews, then its your resume but if you are getting interviews, then you might need to practice interview skills or may just be that the market is really tight right now

[fiery furnace]

Okay, thanks for taking the time to talk to me. I am hoping it is the latter but I can always improve my interviewing skills so I'll work on that in the meantime and keep applying :/

[serene umbra]

Gave +1 Rep to @pseudo creek

[pseudo creek]

if you have someone to practice with, that would be the best thing to do, also look up behavioral questions as well note ones you got and practice those

and keep your head up, the market is really tough right now, usually it starts to get slightly easier in a couple months

[flat sedge]

this is also a bad time to be interviewing - budget is available for Q1, but no one is really interested in doing work until the new year.

[orchid crater]

i just got laid off (ya i know great time for it) and ive decided im spending the next 2 weeks with fam - i'll deal w/work next year (i do have a severance for a few months - not everyone has that option) - i do wish @fiery furnace luck

[fiery furnace]

Thanks all ❤️ and good luck @orchid crater as well, enjoy the fam time

[cosmic furnace]

I REALLY wanna add onto this..

Maryland has thousand and thousands of unreported jobs, federal agencies have so many transfer programs, inter agency jobs, word of mouth jobs, and just the craziest contract jobs.

The best thing to do in Maryland is to attend a hiring fair, a lot of smaller colleges have huge connections to these upreported contract jobs.

I've seen it first hand where some agencies are just tired of posting jobs online and want you to speak to them.

[pseudo creek]

no doubt, I'd say that only about 10% of our open positions are posted externally because we try to hire from inside before hiring from outside. Also I remember going to a few conferences and people asking to please bring them their resumes as they were desperate for people. I would say regardless of where you are, go to hiring fairs.

[cosmic furnace]

Exactly! I was so desperate for a job after applying for over 200 jobs that I literally just took the incentive and walked into this small I.T. firm near me and asked if any positions were open. Got a job there a few days later.

Going to job fairs is extremely useful, especially if a hiring manager is attending. I've seen people who were just kind to the hiring managers and bypassed huge segments of their interview requirements.

Just showing that initiative to network in person can get you surprisingly far!

[fiery furnace]

I will be doing this after xmas to supplement my hundreds of online applications! Fingers crossed

[hearty tree]

Anything from mid-level to senior level experience.

I've heard from various people that in the tech industry, getting your foot in the door will be the most difficult part.

[hearty tree]

Yes, I came across cyberseek a while ago & have gone back to read more as I learn more.

I say hundreds of thousands because the national number of openings reads 572,392 as of right now. If you take into account other countries, then that number can only be higher. I'm guessing most of them are based in the United States though.

I have am confident that you're giving me great advice, and people definitely try to sell you something. But what do you think this site is trying to sell? They have more information as to how they source this data: https://www.cyberseek.org/index.html#aboutit

To be honest, I also don't get as many hits when looking online. I do see thousands of job postings when you search within the US, but that figure makes it seem significantly larger / like you can walk into a business and join their cybersecurity team

[hearty tree]

that's wild,

so the tried-and-true method of walking in the front door with your resume in hand can actually work?
I gotta try this once I start applying to jobs 🤩

[cosmic furnace]

It's heavily dependent on what company it's at and who you know there. In this situation the stars aligned, you'll have better chances at a job fair.

Just keep applying and you'll get somewhere!

[pseudo creek]

Cyberseek appears to be a collaboration but Comptia is a primary partner in it so yeah they are trying to sell certifications. But again if that number is right (500k job openings), that job data is not visible to you nor I. Lots of those job openings may be internal only positions which isn't useful for job seekers that don't currently have jobs at those companies.

[hearty tree]

that would make a lot of sense, thank you for the advice!!!

I genuinely appreciate it, and take it into account as a I figure things out while in school :}

[serene umbra]

Gave +1 Rep to @pseudo creek

[hearty tree]

I'll definitely be attending those then, once I transfer over to a university!!!

[pseudo creek]

and I'm not trying to be discouraging, we definitely need people in cyber but I hear a lot of people thinking "why can't I easily get a job if there are so many openings?" and it is more nuanced than you think. But I love working in cyber, I think its great, I love more people coming to the field, just it may take a bit of work. We are also in one of the most difficult job markets in a long time. Lots of people got laid off in the last year and so you have thousands upon thousands of people who are seeking a job who have experience in related fields or even in cyber itself and its hard for juniors to compete right now.

[tulip pawn]

Wouldnt juniors have no chance then

If your options is someone with years of work experience pivoting to cyber vs someone with little to no work experience starting in cyber. Well.. it seems like an easy answer for every hr rep in existence.

[hearty tree]

I appreciate you clarifying that.

I was applying for web development jobs for a little before I decided I really wanted to go back to school first. The competition there is insane too. One interview, I felt like asking; they had more than 17,000 applicants apply for an internship 😂

I might apply for the same positions again after school, but I got extremely interested in cloud engineering while self-teaching.

I have 3 years to go in school, and I will try to make the best of them!!

[hearty tree]

sometimes the advantage you have is that many are willing to work for cheaper,
i.e. you will not pay a junior the same as a more experienced candidate

I feel like my first career job will be a straight grind, but I wouldn't mind it 🤷‍♀️

[daring mortar]

please rate my cover letter for Safety and cybersecurity internship job posted on upwork Hello,

I noticed the need for cybersecurity intern who wants to learn and get hands-on real experience with your company. I am looking for this opportunity since I become ready after teaching my self on different lab environments like Tryhackme. I am certified with introduction to cybersecurity learning path. I am on the learning path of SOC level 1 and junior penetration tester. Regarding my soft skills I have past experience of pair programming with international students, that means I have both soft skills and collaboration skills. I want cybersecurity jobs to go longer and I went to dedicate this passion to company like yours.

Warm regards,
Yared

[tulip pawn]

This cover letter kinda assumes that the person reading it knows what's in the paths

Maybe there's room for some expansion of the letter with explanation that you learned xyz tools or skill sets that match the job requirements

[pseudo creek]

What Eduardo said is correct, juniors are going to be cheaper but also it really depends. Companies are generally trying to hire for long term, if a person is too senior, you know they will leave at the first opportunity

[fringe spade]

Juniors can also cause problems in this area, as they often tend to stay in a company for a shorter time than seniors, because they are first hired for a low wage. After a year (or less) they can opt for more mid-level positions with a nice salary boost

• the junior, for the first few months does not bring much profits to the company, sometimes even a loss, as they have to be trained first to do anything without much supervision

[hidden flare]

After having worked for a couple years and watching our company hire exclusively entry-level candidates for a position, I can understand why a lot of companies tend to avoid it. So much time spent handholding..

