cyber-and-careers

[loud fern]

There is also option to move laterally in the company you work help-desk for

Depends on certificates. Degree only says you completed the tasks on time, it does not tell much to a potential employer that has not gone through the study programme itself.

Without experience, degree + certifications don't mean much, they might get the interview at best

How do you know he has 15 certificates?

I don't know what WGU is, there are many that bear that 3 letter acronym

[wary shell]

I only have the comptia trifecta, lunux essentials and ITIL. My future certs in the 6 months to come are cysa, pentesr+, isc2, project+ and I think a cloud cert.

[loud fern]

Most of these are entry level certificates, and they correlate a lot, I don't think its brutal to start from entry level with those

[pseudo creek]

sounds like a great opportunity to start with.

[wary shell]

@warm hinge I agree the job is not the most desirable, although I know the concepts of everything I studied as far as the terms go, I just don't have the hands on experience. Sure I've used wireshark, Nmap, forensic tools in labs provided by the schools. But I don't think practical labs will be on a high interest to employers. But then again I'm not an expert on what employers think so I could be wrong.

[loud fern]

Also I wouldn't put that much expectations on certificates, a lot of them don't test understanding but memorization, but that's just my 2 cents on them, so it doesn't matter if you have 10 or 20 of them, if they are acquired through temporary memorization they don't really reflect on your understanding of things

So, I'd recommend getting the helpdesk job you are offered, and get hands dirty there, and if you don't like it, you will have at least the experience time ticker going, easier to move to somewhere else

[pseudo creek]

generally employers believe that a degree exposes you to various concepts but really you have to learn to work, learn the corporate environment, learn the tools and techniques that are really used in the work world.

also learn how to deal with customers / learn how to be on a work team

[loud fern]

I think you have a wrong understanding of "certification = job"

[pseudo creek]

well what did they do? did they have internships? Did they know someone at the company? Did they volunteer at cyber security events/conferences?

[loud fern]

Did they maybe have some personal projects to show?

[pseudo creek]

I mean, really employers don't care too much about certifications. There are some valuable certifications but overall, certifications are just a basic qualifier

[loud fern]

Certifications are good for metrics, baseline and advancement

But just because you have a certification in somewhere does not certainly mean you are any better or know any better

[pseudo creek]

I'm not anti certification but 1 or 2 well known certs is better than 10 basic certs

[loud fern]

I have only 2 certifications as of now, I don't see reason to hoard them

[wary shell]

Honestly, I've been kissing butt trying to get in the IT department at the amazon warehouse I work at. The spots are full and there are almost no positions available in the country. I'm just waiting to see if one of the guys will move on with the time frame I have. I work on other projects like roblox game development with my little brother, I'm trying to create an AI like chatgpt although I'm just barely passing the beginner phase of machine learning.

[pseudo creek]

I only have 1 active cert

[loud fern]

The beauty of my certs is that getting the other one restarted counter for my first one, SANS is lovely ...

[wary shell]

Maybe it's just my location, maybe you all live in a larger city. Relocating has been on my mind.

[pseudo creek]

the job market is really really tough right now

I know plenty of people who started in help desk, I work with them

[loud fern]

Not necessarily but could contribute, a lot cyber positions could be remote though, I would look at those as well

[pseudo creek]

my manager started working at the help desk

[wary shell]

I really appreciate your responses, when I do these in person I usually get the " you're going to have to figure it out your own" treatment.

[loud fern]

Welcome to my job ...

You either sink or swim, but it certainly helps you grow in the field

Also to expand on that
"does all of this only get you a call center job?"
The fact he mentioned "limited active directory" and "troubleshooting over the phone" are quite valuable already, and most call centres don't even let you touch the AD

Experience > degree/certs/connections for sure, but they are better than nothing AND they will give you a roadmap what to study instead of blindly looking around

[wary shell]

Is a ticketing system like ServiceNow helpful for experience? Now that my memory is popping up from the interview, they did mention ServiceNow

[pseudo creek]

yup

[loud fern]

Yes, every IT environment I know uses either ServiceNow, Jira or some other alternative

[pseudo creek]

well I'll say that people are having trouble even getting IT help desk jobs, its a very competitive landscape out there

[loud fern]

High demand in senior fields, high excess in junior fields, market is a funny thing ...

Most employers don't want to train from scratch, their hiring processes start when they already need it, cannot postpone it anymore

So they expect a guy that already knows their thing

[pseudo creek]

well they don't want to train from scratch and only have that employee jump somewhere else in a year

[loud fern]

Or that, though most of the time the job ad won't go up unless it really is necessary to fill this position, like previous guy leaving

[wary shell]

I have read posts of people working for only 6 months or so just to get the experience and move on to a better job, is that like the norm in IT?

[flat sedge]

It looks really bad to leave a job in under a year.

[loud fern]

Depends if a company knows how to keep their employee satisfied or not

[pseudo creek]

I would try to stay at least a year unless it is really really bad, like you barely start doing the job at the 1 year point

[flat sedge]

One of the things the business has to consider is cost of replacement, and they have a schedule for the typical employee to outgrow a position - if you leave or out grow the position too soon, they have to re-train for that role ahead of schedule.

tldr; leave a role before a year, it's a potential risk to the business

[loud fern]

Then again there are other situations where you have people working only 3 days and then they put 2 years in linkedin 🙄

[pseudo creek]

also the other factor is if you are leaving multiple jobs at/before the 1 year mark, you aren't really seeing success in that job, you are leaving before it gets tough

[wary shell]

Plenty Words of wisdom in here ✍️

[flat sedge]

the usual schedule I think of is, year 1 is just learning the job. year 2 is learning how to be good at the job. year 3 is mastering the job to the point where it's less work for you to do (automation, efficiency, etc)

[wary shell]

@warm hinge sure

[stoic cave]

This tracks

[clear schooner]

Hello, I am a web developer and would like to shift more towards cybersecurity. What laptop do you recommend? Mac, Windows, Linux? Also, I would like to use it personally occasionally for watching series with a budget of around 2500

[warm hinge]

Hello. Do you recommend cybrary courses for beginners?

[fringe spade]

Honestly for cybersecurity you don’t need a powerful machine, even a $500 laptop running Linux would be sufficient. But I’d advise getting something with at least 16GB of RAM if you want to run virtual machines on that computer

[clear schooner]

OK, thank you

[serene umbra]

Gave +1 Rep to @fringe spade (current: #289 - 16)

[warm hinge]

also can someone recommend a linux course? pls

[fickle grove]

Depends on what course that would be as they have beginner, intermediate and advanced ones. Also, the instructor will also be a factor to consider here. They are offering a lot of free courses if I remember correctly so you can take a test drive for yourself.

[fickle grove]

FreeCodeCamp has one and there are lots of Linux training videos on YT (one of which is TCM Security's).

[loud fern]

I recommend Red Hat Linux courses

[frail drift]

What is the average salary for cyber security?

[sleek sedge]

How long is a piece of string? It all depends on so many factors

[exotic kindle]

im a beginner at cybersecurity which cert should i aim for ?

[sleek sedge]

• Where is the position based?
• What is the position?
• What responsiblities do you have? etc

[uncut pier]

read this wrong and thought you were genuinely asking how long string is

[dense dagger]

Security+, it teaches all the basics needed for security

[flat rapids]

Hey! Anyone know much about cybersecurity bootcamps?

I live in the US btw if anyone in the US is more experienced with this topic

[fringe spade]

You can learn the same stuff for free/a fraction of the price

But if your employer pays for the bootcamp then I’d say it’s not that bad

[flat rapids]

Hey, @fringe spade Can I add you to discuss privately?

[fringe spade]

Hi, sure but there might be more knowledgeable people in this channel that could give their insight

[flat rapids]

So I lost my job and I wanted to go in the direction of cybersecurity. I don't have a degree in anything IT/computer related and that's why I was considering bootcamp

[fringe spade]

Bootcamps aren't that bad if u want to learn something, but there are better ways, for example look at #start-here, it will be way cheaper

HR-wise bootcamps don't mean much to a potential employer

[west sonnet]

The cert path isn't a bad one to explore and honestly think many people like this route cause it's less upfront cost (depends on the cert, need to prefix that) in comparison to a bootcamp. I went down that path and happy I did. But its important to stress that learning cybersec topics will take time and you'll need a solid foundation to start from

[flat rapids]

Yep, I'm definitely working hard on all of the free rooms (as of now) on tryhackme to get a better foundation of cybersec topics.

I was planning to go to bootcamp next year, but have you gotten a job from the certification ?

[rugged delta]

You can learn quite a lot through THM. You'll learn a lot about Windows, Linux, Networking and other things along the way to set a good baseline on your journey and learn a lot about the various roles in the field and the kinds of tools used by each role. Bootcamps tend to shovel a whole broad spectrum of general stuff in your direction in a short space of time without giving you enough time and resources to absorb and practice the things you're supposed to learn.

Better to follow the teachings in THM. There's hundreds of free walkthroughs and challenges and the paid content is high quality and at your own pace.

You can consider various certifications on your path and one of the most popular first certs people go for is the CompTIA Security+. It covers a lot of the general knowledge you need for cybersecurity starting out. As you develop more in the direction you want, there are other well-regarded certs but cybersecurity is about continuously learning and developing your skills and abilities more than anything

[west sonnet]

Once I got my CompTIA Sec+ I started to get more interviews and more looks on Linkedin. Which in turn got me my first job in tech (mind you this was during the pandemic, and the market was different). Like @rugged delta mentioned, there are alternatives to bootcamps and even CS degrees (but different convo). Focus your time and resources to the fundamentals and you can certainly learn a lot on THM

Its like a marathon, not a sprint

[flat rapids]

Thank you guys for your input!

[fringe spade]

An easier cert like eJPT or Sec+ will mean much more to an employer than a bootcamp, so it's better to invest in that

[flat rapids]

So even if I don't have any experience/formal education in cyber security or computer science, I would be able to get a job in this field?

[fringe spade]

It is not as easy as it was a few years ago, but if you put enough effort then you should be able to find something

[flat rapids]

I see, and I would get the same/better learnings from the certification vs. bootcamp?

[fringe spade]

I never saw "completed xxx bootcamp" in job requirements, although you can see a lot of ceritifcations listed there

[west sonnet]

Yeah same, never seen "completed bootcamp" in a job description before

Just CS degrees and or Certs

[flat rapids]

oh okay I looked on youtube and they were saying that bootcamps are more impressive on a resume than a undergrad CS degree, but unsure which youtubers are sponsored by bootcamps and which weren't haha

thanks! I'll look into certifications then. Any certifications for beginners? Are these for beginners: eJPT or Sec+ or CompTIA Security+?

[fringe spade]

Sec+ and Security+ are the same thing, but yes I'd say these certs are beginner friendly

[flat rapids]

got it thank you!

[rugged delta]

Take a look at these success stories from the THM blog to get an idea of what some people did to enter the field. Also consider reading from the Tribe of Hackers books. They're a collection of interviews from experts in the field and they do discuss what you need to show your abilities to work in the field

https://tryhackme.com/r/resources/success-story

[flat rapids]

Thank you!

[serene umbra]

Gave +1 Rep to @rugged delta (current: #21 - 353)

[warm shard]

Thanks so much for the insight

[serene umbra]

Gave +1 Rep to @rugged delta (current: #21 - 354)

[rugged delta]

I would recommend pursuing the Sec+ (CompTIA Security+, same thing). The eJPT is a simple entry into pentesting but won't get you a job as a pentester. In fact, I'd pretty much stay away from INE/eLearnSecurity certs altogether. You could do the Sec+ in about 30-60 days studying a couple of hours a night, most likely. From there you could learn the skills needed for SOC Analyst or other positions.

Pentesting, for example, isn't considered an entry level position in cybersecurity. It is a lot of fun to spend time learning how to do it though. For a pentesting certification, I'd consider something like the TCM PNPT initially. TCM (The Cyber Mentor) has a good reputation in the cybersecurity community and his courses are reasonably good quality. He does have a junior pentester cert called the PJPT, which is positioned similar to eJPT, but you're going to be covering that same content in PNPT anyway. It can help you get comfortable with the process of pentesting certs but it's totally okay to just go on to the PNPT.

While PNPT is gaining recognition in the field, it's not quite as well known as the OffSec OSCP. It's highly regarded because it was the first practical cert for pentesters many years ago and lots of hr people and pentesting teams request it. It is quite pricey compared to PNPT or another alternative, the HTB CPTS. To do any of these certs, you'd generally be expected to commit to 3-6 months studying maybe 30 hours a week, depending on your schedule. Many people do it over the course of a year.

It's still fun to progress towards these higher level roles, even though it can take some time.

[pseudo creek]

who is "they"? I mean largely, cybersecurity bootcamps are a scam. I've heard so many horror stories from people who went to cyber bootcamps and had a bunch of debt and no job.

The reality is that you only need a couple certifications to get your foot in the door (Network+ and Security+ are solid certs)

and pretty much everything subtlety said

[flat rapids]

sounds good - yeah I saw some horror stories, but also some videos promoting bootcamps saying they got a great job etc etc so I wasn't sure which route to take

[pseudo creek]

yeah it is wild, people get money from advertising

[flat sedge]

Evaluate the source as well - a lot of those are paid reviews or paid advertisements

[flat rapids]

yeah that's why I can't really trust youtube, which is why I came here to talk to real people who aren't sponsored haha

[hardy sundial]

As someone who went through a bootcamp (and paid out of pocket), I would recommend cheaper options. The one I attended essentially prepared us to take the Security+, but as others have said there are many cheap and/or free resources online that yield the same result. I think a study guide for example only goes for $30 and practice exams in the same ballpark. Professor Messer, Mike Meyers (though I think he retired recently?), and THM meanwhile are free. LinkedIn Learning is available for free through many libraries as well, and Mike Chapple’s stuff there has helped me out.

