cyber-and-careers

[thorn haven]

I just put those things as that what my university requires though and if I take it out I don't know if I will like get an offer that just my worries

If you know what I mean

Cause I have had my resume review by the university staff before

[pseudo creek]

what? your university requires you put in communication, teamwork, decision-making?

[thorn haven]

Yeah

[pseudo creek]

they are wrong

[thorn haven]

I can show you a sample resume template

[stoic cave]

It's probably some guidance counselor

[pseudo creek]

just because its a sample resume doesn't mean you have to follow it

[stoic cave]

Mine wanted me to put some things initially, but I pushed back and we compromised.

[pseudo creek]

also, your professional profile specifies basically what your degree is but your education already has that. Use your professional profile to showcase your interest, not what is elsewhere in your resume

[thorn haven]

this is what we have to follow off

[thorn haven]

eh idk i mean after all they preach it like is the only way to get a job and im like hmmm

[stoic cave]

What happens if you don't follow it

[thorn haven]

okay

[thorn haven]

lol idk

dont ask me

[stoic cave]

You're an adult now, you have to make the decisions that work best for you and your future.

[thorn haven]

wdym by the right and left side for that section skills wise

[stoic cave]

So it seems like there are no repercussions.

[thorn haven]

yeah i guess

so i guess get rid of the certificates and then tweak my profressional summary and get rid of teh soft skills right

am i missing anything

[stoic cave]

Move your capstone

[thorn haven]

okay

would i just add that as a project in my experience section and labled it projects

[pseudo creek]

ok don't use the skills in this example but use tab spacing like this

[stoic cave]

No, not in the experience section. It gets it's own section

[fiery harness]

This is mine

[thorn haven]

okay

[pseudo creek]

see like Joa's skill section (except again, don't put soft skills)

[thorn haven]

ah gotcha

like a column type list

but would it be ats friendly though

[stoic cave]

You can go side to side list

Hang on

[pseudo creek]

you use tabs not columns

[stoic cave]

It just needs to look well spaced

[thorn haven]

ok

[fiery harness]

what should I improve?

[thorn haven]

ok

[pseudo creek]

so I'm in the US and I'll say I can't exactly speak to what is expected in EU or Spain specifically. Your resume is 3 pages, thats a bit much. I know EU is a little more lenient than the US but I've heard people say 2 pages max for early career.

Your Professional summary is a bit long. In the US, we are told not to put "I" in a resume, again, not sure what the standard is but I would stick to 2 sentences max for your summary. Your skills have a lot of soft skills, which again I'm not keen on because anyone can say they work well under pressure.

Your last page has a lot of spacing for your education. Also you mention your languages twice on the last page.

Under certifications, none of those look like certifications? They all look like courses.

[stoic cave]

You also didn't redact it, just fyi

Seems like all your information is in the top banner

[pseudo creek]

yeah I didn't mention that aspect but was just going with it.

[fiery harness]

Yea i thought about the length

Gonna reduce it a lil more and yes they are not certifications

mostly free courses

but I did some ImmersiveLabs labs and got a lot of badges

I dont know where to put it

[pseudo creek]

it is probably better to have a LinkedIn and put it there, badges aren't worth much on a resume

[fiery harness]

Alright

So let me make these changes

[polar sedge]

Hey guys, i was wondering if this is the right channel if i wanted to ask some advice for job paths?

[pseudo creek]

I would suggest deleting your resume, making changes, then blocking out your name/contact info before you post again'

[pseudo creek]

sure

[polar sedge]

Well, it's a bit of a personal question really. I've been in a tier 1 Help Desk position for about a year now, and i feel like i'm ready for some growth (for more reasons than one), but unfortunately don't see the potential with the company i'm within anymore. So i'm considering applying elsewhere, but i realistically don't want another helpdesk job. Where can i take that experience, and are there any other lateral or better positions that this can lead to?

[fiery harness]

done!

for some reason portuguese made another page by itself...

im gonna cut something more

done

[brittle pier]

Your business degree will definitely help you in management

[fiery harness]

thanks!