[fluid trench]

100%. i think the smartest way would honestly be hire a mix if you can,

[fringe spade]

Agreed, although hiring only seniors/juniors might be a business model for some companies

[vestal egret]

If you don’t hire entry level people the industry will die out. Everyone will have been entry level and hoping for a chance at one point so why can’t we

[dense dagger]

Are you talking about IT in general or cybersecurity?

[vestal egret]

For me cyber

I’ve seen a lot of people complain about entry level people who seem to forget they were once entry level entry level. Just sucks

[dense dagger]

Not to be gatekeepy but cybersecurity is seldom an entry level job

[pseudo creek]

Well there is this aspect that juniors often don't stay long. In general, we say it takes about a year to train a junior but also takes about 6 months to train an external, which is why often internal hiring can be preferred. Also for many companies, cyber is not something that brings profits, it is a cost center. I've never brought profits as I work cyber for a large company, but really what we are looking for is productivity.

[pseudo creek]

it won't die out there are a variety of reasons especially in the US. The military gladly trains people in IT and cyber skills, when those people leave, they are easily hired. Also helpdesks... it is a common pipeline, I know lots of people don't want to do it, many people didn't do it but its one way we get people into IT and eventually cyber

[dense dagger]

Agree, often times you also won’t be employed at a large enough company that has a mature security posture, those types of companies can handle hiring entry level roles because of their pool of talent. You’ll most of the time deal with SMEs which are trying to grow their security posture and aren’t really looking for entry levels who they actually have to train.

[fringe spade]

Well, looking at cyber as “a cost center” is not always the best way. Multiple companies profit from cyber as this can be a USP for some tech/services and can be an investment that will bring profits in the future. I’d say that this industry is a mixture of both technical and business aspects, therefore it should be seen as an opportunity to grow the company, not only “prevent losses from cyberattacks”

[pseudo creek]

I'm not sure what a USP is, but often companies talk about cyber being a cost center since those in cyber work for the good of the company vs selling products. But overall, companies have seen the detrimental effects of cyber attacks so they believe cyber is a good investment but its also hard to say "we want to hire someone who will not bring much value to the company for a year and will likely leave once they do". Luckily the company I work for strongly believes in investing in cyber and we do hire juniors straight out of college and train them up and yes a good portion leave but many stay.

[fringe spade]

Oh sorry, USP as a unique selling point

[dense dagger]

Agree, most cybersecurity requirements take time to implement and not everyone is always on board with security as it can sometimes pose with business requirements.

[pseudo creek]

oh my gosh, I have so so many stories about programs within my own company trying to skirt security because they believed it halted progress but security had to adapt

it is also a balance of figuring just enough security to get things done and balance the business needs

[fringe spade]

Yeah that’s the hardest part, as the technical people might not understand the business side and vice versa

That’s why a good CISO that has experience in both is a miracle for the company

[pseudo creek]

yeah I mean its sad to say that security has to be flexible but we do, perfect security doesn't exist but we can get to a good level

[dense dagger]

Yeah, and that comes with experience. I face impostor syndrome often because I'm at an analyst role with 1 yr. of experience, my superiors went on to other companies and I'm left as the only staff level along with another one and its so hard to say whats the best security for these types of things because I lack sysadmin/developer/network experience

[fringe spade]

All of the superiors? 😳

[dense dagger]

Yep, staff level and manager only

no supervisory level

i'd say its a shitty experience but i had to push through. i had to learn tons of stuff on a short timeline

[fringe spade]

Sheesh that must be hard, but I guess it might be motivating to learn more in less time

Although learning from more experienced colleagues while on the job is probably the fastest and most effective way to learn new things

[dense dagger]

i agree. im grateful that there are some experienced staff on other teams (devops / system admin / network) that help me able to understand stuff

[hidden flare]

Of course, everyone has to start somewhere.

[dense dagger]

its all just being a big sponge and taking everything in

[fringe spade]

That’s a great mindset. Worst thing to do is to block yourself from getting new knowledge and think that you know everything, especially in cyber.

Are you doing any other certs now after OSCP btw?

[dense dagger]

I have a voucher for ASCP which I haven't taken yet but these are what I'm looking at in the near future:

• CRTO I & II (generally for learning only, I don't see these anywhere in job desc. around my area)
• PJMT (for mobile application security testing, kind of a work requirement but we'll see)
• OSWE -> OSEP - OSED (i just wanna be a kewl OSCE3 kid)

[fallen heron]

I don't know how you can bear to do that much offsec

[fringe spade]

That’s pretty cool, good luck with all of them. I have my OSEP exam scheduled in 3 weeks so we’ll see how it goes for OSCE3 lmao

Never saw any mobile certs as a requirement on any posting though

[vagrant iris]

Hello

[fringe spade]

I find their certs addictive

[fallen heron]

I'm completely on the opposite side, I'm not touching anything after pen-200 even if someone offers to buy me learn unlimited

[dense dagger]

No one really looks at other certs in my area other than OffSec

[fallen heron]

Do you really need anything more than OSCP?

[fringe spade]

Yeah these are also exhausting, although OSCP is the least pleasant one to do

[fallen heron]

It wasn't exhausting, it was just a joke

[fringe spade]

Most of the time, no

[dense dagger]

OSWE for whitebox pentesting is nice, I think its the only other cert they have that actually has value IMO

OSEP and OSED, maybe when they update the course content, it becomes better. Currently, there's a lot more value on getting maybe CRTO I & II and an unlimited MalwareDev Academy sub than doing both.

[fallen heron]

Since HTB has come out with an advanced web path, I wouldn't touch OSWE with a ten foot pole

I was so disappointed with pen-200, if that's their most updated course, I don't want to see the others

[dense dagger]

The new path is amazing. I definitely want to participate on it.

[fallen heron]

Yeah, it's great, and the next thing will be advanced AD, can't wait for that one

[dense dagger]

Oh yeah that too, it sucks that a lot of those modules are behind a cube paywall

Maybe when I can afford their Gold Annual plan, I'll take it

But the OffSec certs, strictly only as work training

[fallen heron]

Some unsolicited advice, but none of their annual plans are worth it

Gold is worth it only now with the 20% discount, after that it won't be

Platinum sub is where it's at

[dense dagger]

But the platinum sub, you have to keep buying those cubes too right?