The only thing I got from my bootcamp that I didn’t get from these was a few new IRL connections.

I don’t think I’ll be seeing any money from the bootcamp for that review

[flat rapids]

hahaha thanks for your honest opinion, it really helps coming from someone who has gone through bootcamp. I think the IRL connections was the main thing for me because if I don't understand something the person can guide me, but I guess I can get the same help from digging online.

[serene umbra]

Gave +1 Rep to @hardy sundial (current: #2001 - 1)

[hardy sundial]

You betcha! There were certainly some moments where friends of mine would have had more difficulty were there not an instructor to guide us, but that can come down to how you learn best and how much money you value that guidance at. Because I was already pretty used to finding answers online and didn’t utilize our instructors as much, the value just wasn’t there for me. If you’re the type of learner who does best with others providing guidance, this Discord may be a good alternative, albeit not in person.

[exotic kindle]

as a total beginner ?

[pseudo creek]

a beginner in security. If you are a beginner in IT, you might need to work on some other things

[exotic kindle]

such as ?

[pseudo creek]

networking, operating systems knowledge, possibly scripting knowledge

[exotic kindle]

where can i learn these ?

[pseudo creek]

well tryhackme.com for one

[tulip pawn]

isnt compti kinda expensive thought?

[stoic cave]

CompTIA? In the grand scheme of things, no.

CompTIA, $300 with no discounts for Security+, vs SANS/GIAC, $10000 for a single class & exam

Fair

[tulip pawn]

There is that huge fear thou that if you fail it you just lose so much money

[stoic cave]

That's why you study and prepare. They outline the material that is going to be on the exam and tell you where you need to be technically and knowledge wise

[jovial cosmos]

hey for resumes in the education section can u put like tryhackme soc analyst 1 or nah?

[stoic cave]

Education is for formal education, THM can go in an extracurricular section

[undone shore]

I mean, you could put it under a section entitled "hciwivbeidksiwgjie" if you want. Doesn't mean it's a good idea, or the right place to put it

[honest ledge]

Hi everyone, I am looking for a partner in my learning journey, I am quite new to cybersecurity but really eager to learn !

[unborn zealot]

pm me

[gray tartan]

hey guys which according to you a best certification in cyber security

[broken idol]

Would depend where you want to go.

[fickle grove]

CEH doesn't have the best reputation due to some ECC blunders. However, that isn't to say it won't open doors for you as it is still recognized by DoD (if you are in the US).

Edit: Didn't know what /s was for until earlier.

[broken idol]

Please tell you seen the /s

[fickle grove]

Ooh.. didn't know about it until now. Sorry. 😅

[rugged delta]

You could start with this post, as it's a response to a similar question

#cyber-and-careers message

[gray tartan]

As in india comptia+ in not as much recognised as CEH .What about your countries?

[rugged delta]

In a lot of other countries, EC Council has a reputation for poor levels of cyberscurity and mishandling their customers' data, hosting malware, sexist/misogynistic activity in their promotional material and official activities, copyright theft and plagiarism. They're really a shitty company

OffSec OSCP is by far the most widely recognised pentesting certification in US/EU and other countries/areas. It's well known and was an early practical test of someone's pentesting abilities but competitors have been providing some interesting alternatives, such as TCM PNPT and HTB CPTS, with other certs like CRTO I & II, CRTP/CRTE and others.

Also, stay away from INE/eLearnSecurity. Their stuff is just poor quality

[slow smelt]

Hi, guys, can you please recommend the best cyber certs

By saying the best I mean:
They are affordable (relatively to other certs)
They are well-known and appreciated in the community
They are for entry-level specialists who wants to join the field

I want to get a job as a Penetration Tester, so would appreciate any recommendations

I heard about CompTIA, but for some reason I get Access Denied once I want to proceed with purchasing. Maybe it's because I'm from Ukraine, not sure

[flat sedge]

You shouldn't be paying for certs yourself. Certifications are business value, not really a requirement for individual contributors to pay out of pocket.

The only certs you should pay out of pocket for are the entry level certs, like Net+, Sec+.

[harsh ruin]

We all want to get jobs as pentesters but nobody wants to digest 10 cisco books on networking and master python and php.

Wouldnt it be more beneficial to study the core fundamentals the technology before you get into application of tools we really cant even begin to understand ?

[flat sedge]

Pentesting really isn't a "true" entry level type of role. You need to know a lot of background and have demonstrable knowledge and experience.

And really, people misunderstand the role that pentesting fills; many orgs do not do pentesting as the potential risk is too high for their business requirements.

It's important to keep in mind that the value of a pentest is not in the pentest activities, it's in the report.

[harsh ruin]

Absolutely... Im starting to realize that. It almost just seems like a waste of time to play with these tools. I feel like a parrot control v'ing someone elses knowledge when I know nothing about the mechanics of the tech

[flat sedge]

Pentest is such a small part of security; you can use CTFs as a vector to explore your own learning path, just be aware that there will be gaps as you won't be learning things consistently

[harsh ruin]

Im hoping to get into grad school for CS. I feel like the tools are easier to pick up then how they are programed and actually work. And without the knowledge of how they work its like being stuck in a dark forest without a compass.

I love the CTFs though they are extremely fun and I learn alot

[dense dagger]

If you're saying you need graduate school just to understand the tools then I would disagree

[rocky bear]

This is completely true, tools exist to automate the boring stuff and make your life a little easier, but you still need to know what the boring stuff is.

You can't run a tool against a client's infrastructure if you don't know what it does. It's irresponsible at best

[harsh ruin]

Not at all... anyone with the drive to understand programming and networking can understand the tools.

I just think that a thorough understanding comes from a deep analysis of the boring fundamentals that will make you fall asleep

[rocky bear]

Absolutely! And over time the fundamentals actually become fun 🙂

[harsh ruin]

I agree. Im coming from a completely different field so its hard to pick up initially. Application of fundamentals is the best part !

[rocky bear]

You got this! The cool thing about knowing the fundamentals is that they're applicable anywhere. Offensive security is a security niche, but they can be applied in whichever security role you happen to fall into

[flat sedge]

Would recommend compsci instead of CyberSecurity. Better fundamental understanding of how things work, from what I've seen many security degree programs neglect that to focus on how to use tools and on governance, not on the technical fundamentls

[dense dagger]

i have an intern that does specialization in security, the instructors are idiots

tells them to go run a port scan on a website without a vdp or bbp

[rocky bear]

Insane

[dense dagger]

i cant blame them, the pay for teaching is astronomically bad where i come from

i just told my intern i can provide them supplemental knowledge or teaching if they don't understand something from their courses

[harsh ruin]

Im in a compsci program studying programming and networking. My dreams to get into grad school for telecommunications

Can I ask about the roles you are in ? Im genuinely curious

[rocky bear]

I'm a pentester

[rocky bear]

It's still illegal? I feel like they should at least have the common sense not to scan random websites. But yeah the pay that professors/especially adjuncts get is usually criminal

[dense dagger]

yeah, i told them not do it again cus its illegal 💀

its more worrying for that

[harsh ruin]

Whats the field like on a day to day ? What kind of clients do you get to pentest for ?

[dense dagger]

Dont scan anything you dont own or not have permission on, esp. if youre using a company owned machine

[rocky bear]

Small to middle size companies who need a pentest for compliance. Usually it's just a checkbox for them, some are more receptive to others. Talking to clients / writing and delivery the report is a big part of my job. It's all very fun imo, but definitely glamorised

It's pretty beaurocratic, which I actually like the repetition of but I know some people don't. I'm a consultant so I get a new project every one to two weeks, sometimes three depending on how big the project is. Clients usually want it to be as quick and concise as possible, to their detriment unfortunately

My projects are usually web based, with some external / internal network pentests mixed in. 80% web

But yeah it's fun! I like it

[upper bay]

hello guys

[harsh ruin]

That sounds like a great time tbh. I really enjoy the technical aspect of work that adds a complexity to the day. Unfortunately the problems I see at work are tend to be repetitive. Complex at first, but then it just ends up being a lot of steps you have memorized.
I have to deal with the beaurocratic repetition on my job as well. Not a fan of the robotic day to day work.
Im really hoping to end up spending the rest of my career in a field where I can apply creativity and abstract thinking. I was a engineering dropout who ended up in business. With all the math Ive taken I realized I already have more than half a bachelors done in compsci.

[rocky bear]

The cool thing about working in consulting for me is that it's both dynamic and repetitive. Repetitive in the sense that the ebbs and flows of the project are the same, you meet a client, you testing the stuff, you deliver the report, yada yada - but each project is different, different technologies, developers, intricacies. So it's not really boring ever

That sounds great, I'm pretty weak on the maths side, it's something I want to improve on

[slow smelt]

Yeah, that's the case, I want to start my career in cyversecurity, and I need some basic entry level certs, but as I said for some reason CompTIA doesn't provide its services for Ukraine, I mean I could use VPN, but wouldn't there be any issues after?

[slow smelt]

Yeah, thank you, great point. I'm kinda having hard times deciding what to do, I'm a General QA with over a year of experience and I like it and I would also like to learn the cybersecurity side of things to test it as well, but there are just few vacancies like this probably, it's to specific, that's why I think I need to make a choice whether I want to proceed with what I have now or try to enter the cybersecurity field

[serene umbra]

Gave +1 Rep to @flat sedge (current: #10 - 732)

[rugged delta]

You can always get the study guides and learn the content. Network+ and Sec+ are the most appropriate ones but you can carry on with the other certs as well

[noble summit]

Hello everyone.. Any advice on creating a CV for a SOC 1 anaylist without any real experience in the field apart from what I learned on THM? I have been on board for 2 years and acquired lots of knowledge, doing it mostly as a hobby, but would love it to be my future career. Thank you

[rugged delta]

You're a subscriber. Have you completed the SOC 1 & 2 paths or any other paths? Having these listed in a personal development section could help. Several people here have already uploaded pictures of their CV with personal information hidden/removed and you could do the same. There are many CV/resume ATS resume checkers, where you upload your cv and the job role details you're applying for and it gives you info on what you might change.

You can include skills you've gained, such as particular applications/processes/languages you've acquired, as long as it's relevant to other content on your CV and to the particular role.

You might consider reading the Tribe of Hackers Blue Team book, the Cybersecurity Blue Team Toolkit and other blue team books available to get to know about the role better

[quaint flare]

I've been reading some comments here how eJPT is worthless 🥲 I already had my company pay for it though and about 15 hours into studying (out of 150) so i'm gonna stick with it

my question is then any tips for it? anything I should focus on in it, I'm not sure if a lot of the material is redundant/useless, am I wasting my time or should I just speed through the material

for background, I have sec+ net+ and cysa+, I'm newish to pentesting though

[static tide]

it had some okay knowledge in it when i went through the materials, but from a recuriting standpoint it is quite worthless

better to have it than someone that is otherwise the same as you, but it doesn't outweigh any of the other known entry level exams

[rugged delta]

It's not completely useless, it's a good introduction to basic practical pentesting tools and processes. It's just that it doesn't teach you enough about pentesting to be able to do the job. In saying that, I have seen a handful of people getting jobs based on it, but it's very rare. You should continue on with it, because you will learn valuable skills but after that I would suggest going for PNPT, CPTS or OSCP. Or all three in that order if you can afford them and need extra assurance in your processes.

PNPT and TCM's other content is really good at giving a grounding in pentesting and you get to interact with someone who has built a great reputation in the field over the past number of years as a pentester and a trainer. His courses are video-based primarily with labs and good quality content. You can try a 15 hour intro to pentesting on his YouTube channel, the first 15 hours of his course. CPTS is slightly newer to the field but is growing slowly. It's around the same price point as PNPT. The course is text-based with questions and labs. You need to complete the course 100% before you are allowed to take the exam. OSCP has been in the field for quite a few years now and is widely recognised as a standard pentesting certification. They've made several improvements to their training and exam environments, having both written and video training and lots of labs available in your prep for the exam. It's the most widely recognised and requested by pentesting recruiters/teams/their clients but the price is from $1650+, depending on the option you choose.

There are other up and coming pentesting/red teaming certs like CRTO I & II, CRTP/CRTE/CRTM etc... Also, good job on tying down the CompTIA certs, they're a good foundation

[brittle pier]

Thanks for this. I’m gonna save this

[serene umbra]

Gave +1 Rep to @thick dirge (current: #138 - 48)

[noble summit]

Thanks for the reply, I will definitely try this

[serene umbra]

Gave +1 Rep to @thick dirge (current: #132 - 49)

[noble summit]

Thank you for the reply, much appreciated

[vapid temple]

how do we all feel about Computer science degree's?

3-4 years is a lot of time in the context of ICT

is any of it relevant by the time you're out of there?

[stoic cave]

Yes, get one if you can from a reputable, accredited, school.
Not sure what ICT is.
Yes.

[dense dagger]

Information and Communications Technology

Still considered as IT from where I’m from

[knotty karma]

hey guys, i have about one year of vapt experience including web application, mobile, thick client and cloud PT.

I'm planning to get a eWPTx voucher in the INE's leap year sale, how advanced is this certification and is it worth it?

[warm hinge]

Is blt1 course enough to crack the exam?

[rugged delta]

The course is intended to teach you the skills that will be examined

[pseudo creek]

Honestly, I personally don't think any INE certifications are worth it. I would look at other options out there

[fringe spade]

eLearn seemed good before they were integrated with INE, now their reputation is closer to CEH and EC-Council lol

[pseudo creek]

Yeah it's depressing how badly they went downhill

[jade crow]

If you have OSEE, or OSCE3 you might get a job, anything else you wont.