[abstract lance]

@stoic cave YOU HACKER

[stoic cave]

Can I help you?

[abstract lance]

YES

I WANT TO HACK LIKE YOU

PLEASE

I WANT TO HACK MY TEACHER

[stoic cave]

One moment please

[abstract lance]

OKAY

[cobalt escarp]

Hey, this is illegal and against our community rules #rules

[abstract lance]

😡

OKAY

I WILL NOT HACK

[cobalt escarp]

Thanks 🙂

[stoic cave]

I'd bail

Don't work for free

[distant pier]

Those 6 weeks should be paid as part of your onboarding, which comes after receiving a job proposal to sign.

[flat sedge]

it's for a junior system admin role

are they basically asking you to have linux+, rhcsa or lfsa prior to hire?

net+ and sec+ is not a 6 week course

usually net+ is broken down into 2 1-semester courses

Ask them if they'll reimburse if you pass

[distant pier]

I would recommend to skip this employer opportunity, compTIA certifications don't prove skill, so it is dubious why they ask for these to prove skillset.

[flat sedge]

it may be a business requirement for the cert to fill the role

ifthat's all that's on the requirements list, ask if you can talk to another recruiter

[distant pier]

I presume this is a bootcamp style class that will prepare you for the exam? Still strange they request this.

[flat sedge]

because you are being asked for shit that's not on the job req

[distant pier]

Yeah it is not completely uncommon, but dubious for sure. 🙂

Filtering Out people also does not sound classy in an interview. 😄

[fiery harness]

i agree dont work for free

[flat sedge]

Ask for a different recruiter. If this is coming from the technical hiring manager, it's a hard pass.

[polar aspen]

I got something similar in an email, where they offer to me to take their course on cybersecurity for $300 in order to get the experience to get a job

[fiery harness]

Olsen?

or something like that

[polar aspen]

not quite sure it was awhile ago

Happen twice

I look into the course and it was literally for something to get a security+ cert level

which i have

[fiery harness]

they offered me an "intership" but i had to pay

lol

[polar aspen]

yeah fk that

[fiery harness]

yea

"pay us so u can have some exp"

fk that

[fierce bane]

Im looking into stating working torwads a carrer as a pentester is there any recemondations on where i should start off at?

[rugged delta]

Well you can learn a lot of skills here at Try Hack Me. A pentester is considered a fairly advanced skill level in cybersecurity. Even a junior pentester needs lots of useful knowledge and skills in things like Linux, Windows, Networking and understanding how coding works. You can learn a lot of these things as you progress through Try Hack Me's paths and find the area you like the most. Then you can learn different skills and do things like the challenges in rooms and networks on THM, learn how to perform in CTFs, consider pursuing certifications or going to college, etc

[golden merlin]

Hi, I got curious and telnet gives me accès to the Dutch police mail server, smtp. And it seem not to be a fake smpt. What to do with this information?

[cobalt escarp]

Is this a bug bounty?

[golden merlin]

Is this? I did inform them about this vulnerability risk.

[fiery harness]

maybe a honeypòt

[coral vault]

They have a disclosure agreement

You can contact them for "kwetsbaarheid melden"

Usually though, its asked not to make it public before they had a chance to respond

You can also contact the National Cyber Security Center. They have a hotline 24/7

https://www.rijksoverheid.nl/kwetsbaarheid-melden

Be very careful the OM doesn't like people going too far...

You can DM if you want

[golden merlin]

Thank you sang I think I need some help.

Since I did everything in the wrong order, again. I did publish it right after that I did inform them.

[golden merlin]

Im not sure if it is a honeypot since they blocked my IP after I did send some emails from one person to his self and another few persons.

And I guess they did block my Mac address since I'm switching ips.

[broken idol]

You've already been asked if this is a bug bounty?

[golden merlin]

Sorry I do not understand what my answers could be on this question. I'm really sorry for that.