I just like the less hassle maybe, I haven't done the math though on how much I'd lose/save

[fallen heron]

You can have it active as long as you need, you get 1000 cubes a month, you'd need a very fast pace to actually require more than that a month

[fallen heron]

Yeah, I follow their server very closely and people have done the math before

Not only is platinum cheaper but you're not on a timer where you need to finish everything you want within a year

[dense dagger]

Yeah, it seems like this is the way to go if you're planning to do the other roles but holy the price on the web expert is 7500 cubes

[fallen heron]

You get back 20% of those cubes from modules you complete, so it's more like 6k which is 6 months platinum

Basically 400-500 for the whole path

[rugged oxide]

hello guys

[sleek sedge]

Student plan is awesome.

[fallen heron]

The value for money is insane with a student plan

But that's up to tier 2 and doesn't concern the advanced path

[sleek sedge]

Oh it doesn't cover the advanced ones? Shame

[fallen heron]

Makes sense to me, it's advanced after all

But the student plan covers three cert paths + anything tier 0-2 that's not in those

[rugged oxide]

i'm looking for SOC internship is there anyone with a link to it?

[fallen heron]

Search local job sites

[rugged oxide]

haven't got any in my country

[fallen heron]

Along with local companies that may offer internships

Then LinkedIn and Indeed

[rugged oxide]

okay let me checks thanks

[serene umbra]

Gave +1 Rep to @fallen heron

[stoic cave]

And that kids, is how you get fired

[orchid crater]

ive had more than a few arguments with the sales dept about crap like this.

[hazy dove]

How does tryhackme courses compare to beginner certifications such as the google certificate and such? I’m a beginner, Should I be starting with the google certifications over tryhackme?

[dense dagger]

tryhackme overall has more content imo but the benefits of the google cert is you get % off Sec+

[vestal vector]

is it a waste of time to get those free certificates to add on linkedin. I'm talking like "Splunk intro / Splunk basics etc.", or "Blue team free courses/certificates" or "Palo alto/Cisco academy etc."

i'd be inclined to think they'll be a waste of time in regards to actually getting a job but i see some people collecting them like pokemonz

you can finish most of them like in 1/2 days so they feel pretty worthless to me but idk

[fickle grove]

If they can use it as CPE credits, then I suppose it is useful in a way.

[vestal vector]

dont think they give any credits

but i'm wondering if recruiters or employeers would ever care about any of those on linkedin

[fickle grove]

Some do provide completion certificates that indicate the number of hours it took to finish or complete the course.

I don't think recruiters or employers take notice of those though.

[vestal vector]

yeah i also see a vast overestimate of the "time/lessons hours", like material that's gonna last for maybe 3 hours and they write "15 hours of lessons!!"

[rugged delta]

You shouldn't waste your time with the Google certificate. Do some Try Hack Me and learn how everything works. Then consider Security+ and Network+

[hazy dove]

thank you

[timid forge]

Hey all, quick question. I went the degree route for cyber (total regret) and am now on the job hunt. I took the google cert (another waste of my time) and have been playing on THM. Do any of you feel that completing the THM Splunk classes is sufficient enough to be label as experience on a CV?

[rugged delta]

If you're a subscriber and you complete all of the splunk rooms you could be able to discuss features of it in an interview etc

[timid forge]

I am and dove in with the SIEM room. Since then I have moved into the Splunk rooms. Thank you for your input.

[serene umbra]

Gave +1 Rep to @rugged delta

[fringe spade]

Set up a Splunk environment using virtual machines, create some queries, complete the THM rooms and id say you’ve got some basic skills needed to work with Splunk in a real environment

[timid forge]

Any suggestions on the VM setup? Links or GitHub repositories and thank you for the idea.

[fringe spade]

https://zainulabidin7.medium.com/how-to-install-splunk-enterprise-and-ingest-logs-using-splunk-universal-forwarder-b5cd36196642 this or you could try to install Splunk Enterprise on a Linux machine if that’s better for you

It could could be a fun project, also mixing with setting up an Active Directory lab to learn windows administration

[flat sedge]

Instead of splunk, I'd recommend Wazuh as an alternative - fully open source and agent based monitoring is becoming more and more common

[fringe spade]

Another good one, I’d say both are worth a try and will definitely be an interesting thing to mention during an interview or on resume

[grand kite]

Hello

Can someone detail the difference between IR and pentest?

I'm considering IR
I had a bit of playing around with pentest and didn't like it much.

In other terms: Can an Incident responder tell me what to expect from IR day to day?

[vestal egret]

ir is blue team the defenders and pen testing is red team the ones who hack to find the problem

[fringe spade]

Incident response acts up when they or someone else from the blue team identifies an incident for example a cyberattack on the company

In that case they try to stop the attack and reduce the impact

(In my opinion) it’s way more stressful than a penetration test, as in IR time is a huge factor and you have to act quick and be effective

[lofty quiver]

heya guys i registered for my N+ exam and got the official study guide, hopefully a strong focus on networking can help me in cybnersecurity in the future.

[fluid trench]

both VERY different. I do mainly IR. Pentesting is taking a network, software, webapp, or whatever, and trying to find every vulnerability to send as a report to be fixed (in loose terms).

IR (in my case, DFIR) is acting after an incident, or attempted attack. Without breaking my NDA, and example would be we had a client who was recently hit over the weekend with a remote code execution vulnerability (known CVE). Luckily it was caught by the sentinel firewall, and the IPs were blocked, but I had to go through their system logs, their SIEM, their AD, event manager, and their servers to ensure integrity of the system. Ensure that everything was caught. Make sure that over the weekend during the incident, that any unknown IPs were investigated, and confirmed to belong to company assets or vendors. That's the more exciting and stressful scenario. There is a lot of liability if you miss something.

On the other hand, most of the time in our case, it's responding to phising attempts and clicked links. Responding to employees downloading malware, and ensuring we get it removed. A lot of repetitive stuff. Changing passwords, logging out of all sessions, checking email forwarding rules, and checking sign in attempts and 2fa attempts.

[grand kite]

is DF separate from IR?

[broken idol]

No, IR is digital forenics.

[grand kite]

So in terms of stress, it is high in IR?

[grand kite]

That is good to know, since sometimes I see DFIR and others IR so I thought they can be separate

[broken idol]

They are the same, but have their differences also

[fringe spade]

Probably one of the most stressful jobs in cyber

[broken idol]

DF is mostly done after the event is happening.

IR is usually done during the event.

[grand kite]

Makes sense

Apart from SoC, DFIR and pentest
what are some good options in the field?

[broken idol]

Depends on your interest really.

[grand kite]

I'm usually interested in programming with low level languages like C

I have CCNA and network security

And I like to configure systems

[fringe spade]

Maybe you will enjoy malware analysis or exploit development?