[fringe spade]

Yeah, especially that they were the only hope for strong competition for OffSec

[rugged delta]

I have friends who got other certs, got OSEE and they wouldn't hire him cos he didn't have OSCP

[jade crow]

what the fuck 😂

[fringe spade]

At that time many companies/clients require OSCP so you wouldn’t be too useful to a consulting company with OSEE only lol

[rugged delta]

Yep, one of their clients wanted all staff working on their network to have OSCP so they wouldn't hire him.

[rugged delta]

PNPT, CPTS, CRTO I&II, CRTP/CRTE/CRTM... Lots ot interesting certs that don't have the reputation with hr peeps

[jade crow]

I dont know what to say m8 I have oscp and I got 0 interviews

[fringe spade]

eLearn started to get that reputation

[rugged delta]

It's not about just the certs though. You need to show your professional and personal development in other areas

[fringe spade]

Certs aren’t the only thing, maybe there’s something wrong with your resume for example?

[jade crow]

This is just sad that the people dont realise how hard is it to achieve OSEE and his capabilities

[rugged delta]

Yeah but they were always the Ryanair of certifications

[fringe spade]

True haha

[jade crow]

i dont have that much exp in field

[rugged delta]

Yeah but OSCP is something he should have just done on the way. I know people who did CPTS and just trashed through OSCP straight after

[rugged delta]

No harm working up from helpdesk-IT-SOC-wherever on the way to what you want. Once you show your abilities it opens doors

[jade crow]

Yeah got that, but still helpdesk has nothing to do with pentesting

maybe soc malware anals and thats all .

[fringe spade]

Do you have any experience in IT?

[jade crow]

yeah

I did some security audits for some companies

[rugged delta]

You do need to show you know how computers work and helpdesk is a great first step. You don't start being a pilot in the cockpit of an A380 or F16. You start out in a tiny Cessna 182 and get the basics right

[jade crow]

makes sense now

Thank you m8

[rugged delta]

Pentests are kinda like security audits, except you're doing the audit from the outside, in and writing the documentation on exactly why the environment is failing

[jade crow]

yeah

[buoyant mural]

hi

[sturdy scarab]

looking for some advice please
got my 2nd stage/final stage interview for a junior information security analyst position its an in person 2 hour interview, what can I expect considering I was asked technical questions in the 1st teams interview

[blazing wyvern]

Might be a mix of technical questions along with behavioral and checking if you’d be a good fit.

They may ask you situational questions

[buoyant sapphire]

Anyone have an extra GCIH practice test?

[boreal zephyr]

I haven't personally be part of a 2 hour interview, ever. I have gone through technical studies, about an hour long where I was encouraged to make as many assumptions as I wanted. Review a system, invent a viable threat candidate, develop an attack path analysis and mitigation strategies, and then create a test case in which my mitigation would be effective

[hazy trellis]

Anyone from Kansas USA?

[boreal zephyr]

My scenario was an airborne mission system (AMS). I made the assumption that the threat was an APT attempting to inject false incoming position and time data in order to confuse the AMS system and convince the AMS operators to give bad Command & Control data to friendlies in the air space by reporting false adversaries. The attack path, or kill chain, was a high level invention. The APT would intercept and jam incoming ADS-B tracks and transmit malicious data to subscribers using the same valid messaging scheme. My test case was to develop and satisfy a requirement that all ADS-B transmissions be verified (integrity/confidentiality) using the existing protocol structure. This would be satisfied through an encryption scheme that masked the payload using a preshared key loaded by the ADS-B LRUs in use by all trusted operators. The test case would be proven when encrypted payloads could not be intercepted, modified, and retransmitted (confidentiality) by an adversary

Anyways, sorry for the diatribe, just wanted to give an example of an interview I had recently.

[boreal zephyr]

Oklahoma

[olive sierra]

@boreal zephyr hey, what do you recommend for study?

I want to work with red team

[boreal zephyr]

I suggest that you aim for OCSP

OSCP*

It is the de facto cert for entry level pentesting/ red team

at least in the US

[olive sierra]

i really want a path to learn more about the area, cause i'm learning a lot of thinks about cybersecurity on tryhackme website, but i want to learn more

[olive sierra]

mmm got it

[boreal zephyr]

THM is a great place to learn, as is HacktheBox. You are responsible for your own education, however. I personally view OSCP to be a great filter for skillsets. I also appreciate GIAC certs and CASP from CompTIA

Those are the things I look for in a candidate; I put less weight on formal degrees but sometimes I am hampered by HR in the degree area depending on the role.

[olive sierra]

oh, right

i'll be graduate in information systems in july

and i'm trying to find some job in brazil

cause i live here

and i'll follow your tips above

thanks mate :))

[boreal zephyr]

I have no idea what the job market in Brazil looks like; some certifications or certifying agencies have more respect depending on the locality. I would review the job posting in your local area and identify the things that they are lookin for as goals for yourself

But, to learn and grow your skillset, THM is a great place to learn

[olive sierra]

Thank you so much mate

[serene umbra]

Gave +1 Rep to @boreal zephyr (current: #229 - 22)

[olive sierra]

helped me a lot

[boreal zephyr]

You are quite welcome. If you have any other questions feel free to ask here.

[olive sierra]

✌️

[boreal zephyr]

What are you interested in?

[scarlet scroll]

Red teaming

Given I actually understand what that is, it's an all out attack on an orginazation ethically from what I understand

Minus the DDoS and other things

[boreal zephyr]

Red teaming isn't just executing a penetration test. You can't just walk into a network are start reconning for vulnerabilities. There are facets to red team including legal, test and evaluation, risk reduction, program mangement, etc.

If a company hires your team to conduct a test there are rules, laws and governance that you have to understand how to apply. That being said, my foremost recommendation is still OSCP and GIAC.

The reason being is that OSCP requires you to document and report, not just do. Critical parts of a red team engagement. GIAC teaches the laws and ethical governances needed to actually conduct business. Red teaming, at the end of the day, is a service.

[scarlet scroll]

Makes sense

[boreal zephyr]

As a practitioner, technical knowledge is important, but engagements are well-defined, planned activities. I will have developed a risk-reduction test well ahead of actually going on site and performing any red team activity.

[scarlet scroll]

How do you usually develop the risk-reduction test?

Also is it taxing? Work-load wise?

[boreal zephyr]

Happy to walk you through it!

My experience is in developed systems, not enterprise. That is to say, I am testing against a set of system requirements. For example, Gorfle LLC is developing a new ice cream machine. Gorfle wants to be assured that the ice cream machine is not vulnerable to privilege escalation attacks. I would help them create a requirement to prevent a privilege escalation attack, for instance " The Gorfle machine shall enforce mandatory access controls on all files resident on the system".

The engineers would create mandatory access control labels, lets say SELinux for example. My red team engagement would develop a test plan specifically to test the effectiveness of that implementation.

Now, extrapolate that to 100+ more cyber related controls

and that is our test plan.

[scarlet scroll]

That makes sense

[boreal zephyr]

Our red team will develop a comprehensive risk reduction test plan that encompasses all of those requirements and we write novel test cases to try and circumvent them.

We also use software tools like SAST and fuzzers to compromise the underlying software mechanisms, if applicable.

Yes, it is taxing. its 90% planning 10% execution

then we write a report on our test findings.

All that being said, enterprise cyber is a whole different world.

[scarlet scroll]

Sounds like a stressful version of chess

[scarlet scroll]

makes sense

[scarlet scroll]

Pay being better?

[boreal zephyr]

no it pays a lot worse in my experience, and has much less freedom

You can't play around in production land

You run scans, document findings, and leverage mostly automated tools to avoid breaking stuff

[scarlet scroll]

That makes sense, can't mess up the entire thing

[boreal zephyr]

To get a job or develop your skills?

[scarlet scroll]

Both please

[boreal zephyr]

For a job, get certs. Whatever certs are in demand in your locality. To develop your skills, work in THM is a start. Create a portfolio, take what you learn and apply it to a novel situation or use case to demonstrate your skillset. About a decade ago I fell in love with Wifi Pineapple. I wrote some custom scripts to abuse the wifi beaconing functions in most cellphones at the time and brought it on a commercial flight. Definitely don't do that, its illegal. But I generalized the scenario and wrote a thesis

If your funny, start a Youtube channel and explain what you learn to a new audience. The best practitioners are teachers.

[scarlet scroll]

That's a good idea, thank you

[boreal zephyr]

Basically, hone your skillset. Define what it is you want to do, and chase it.

Cyber is a huge field.

[dense dagger]

Real, also can I ask a question. I’ve been offered a threat hunting / IR position which is very different from my current skill set (application and infrastructure security). Do you think theres a big jump in terms of skills/knowledge and do you think pentest/red team certs can translate to this role?

[boreal zephyr]

There is a pretty cool dude I found on YT the other day named Cr0w that is doing that very thing. They are learning and teaching as they go, they have a cool series on the Win32 API and DLL injection. Pretty funny and basic enough to follow along.

[scarlet scroll]

Will check them out, I wanted to start a YouTube a while ago but school and stuff have been taking over my life

[dense dagger]

I’m asking since I’m planning of trying to negotiate that my red team/pentest certs are also helpful for blue team in that I can build better detections since I know how an attacker works

[boreal zephyr]

Threat hunting and incident response is a very specific skill set. If you are already in application security I think there is significant overlap in fundamentals but its less of a skill set jump and more of a difference in methodology. I think someone in the red team world would translate very well into an IR role

IR is about detection and response, someone with a solid red team background would know what to look for.

I once encountered a scenario where an SOC analyst flagged a seemingly suspicious IP that they said originated from Russia and was communicating over FileZilla to beacon back to the source IP. They sent off all the alarm bells and quarantined a production server.

The call came from inside the house.

[dense dagger]

Hmmm, alright alright, I might have to think about it differently then on how I approach and probably do some training on some websites. But do you think certs like OSCP and CRTO would translate into better negotiation for pay?

[boreal zephyr]

No I think they negotiate you a position. Experience and time in role give you better pay. OSCP is entry level

[dense dagger]

Okay okay, do you think potential and longetivity are possible factors in getting increased pay?

[flat sedge]

The role of certs is for the business to demonstrate expertise to other entitties. If the gatekeeper requires the cert it's because of business reasons.

What gets you increased pay is a history of demonstrable value in the roles you've already had

[boreal zephyr]

Well said. Often times a certification or specific degree is required to fill the role, especially in government contracts, (US)

[dense dagger]

Hmmm that’s fair I understand that completely. But I also thought that since its less expense to hire someone that already has a cert than hiring someone without, there’s better incentive to raise someone’s pay

[boreal zephyr]

This depends on the role and the industry, but in my industry specifically I can only hire folks with a certification or degree that qualifies them to the role. It isn't a matter of cost, but that I could be penalized by hiring someone that doesn't meet the requirements stated in the contract.

For example, if I am required to provide 200 hours of engineering support, the people that I hire to provide that support must be qualified engineers as per the contract

Sorry its probably more info than you needed.

[dense dagger]

Oh okay so rather than it becoming a preferrable cert, theres also times where its a hard requirement

[boreal zephyr]

That's right, but certification are still demonstrable measures of an individuals skill set. And sometimes, there are opportunities like Engineering Waivers that provide some relief

[flat sedge]

It's demonstrable value. The cert has some value in that, but not as much as experience in the domain. The entire reason certs exist and are expensive are for independent accreditions to "certify" expertise. Don't get hung up on having/not having certs. The learning is super important, the cert is what the business uses to justify the expense.

Because it's the justification that gets provided to auditors or clients to support the claim that hte org is meeting business requirements for expertise

[boreal zephyr]

All of this is still within the scope of a given cyber field. There are some red team operating strictly in the private business sector that are not beholden to any of these requirements

[flat sedge]

And the boutique firms that don't have that requirement are really well known and highly regarded in their fields. But if they had a big enough client that requires CEH? The business will get their employees those certs because it's brining in enoughmoney to justify the expense

I use CEH explicitly in my example because it is a bad cert.

[boreal zephyr]

I would rather get my folks qualed in CEH and win the contract than lose out because I have no respect for CEH at all xD

[flat sedge]

Exactly

If a candidate has CEH without a good reason, their interview usually doesn't go well

[dense dagger]

Ok I have a last question. So when trying to negotiate for pay, I usually hear its 25% increase on basic pay. But theres also benefits, in my case I get a government mandated 13th month pay, a Christmas bonus in the form of 14th month pay and a bonus pay dependent on the company’s performance. Usually its a guaranteed 15th month pay but can shoot up to 16th month. My initial computation was (basic pay x 15) / 12 for my annual compensation

Is this somehow correct or am I thinking wrong?

[boreal zephyr]

I am not in a position to negotiate your wage

Sorry friend this is just beyond my scope

[dense dagger]

No worries mate, your inputs have been valuable re: certifications

[sturdy scarab]

any last min interview tips for a f2f interview tomorrow

[fringe wigeon]

if it's a junior/trainee position, look up common interview questions for it
maybe refresh on some network basics like the OSI model or something

mentioning self-taught learning and hobby projects related to the position in question is also often a good look since it underlines your interest as well as your capability / excitement for learning, in my experience

and finally, make sure to be on time and to dress sharp (business casual)

[pseudo creek]

well it often depends, some of it on country you are in, some on company. I'll say at my company, junior level cyber make below what junior level software engineers make, but not a ton but senior cyber make more than senior software engineers

As someone who has been in cyber a long time, I've never had an issue with vacations, savings, buying a home, etc.