I heard the term bug bounty somewhere and somehow but I do not know yet what this means.

[broken idol]

I suggest you stop disclosing details publicly, and contact the Dutch pvd

[golden merlin]

Ok I can do that

But its complicated since I have more information about things that are going totally wrong in this organization

I feel horrible with this.

[broken idol]

Its not complicated at all.

Stop disclosing it publicly, thisnincl here, social media and DM's.

[golden merlin]

When do I know if this will be alright?

[rapid zenith]

When they contact you back you can ask if you can publish

And when

[golden merlin]

Ok thank you haha fuck my life.

[rapid zenith]

If it's legit, they'll ask for your address. And send you a very cool tshirt

[golden merlin]

I did enjoy this adventure. Can I say that?

[broken idol]

(Not a prison one )

[broken idol]

Is that @sinful kestrel ?

[sinful kestrel]

I got about 8 of them now

[rapid zenith]

Send me one

[broken idol]

It was 5 the last time we spoke 🤣

[sinful kestrel]

😄

[broken idol]

Two more and you get to keep them.

[sinful kestrel]

One had holes in it, so I got an 8th

The trophy was even harder than the shirt

[broken idol]

Damn.

I'd have preferred the refund.

[sinful kestrel]

[broken idol]

You must be on first name terms with them

[sinful kestrel]

"It's frost again..." 😄

[rapid zenith]

In the counter intelligence agency lists

By name and dob

[sinful kestrel]

My latest is CISA giving me a 2nd shoutout

[sinful kestrel]

https://english.ncsc.nl/contact/reporting-a-vulnerability-cvd/cvd-report-form

Report it here and they'll email back if it's in scope and/or not an issue

[golden merlin]

Okay, haha so maybe I go to jail now? Great. Can I bring my laptop there?

[brittle pier]

I mean you shouldn’t unless you did something your not supposed to

[broken idol]

You won't go to jail

Unless you've done something completely wrong.

[brittle pier]

One step ahead if you . Hell yeah

[golden merlin]

But I did send emails to persons in between and I know they also have a serious problem in between. Ai.

[broken idol]

You're not one step of me

[broken idol]

Which person?

[brittle pier]

Don’t tell me

[golden merlin]

A teamchief in the Hague, an officer in the Hague, and an officer from another district.

And they have a lot of tension in between for some reasons.

[broken idol]

Should probably be fine.

Just don't disclose anywhere unless.yoy have permission.

[golden merlin]

Ok so I did delete my post on LinkedIn. Haha. And I did make a thank you to meet this thm community.

[golden merlin]

It was nice adventure. I did really like it. But I have to fill in this form right?

[brittle pier]

Yes

[sinful kestrel]

You don't HAVVVEE too but in good faith it's prob best

Worse case they deny and you go on about your life

best case you get a cool shirt

[golden merlin]

Hahaha

[broken idol]

It's better than a hoody.

[golden merlin]

I did not know this haha.

[golden merlin]

So there is work to do. I do appreciate that.

But with a nice beer since it is kingsday today isn't it?

[pearl scaffold]

how do i go about bug bounties from zero?

[golden merlin]

Follow your heart and read the documents about cvd.

[pearl scaffold]

didnt see the bb channel, I think the discord auto-optimization hid it from me

[stoic cave]

This channel is for help with career questions, and as a recommendation, you may want to take a look at the #rules. Not sure what direction you're headed with that question.

[odd bay]

mb

[golden merlin]

Morning

[severe warren]

hello everyone. im willing to get into soc analyst position. is it okay if to include any of the TryHackMe rooms in experience or projects field? for example to prove the ability to use splunk.

[golden merlin]

There is one or more learning paths on thm and they are called soc analyst.

[severe warren]

ive already completed it

i mean, there are some rooms that are not in path, but are good for practice. so is it okay if i type these rooms in my cv experience field?

[fickle grove]

I'd say it depends on your work experience. Are you coming from a totally different field?