[grand kite]

Is malware analysis in high demand?

I would rather not have to do work with any government

[fringe spade]

Not as much as the other roles that you mentioned

But it’s usually better in terms of earnings

[grand kite]

What about exploit development?

[fallen heron]

even more niche, and you have to be really, really good

[grand kite]

that's for the elites then

DevSecOps?

[fringe spade]

The demand is quite high

[fallen heron]

I think an important question is what's your work experience so far?

[grand kite]

I'm still a uni student

I have worked on multiple personal projects (again mostly C, but some bash and Python too)

[fallen heron]

with CCNA you can probably score some kind of network admin position, and move up from there

[grand kite]

What would combine sysadmin with security?

I guess some sort of security engineer?

[lofty quiver]

im doing Network+ instead cause its way cheaper in my country, you think its fine?

[fallen heron]

only you know that, is it on job offers or not?

[grand kite]

I will investigate DevSecOps

What makes you like/hate your current security role?

The question is for everyone: pentesters, SoC, IR, red teamers, Risk management...

[fluid trench]

depends on the day

[fringe spade]

I enjoy being a penetration testing consultant - we get to work with different companies, software and environments, so it doesn’t get boring

[fluid trench]

I enjoy DFIR, but I also enjoy pentesting and reporting. Depending on the pay I'm able to get, I'm about to be offered the chance to take over the security dept under our CISO, so I'll have my toes in every domain of our security. The plan is to have me carry out pentests eventually while we grow, and then as my duties fill up, pass that on to more employees.

[grand kite]

I'm having a hard time deciding what to do

this field is so large that I can't get myself to focus on one thing

[grand kite]

What does a normal work day look for you?

[grand kite]

You sound a good fit for purple teaming

[fluid trench]

I do both 🙂 so by technicality I am

I thoroughly enjoy my job

[fringe spade]

Well I spend most of my time on engagements, report writing is usually less than 30% of the time for one audit. The work is mainly remote, so I’m just trying to hack companies from home haha, it’s not a 9-5, but a client sometimes demands pentesting during nighttime or working hours.

[grand kite]

How did you decide what path to follow?

[pseudo creek]

honestly, I wouldn't worry about it too much, the field is very fluid, try one thing if it isn't to your liking, you can pivot

[fringe spade]

I always liked IT, started with setting up servers for computer games and writing simple scripts, but never really thought that I’d end up in this field. Then discovered cybersecurity, done some learning for fun and landed a job at a relatively young age

[fallen heron]

where you start is most likely not where you'll stay, so it really doesn't matter, take whatever job you can get and go from there

especially in the current market

[pseudo creek]

yeah that is what I was trying to say, my first IT job is nothing like my current job and my current job didn't exist when I got into IT

[fluid trench]

current market sucks

[orchid crater]

i have been a windows admin , the guy running cable , a web developer , a database admin and a few other things in the past 30 years - i say try whatever you want and see if you like it - no one says you must have a gole all the time

[fluid trench]

I applied to probably 800+ jobs

got 3 interviews

[grand kite]

Wow 800 to get 3!

[fallen heron]

yeah, I see people sometimes give up and get really down after 50 or so applications, but it feels like you can easily go into the high hundreds these days

[fringe spade]

Recently it happens even more often unfortunately :/

[fluid trench]

it's because I had no experience, no certs, and no schooling

[orchid crater]

i let head hunters / recruiters do all that for me - they also tend to weed out the stuff thats not worth it

[fluid trench]

have you landed a job?

I tried recruiting agencies, but they found nothing for me

[grand kite]

I was thinking about following IR path on letsdefend

[orchid crater]

me no - but i only got laid off 2 weeks ago and i have some severance so im going slow till the new year - really bad time to be looking , but jan/feb is normaly a good time as companies have new and biger budgets - there are 1 or 2 good leads

[grand kite]

But the subscription is not really cheap (it needs VIP+)

[fluid trench]

how much is it?

[orchid crater]

place in NJ looks good - but it's a fricken 90 min drive each way

[pseudo creek]

look at DFIR Diva, she has a ton of free resources

[grand kite]

40$ per month

[pseudo creek]

https://dfirdiva.com/

you shouldn't really be using paid resources until you get the basics down and exhaust free/cheap resources

[grand kite]

Exactly what I was thinking

[fallen heron]

since you're a student, I fully recommend the student sub on HTB Academy for $8 bucks a month, their SOC/IR path is getting some great feedback

[fluid trench]

Lots of good soc stuff coming out recently. Sad they all use splunk lol

[orchid crater]

https://tutsnode.org/ is a good place for getting video series - i grabbed a CEH course and exame prep off that

[fluid trench]

just cause we don't use splunk so it feels way different

[pseudo creek]

well if you know splunk, you can learn other similar tools

[orchid crater]

splunk is qiute old

[fluid trench]

yeah, ours is just quite a bit different layout I feel

we use Graylog Enterprise

[grand kite]

Is it a good idea to try and follow 2 paths at once?

[fallen heron]

pretty sure they literally take paid content lol

[pseudo creek]

splunk is used widely in the industry

[grand kite]

While I didn't like pentest, I left it halfway through the path

[pseudo creek]

try to get the basics down then you will be able to learn specifics later on

[fluid trench]

yeah i know

[fringe spade]

Linux is also quite old, but it is still widely used

[grand kite]

Thanks everyone for the feedback!

One more question: How much relevant is a PhD in this field?

[pseudo creek]

a PhD is only relevant if you want to do research but you won't be doing pentesting or IR with a PhD, you'll be doing research or management

[fallen heron]

right in front of a moderator lmao

[cunning shadow]

Done!

[cunning shadow]

[BANSPAM] I cannot DM della_jackson#0!

[grand kite]

Lol nice

[pseudo creek]

makes it easy

[fluid trench]

man two in a row? I just had jabba ban one in #infosec-general

[fringe spade]

PhD might be really useful in machine learning as that’s a field that mainly focuses on research

[exotic sand]

Heeey guys!

Sorry to jump in like this😅

Who is based in the US here?
Also, if you are a recruiter based in the US the THM team would love to ask you a few questions regarding careers in cyber and the hiring process for junior roles.

We would really appreciate your help so please feel free to DM me or katiethm. We can offer a £20 amazon voucher ☺️

[broken idol]

Same user.