I'd say do what you enjoy

[serene umbra]

Gave +1 Rep to @pseudo creek (current: #14 - 469)

[pseudo creek]

I'm in the US but that sounds good to me

[loud fern]

What's the salary range for same job? If you were to look around on the market, you would get your answer.

[pseudo creek]

our taxes are... complicated

some taxes are pretty low comparitavely but also we pay a good deal for things like healthcare

[loud fern]

Is 36.92 pounds you are getting for cybersecurity position or is it for your software engineering position?

Seems to be above average. Can't say its bad.

What do you mean by obvious reasons? Why can't salary be disclosed?

[flat sedge]

"Junior Security Architect" is still a pretty senior role. Architect > Engineer.

[loud fern]

For starters, could had started with specifying its cybersecurity architect, cybersecurity field is so wide and that each role has different salary expectations and obligations

[flat sedge]

Architect is usually 10+ years of experience

[loud fern]

Yes, Security Architect is senior role

[flat sedge]

check with the local labor authority, if an employer tells you that no one is allowed to discuss their salary with coworkers, that's often illegal

[loud fern]

Analyst

[flat sedge]

Analysts have a different job than Engineers. Often, they are peers.

[loud fern]

The job is different though, but analysts don't per-se implement or build usually

[flat sedge]

Analyst roles tend to be "less" technical than Engineer roles, and are focused on evalauting data (such as from monitoring tools) than implementing/deploying/maintaining plans from the architects.

that's much more inline with what I would expect entry level to be in the UK

Part of the difference in the salaries is that Security is not revenue generating. Developers do generate revenue.

It's why Sales typically makes the most, they bring the most money in, so they are highly incentivised for that function.

[loud fern]

In security you want someone that protects your money well

Usually salary is brought up because the demand is high for more senior roles

[serene umbra]

Gave +1 Rep to @loud fern (current: #1002 - 3)

[loud fern]

No problem, good luck

As Pentester, the hacking you do is small portion of actual job, using those VM challenges one after another can be quite deceptive in a way

Also the fact that you know there is always a solution, you just need to find it, is not real in the actual environment, there you might not find anything at all

Or you might find a lot more ... Depends who your client is

And their security posture

Maybe, I have not had any interaction with hackerone

I work in a SOC

Can't complain, would be always nice to get more though

I am in this unfortunate situtation that my country is small, so there is no "market" to draw comparisons for the role, and closest ones you can get are for somewhat similar roles and derive from there, basically what you think your worth is and negotiate for it

[leaden cypress]

I have an interview for my first pentesting job tomorow. (Well tecnicly today)

I'm usualy very confident in my capacities but.. I feel like I lack experience and don't feel confident in this. I would love to have the job to aquire professional experience in it tough.

[mystic wing]

Hey
I'd suggest you to:

• have a nice rest to clear out your thoughts, and just be not too nervous about this
• interviews are just a test, if you fail, sometimes the interesting part is your reaction about it. If you're losing your cool, well that's not a good start

And your worries just show that you care about the job

[leaden cypress]

I'm mostly woried what if I get the job and I realised i'm not good enough.

meh, i'm worying about imaginary things. But telling it here helped somehow.

[blazing furnace]

Hey everyone, I'm wondering if starting a career in a Security Operations Center (SOC) is feasible after obtaining a CompTIA certification and similar ones. Or just better to start with Cisco certifications and aiming for networking roles and only after gaining some enterprise experience continue cybersecurity path?

[blazing furnace]

Congrats man!

[glacial moss]

hey is there a cyber instructor that could answer some questions I have?

[fringe spade]

hi, just ask the question, there’s a lot of professionals in this chat

[cobalt escarp]

Ask the questions and if someone can help they will:)

[mystic wing]

tbf, it's expected that you will have an integration phase, and for sure you will learn, unless your manager doesn't know how to manage a team (it happens :/)
now, break a leg for the interview

and be prouf of yourself for having an interview, it's the beginning of something great :)

[mystic wing]

which certifications exactly?
I need some confirmation, but I think Cisco's certification have a bit more value, which could translate to better pay and higher chance of getting hired

[dense dagger]

Cisco is more geared towards networking and Cisco products. You have better leverage with your Cisco cert if you're applying for a network related role

[dense dagger]

Security+ is a good baseline certification that teaches you across most security domains to strengthen your fundamentals. Also, companies that offer SOC L1 positions, they tend to hire new graduates for this role.

[pale glen]

hi everyone, I plan on getting a bachelor in cybersecurity. I would fail a CS Bachelor as I am pretty average in maths. However, I read on reddit that you can't succeed a cybersec career without having a CS Degree. I'm pretty concerned right now and I don't know what to do. Any advice. Pardon my broken english.

[pseudo creek]

Reddit is wild, you can get into Cybersecurity without a Comp Sci degree. I would look at the cybersecurity degree and see if it focuses more on the technical vs policy.

[pale glen]

Thanks, I appreciate

[serene umbra]

Gave +1 Rep to @pseudo creek (current: #14 - 470)

[barren nest]

would security+ help in acquiring entry level pen testing roles?

[little matrix]

As per their website, yes, but I would disagree. It covers a lot of fundamentals, but not much hands on. Which is quite important when it comes to pentesting.
Unless they made major changes with the SY0-701 .

[flat sedge]

security+ would be a basic pre-pentest foundation knowledge

much like subnetting or being able to read source code

[mystic wing]

cyber security is a broad term if you ask me
there's job which are more technical and some which aren't (governance)

it all depends on what's interesting you
if you want to work for pentesting, then yeah for sure, it's better to have a well recognized certificate

[soft zealot]

If for example a Senior Content Engineer (Blue Team) with a good background is hired in a medium big company, do they go trough a trial period first? And what if they sign the contract then prove to be incompetent towards the assigned project only afterward? How does it work in say UK or us. and, does it happen often
example is a bit specific but i'd love any global lesson on corporate world workflow

[dense dagger]

In my country, there’s a 6 month period before they get regularized

Then comes a performance review

[pseudo creek]

In there US, there is no trial because they can basically fire you at any time with little notice

I think other countries have trials because it is harder to fire people

[coral vault]

That trial period is usually mutual. You can quit at any time if you don't 'vibe'

[buoyant mural]

hi there

[hollow sun]

Hi,

I'm an IT engineer who's passionate about cybersecurity and pentesting, and I've done internships and gained experience in dev, devOps, cyber, and so on.
For several months now I've been doing a lot of CTF (mainly in Linux environments), I've managed 100 rooms on THM, and a few on other sites.

I'm applying for jobs in cyber, pentest, SOC. I'm having trouble getting a job. Right now I have free time and money. So I'd like to get certified to boost my career start and open up opportunities.

I've already had a look at what's out there. There are two options open to me:
CEH and OSCP.

I'd like your advice. How do I know if I have the level to take these certifications? Which is the most relevant? How much preparation time is required? Do you have to have a lot of experience to take them? Anything else?

Thanks

[pseudo creek]

what country are you in? CEH is really only useful if you are in India

also I'd possibly post your redacted resume here so others can review. If you aren't getting interviews, it is either you are applying to the wrong jobs or its your resume

also I will say, don't sleep on cloud certifications (I am biased as someone who works in cloud security)

[hollow sun]

I'm in Canada or/and EU

[pseudo creek]

yeah I'd look at OSCP then but also possibly Security+

[buoyant portal]

This is just what I've been told as I'm not actively trying to get into anything red team, but no pentest op is going to hire entry level, your best bet is to focus on applying for a SOC specifically and then once you've got some experience start moving towards an offensive team.

[hollow sun]

Okay thank you

[serene umbra]

Gave +1 Rep to @buoyant portal (current: #1327 - 2)

[buoyant portal]

getting a splunk cert would be an idea too

[indigo arrow]

Hello! My name is Nicole and I’m seeking an entry level career in IT networking. I’m looking to get my foot in the door and climb my way up to cybersecurity. I created a resume website nicolecampbell.tech. My resume can be downloaded from there.

[worldly whale]

🎣

[stoic cave]

Just an FYI, people don't like having to download things to review resumes. If you verify, you'll be able to post an image in this channel of your resume. Make sure it is redacted of all PII and other sensitive information.

/docs verify

[crude sphinx]

Discord: How do I verify my TryHackMe account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

Feb 27, 2024, 5:42 PM

[stoic cave]

Thanks, my LTE is super spotty right now

[indigo arrow]

👍🏽

[rustic laurel]

How much would I be limited by job opportunities in cyber security (or in any technical field really) if I studied at a university that isn’t well known or reputable?

For context: Im having some family conflicts about where I should study, family wants me to study in Brazil, parents want me to study in Europe.
Would it really matter in the end?

[spiral anchor]

im curious as well

[still shell]

Has anyone ever had to do a coding and design interview for an AppSec engineer role? I've been doing pentesting in my current role and haven't really had to "code" on the job. Anyone have recommendations on how to brush up on that for an interview? Same ask for the design interview - they said it would be a whiteboarding system design interview - anyone ever do that for an AppSec engineer role?

[buoyant portal]

This is what my instructor told me: at the lower level, where you get your degree or having a degree at all doesn’t matter too much. As you move up into leadership roles and different advanced positions, where you get your degree matters more.
Basically your first degree to get into the field isn’t as important, but if you want to later get a masters or higher you should go to a well known institution

[tawny hawk]

I have never heard that advice before. Actually the exact opposite in my experience. Prestigious degrees are good for getting you a job out of school/when you graduate. The matter less the longer your work experience

And I say this as a 34 year old with a prestigious degree

[pseudo creek]

It can vary by country. In the US, no one cares where your degree came from once you have a couple years experience

and masters degrees? its a checkbox and again no one cares

[buoyant portal]

He runs the SOC for SAP software and told me that in confidence, not as a sell for the school I’m in or anything. I think like Azure said, it varies. I’m not really interested in getting a degree at all unless the company I work for wants to pay for it 😅

[vapid plinth]

Same take as Zojja, but for the Balkans, no one really cares where you got your degree as long as you have it as most businesses need it to apply for clients etc. rather than to see if you're a worthy candidate. Work experience pretty much replaces the degree, haven't delved into the whole master's degree requirements though so no input

[fickle grove]

In my side of the world, degrees are a requirement even though it isn't relevant to the work you are doing or going to do.

[dense dagger]

In my country, there’s still rampant discrimination between university degrees so having a prestigious degree definitely helps getting a job. There’s even hiring catered towards prestigous universities before local mass hiring.

[woven mirage]

Hello fellow balkans

[terse latch]

is this only for IT or all the sectors?

[finite aurora]

i might be landing an internship for cybersecurity sometime in the coming months and im wondering if i should learn how to use a stress tester for networks and if so which ones?

[sudden hornet]

How important is programming when looking to become a SOC analyst?

[fringe spade]

Networking and system administration knowledge will be more important, but programming might be useful

[sudden hornet]

Ah okay thanks!

[serene umbra]

Gave +1 Rep to @fringe spade (current: #277 - 17)

[pseudo creek]

pretty much every sector

[cunning shadow]

There are no URLs in that message.

[zinc kernel]

Hello, anyone here with CPENT certification..??

[strange arrow]

Looking for a UK (preferably Manchester) based entry level IT/cyber roles to start after I finish my cyber security degree in a few months. If anyone knows of such a role let me know!

[rustic laurel]

I see. It seems people have mixed opinions about it. I just hope I wont regret my decision.
Thanks your answers guys

[serene umbra]

Gave +1 Rep to @buoyant portal (current: #1002 - 3)

[static tide]

Cheltenham based but not sure if currently hiring atm - for pentesting

[strange arrow]

pentesting in Cheltenham sounds like something I would be interested in :)

[hollow sun]

How much time did you take to get your OSCP cert?

[terse latch]

What are the essential courses to become a Pen Tester?

[normal ice]

Please I need help for one of the rooms on tryHack Me

its a room for FTP, SMTP and POP3 Labs

Please any help will gladly be appreciated

[rugged delta]

Pentesting isn't something that can be learned just by doing a few courses. You need a good understanding of Windows and Linux administration, networking, a little bit of Bash/Python to start with and then build your skills from there. That being said, you can learn a lot through THM and all the rooms/paths/modules/networks available.

The CompTIA courses/study guides/exams can provide a good introduction to the field, such as Network+ and Security+. After that, aiming towards the OffSec OSCP would be a good goal, as it aims to take you from basics to junior/intermediate level. There are other certs around that level, such as the TCM PNPT and HTB CPTS that cater to new entrants but with a better price point. While their knowledge is better than OSCP, and they run for about a third the cost, the OSCP is widely recognised as the standard still by hr departments and clients due to its longevity in the industry.

That being said, the OSCP 'Try Harder' motto and mentality seems to be based purely on the fact that their course doesn't teach you all you need to know to pass the exam. The other two tend to bridge that gap. Certifications don't make you a great pentester though, and after that you'll need to develop your skillset to become a better hacker so as to operate within a team

[rugged delta]

Go to #room-help or #room-hints

[terse latch]

Exactly, I agree what you mean. That's why I am asking actually. Do you think this is a good pathway?; https://jhalon.github.io/becoming-a-pentester/

[rugged delta]

It's a good set of recommendations on the way to being in your chosen role. There are far more roles than pentester in cybersecurity, though having a bunch of those skills can really help, and yes, having a bunch of resources, pathways and mini-goals can help you find your own direction. You're going to grow your skills as you develop in the field and there's no 'single way' to go. You do just have to be resourceful and get stuck in on absorbing plenty of resources and using them to build your skillset

[dense dagger]

I disagree, the OSCP course has all the things required to pass the exam.