#cyber-and-careers message

[severe warren]

nah. Im a student who's been interested in IT for long time and learning cybersec field for almost a year so far.

[stoic cave]

No, THM is not experience and it's also not your project. I would make an extracurricular section and include completed paths there.

[severe warren]

can anyone suggest any videos or articles for good soc analyst resume?

[blazing wyvern]

if i want to get AZ-500 are there any certs i should get before-hand? 104?

[fiery harness]

Azure has a roadmap i think

[glad dust]

love it

[true hearth]

u can visit soc ion & refusix

[bleak pine]

How useful are cysa+ Ans pen test+?

[stoic cave]

Depends

Are the roles you're applying to requiring those certifications?

[bleak pine]

I’m asking in like comparison to security+, in how it allows you into more security roles.

Like if my goal is to be in the security field of some kind how helpful or useful are they to jobs etc

[stoic cave]

The reason why security+ "allows you into more security roles" is due to it being a requirement for the role typically

It's also generally considered the baseline level of knowledge needed for cybersecurity work, which is why you see it in the requirements a lot of the time.

[stoic cave]

Again, it's going to depend what the role is asking for. If you have no professional experience or a degree, it's probably not going to matter. Certification(s) without experience, or even a degree, don't help. It shows you're good at sitting for a test, but that's about it.

[lavish garnet]

Hallo boys

Hello

I questions

[broken idol]

Then ask?

[lavish garnet]

Is there a serious hacker who can help me?

I need to know if you think it's possible for someone to sell rigged pokerstars? So see the cards or do you think it's a scam? I found a guy who sells a 1000 euro program but wants payment in bit coins

[dark grail]

Hello everyone, I'm fairly new to TryHackMe and cybersecurity in general. Having worked as a web developer for a while, I'm now seeking your recommendations on how to find my first job in offensive cybersecurity.

[dense dagger]

@broken idol

[dense dagger]

What specific job functions have you done that are directly or indirectly related to security and what relevant certifications do you have within security

[lavish garnet]

Thanks bro

[serene umbra]

Gave +1 Rep to @dense dagger (current: #22 - 367)

[dense dagger]

There are specific areas within application security. If youve worked with CI/CD tools and implenenting security within it, DevSecOps is a good role

There is also offensive security related roles such as penetration testing specifically for applications

[fiery harness]

pentesting for entry levels on cyber seems today almost impossible

[dark grail]

I have been a full-stack developer for one year, and in terms of certifications, I only possess certifications from TryHackMe and the eJPT. I understand that it may take some time to find a job, but I welcome any hints and suggestions.

[dark grail]

I am particularly interested in jobs related to offensive security, such as penetration tester or red teamer.

[broken idol]

Nahz that's not what we do here..

[dense dagger]

Its doable but I think people hear entry level within cybersecurity and think its open for new graduates

which isnt the case most of the time

[lavish garnet]

Bro I know mine was just a question if you think it's possible or not

[dense dagger]

Yeah, those are seldom entry level roles

[dark grail]

So, what do you suggest for me? Should I pursue another job and then switch back to penetration testing later?

[fiery harness]

yea

im actually going for an entry level on IT

and meanwhile gaining exp for better roles

its easier to enter on blue side

[dense dagger]

I would do is: 1) implement controls that will improve the overall security of your company, this will boost your resume. 2) get a relevant certification within your local area, this can be OSCP, eCPPT, or PNPT, whichever is looked upon. 3) get lots of training hours in on training platforms. The more potential skill the technical recruiter sees, the more they’ll take a chance on you.

But also switching to a different job can work like SOC

[fiery harness]

do u know any better places to job hunting other than linkedin

from europe

[dark grail]

No, I don't.

[dark grail]

Actually, I am preparing for my eCPPT certification, which I have to pass in August. So, for now, what would be better for me: pursuing pentest certifications like OSCP, or starting with roles in SOC or any other job certifications, and then pursuing pentest certifications later?

[dark grail]

It pains me, but it's really difficult to find the first job.