[orchid crater]

sorry cybermo , i use recruiters - but i cant shoot an email to one or 2 to contact THM

[exotic sand]

Thanks febert! That would be really helpful! I will DM you a contact email for our team ☺️

[serene umbra]

Gave +1 Rep to @orchid crater

[grand kite]

Ok thanks. An engineer it is then 🙂

[serene umbra]

Gave +1 Rep to @pseudo creek

[orchid crater]

also going to post somthing on linkedin

[exotic sand]

Thank you so much! You are amazing!!! 🙏🎉

[orchid crater]

i would hop onto the search , look for each of those tools and do the room it points to

starting with https://tryhackme.com/hacktivities?tab=search&page=1&free=free&order=most-popular&difficulty=all&type=all&searchTxt=nmap

[sleek sedge]

Woops wrong channel

[tranquil zenith]

Hey everybody, quick question. I’m thinking about applying for some local cybersecurity courses that offer a CompTIA CySA+ and within their application, they ask about any prior IT courses or training. I’ve spent a lot of time on THM paths and earned some certificates so would that count ?

[orchid crater]

i would definitely mention it - it lets them know you have the basics allready

[stoic cave]

Like accredited college courses?

[tranquil zenith]

Awesome thank you !

[serene umbra]

Gave +1 Rep to @orchid crater

[stoic cave]

If it's a bootcamp, I more than likely would not recommend that

[tranquil zenith]

It’s a free 15 week course

It’s through Per Scholas I’m not sure if that’s bootcamp or not

[stoic cave]

I guess my question would be how is it free if you're able to sit for a paid exam

[tranquil zenith]

I honestly have no clue, my barber told me about it and he said it was free 🤷🏻‍♂️ I’m still looking into to see what they’re all about

[orchid crater]

back in the mid 2000's homeland security was paying security personnel to go around giving courses to IT professionals , it's how i learned about the existence of metasploit - and that was free (well the tax paiers paid )

[orchid crater]

this is definitely the place where people would sniff out a scam 🙂

[stoic cave]

Yeah I'm not saying it's not possible, just saying to be wary

[orchid crater]

well if your goona ask , might as well do it in a room full of people who look at span a lot

[tranquil zenith]

I mean I’m sure it’s not as good as going and getting a college degree but any experience is better than none I suppose. He already finished his classes and said he feels like it worth it

[orchid crater]

being able to acctully do what you claim to do is more important than any cert or degree to most interviewers , only when you start looking into goverment jobs or working for a collage do they ask for that and it's not often if you have experience.

so i say get all the training you can

[fringe spade]

Sometimes clients require higher education and/or certifications, but real knowledge and skills are 100x more important

This is also the reason why some employers have a strict requirement for having one of those

[orchid crater]

once you start looking at security clearances and background checks the certs do come up

but thats not entry level stuff at that point

[tranquil zenith]

I agree 100%, I’m trying to get as much practice and knowledge as I can

[orchid crater]

speaking of - did you know it's a requirement to have a degree in criminal law to even apply to be in the fbi

seometimes weird facts just come out of my head

[fringe spade]

Thats interesting

[tranquil zenith]

I didn’t know that, that’s pretty cool

[orchid crater]

ya tv makes it look like it's just go to langly - a friend of mine got out of the army (airborne) and found out about that when he looking into it - the army would pay for it (gi bill) but he instead opted to work in customs at the airport

[pseudo creek]

the fbi requirements are pretty high, when I talked to the fbi, they definitely were looking for a degree

but you don't have to have a degree in criminal law if you are going into cyber security

only thing is though, like I can't imagine some of the stuff the FBI sees, that isn't stuff I would want to see. Like the stuff we have had to call the FBI about... oof

[blissful nova]

how hard is it to become a pentester and to find a job?

[fluid trench]

partially true? You need a bachelors, doesn't have to be law related

They hire teachers, lawyers, computer science, etc.

[pseudo creek]

a lot of that depends on which country you are in, if you have a degree and what experience you have

[blissful nova]

I live in the states and i have no degree but i was a game coder before i wanted to do cyber security

[orchid crater]

the whole human trafficing thing i could never deal with

[orchid crater]

as ex army he wanted field agent

[fluid trench]

FIeld agents are also hired with any bachelors

may be the best option fo ryour chances, but there are no requirements

I've seen special agent postings with "cyber security experience wanted"

[stoic cave]

Not sure if it's a hard requirement, but CJ is definitely preferred for field agents.

[fluid trench]

def preferred. just pointed out not a req

[stoic cave]

They accept other degrees for all jobs, but field agent is kind of in its own category

iirc they want a masters degree as well

This is from several in-person conversations

[fluid trench]

ah, mines only coming from the listings I’ve seen put out

could be that they aren’t hard req, but unlikely you get hired without

[pseudo creek]

if you see them at a conference, talk to them if you are interested. Their pay is still not great compared to industry

but without a degree, they won't be too eager about you

[stoic cave]

And being able to work very long hours and move from office to office

[grand kite]

Still in the quest of finding my starting path

any detection engineer here?

[fleet belfry]

is there any job position that average speaking is remote?

[grand kite]

There are remote jobs in this field

[fringe spade]

There are remote positions, but it’s harder to find those when you don’t have too much experience

[fleet belfry]

am I wright in saying that remote position requires a bit more of programming skills other than simple analyst skills?

[fringe spade]

If you want to become a programmer, then sure you’ll need to have that skills, but for a security analyst or a penetration tester programming skills are (most of the time) not that important

[pseudo creek]

Nope, all of my team is remote but none are programmers. We are all experienced.

Our cloud security positions are mostly remote

[orchid crater]

i never understood the reasoning behind having people commute to an office , one thats costs the company a ton of $ , to log into a computer , just to be able to work with machine in another state in a dc - and that is just admins , the devs are mostly in the same position - it DOES allow you to socialize more (this is a human requirement) but it doesn't make any sense from a financial point of view.

[pseudo creek]

some jobs cannot be done at home but also I think employee growth can be stronger in an office. My company realized long ago the benefits of WFH, I've been WFH off and on for 20 years, became full time WFH 7 years ago. Other aspects include that some management really feels if they don't see you, they think you are goofing off. Its all part of the work culture that has to be fostered though to enable WFH

[orchid crater]

that whole management thinks your goofing off tells me 2 things , bad managers and people who do not want to be there

[grand kite]

I think a hybrid approach would be nice

Like a day or 2 at the office

[hidden flare]

I wouldn't want to WFH full time. I'm more productive in an office

[orchid crater]

im just outside a major city so the number one hassle is the commute - ALL the roads get backed up all the time , and i refuse to drive in the city at all (so it would be trains for me) - i would like a hybrid thing , as long as it doesn't involve a 1 hour drive back and forth each time

[pseudo creek]

I'm definitely more productive at home than in an office

[grand kite]

Yeah sure and no transport

[fringe spade]

I’ll do only 25% of the work I was supposed to do in an office lmao, too many distractions

[grand kite]

For me a day or 2 is nice to socialize with others

[fringe spade]

Everyone is different

[pseudo creek]

I haven't been colocated with my team for 16 years, I have worked in distributed teams for a really long time

we are all across the country and now mostly WFH

but I had way too many interruptions from people when I did work in an office beyond the office being loud in general

and I still 'socialize' with coworkers but its different and more timebound

[fringe spade]

Yeah, I don’t like working from an office but I like having the possibility to meet and socialize with my colleagues once a month/every few months

[orchid crater]

i have an issue with stupid - and unfortunately in a large office more than a few people working dont have a full deck and i loose patience fast (its a char flaw i know) - IF im coming in into a place with confidant people in the IT field working with me thats great , if i end up sitting next to the marketing stratigest that looks like he is still drinking on the weekends with his collage buddies then i will be taking a ton of breaks.