[rugged delta]

And yes, he does make a good point, a lot of courses and certs can be pricey/unaffordable/out of reach without good backing from an employer in a lot of cases but there are always other resources to learn the same skills and knowledge in a safe and legal manner. A lot of the things we do in cybersecurity would be illegal or at least in a legal grey area without resources like THM/Offsec and other providers

[rugged delta]

I'm just going on what I've heard from people who've done the course. I know they've been working to improve things the last 5 years with regular updates to the course/exam environment/proving grounds

[dense dagger]

I do think that people go into OSCP and think they can learn tons of new, untaught techniques. That’s not the case and its main focus is trying to build your own methodology and exposing you to a lot of vulnerable services to build the said methodology.

HTB CPTS also encourages this type of approach with their modules and challenges.

That said, I do think my current recommendation goes like HTB CPTS > OSCP > PNPT.

[rugged delta]

Well I am finding the CPTS very informative and I'm hoping to have that and OSCP before too long. I'm finding it certainly helps refine the approach to tackling pentesting challenges in the most efficient manner.

[dense dagger]

Been thinking of taking it myself too, how far are you in and how long do you take to finish a module?

[rugged delta]

I think PNPT would possibly make a better intro to the field, since TCM's approach is very encouraging to new entrants, and he does have a great way of communicating techniques. Plus, your post-exam process, as well as the report requires a report debrief with Heath Adams himself. I think the biggest disadvantage to the CPTS gaining popularity is the requirement to complete the path 100%, which definitely discourages experienced pentesters taking the exam and being advocates for it; but as a new cert provider, I think they basically wanted to ensure their methodology was fully reliable. All three are fairly comparable and I think we can agree are the basis to starting as a pentester...

[topaz narwhal]

I planned to do keylogger as my final year project in python what kind of api shall i use i am so confused can anyone suggest me?

[warped anvil]

Did a small write-up from my OSCP exam experience and preparation if anyone is interested. Note: Write-up was approved by OffSec. The OSCP Journey In 2024: Exam Review & Preparation https://medium.com/@simonsynnes/the-oscp-journey-in-2024-exam-review-preparation-7ec27ca38c4b

[warm hinge]

im going to take a look at it :)

[warped anvil]

@warm hinge this is the first form of article I have written in years, let me know how it goes😁

[hollow sun]

Will read it, thanks

[serene umbra]

Gave +1 Rep to @warped anvil (current: #2012 - 1)

[dense dagger]

Not necessarily Heath Adams himself, I know sometimes he delegates the task to other senior pentesters of the company. While its true about the amount of information you get for $30 and is very welcoming to new students, I don't think that the PNPT is within the level of CPTS and OSCP simply on the limitation of their training platform.

Even CRTP, which is priced at $249 for their 30-day access has their own hosted labs.

[polar aspen]

Thank will take a look, thinking of doing OSCP after taking CISSP

[serene umbra]

Gave +1 Rep to @warped anvil (current: #1330 - 2)

[warped anvil]

sounds like a good plan that 👍

[mystic wing]

Break a leg
My teacher did the opposite, because it helped him to get the CPEs for the 3 years

[kindred prairie]

i'll give it a read, ty

[serene umbra]

Gave +1 Rep to @warped anvil (current: #1002 - 3)

[sinful kindle]

Hey all, I noticed THM just released a DevSecOps room and I remember from university one of my professors absolutely raving about how great of a job that is. Anyone have a general description of the job or its expectations? I have heard it follows the programming side more

[unreal arrow]

https://aws.amazon.com/what-is/devsecops/#:~:text=DevSecOps is the practice of,is both efficient and secure.

[sinful kindle]

Thanks for that!

[serene umbra]

Gave +1 Rep to @unreal arrow (current: #74 - 79)

[floral timber]

Hi all , just got my Sec+ certification done, was hoping for some guidance on how best to leverage this to get an entry level position in the industry ( remote) , any guidance would be helpful. Thanks

[terse latch]

Is it your first cert? If not, let us now what other certs do you have?

[floral timber]

Have got the Google cybersecurity certificate and an Advanced cybersecurity certificate from IITK

[terse latch]

thx, and whats you goal? I may follow the same way

[floral timber]

Goal is to get a job , maybe as a junior analyst in this field, inclined towards remote positions though

[terse latch]

I see

thx

I am targeting to become a pen tester but I think it doesn't work to become a penetration tester directly. You need to start somewhere else, in some other cybersecurity jobs that I haven't discovered yet.

[floral timber]

Yeah the path to get a job isn't very clear , maybe intentionally so 😅

[terse latch]

Honestyly, I came here from a job post. the first phrase was about oscp certification requsition. So I started from end :).

[floral timber]

What's the best place to look for open positions? LinkedIn seems to have few available

[limber shale]

Not a bad place to start https://www.cia.gov/careers/jobs/cyber-operations-officer/

[terse latch]

🙂

[floral timber]

Haha, i think this might only be US citizens

[terse latch]

I dont want to get captured by swat team at 5 am early in the morning 🙂

[fickle grove]

Depends on which side of the world you are I guess. You can start with Seek, Indeed, etc.

[floral timber]

Based out of India, thanks, will check these out

[serene umbra]

Gave +1 Rep to @fickle grove (current: #15 - 442)

[coral vault]

I have to say that posting by the CIA is a good listing though

It's broad and kind of gives off a non-specific vibe of like 'hey man if you're good, show us'

[topaz narwhal]

Hello guys ,
To my keylogger project what kind of api should I choose and which is best to send the log file from target machine to host machine

[dense dagger]

I'll refer you to @cobalt escarp or @tacit bobcat

[cobalt escarp]

Please don’t ask about this here

[topaz narwhal]

Sorry I don’t know where to ask 😅

[sudden hornet]

So atm I've got about 1 yr 9 months in IT Support exp and am looking to extend that with my new job to hopefully get to 3 years total then try to get into a soc analyst role. I've heard that CompA+ is more on the 'no prior IT knowledge' side of things, so would it be worth still doing A+ if I'm going to approach 3 years IT exp, or should I just go onto Sec+ and Networking+?

[dense dagger]

How is the training in your current company? Are you able to take one every year or multiple depending on the budget?

I'd say Sec+ has more ROI than Net+ if youre planning a pivot to SOC

[sudden hornet]

I finished up my previous employment in the start of 2022 to finish my full-time study (which I've finished now). I'm not too sure if the company I've just signed with (large commercial property business) will place any focus around me getting any certs (from what the CTO has told me there's no intentions atm for establishing an internal cyber team), so my plan for now was to just do the certs outside of work and pay with my own money.

[dense dagger]

Then definitely with Sec+, just remember to still study about networking.

[sudden hornet]

Yep absolutely

Thanks for the insight !

[rugged delta]

Oh I do think that if you're considering entering the field using something like eJPT or PJPT, they should just be skipped in favour of PNPT or going straight to OSCP/CPTS. I do believe lots of people need a soft entry into pentesting to realise that there's a lot more to it than just Nmap, Burp and Metasploit involved in the process, but while I believe eJPT/PJPT aren'y sufficient, PNPT certainly is; and nobody in TCM is going to argue that further training will be needed.

And yeah, of course, there's no guarantee you'll get the man himself, but he is proud to take part in the process. Looking at some of the orgs who publicly endorse his certifications indicates a reasonably high level of quality with more to come. At the end of the day, all of these certs are indicated towards developing an individual to a level where they can begin to operate at a junior level in penetration testing, but of course, there's always more to learn

[warm hinge]

Hello! I can help you here 👋

I released a blog article earlier this week which interviews Max, a Content Engineer at TryHackMe who helped create the DevSecOps learning path with his previous experience as a DevSecOps Engineer. He shares his experience and general expectations of the role here: https://tryhackme.com/r/resources/blog/interview-with-devsecops-engineer?utm_source=discord&utm_medium=social&utm_campaign=blog

Hope this helps - and feel free to reach out to Max via LinkedIn if you ever want to know more!

[tacit bobcat]

why are you trying to make a keylogger?

[sinful kindle]

That is perfect! Thanks for reaching out

[serene umbra]

Gave +1 Rep to @devout flicker (current: #552 - 7)

[bleak crest]

Hey i just passe my Sec+ Certification and it's my first cert. My goal is to transition into cloud security so I have begun to study Microsoft's AZ 900. Should I aim to go straight into cloud security or should I aim for a basic entry level position first? Also I have no prior IT experience, and feedback would be greatly appreciated

[rugged delta]

The cloud platforms like AWS, Azure, Google Cloud and others aren't some magical, mystical thing in the sky. They're a collection of platforms that connect you via a website and other protocols to platforms that use the infrastructure of multiple data centres to be able to rent computer and network systems to get things done. You would need a certain level of understanding of networking, Windows, Linux and other skills to really understand how to get the most from the cloud.

The cloud platforms tend to have their own certifications but it would be a good idea to further build your skills in these areas in order to be able to provide useful skills to any potential employer. That being said, having the basic certs for the cloud platform of your choice can boost your employability and your salary. AZ-900 is purely the fundamentals but you should endeavour to get further specific certs on the path to your goal

[bleak crest]

Thank you so much for taking the time to provide your insight

Would you recommend starting off in a basic entry level position?

[rugged delta]

Most people start in IT support/QA or similar, but if you develop your skills you can advance into other roles. You should look on LinkedIn or Indeed at job descriptions to see the kinds of skills that are required/requested to be able to perform in a role you would like

[hushed salmon]

can anyone guide me>?

[fickle grove]

In what way?

[finite anchor]

hey was wondering what certifications do you guys recommend for someone going into cybersecurity that are worth the money and help with a job

[rocky harness]

Hello Friends...
How are you doing...

i am working in a customer support role in UAE for a telecom. and i am trying to get into cybersecurity. [esp. PenTesting ] I have done 3 certifications CEH, eJPT, PNPT. Whenever i apply for a job, i am being rejected for not having previous experience in cybersec. So i am thinking of taking an internship

is it possible for one with 4 years experience in customer support to take an internship in Cybersec. or internships are only for freshers and students?

your advices/insights are much helpful to me

Thank you

[fickle grove]

I want to land a pentest role myself, but haven't really done anything concrete. However, a few things you may want to consider:
a. What roles have you been applying for - junior or senior level? Have you considered the possibility of taking pay cut if and when you really have a difficulty in finding a pentest role?
b. Have you tried doing personal projects and showcasing those in a blog?
c. Have you looked at job boards and checked what certifications pentest roles in your area are looking for?
d. Have you inquired if there are openings for pentest roles within your current employer and if there is a possibility of being moved to that department or team?

[rocky harness]

thanks mate...

yeah! i dont have problem with pay cut. i just need an entry to cybersec
b. no i have to do that really thanks for the nudge.
c. even for an entry level job they are asking OSCP here...
d. my current employer doesn't have any pentest roles 😦

[serene umbra]

Gave +1 Rep to @fickle grove (current: #15 - 445)

[undone shore]

Why did you go for three certs which are not on the job listings in your area (especially when one of those choices is CEH 🤮) rather than the one which is?

[foggy cypress]

what would you rate the best 3 certs for DFIR
I have an oppurtunity to do SANS 508 and the job will pay for it, is it good option?

[fringe spade]

Any SANS is good if your employer pays for it haha

Haven't done it personally, but I heard it's a good course

[polar aspen]

Check listing on a specific DFIR job you want, usually they will tell you what SANS cert they looking for

That should help

[pseudo creek]

what experience do you have? Do you know the generics?

FOR508 is an advanced incident response and threat hunting course that focuses on detecting and responding to advanced persistent threats and organized crime threat groups.The course does not cover the basics of incident response policies or digital forensics.

[terse latch]

is anyone tried edX.org cybersecurity bootcamp?

or is anyone suggests a good bootcamp to start

what other courses useful before take OSCP exam?

[boreal zephyr]

I personally have not heard of a cybersecurity bootcamp. Or at least one that would be taken seriously. If OSCP is your goal, PWK is the answer.

They call if Pen-200 now I think

https://fs.hubspotusercontent00.net/hubfs/5852453/OSCP 2.pdf

[toxic breach]

as i don't have a structured pathway that's why i'm facing issues with solving ctf's
i've completed the intro and pre security pathway and currently doing jr. pentester path but i can't solve ctf's
if you guys know any free bootcamp or a structured path then please tell me

[fickle grove]

I read good reviews on HTB's CPTS materials which more than prepares you for OSCP. If you are a student, it is even better as it will be $8 per month.

[woven mirage]

https://twitter.com/jerryjhlee/status/1761083586789113919

Jerry Lee (@JerryJHLee) on X

I set up a hidden eye tracker on 2 recruiters to find out exactly where they look at your resume before making a decision.

Here are 5 tips I’ve learned about resumes.

Twitter · Feb 23, 2024, 5:40 PM

[warm hinge]

mm I agree

[rugged delta]

OSCP training is intended to take you from the basics to being able to perform the tasks of a junior pentester. The 90 day course and single attempt package is about $1650, and while pricey, is the most recognised certification for junior pentesters. The Learn One option gives you a year and provides a lot of other value, as you should already understand a lot about Linux, networking and other topics going into the OSCP. It costs about $2600 and can be quite a burden for a potential junior pentester. You should expect to spend several months training, revising and learning in order to succeed at the OSCP, and you should think of it as an investment in, and foundation for your future career and abilities.

Other certifications like CPTS or PNPT can teach you quite a lot, and they both cover mostly the same content to varying extents, some moreso and some less so compared to OSCP. The OSCP is, however, the most widely recognised cert in pentesting, so even though in most cases, it's suggested you have your employer fund your training, even to demonstrate your value to a potential employer, you need to show you have some level of ability and ongoing learning and goals, so it can be worth it to invest in the OSCP and potentially one of the other two in order to make you a more viable option.