[fiery harness]

Try get The job first

[dense dagger]

I’m not sure which would be a better career path. IMO, both can work.

[fiery harness]

OSCP is better i think

[dark grail]

I heard it is very difficult to get. Is it?

[dense dagger]

Its not imo

[undone shore]

It's entry level. Technically it's not difficult. Just need to keep a cool head and manage your time during the exam. It's high pressure, and easy to make mistakes. If you panic, you're done.

[dense dagger]

The most important thing that OSCP builds is a methodology

[fiery harness]

I honestly dont know

but ill do it sooner or later

i expect it to be intermediate

osep is way harder

[fringe spade]

Tbh OSEP isn’t that bad, it’s basically a continuation of OSCP. I know people that skipped OSCP and got OSEP instead, but they had a little bit of experience in the field

But OSCP > OSEP, some recruiters might not know the following cert or there might be business requirements that say that OSCP is a must for that role or contract

[proven wyvern]

Its a 10:1 ratio for blue team jobs compared to red team jobs. Get a job on the defensive side of things, grow your network and skillset then transition to the red team if the opportunity presents itself.

[slim copper]

Hey everyone, i just got my sec+ certification (letsgooo) and now I am thinking of applying to jobs in USA as a non-USA citizen. Do companies provide visa sponsorship usually?

[severe warren]

what rooms can you recommend for SOC position training?

[fickle grove]

I'm not from the US, but from what I'm reading, getting VISA sponsorship in the US is quite a challenge unless the role you are applying for is quite specialized.

[fickle grove]

I noticed you are a subscriber. I would recommend taking a look at the SOC 1 level 1 and 2 learning paths.

[severe warren]

ive completed the level 1 path

and now i think i need to practice the gained skills. so if any of you can recommend practical rools related to SOC, i'd be grateful.

[rough bay]

Anyone of you put tryhackme into resume?

[hazy cradle]

yeah i do

[dark grail]

Is it possible to transition to bug bounty and then to pentester? That way, the path seems a little more straightforward. I would just need to start with web pentesting and then move into pentesting. I think it would take less time for me to go that route than to start with a SOC and then switch back to pentesting again. Don't you think?

[broken idol]

As a hobby, sure.

[rough bay]

So what’s the alternative apart from hobby

[broken idol]

Nothing really.

It's not experience, it's all extra learning you do in your own time.

For all we know could have used writeups for all the rooms.

[pseudo creek]

If you are in the US and there are a shortage of qualified workers, a company may provide sponsorship. If you are outside the US, it's highly unlikely. I will also say since a ton of companies have been laying off in the US, there is no shortage of qualified workers.

[rough bay]

For home labs where do I put them in resume then?

For me to showcase

[sleek sedge]

Hobbies/extra-curricula

[rose quartz]

Does anyone know of any catalogs of pentesting and/or general security projects I could tackle to build my CV and overall proficiency in the field?

[fiery harness]

Ask Chatgpt for some help

it works

haha

[cobalt escarp]

We do not use ChatGPT as a suggestion to solve problems here 🙂

[proven wyvern]

It definitely counts as hands on experience yes.

[pseudo creek]

it counts as learning, not experience

[ember meadow]

Agreed, the machines are configured to be vulnerable which doesnt make them experience

[thin drift]

try bugcrowd.com or hackerone.com... .govs if youre in the USA are easier targets

[full sandal]

You don’t, you lie and say that’s what you built at a company

And you swap just swap put terms/details that indicate it’s consumer grade and put in enterprise grade stuff there(like you didn’t build it with 5 regular hard drives, you used the expensive server grade SAS drives)

[sleek sedge]

You're not being serious...right?