[grand kite]

The "socialize" part became important for me due to staying at home most of the time for 3 years straight with minimal socialization (as a student)

That took a toll on me

[orchid crater]

doesn't get better as you get older - all my friends went off , had kids and only 1 or 2 do i ever talk to , my social circle is quite small and after a breakup last year im also finding myself alone more than not - i do force myself to go out to a local music act (lots of restaurants and bars w/live music around her)

[grand kite]

That's so much promising

For me it is due to school friends going each their way and cousins out of the country...

Quite the loner

[orchid crater]

if you get married and have kids your social circle gets larger as you get involved in school and sports and all sorts of things that other parents are doing - but if your like me and have never had the desire (or even understand why anyone would want to that to themselves) for kids - you tend to loose a good deal of the ones who go off to have a fm as they are busy - just be aware of it

[grand kite]

My situation got better this year

found a couple of new interesting friends

Anyways this chat is for careers so...

I'm looking for anyone who tried detection engineering

or DevSecOps

[sleek sedge]

@pseudo creek How much of your WFH is video-meetings?

[grand kite]

Hope it gets better for you sir

[pseudo creek]

0

(you also don't have to have kids to have a large social circle, I have a decent social circle, I have friends with and without kids, I have no kids)

[orchid crater]

when i was working (laid off 2 weeks ago) the video was once a day for scrum w/team and 1 -2 video calls a day , sometimes more if something big was going on . and slack was on screen 24/7

[pseudo creek]

my company does not have a strong video culture so I do have a lot of meetings on the phone but rarely is it on video

[sleek sedge]

Fair enough!

[grand kite]

My camera is taped, would they mind 🙂

[orchid crater]

true , i was just saying i lost a good chunk when they went their own ways - most of my circle was tied to my ex also so that is an issue.

[pseudo creek]

I'm an architect for a DevSecOps team if that is helpful

[pseudo creek]

you would get a company computer (hopefully) and it depends, some companies will expect you to be on video

[grand kite]

What does DevSecOps do?

It appears to be a loose term

[fringe spade]

You can always get one of those fancy camera shutters for a laptop

[pseudo creek]

it is a loose term

so there are 2 different camps of DevSecOps... the Sec just means you integrate security into the process... but on one side you have Development so you could be developing software... on the other side you have operations so you could be doing Infrastructure as Code type work, I'm on the side that focuses on the operations piece

[orchid crater]

my company supplied the laptop i used - personally i put a separate usb camera on it so i could rdp to the laptop - but i also have a sliding cover on it - some meetings we kept cameras off (normally a sales meeting when i was acting as a solutions engineer i would just have my icon up) the only time we HAD to have our camera on was during the quartly company wide meeting - our ceo said he wanted to see everyones faces - even he didn't put anything more than a t-shirt on unless he was doing sales calls (then of course it would be a suit)

[pseudo creek]

I mean I've seen DevSecOps referred to things I wouldn't consider to be DevSecOps but they use it and those are teams developing actual software

[orchid crater]

if you put DevOps on your resume , you should really know CI/CD and git - the Sec part of that can cover a lot including how the pipeline is setup , what the code does and what hardware it will run on , really dependent on the project/client

[grand kite]

This thing in cyber related fields is so annoying

Even security engineer is a loose term

[pseudo creek]

thats because there is no official place to define all job titles, I mean NIST in the US is trying

but where you find IT, you will find security

and its also why you should really ignore job titles

[grand kite]

I thought because HR are clueless

[pseudo creek]

I wouldn't even put DevOps in your resume, but I would put the various tools that are commonly associated with it

[pseudo creek]

no

[grand kite]

What if a hardware failure occurs in their laptop? Do they blame you or what?

Or investigate

[grand kite]

Like GitLab CI/CD?

[pseudo creek]

ask 10 different cyber folks what a cybersecurity engineer does and you'd probably get 10 different answers

[pseudo creek]

they replace it...

[grand kite]

Ok. Sorry HR people

So for devsecops starting with CI/CD would be good?

I already have very basic pipelines for my projects to do tests

[orchid crater]

well we are all system admins so most things we are expected to fix ourselves - and i had a batt turn into a taco , they dont put blame on anyone (unless you were using it as a door stop and the door smashed the screen) they just shipped me a new one

pita because then i had to customize it to my likeling all over again

and i ended up with win 11 insted of 10

[grand kite]

I get to put any OS on it?

I'm more comfortable with Debian

[pseudo creek]

I think you are getting ahead of yourself

[grand kite]

Sorry just curiosity questions

[pseudo creek]

I would less start worrying about what kind of laptop you are getting and really just figure out your path

[orchid crater]

despends on the company - most corp laptops etc have bulk licences - i had a choice between a windows laptop or linux - because of some of my tools i took a windows one but installed WSL on it right away

[pseudo creek]

I mean, in my company, no you have to use either MacOS or Windows desktop, you cannot use Linux

but if you must, you could have a Linux VM

[orchid crater]

ya im just providing background - this is all secondary to getting a job you like and want

[grand kite]

I guess I will investigate DevSecOps

Thanks again everyone

(For the third time)

[fluid trench]

it’s also a benefit of collaboration. I lot easier to work with someone in person to fix an issue then to remote in and talk via Teams

[amber mauve]

hi there , i am just a newbie enrolling some things out . am i free to ask what it requires to atleast become a basic ethical hacker or maybe an actual hacker ?

[orchid crater]

i also think there is a mentality from up high (as in execs) to do the same thing that has worked for decades - new stuff doesn't work well in large companies - it's why just about everyone of them has some CD library or something running old software in the closet in the basement.

i was changing reel to reel backups 10 years ago if that gives you an idea of whats out there

[dense dagger]

Also, people tend to reply longer when remotely

[dense dagger]

not sure if this was also discussed but paying rent for something not being used is also an issue. there are companies that have leased out office spaces for around maybe 3-5 years and want to see some ROI on their investment.