However, holding a particular certification is no guarantee of an interview or getting a job, as the world of penetration testing is highly competitive. You should also make plans to understand a variety of roles and be willing and able to perform or redirect your efforts towards another role in cybersecurity while you build up your pentesting skills.

You will find a lot of excellent content to grow your skills in Try Hack Me, and do realise that it can take quite a while and a lot of effort before you're able to fit into the role of penetration tester

[warm hinge]

thanks a lot 👍

[cyan elk]

would going through the free stuff for the jr pentester/red teaming/offensive pentesting paths be enough to potentially go for OSCP? or would you recommend going for something else? Asking cause I have a very limited money income so I'm sticking to the free stuff for now.

[coral vault]

What I have heard from my current SANS instructor is that it is a pretty hardcore course

Its die hard technical, contrary to some more lecture styles sans courses. I am doing the 508 in May

[stoic cave]

Not sure what this site is, but official postings for US Government positions are on USAJobs

[woven mirage]

Oh

should i erase the post

[cobalt escarp]

I have removed it

[woven mirage]

oki, im sorry

[dense dagger]

Yes + Wreath & AD networks

But the thing you need to practice is methodology, so when you take the PEN200 course, you’ll have access to their labs which will help you immensely with building your methodology.

[cyan elk]

alrighty thanks a lot ^^

[terse latch]

This is so neat, thanks. So, what do you suggest as a job lower than pen testing but related to it? I am especially interested in part-time remote positions where gaining experience is more important than the money. (I have found these ones with AI search "Security Analyst,SOC analyst, Vulnerability Assessment")

[serene umbra]

Gave +1 Rep to @rugged delta (current: #21 - 357)

[pallid cosmos]

Has anyone looked at the new Empire Ops course that BC Security just published? it looks interesting but I don't know anyone that has taken their training before and all I know about them is that they build Empire

[oak oar]

Hello, I have started TryHackMe about one month ago, with the aim of being a Bug Bounty Hunter. But it seems there is a gap between being able to complete THM challenges, and rooms, and being able to find vulnerabilities on online websites, which I'm not able to do clearly now.
And it is fortunately not surprising, that websites are able to protect themselves from one month newbie learner. But would you have any advice, or any learning path (did Red team, Junior Pentester for now) that would help me reach that level ?
Thanks a lot

[hot kayak]

Good morning house, please I in need guidance in SOC. I just concluded my beginner pathway in cyber security course. Which courses can I take moving forward

[cursive zinc]

Move onto harder rooms and watch YouTube walkthroughs good bounty Hunter one that I seen is Lostsec plenty more out there aswell

[oak oar]

Already did hard rooms, but about Lostsec, thanks a lot. It's very instructive just after 3 mins, about the way he uses tools: exactly the kind of things I was looking for, thanks a lot once again

[serene umbra]

Gave +1 Rep to @cursive zinc (current: #2015 - 1)

[barren cloud]

Is there anyone which has experience in SSRF? I'm trying to obtain a resource from a php server, which applies as the last security step a content type check, allowing me only to retain type: image/..., but I would like to obtain a .php file instead
I was trying to see if php://filter could solve my problem, but got no luck. The command which is returning the resource url is file_get_contents($...)

[bleak crest]

Any tips on creating a professional LinkedIn profile for cybersecurity?

I am trying to get some interviews

Any help would be greatly appreciated

[slow gazelle]

Has anyone ever done any of Rapid7's product training? I'm considering one of their classes, but it's very expensive, and if it's on par with some of the product training I've paid for from other vendors in the past I'm going to be bummed

[flat sedge]

I did the Metasploit Pro training several years ago, it's extremely product specific and I would not aconsider it useful unless you alraedy know a fair amount about pentest and assessments

It's product training, not an exploration of hacking technique

Remember that product training is a business thing not a technical thing

[slow gazelle]

Yeah that's not a problem for me, we use their products at my job a lot (though not enough to get any discount on the training) I've just done some training from vendors in the past where it basically just felt like the instructor was reading through the documentation that was already available online for free

[flat sedge]

The trainer I had for MSP actually knew their stuff and had presented at defcon in the past - trainer understood the use case

[slow gazelle]

That's good then, that's the kind of thing I'd want, I've definitely done training where literally every question was answered with "I'll have to look that up"
I think they stopped doing the metasploit one of replaced it with a newer course, but I'm looking at the one for their SOAR platform InsightConnect

[flat scroll]

Greetings everyone, i was wondering if someone could help to find my first job, i got a lot of pentest and it sec skills but no degree cause the university in my country had actually poor contents, in ur opinion,what should i have in order to find a good job as a pentester? i have some certifications yet

[warm hinge]

You may struggle with junior roles atm. A lot of people advised me to find an IT role like be a support or an engineer, then study for certs on the side to build your portfolio. Info sec is more of a role that you transition into through getting certs and having IT experience from what I know.

So I'm doing network engineering while getting certs on the side ^_^

[flat scroll]

Mh... my doubt now is : should I get a degree then?

[flat scroll]

U mean university?

[warm hinge]

When I say certs I mean qualifications from vendors like CompTIA, OffSec etc

They are globally recognised

[flat scroll]

Oh ok

I have Comptia Sec+ and CEH

Also Cisco certs

[warm hinge]

That's good, do you have any IT exp?

Job wise

If you do then, start looking for some junior roles

[flat scroll]

not in IT environments.. that's my problem

Unfortunately in italy there isn't any work place

[warm hinge]

Yeah, try and find something in IT if you can ^_^

[flat scroll]

Thank you anyway 🙂

[warm hinge]

Good luck

[pseudo creek]

if you can, I would talk to people in your country who work in IT. they would be best people to advise you about getting a job

[flat scroll]

Lat question, how should i connect my THM account to discord? sorry if it's not pertinent with the channel

[pseudo creek]

sure, no reason not to

[flat scroll]

i'll try to 🙂

[ancient fossil]

on your profile page at the botom theres a discord token, use the verify bot command and it will ask for that token to link the two

dont share the token publicly though

[flat scroll]

In which channel should i verify? i'm trying to find it lmao

[crude sphinx]

Discord: How do I verify my TryHackMe account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

Mar 5, 2024, 1:44 PM

[pseudo creek]

that has the information

[ancient fossil]

#bot-commands is where most commands are used

[flat scroll]

Ok nothing i realized that was the bot

[pseudo creek]

you can message the bot as well

[flat scroll]

I'm gonna do it now, Thank you again 🙂

[hot kayak]

Please guess, how can I share my tryhackme profile with someone

Please is it possible to share my tryhackme profile with someone to show proof of progress

[pseudo creek]

yes, the url is tryhackme.com/p/<your THM username>

like this is mine https://tryhackme.com/p/Zojja

[hot kayak]

Thank you so much

[strong anchor]

hello guys , i really wanna know , how they know that a given service /os have a specific vulnerability , how do they find out that vulnerability and how they create exploit , and what this field called!

i hope you guys understand my question , am talking generally about zero days vuln

[dense dagger]

Zero days are found through research. Common methods are fuzzing whitebox testing, and reverse engineering.

The closest thing I can think of for a field is security research, specifically exploit research and development.

Google has a Project Zero team that specifically does this. There’s also other research institutes that do this.

[pseudo creek]

exploit development is a common name for it

[strong anchor]

i mean , how do cyber criminals find zero days vuln , i don't think is whitebox testing but black am i right?

[strong anchor]

thanks

[serene umbra]

Gave +1 Rep to @pseudo creek (current: #14 - 471)

[strong anchor]

i saw , thanks 😊

[south vigil]

Hello! I'm learning how to find malware that evades antivirus programs. I'm currently working through SOC Level 1 on THM and learning a lot. I particularly enjoy the endpoint material compared to the network material.

After completing the SOC learning path, I plan on joining more learning paths to continue my educational journey on THM. I would really like to also pursue a certification related to this topic of interest (finding malware that evades antivirus programs). I was wondering if there may be a recommendation for a certification to pursue specifically related to the topic of interest I mentioned? What certifications are employers interested in when reviewing a candidate that has this malware-hunting skill?

Thank you!

[vagrant socket]

Just wanted to say that after 2 years of work I finally got a cyber job!

I work an analyst position at a hospital, got hired over more qualified candidates because I did so much better in the technical interview. Couldn't have done that without Tryhackme!

[dense dagger]

One thing separates cybercriminals from actual researchers is ethics. Sometimes cybercriminals steal confidential IP from companies like source code and dev builds, etc. and find vulnerabilities from there to develop 0day exploits.

Typically these threat actors are nation-backed or part of a larger criminal organization ring. One of their techniques is to plant double agents inside companies they want to take control in.

[strong anchor]

make sense

thanks

[coral vault]

The THM Red Team Path has some EDR / Host Evasion rooms to study through

It's not really hardware that evades the detection in and of itself, but techniques used like obfuscation and wrapping.

I mean, certain hardware does it, but it's prudent to seperate the two for clarity

[gaunt berry]

Hey I have a question. Can I get a cyber security job without a degree? Or any tech job?

I want to teach myself instead of paying thousands and thousands for college

And I know there are people that got a tech job without a degree, but how likely is that?

[stoic cave]

To be real, not likely (not saying it doesn't happen). If you're in the US, I can provide some insight.

[limber shale]

Of course, Kevin Mitnick considered to be The Greatest hacker, got caught (probably deliberately) went to prison wrote a book on cyber security and now is head of security at some fancy pants tech company. So it isn't implausible, just not very probable. Just depends on how far you're willing to go to prove your worth

[stoic cave]

He's dead....

Also, blackhat activities land you in prison, not a job

[woven mirage]

not in russia and china

[limber shale]

True, but for him it did both. I'm not saying become a black hat. I'm saying just try to make yourself stand out. Or just get a degree

[limber shale]

Poor guy died at 59 when his wife was pregnant with his first child

[stoic cave]

That's also not true.

[limber shale]

And yes, I googled 😂

[woven mirage]

isoon leak as an example?

[stoic cave]

Frankly, there really is no room for buts, especially now. Anything other than 'whitehat' will put you on the wrong side of the law and ethics. There are better ways to "make yourself stand out."

[limber shale]

Sooo...seen any good movies lately?

[stoic cave]

Not sure what you're referencing but as an example, Russian Federal services do arrest hackers, especially if they hit targets within the country.

[woven mirage]

I may be misremembering, but I think in the leak it was revealed the contractor was stealing data from central asian (?) countries governments

Im not sure how exactly blackhat is defined in state relations

especially since this was a contractor and not a state agency

also sorry for going offtopic

[strong anchor]

In russia if u are a blackhat russian government will make a deal with you ?

[woven mirage]

no lol

[south vigil]

Thank you, Sang. I'll take a closer look at those rooms.

[serene umbra]

Gave +1 Rep to @coral vault (current: #813 - 4)

[south vigil]

Thank you for reading and your response. Am I allowed to say I'm interested in both automated and manual detection? 😀

I can ask ChatGPT to write me a Python script, but I'd rather understand how it works and how to do it myself. So, in reference to malware detection I am totally for using tools that help the process but I'd also like to understand how it works and how to do it manually.

[tacit bobcat]

let's not be a blackhat, k?

that'll get you banned from here at the very least

[ancient fossil]

world has more than enough blackhats

[strong anchor]

brother , its a question :))

you get ban for a question ?

[tacit bobcat]

no, just for doing stupid things 😉

[south vigil]

Thank you, again. I would like to clarify what I'm thinking in this area. Firstly, I am horrible at coding. I have also tried to learn it and it hasn't 'stuck'.

However, I am good at analysis and have been using that to my advantage. I've been learning how to read and hunt in Windows Event Logs, use Sysinternals, understand what looks like a normal system process, investigate Windows registry...that sort of thing. Is that considered manual malware hunting?

Then there are other tools obviously that either speed up the process or automate it for you. That is kind of what I'm thinking of in terms of automation.

So...I'm not sure how system programming fits with this, but I hope this might shed some more light on what I'm thinking.

[serene umbra]

Gave +1 Rep to @thick dirge (current: #127 - 50)

[strong anchor]

can u explain?

[pseudo creek]

this is what I would call DFIR, primarily the digital forensics aspect

for digital forensics you will have someone physically looking at systems

[south vigil]

@warm hinge My apologies for any confusion here. Programming is not something I would like to get into, and areas like reverse engineering and code analysis I think is way above my head.

To give an example of a scenario I've got in my head: Say someone comes to me and says their laptop is acting 'weird'. The antivirus and firewall didn't appear to catch anything. However, I start looking into things further and notice strange network traffic present in logs I'm inspecting. Also it seems that there are some red flags in Windows Event Viewer. (Remember I'm just starting to learn this so this may not be an amazing example.)

I don't know if I'm explaining this well, but I hope this is somewhat helpful. I value the suggestion about system programming, but am not sure what it has to do with this.

I think you hit on areas that I think I should explore further, like threat hunting and incident response.

[pseudo creek]

to me, threat hunting is not looking at individual systems

[pseudo creek]

that is what I would call forensics

[undone shore]

I mean, in fairness you'd still be ingesting event logs from individual systems

[south vigil]

@pseudo creek Thank you for chiming in with your suggestions. I want to be able to hunt for malware on individual systems, but also learn how to do this at scale, say in an enterprise environment with 1000 endpoints.

[serene umbra]

Gave +1 Rep to @pseudo creek (current: #14 - 472)

[undone shore]

Just a big difference between that and remoting in to manually read event viewer

[pseudo creek]

sure but usually (hopefully), you are doing it in an automated way, if you had to have someone go look at every system for something out of place.... oof

[undone shore]

Oh yeah, absolutely

I know threat hunters who do routinely go and do manual deep dives on individual systems that have been pulled up in the SIEM, but:
A) That's getting more into DFIR than CTHA, and
B) They'd be in one hell of a sorry state if they didn't have the alerting system

[warm hinge]

It doesn't depend on the hat color, those terms are nothing when it comes to gov.