[soft drum]

Has anyone here done ISC2 Certified In Cybersecurity exam? I have a voucher for it that expires soon so I'm currently studying for the exam

Oh it's in person? I thought it was online 😭

I'm in Canada idk anywhere near where I'd take the exam

Oh I might be able to book it at my college's test centre but I'm not sure if I'd have pay for that or not. I'm only doing the exam since it's covered by my program

Have you found the exam prep easy? We're starting to go through some topics over it now through my program but I've yet to follow up on anything by myself or do practice questions

The voucher is for the exam itself

I don't know if it's supposed to cover all of the costs or just a certain dollar amount though

I'm hoping I'll pass lol this is my first time trying to get a cert. There's so many things that we are learning about for each section of the exam

Thank you

[full sandal]

I am being 100% serious, people usually don’t care about homelabs in an interview. You can easily flip it and just say you did more than you really did with previous jobs and list details you learned from your homelabs. End of the day it’s to express you know the skills, for some reason interviewers don’t care about stuff if it isn’t directly benefitting a company and making money instead of just being done for fun and without profit being the motive

[sleek sedge]

But your lying on your CV?

Like completely changing it

[proven wyvern]

Dont listen to the people telling you “home labs” or whatever isnt hands on experience. It absolutely is experience. In fact there are several websites besides tryhackme that also give you real world hands on experience.

Just a bunch of debbie downers and negative neds telling you nonsense.

They’ll tell you it isnt experience but wont tell you how to get experience to get an entry level job that requires experience.

[full sandal]

Now I don’t think it should be that way but it’s a job, I’m there to make money to survive. I’m taking every advantage I can get. I don’t support lying, this is just stretching the truth of homelabs into my work experience, doesn’t mean I lack the skills or knowledge.

[proven wyvern]

The best part is these same people will tell you CTF’s and home labs aren’t experience but if they make it to the “top 1%” of the website THEY PUT THAT IN THEIR BIO AND RESUME 🤣

[fiery harness]

I prefer do home labs than not having them done

if that gives some boost

Ill do it

[sleek sedge]

oop

[broken idol]

My thm rank is nowhere near my LinkedIn or CV.

[proven wyvern]

So explain how you get experience for an entry level job without:
CTF’s
Any “home lab” website ie THM, HTB, etc
Internships

You can have all the best certifications in the world. Means nothing to any company without hands on experience

David Bombal interviewed an Ex- NSA hacker Neal Bridges

He explains that if you have a “cert”
With a “ton” of demonstrable experience with things like HackTheBox (HTB)
Then you will have a really great chance at getting hired.
Its just wrong to say that putting it on your resume means nothing because it absolutely does mean something

[flat sedge]

You don't need those for entry level. They help, but they are not a hard requirement. Listing homelab as professional experience is a disqualifying mistake. If someone does that, and gets hired, the company is completely justified in terminating employement for misrepresenting their history.

[proven wyvern]

Ok, the question still stands.

How do you get experience for an entry level cybersecurity job that requires experience?

But you cant get that experience without getting the job that will give you experience?

Nobody can answer this question and it makes me chuckle every time

[flat sedge]

Work in other areas of IT. Sysadmin, netadmin, help desk, dev are all common routes into security. Due to the nature of security it's rare that a company offers a true, entry level security analyst or engineer role.

Entry level to security usually requires 2-4 years of experience in another domain.

[vestal vector]

I somehow got a job offer for a junior role at a big international company with a start date already decided, which i accepted and I'm VERY excited, but I still don't feel "safe" lol, in the sense that I don't feel I can relax and stop looking for jobs, but maybe i'm just being paranoid.
Like i have to do onboarding and a background check, so I'm thinking something could go wrong there, or the hiring manager could change his mind 1 week before my supposed start date or something. But maybe I'm being irrational

[flat sedge]

Once you've signed the contract, you're as "safe" as you're going to get.

[vestal vector]

maybe it's impostor syndrome kicking in before i even start working in the field

[vestal vector]

i haven't signed anything yet, i only accepted the offer letter. I'm assuming i get to actually sign a contract after I finish the onboarding

[flat sedge]

Usually there's an employment contract you'll have to sign with something like docusign, or in person if it's at a physical office. Accepting the offer starts the contract process, usually that will take a week or so.