In my country, there is actually tax write offs for it if at least 20% of the workforce are in office now after the COVID lockdown.

[orchid crater]

ya there are some leases that are still in effect and that is an issue - companies in the us got huge tax write offs last year , wont happen this year BUT year to year leases are common in smaller start ups or consulting firms and those acctully can pay more (startups are hard as you tend to wear lots of hats)

[pseudo creek]

Not necessarily, screen sharing is a thing

[orchid crater]

of course if you have only used teams then i can understand that line of thinking (seriously leave it to M$ to fk something up)

[fringe wigeon]

I finished my bachelors in computer science earlier this year and wanted to start with a junior role in pentesting/consulting, but the competition is tough.
I'm considering writing applications for sysadmin and netadmin roles as well, since there's usually a lot of open positions for that.
Do you all think that would be a good way to get started in the cyber security sector? Any other suggestions for entry-level positions that might be good for someone looking to get started and earn money for certs?

[orchid crater]

wow - i just droped my resume into chatgpt and asked it to improve it focusing on my role in security and , wow , um .. it feels like cheating using this , wow

nothing is untrue , but it really shines a light on some very special skills that i would of never worded as such but , wow

[brittle pier]

Don’t let me catch you using chat gpt around me boy. I got my eye on you Mr

[digital fern]

Hello everyone

[fleet belfry]

did any of you got appreciation from an HR or any company having tryhackme certification inside the CV?

[fluid trench]

I did not. I got more recognition volunteering as a website admin for a local security meetup

[fickle grove]

I don't think HR folks would appreciate THM completion so long as it is not one of the keywords they are looking for in a candidate.

[urban shale]

Hi @fleet belfry
As ISO, I check if candidates joined CTF, improve their skills on THM or other platform.
HR are doing the background check , run interview to catch if the candidate has the correct mindset to not harm the brand , salary discussion, etc.
We are working together when I obtain a new headcount.

[pseudo creek]

I'm not in HR but I am often asked to review resumes to see if we should provide an interview for our cyber positions. I don't deal with a lot of junior hires though usually people who have already been in the industry for 10+ years. BUT sometimes I am asked to review resumes we get from people re-entering the civilian work force and one thing we do like to see when that they have a continuing education/personal growth area which could include things like THM, HTB and others.

[errant marsh]

is Sec+ a good cert for beginners or should i get a pratical one like pnpt or ejpt

[fringe spade]

Which role are you interested in? Are you already working in cybersecurity/IT?

[errant marsh]

am a cybersec student

[royal zenith]

Salam

[fringe spade]

And you want to become a penetration tester orrr another role within cybersecurity?

[errant marsh]

cybersecurity analyst , as PT is a mid to senior role

[fringe spade]

Yeah, then Sec+ will most likely have more hiring power, as it’s more applicable for a cybersec analyst

eJPT is good, but it does not have a lot of value for recruitment

[midnight rain]

what about ecppt or ewpt

[covert tundra]

heyy guys, i am a beginner to cybersecurity and chose tryhackme as the platform to learn the foundations and hone my skills, i recently completed my bachelors in comp sci with a gap year and multiple backlogs and i am planning to apply for PG diploma course for cybersec in toronto, canada. the issue is these colleges have a set requirements of backlogs and gaps that they can accept and i have exceeded those limits, my counsellor guided me that with proper SOPs and justifications for backlogs my chances could increase and with certificates for courses in the similar field should help make my application stronger. i was wondering if me stating my training and achieving badges from tryhackme with my level would be acceptable by the colleges or should i aim for other paid certificates?

[fringe spade]

I’d say these are better than eJPT, but still not as recognised as OSCP. Depends on your location, I’d suggest looking at your local job postings and checking which certs are listed

[covert tundra]

i am from india and i am applying for colleges in canada

[midnight rain]

OSCP is the widely recognised one, but its too expensive. Is there an exam only option. I dont see it here https://www.offsec.com/pricing/individual/

[fallen heron]

There is no exam only option

[midnight rain]

that's a bummer

[coral vault]

I did. They said it showed affinity and dedication. The personnel advisor liked it and so did the hiring manager

[dense dagger]

They used to have a 30-day and 60-day bundle but its all gone now

[vast geode]

What keywords they will search for?

[fallen heron]

Whatever is in the job ad/description

[rugged delta]

It is a bummer but they market themselves as an educational organisation, not a certification provider. The certs are the result of you undertaking their training. OSCP is widely recognised as a hr must-have in a lot of orgs and even clients demand that the pentesters undertaking exercises for a company hold the OSCP; to the extent that I've heard of companies denying participation by OSEP holders (the next level up), because they didn't have OSCP

[fallen heron]

If only they were actually good at educating

[rugged delta]

Yeah that's the trouble. The Try Harder methodology is really the 'pedagogy is not our thing, buy some books' methodology. Speaking to people who've done CPTS, after that they say OSCP is a walk in the park

[fallen heron]

Exactly, I was so disappointed by what you get for your money, the pen-200 course is so barebones compared to other options on the market, and especially compared to CPTS

But they're the gold standard for HR and for clients, so a lot of us have no choice

[rugged delta]

Yeah but slowly that'll change. OffSec are riding high on a reputation built when the only alternative was SANS and even up until recently they were very affordable. Five years ago you could do your OSCP for less than $!000. They have built a good reputation and they do turn out good pentesters because generally the people paying for the courses/certs were people dedicated to security. As a pentester you do need to know a lot more but their training is now playing catch up to the likes of PNPT, CPTS, CRTO, CRTP/E etc.

I do love speaking with their reps and SANS trainers at conferences. Word is getting out about the other options on the market. Certain groups are paying attention and seeing what other training orgs are offering. Certification, of course isn't the only way in to the field. You need a diverse array of skills and achievements to really get noticed. Having a record on HackerOne/Bugcrowd, partaking in and scoring high in CTFs, etc,. are good opportunities to shine

[fallen heron]

I do hope to see that change in the coming years, too late for me, but I'm definitely not of the mindset where just because I had to do it, so should newcomers after me. It currently doesn't seem to me like they're trying to play catch up, they would have to overhaul the course completely, which it feels like they believe they've already done and it's good enough.

[rugged delta]

Well they don't really feel any pressure to change cos they're like U2. People will still buy the album cos they're so well known. Right now, it's the barrier for entry to most pentesting roles

[fallen heron]

I know, it's unfortunate, but we have to play the game as things currently stand.