[undone shore]

Nothing in general, tbf

[warm hinge]

It's upon the level you have. they can turns you to any color they want.

[pseudo creek]

yeah I'd consider that forensics, although I also think threat hunting is kind of a new term to make it sound cooler? I dunno

[warm hinge]

it's about how much they pay for you to accomplish a given service.

[undone shore]

As far as I can tell from working with threat hunters as the other half of a purple team they're effectively a combination of SOC analysts on steroids and forensic investigators

[pseudo creek]

the threat hunting 'techniques' were done by DFIR teams and fell under digital forensics before it was called threat hunting

[undone shore]

Yeah ^^^

[pseudo creek]

so whats the different application and workflow?

[undone shore]

Extrapolate that out and you stick a red team in the same boat lmfao

Different application and workflow but we're still talking about what does and does not get logged and alerted on

[pseudo creek]

I mean I'm honestly asking what you think the difference is, generally there is a reason you are looking for something, not just randomly

[south vigil]

This is an interesting discussion, thank you all. One point of confusion I have is career pathing related to DFIR/threat hunting. If you were hiring someone that has the skill set to find malware without running a scan with something like AVG, what cert would you be interested in?

THM has a LOT of content, and I've really been enjoying it. I'm wanting to build on that with a 'piece of paper'.

[pseudo creek]

I'd get yourself over to DFIRDiva.com, she has a lot of good info

[undone shore]

Why would you cut out a valuable metric like antivirus?

[south vigil]

@undone shore not cutting out, I didn't mean that...I meant with the assumption that's already been covered.

[pseudo creek]

and I'll say I did a couple years of DFIR, heavy focus on the DF portion. It was interesting work, trying to find indicators of compromise and what happened when

[south vigil]

looking at this now

[undone shore]

As a general rule an enterprise AV feeds back into centralised monitoring -- it's one of the (many) controls which should be in place to build up a bigger picture of potential compromise. AV by itself (especially consumer grade like AVG) is unlikely to catch everything, but as part of a bigger picture it can still be really useful

[distant pier]

Just remember that similar to Red team positions these days being often glorified pentest/application security testing positions, threat hunting can also just be spiced up DFIR as a job role. 🙂

[pseudo creek]

spicy DFIR sounds pretty solid to me

[undone shore]

Point being, you wouldn't necessarily want to hire someone who has the skillset to find malware manually. It would point at a really good understanding of Windows internals, yes, but being able to handle all of those centralised data sources and hunt down alerts is much more important

[pseudo creek]

and I'll say while Hymnosi types a bunch, I think a lot of "threat hunting" often comes by evaluating SIEM data vs individual systems, that is what my difference is and potentially using things like Ansible to look for known TTPs

[undone shore]

I'm not on the blue team side, but I'd imagine that's effectively the equivalent of hiring a CTF player for a pentest position
Potentially a lot of very good theoretical skills, but those don't necessarily translate to IRL

I would much rather hire a webapp pentester who can understand and cover the contents of the WSTG quickly and efficiently, than I would someone who can't do that but is able to sit around for 12 hours hunting down some bizarre prototype pollution vuln in a NodeJS templating engine.
If you can do both, that's ideal. But if it's a choice between the two 🤷‍♂️

[pseudo creek]

yeah and I'll say, when I did DFIR on our team, we basically would look for IOCs based on industry shared knowledge and try to find things that we didn't otherwise get alerts for

thats why I said, what I know of things now, a lot of it is looking into aggregated logs on a SIEM for a variety of things, possibly IOCs, possibly things that can be exploited. Also you can use ansible playbooks to "investigate" thousands of systems and see if you find known industry IOCs

[warm hinge]

yeah

[pseudo creek]

back in my day... we didn't use Ansible or an EDR, but we would investigate select critical systems in a variety of ways, again not necessarily due to an alert

(to be fair, this was like 17 years ago)

[south vigil]

Speaking of being a SOC bubba....I've done 24/7 operations (not infosec) and I'm over it...3rd shift, all that

[pseudo creek]

lots of SOCs use a follow the sun model. Not all have 24/7.

[south vigil]

oooh, that's good to know

[pseudo creek]

but it really depends

my employer is pretty solid, they sent me to SANS classes and all that

and also had a lot of on the job training

[south vigil]

I'm looking at https://dfirdiva.com/dfir-certifications/

This may be dumb, but if I want to be a lawyer I go to law school. Which one of 12+ certs helps me with 'career pathing'? Maybe picking the one with a syllabus most closely aligned to what I'm interested in? 6 of those BTW are GIAC...$8.5k per pop.

To me, a big difficulty for someone outside the industry is figuring out a reasonable path to get in. It's not so clear with infosec if you ask me.

At least in my case I'm narrowing it down to DFIR/threat hunting

One of my points being, even with that narrowed down, I'm looking at a list of over a dozen certs.

[pseudo creek]

honestly, I'd look at her site regarding skilling up but I'd say the Security+ is a good solid cert to start with. I wouldn't concern yourself with the EC-Council or even GIAC certs (due to cost)

[south vigil]

got it

I think this is a good point

agreed

[pseudo creek]

and maybe other places you can download images to forensically analyze them, I don't know

[south vigil]

cool, I'm bookmaring BTL1

[pseudo creek]

yeah boss of the soc? or something?

splunk also has free training on their site

[distant pier]

BOTS challenges on THM:
https://tryhackme.com/room/splunk2gcd5
https://tryhackme.com/room/splunk3zs

[gaunt berry]

Can you? I know 2 people that have tech jobs without a degree and a lot of people online.

[ancient fossil]

from what I have seen/heard sometimes it can come down to motivation and portfolio. having a degree is a straight validation of your knowledge. Without you need to show you have the motivation and knowledge an employer is looking for. having a portfolio of things you have done/made can help its probably just less of a guarantee than actual qualifications.

[loud fern]

Anything is possible, was for me, can be for you

[cedar gazelle]

Hi ...I'm a newbie to cyber security..I want to learn from scratch ...can someone guide me

Idont know anything about programming or Linux and stuff

Can someone guide me

[ancient fossil]

https://tryhackme.com/paths

[warm hinge]

you have a long way

[ancient fossil]

look through pre security and intro to cyber security

[cedar gazelle]

Oh that's fine...just want to start..

Ethical hacking is from cyber security too right? I want to learn it

[warm hinge]

uk abt the computer and how it works right?

[warm hinge]

yes

[cedar gazelle]

Like what...

I know about computers and stuff to some extent..not a newbie with pc s

[warm hinge]

then u cant learn cyber security first, u have a really long way

[cedar gazelle]

Is this for free or paid??

[warm hinge]

some of it are free

[cedar gazelle]

I know about computers....

[cedar gazelle]

Is there anyhow I can get the paid stuff for free elsewhere??

[ancient fossil]

https://tryhackme.com/r/resources/blog/free_path

free path guide for beginners

[cedar gazelle]

Okayy thanks

[ancient fossil]

no problem, have fun

[pseudo creek]

so lets be clear. Can you get a job in tech without a degree? absolutely, you just have to open the right door. It takes a lot of networking, building up your personal brand, etc, etc.

Is what was true someone 2 years ago the same today? Absolutely not. The tech industry has been beat up and there are a lot of qualified people out there looking for jobs. They have degrees, certs, years of experience and those are your competition. I don't know when things will even out. This is basically as bad at the dot com bubble which took quite a few years to correct.

and I don't want to be defeatist but just know there are challenges to face going into a workforce without a degree and right now, its a tough world for even those with degrees and experience

[warm hinge]

true

finding a job without a degree is like trying to find a needle in a large and wide straw

[gaunt berry]

Would you recommend going to college?

I feel I can learn a lot more by myself in 4-6 year (the time it takes to get a bachelor's degree) then getting to college

[gaunt berry]

Do you think tech companies employers will understand that soon?

[pseudo creek]

well what I'd recommend if you don't go to college, get a job, try to get into IT tech support if possible

[warm hinge]

or simply just open ur own business

[fringe spade]

starting out by running your own business in cyber is not a good idea

[warm hinge]

welp it could be if u open a computer/pc fixing store and put cyber security as a part of it, thats my opinion

[gaunt berry]

Can i ask how you were able to do it? Did you start in IT?

[loud fern]

I did not start in IT, I just vibed really well with the CEO and I was full of passion, curiosity and demonstrated my out of box thinking

[pseudo creek]

computer/pc fixing store sounds so 90s

[woven mirage]

they still exist here, i did my practice classes in high school for a guy who fixed electronics

[flat sedge]

most of those have been replaced with UBreakIFix type places that just do screen/battery replacements

[pseudo creek]

yeah, I can't even think I've seen one in ages

I know someone who does it freelance but they worked professionally in desktop support for a major company for quite a few years

[shut linden]

jo i have a problem someone is trying do leak my discord acc what should i do

[pseudo creek]

add 2FA?

[shut linden]

nah uhu

it doesnt help

[warm hinge]

still work till today as tech store so

[warm hinge]

simply change the email and passwd

and any other info

[shut linden]

alr. did but nothing thats a wierdo

[barren elbow]

AzureZojja has given you a reply 2FA will be the best option for you

Or if you can't you can use the idea of CLOSED

This are the two things you have to do

[warm hinge]

yeah 2fa is good option tooo\

[warm hinge]

call me vet

[woven mirage]

define "leak"

[south vigil]

thanks

[serene umbra]

Gave +1 Rep to @distant pier (current: #16 - 434)

[blissful kraken]

Done with that what next?

[ancient fossil]

I moved on to web fundamentals and complete beginner pathways

[blissful kraken]

Alright starting next with complete beginner

[ancient fossil]

[hasty summit]

Hey I have also started learning hacking few months ago

[strong acorn]

So for someone to have 3 years in help desk position and their Security+ with knowledge and some small projects on cybersecurity. What sort of jobs should I be applying to? Any titles that I might have an easier to getting and then working my way up?

[wise island]

entry level - cybersecurity analyst jr

[strong acorn]

Is that the only kind of title I should be looking for? Sorry for late response.

[wise island]

jr cybersecurity engineer if you have tried the engineering path on THM.

[broken lily]

Apply for god If 0xgod job?

[pseudo creek]

titles are all over the place in cybersecurity and it depends what country you are in. I would try a search for "junior cybersecurity" and see what pops up. Look for cybersecurity analyst, SOC analyst, cybersecurity engineer, etc, etc.

[strong acorn]

yeah i have been tryinbg those and havent got any hits yet, re-did my resume a second time to try and make it more enticing to HR, seeing if maybe now i'll get some interviews lined up

[polar aspen]

Its going to be hard, but dont give up and keep applying. Sometimes you got to reapply or go to their actual website and apply for that position

[quiet trout]

This is a good guide to follow if your following the pathways. Credit: Shadow

[blissful kraken]

Ohh thanks 🙌

[faint ice]

said guide/list is in the pinned messages in #general channel

[blissful kraken]

Oh but this includes paid paths too so I'll have to customize accordingly since I can't afford paid paths

So will do Free ones

[faint ice]

none of the paths are fully free

still you can go through the free parts of all the paths

or use the search page and filter out the paid rooms so you only see free rooms

[blissful kraken]

Yes, but how will all these paths help ?

[quiet trout]

Thank you! Wasn't sure where it was just took a SS for my reference.

[serene umbra]

Gave +1 Rep to @faint ice (current: #4 - 1661)

[faint ice]

they mostly contain information/walkthrough rooms that gets you going through the motions for using most tools

[blissful kraken]

Oh alright thanks

[faint ice]

also would heavily recommend getting a tryhackme subscription but can understand if the money convertion rate is hard on you

[blissful kraken]

It is unfortunately and also I'm a new user to THM so can't be this quick ig

Just a week old

[vestal vector]

// wrong channel lol

[urban pumice]

Anyone with ISO 27001 experience?

[alpine marsh]

what questions do you have?

[fickle grove]

Yes?

[west sonnet]

ISO 27001 is a fun one

[warm hinge]

tf is iso 27001

[faint ice]

information security standardisation

looks it up on wikipedia

[rugged delta]

It's a standard is a standard created by the International Organization for Standardization for providing a standard to manage information security. Basically, a formal way to say that there are ways to implement your system's security, in line with best practices, which can also be ways to reduce risk, making your organisation better able to comply with regulations and having a measurable way to assess whether you meet certain targets in limiting your exposure to risks.

Of course, auditing and compliance are good things to have, but generally in today's climate,simply complying with standards is considered the minimum level of capability with respect to securing your infrastructure and resources. https://en.wikipedia.org/wiki/ISO/IEC_27001

[rain stratus]

so junior pentester doesn't make sense after complete beginner?

[faint ice]

yes it does.... it is more up to date and covers the complete beginner topics better hence why it is before it on the list

[sudden hornet]

Is it worthwhile going into a network engineer/infrastructure role before going into a cyber role, or should I aim to just dive straight into a junior cyber role if able? (is it a wasted step?) The main benefit I see is just to really get more exp so that you can be more effective when doing cyber (essentially knowing what you're trying to protect). Currently in IT Support looking towards next steps in career progression.

[rugged delta]

It's always a good idea to consider a networking/infrastructure role while also pursuing cyber. The skills you develop in regular IT and those in cybersecurity have a lot of crossover and are interdependent, so if you have an opportunity at such a role, do consider applying. However, if you have an opportunity to get the job you want in cybersecurity, by all means pursue that as well. The thing is, the experience of systems/network engineering will benefit you greatly in a cyber career

[sudden hornet]

Gotcha, thank you!