[rugged delta]

I'll definitely be nudging a few guys I know at the local BSides in the summer

[fallen heron]

That's great! Getting the word out to the right people is exactly what'll help to change things

[rugged delta]

Exactly. It's a tough enough market and once you're in a job, most people in it don't care much what certs you have as long as you're keeping the learning going, unless there's a specific skillset they require you to get

[fringe spade]

Let’s hope it gets better next year

[royal zenith]

Would you guys know any good career paths that mix cybersecurity and computer engineering

[faint abyss]

Hey do u guys have any good tip where i can secure a folder because ive got some important stuff over there and i dont want to lose them either from my laptop dying or someone hacks it

so where can i actually secure it even if my laptop gets destroyed

[sleek sedge]

You need to keep a backup of it on another device

[rugged delta]

Security engineering

https://tryhackme.com/path/outline/security-engineer-training

[faint abyss]

is gdrive safe?

[sleek sedge]

Define "safe" for your threat model

[faint abyss]

well as i said i dont want my files to get deleted by anything because i dont have a strong laptop but you never know what can happend my laptop can break or even worse i could get hacked

so where is the safest way to secure them?

do u think if a buy a small storage box

and secure them there?

[sleek sedge]

Google Drive is perfectly fine for backups, if you don't want to upload your files to the cloud for whatever reason you could also back them up to a USB

GDrive is pretty secure, and if you wanted to you could locally encrypt them and then upload it

[faint abyss]

how do i encrypt them

[sleek sedge]

There are many ways of encrypting your files, you'll have to do some research into what best suits your needs

https://cryptomator.org/
Is one example that is specifically designed for cloud usage

[faint abyss]

ok thanks

@sleek sedge when it comes to cybersecurity which programming languages should i learn?

[sleek sedge]

https://www.upguard.com/blog/does-cybersecurity-require-coding

[unkempt stirrup]

hey guys

for an aspiring pentester, are there any rooms/paths that award certifications which would go good on a resume?

[fallen heron]

From THM, you get certificates of completion, which are not certifications, so that would be no

[copper oar]

HELLO

[rugged delta]

You can include the certificates as posts on your LinkkedIn and maybe mention it in a personal development section on your cv/resume alongside perhaps having a blog/github and maybe make a home lab and mention that

[unkempt stirrup]

these are very helpful and useful tips, thanks a lot

[stoic wing]

Sorry if I’m interrupting but may I chip in?

I like to categorize it as follows:

Webapps hacking: JS, SQL, php

OS: C (maybe C++ or really any language that can be interpreted or compiled on the target host/server)

Networking: python, Go, maybe C (for the sockets)

You should start with python, then move to SQL and JS and you don’t have to bother learning the ins and outs of the last 2 languages. Just good enough to understand what the code you’ll be reading does

[vast geode]

i get a big progress in red team , so does compines steal look for red teamrs ? or i should learn soc insted ?

[fringe spade]

Yes they do, but red teaming is usually for more experienced penetration testers, therefore if I were you I’d still try to search for more entry level roles if you don’t have experience. SOC would be more beginner-friendly

[vast geode]

what entry level roles which related to offensive part ?

[pseudo creek]

the problem with having entry level and the offensive part is you can break things, so you could try to find a junior pentester role but they are rare

and usually you have to prove yourself in some way

[vast geode]

you mean that the content which i will learn from tryhackme does'nt enough ?

[pseudo creek]

no

its starter info, way to get you on the path but you need a lot more than that

[vast geode]

what advice can you offer to get more ?

[fringe spade]

Well, finish those learning paths, do some boxes, portswigger labs, practice, start a blog, create your own labs etc

Getting into pentesting as your first job is harder than 3/4 years ago, but it is still possible

[unkempt stirrup]

what do you recommend as learning paths for complete beginners?

[sinful furnace]

A little career help.

Hiya guys, I would like to get some career advice for a little context I’m 15 and dropped out of high school recently because I’ve decided to take on a paid internship i got through a connection, just a couple questions.

I’ve already gotten through the interview and im set in Jan for my onboarding, my questions are if I can get more internships or do I keep doing this one? Or is it possible this could turn into a permanent role if they have on available.

I was called into the office for a day when my to-be head manager showed me a chart of key points in the internship I’d learn while doing the role.

I can’t remember all of it but it was red/blue team type of tasks such as reviewing code for vulnerabilities and doing phishing emails internally, another one that caught my eye was a pentest on their network which was the last on in the list, There was a ton more but I can’t recall right now.

Another question I had in mind was does my lack of high school degree make out to be off-putting to other recruiters/hiring managers. I’ve gotten loads of praise and reassurance from other people in the place I wanna be in that with hard work I can make it to my dreams.

I know I will never go back to school but that might change in a year or two after seeing if I can apply to more internships through connections I make in the company I’m just focusing on now and a few years into the future.

Anyhow that’s all I have to ask I’m happy with anyone helping and pretty excited to start. Thank you!

[pseudo creek]

well a lot of this will depend on what country you are in. In the US, you can get a high school equivalency called a GED via testing. A lot of people who feel high school is not for them or have to work for various reasons use this route. I would definitely talk with your manager regarding your career options with the company.

I will also say that in the US that lack of degree (and I'm not even talking high school) is a reason that employers can use to pay you less than your peers.

[sinful furnace]

Haha thank you so much for a response. I have been learning and improving on my soft skills so I’m sure I can get at making connections.

[serene umbra]

Gave +1 Rep to @soft zealot

[sinful furnace]

Hiya thanks for responding, I have thought about a G.E.D but I’m currently in Dubai, though I do have plans to work in the US since it’s closer to family.

[pseudo creek]

well internships in the US are largely reserved for students, high school and college. It would be very challenging in the US to get a job without a high school or equivalent diploma. Not just a cyber job, but any job.

[sinful furnace]

I was thinking like getting more experience and doing more jobs/internships and then with all that work history I could try, But I want to ask you if that’s still a deal breaker after all of that experience and I also would link with a lot of people that could play into it.

[pseudo creek]

yes, for many jobs, it will be a deal breaker. Companies in the US will check, even small companies. I had a friend recently who has 18 years of experience, was working for a small company, they had to delay her start date due to her high school diploma validation not coming through.

[sinful furnace]

Dang thats tough maybe i could just stay in dubai and go for the holidays

[pseudo creek]

I would still validate with people in Dubai if it would be a hinderance to your career there

[sinful furnace]

would a ged work?

[pseudo creek]

in the US, a ged is equivalent to a high school diploma, so yes