[serene umbra]

Gave +1 Rep to @rugged delta (current: #21 - 360)

[fiery oar]

Guys Imma beginner in pentesting and planning to do a cyber certification. Suggest me any certifications I could do now and let it free or not be costly coz I'm broke

[polar aspen]

I believe htb has some certs you can look at

Comptia has pentest+ but I thinks it's near or around $400 or something

Not sure if there are beginner pentest certs I'm aware of

[warm hinge]

Is it possible to get a job without any degree in cyber sec?

[loud fern]

Yes.

[fiery oar]

Yeah sure.. any specific certification I should concentrate?

[loud fern]

Free certificates hold no value to employer, and are not often in high reputation. I wouldn't waste money on beginner certifications if financing is the root problem, save up, study and get something that actually opens a door to interview like OSCP.

[fiery oar]

Understood..then which one should I go 1st??

[loud fern]

If you want to pursue pentest, anything from Offensive Security.

[fiery oar]

Okey

[woeful grail]

Anyone here from Canada? The job market seems rough right now. Wondering if anyone has advice.

[idle river]

Anyone here passed CAP by secops? Wanted to know if there is some material to go over for quick revision. Something like a THM path or YT playlist maybe?

[broken idol]

Hay, this is more themed for #room-help

[green estuary]

oh my bad

[rigid nova]

Coming from a C#/JS environment, I wonder if any languages are "preferred" in cyber security/Pentest field?
I would suspect something like PHP or Ruby for web related stuff and C for OS side?
BASH and SQL seems like a no brainer?

[pseudo creek]

a fair amount of programming is done in python. Understanding of javascript can be useful

[flat sedge]

You'll almost never need to write code as a pentester. Reverse shell would be the most common, but that's very commonly done with tooling.

If you are into Burp or Zap, Java is a good language to know if you want to create your own plugins and modules.

[undone shore]

I'd say that depends on the role tbh. I'm a pentester but I spend quite a bit of time on infrastructure and custom tooling 🤷‍♂️

That said, very few others on the team are in that position. It's definitely a much more niche role to assume (but in my experience a valuable one from the employer's perspective)

[flat sedge]

I would say that if you are building infra and/or custom tooling, that really isn't pentester specific; development is a different sort of activity. That isn't to say that a pentester can't do those things, but those aren't a deliverable as part of an engagement

[undone shore]

No, but they are very desirable to a pentest team

e.g., we do a lot of mainframe stuff, and there isn't a whole lot of mainframe tooling. I'm literally working on some MITM stuff for TSO Auth as we speak.
That's something that will be beneficial to the team, and that we wouldn't otherwise be able to facilitate.

[flat sedge]

That's fair

[reef holly]

people like Python because it feels simple/basic. Go is also popular. However, you can use any programming language, and Cyber Security people generally don't write that much code. There's actually a lot of security tools written in Ruby (ex: Metasploit, BeFF, Ronin, dnscat2, etc). General rule of thumb is to learn one scripting language for quick and dirty stuff and one compiled language for when you need raw performance.

[flat sedge]

In the course of an engagement, I don't do much in the way of tool creation or code maintenance though. After the fact... Well, there's a few systems I actually do manage for the security group(s) and ansible is definitely a part of that

[undone shore]

So, TL;DR: I do very much agree that a pentesting role (in fact, most cyber roles, let's be honest) won't require you to write code, especially not on a daily basis. It's not a crucial skill that you must learn.
That said, it's an incredibly valuable skill to have, and will make you much better at the job if you have that understanding.

And yeah, IaC is so beneficial these days too ^^

[dense dagger]

Yo i did

https://rkive.gitbook.io/certified-appsec-practitioner-cap/

[serene umbra]

Gave +1 Rep to @faint ice (current: #4 - 1670)

[idle river]

This is neat
Thanks for this

[serene umbra]

Gave +1 Rep to @dense dagger (current: #23 - 350)

[marble relic]

hello guys, i finished the
introduction to cyber security, and
Pre security paths, currently at "complete begginer", and aftwarward i plan to do the Jr penetration tester.

will that be enough for me to look for a job at this point?

[dense dagger]

What is your previous work experience?

[marble relic]

im currently working in constructions

of buildings

i want to work in an office

[dense dagger]

Do you have previous relevant IT experience?

[marble relic]

i start learning 3 months ago, and i started tryhackme a week ago

[dense dagger]

Ok so it might be a little hard for you to transition into a cyber role from no relevant IT experience.

[marble relic]

so which paths i need to complete to get a job assuming i learn them well

i need a realistic deadline

[dense dagger]

I don't really think the THM paths can actively land you a job without doing other things

[ancient fossil]

job market isn't really predictable

[dense dagger]

Like doing projects and whatnot

[ancient fossil]

THM teaches you stuff you need to learn, it facilitates other things

[dense dagger]

The paths are there for you to learn stuff but you have to supplement them.

[ancient fossil]

other things get you jobs

[marble relic]

what other things?

im also hacking some boxes on hackthebox

[ancient fossil]

projects, work experience

also helps you network

[dense dagger]

a relevant IT degree can also help

[marble relic]

degree like university?

[dense dagger]

Could be, there's also like a non-traditional trade school that focuses on IT maybe

I know someone here who does it

[marble relic]

i dont have time now to go to front learning school or university

i back to work in 3 weeks and then ill only have weekend and 2-3 hours evening to learn

[dense dagger]

I understand that but you're trying to transition from construction into IT

[marble relic]

yes

[dense dagger]

You're bound to be behind others that have already a head start

[frail hound]

It can be done

[dense dagger]

I know someone here who was doing factory work and was hired as IT Support for a local company in their area

[frail hound]

Just focus on learning all the time,do some more recognized certificates and do projects in your spare time. Also learn to script and upload some scripts to github.

[dense dagger]

Try to aim for those roles first than a complete transition into security

[marble relic]

lets say i get all this skill matrix maxed or almost maxed, do you think i can apply for job

[dense dagger]

I don't think the skill matrix is a good indicator

[marble relic]

do you work in it?

IT

[dense dagger]

Yeah, I do

[marble relic]

what do you do in the job?

[frail hound]

I can tell you my story. I started learning IT in January of 2023. I did tryhackme paths plus i studied for Comptia Sec+,then after passing it i did CertifiedCyberDefender which is practical exam for Threat Hunting/Digital Forensics,after that it took me 4 months to get a job in IT,where my salary went up 100%+ 😄

[ancient fossil]

I'm doing THM as a hobby with hopes that it may let me transition into it/cybersec down the line. but for now I'm just enjoying learning.
Will probably look to do some certs or maybe look at some VDPs somewhere down the road, either way its a more productive use of my spare time than I had previously

[dense dagger]

But we have different circumstances, I can only say what has been my experience and can't say for sure what yours will turn out to

[marble relic]

so it can be done

[ancient fossil]

just dont assume your path will be the same

[frail hound]

Also i forgot to mention i have only high school diploma and my THM experience + 2 analyst certs landed me a job in such good company,that they want to invest in me via SANS certs .. But im gonna try to convince them to pay for my OSCE3.

[marble relic]

did you get the job because of the exam or you knew enough at that point

[frail hound]

Actually it was kinda long process,i had 3 interviews and technical homework where i had to use my learned skills. Also on interviews i got asked so many technical questions about network,security,web app security,attacks..

[marble relic]

ok i guess i need to keep learning until i can actually do something or hack something

[frail hound]

My point is,everything can be learned on your own but you have to be serious about it.

[marble relic]

im very seriouse about stop lifting bricks

and getting a better job with AC

[ancient fossil]

and if iv learnt anything so far, cyber sec requires proper commitment

theres a lot to look at

its also quite competitive since many roles can be remote

[marble relic]

me too i was in the army 4 years

[ancient fossil]

so its not always location restrictive

[marble relic]

thanks, i will make the best cv ever after i get some practical knowledg

[serene umbra]

Gave +1 Rep to @frail hound (current: #2022 - 1)

[ancient fossil]

gl

[frail hound]

Use reddit and Discord for guidance,and learn to google stuff. You know what i mean,dont just ask immediately something but try to research it and only then if you still cant find answer,shoot your chance on here.

[marble relic]

what did you do in the army?

[ancient fossil]

i also find just searching keywords in here helps find small hints, most issues you have on a room, someone has had before you

[frail hound]

True,just use CTRL+F

[marble relic]

i use chatgpt alot

[ancient fossil]

one thing i like about this discord is ppl are averse to giving you "the answer"

id rather be nudged and spend more time and find my issue

least you learn what not to do next time

[frail hound]

Chatgp is good but its not always correct.

[broken idol]

And the fact that it's confidently wrong is bad.

[ancient fossil]

🤣

[pseudo creek]

chatgpt resumes are also horrible

[warm hinge]

@pseudo creek

[pseudo creek]

yes?

[warm hinge]

Cheese
Cheese is a dairy product produced in a range of flavors, textures, and forms by coagulation of the milk protein casein. It comprises proteins and fat...

[pseudo creek]

this is the careers channel, if you wanna talk cheese, go to #general

[warm hinge]

ok

[long edge]

Any hiring for entry level penetration tester/cybersecurity?

[frail hound]

Yes. Im hiring to see if someone can penetrate my heart..

[loud fern]

Unlikely you get a job here, however you could probably ask help regarding your employment seeking like CV related advice or what to prepare for for a potential interview

[pseudo creek]

THM, much like LinkedIn, is not a dating website

[undone shore]

In fairness, I'm not sure "penetrate my heart" is a request for romance so much as a request for euthanasia...

[frail hound]

heh ee h

[faint ice]

or a request for a pacemaker????

[undone shore]

Wut?

Pacemakers are designed to regulate heart rate.

I, uh, cannot think of a single situation where asking someone to stab you in the chest is even remotely in the category as asking for a pacemaker

One is self-preservation, the other is self-destructive. They are literally opposites lmfao

[faint ice]

was under the presumption that pacemakers need to be inserted into the heart somewhat to help regulate the heart rate hence they would peirce your heart with a pacemaker.... but could be wrong and doubt this channel is the place for this discussion

[stoic cave]

No, I don't think they do. Myocardial perforations (good biology word) are very bad

[undone shore]

No, the pacemaker itself gets embedded into your chest. They generally push wires into the heart via veins.
Either way, if your definition of "piercing the heart" is "surgically implant something into the heart" rather than the typical definition of "stab it" then you could implant a coin, or a bomb, or a vial of magic mushrooms just as easily as a pacemaker and still meet that slightly absurd definition. Either way a pacemaker is completely irrelevant lmfao

[faint ice]

mission success: got a laugh out of muiri

[pseudo creek]

this also is not a Vampire/Van Helsing dating discord

[undone shore]

Nope
Just an eyebrow raise and slight disapproval

[pseudo creek]

no staking of hearts

[undone shore]

I mean, not to be pedantic but staking a vampire's heart is generally considered to be even more spectacularly lethal than staking a human's heart

[blazing wyvern]

anyone got a good list of cloud security interview practice questions? possibly @pseudo creek ? TIA

[frail hound]

Can some mod create section on THM Discord,for only vampire talk? I love me some vampires

[rugged delta]

This is one source I found which has 50 questions that you might be asked. There are many sources online of course so it's no harm to look up other sites that might have others https://www.whizlabs.com/blog/cloud-security-interview-questions/

[flat scroll]

Hi guys, i booked my CompTIA Sec+ exam,I wanted to know if there is anyone who currently holds this certificate to ask some questions regarding the exam :), please DM 🙂

[rugged delta]

You can ask your question here and someone might be able to answer it for you, so everyone can benefit

[flat scroll]

I didn't want to clog up the chat too much: I saw that the exam is full of legal terms with a lot of acronyms, I wanted to ask you what you used to remember them all and if there is a list that groups together all these policies, acronyms and laws

[wild thistle]

should i go for comptia a+, or sec+ will be enough? a lot of people seem to be praising a+ but it seems to be just a basic IT cert that covers fundamentals

[rugged delta]

I don't have the Security+ myself but have covered a lot of regulatory and legislative info during my studies. It's important to take your own notes and read up a bit more on the specifics of the legislation but there are practice questions in the study guide that show you the level of questions and answers you'll be required to understand.

[flat scroll]

Is there any databases where can i get all of these legacy fundamentals?

[flat scroll]

i think it dipends on the type of job ur looking for

[rugged delta]

If you're comfortable with your knowledge of PCs, it would be a good idea to consider network+ and sec+

[flat scroll]

Like in my case, i'm trying to become a Pentester and a lot of recruiter ask for the Sec+

[rugged delta]

They'll likely recommend sufficient sources in the study guide for the sec+

[wild thistle]

im looking for a job where i can do nothing and still get paid

😎

[rain stratus]

upworkers, how did you land your first job there?

[flat scroll]

yes but i just bought the exam voucher, i'll watch something on yt then, thank you 🙂

[serene umbra]

Gave +1 Rep to @rugged delta (current: #21 - 361)

[candid meteor]

Guys, please tell me if CCD certification is worth it? Or TCM security of PJPT worth it?

I mean if these certifications are recognized by HR?

[loud fern]

Depends on the country.

[rain stratus]

What certs in your opinion are better to go for in the EU?

[loud fern]

depends on your goals

[rotund valley]

anyone has a good resources or study plan for cybersec, I am really stuck, I don't know what to learn lol, currently just going on portswigger academy, and do some tryhackme, other then that idk

[rain stratus]

Probably Security Operations or Management, because of my relevant experience as a Support Manager and TAM. But I'm just a year in cybersec, and at this point I just need relevant experience in security to pass the interviews.

[dense dagger]

What’s your current career ambition?

[loud fern]

If you can afford - sans, if not, then maybe microsoft or cisco certifications, EU loves things like that