[vestal vector]

I see. Btw in your experience how likely is it that big companies might rescind/retire the offer for whatever reason, before actually signing the contract and starting to work? Like the hiring manager coming up with some excuse where in reality they simply found a better candidate AFTER they offered you the job, or something like that.

you read some "horror stories" on reddit but then again it's reddit

[flat sedge]

not usually. Occaisonally it happens, and usually it's because the candidate mis represented themself in a way that breaks trust

[vestal vector]

yeah i mean if you get caught lying on your CV or something it makes sense, but outside of that it'd feel pretty bad

[flat sedge]

Usually you don't interview more candidates than open positions

there are other reasons

such as not being honest about involvement in a legal case, or some other pending legal action

[vestal vector]

I also felt like I bombed the technical interview lol, but I guess either other candidates did worse than me or I didn't do as bad as I thought; or maybe they're really need folks in that position

[fallow tundra]

Has anyone here heard of the bootcamp Masterschool? Are they legit and good?

[thin drift]

if hiring would you pick one over the other cert vs. non-cert

[flat sedge]

Technical interviews are used to determine where the candidate is. It's normal to get questions you can't answer or don't know how to answer, especially as a junior

[flat sedge]

Depends on candidate and business need. There is no hard and fast rule.

[thin drift]

@juun but do most filter resumes at the cert level?

[pseudo creek]

I've never heard of a bootcamp for cyber that is actually good

[fallow tundra]

Ouch

[pseudo creek]

I looked at it, it is very... odd to say the least but the goal is to get you a security+ certification, which you can do on your own very easily

if you want more of the career readiness, TCM does have a program for $1000 which includes training and a certification. along with the career guidance, mock interviews, etc, etc. But honestly, you can do a lot of stuff yourself

I would look up professor messer on youtube, look at his network+ and security+ courses, they are both free.

the certifications obviously cost money but the training is free

[fallow tundra]

the selling point is they claim a job guarantee at the end or at least support. I am trying to find a jb for over a year now and it seems I need a new approach. Heard of Messer already.

[proven wyvern]

Thanks!

[serene umbra]

Gave +1 Rep to @flat sedge (current: #10 - 746)

[proven wyvern]

Those jobs all you need is the certs: A+ , Network+ , Sec+ right?

[thin drift]

packtpub.com has those books for cheap/ month

and they are videos too, thats how i found out about THM

on a sec+ video

CISSP

etc

its also has the holy grail of tomes... the web application hackers handbook

[brittle pier]

Nice profile picture

[fallow tundra]

I mean... I am already self learning for like 2 years. All companys say: not enough get work experience (the classic) so a bootcamp with "job guarantee" seems good

[thin drift]

start a sec company, do bug research and try again

get a DBA for a business license

[undone shore]

Also worth noting here that there's a big difference between ranking on THM and HTB.

• On HTB ranks are actually vaguely protected (e.g., high ranks are coveted and tie directly into job postings, writeups of active boxes are banned, there's an actual sense of competition, etc).
• THM is not designed for competition. Writeups aren't moderated. You can get to top 1% easily by following answer dumps in a matter of days (and that's assuming you don't automate it).

It's different systems -- neither one necessarily better than the other -- but how you represent them to a potential employer does matter.
Stating your HTB rank or stats in extra curricular activities related to the job role looks good. That's something I can go and verify if I'm interested, and it's a good indicator that you've been working on HTB stuff legitimately. It's nowhere near as strong as real XP, or a cert, but it's not a bad thing to include.
Stating your THM rank is a bit of a red flag because it means you've missed the point of THM. Saying that you're Top 1%? Big whoop -- there are 3 million users, so there are 29,999 other people who can say the same thing, and you could easily have cheated to get there (not saying you have, but there's no way to verify that).
The point of THM is the learning, so if you've got nothing else to put on your CV then including things like that paths you've completed, or modules you've enjoyed (again, in the extracurricular section) can be good. At the very least it gives you something to talk about if you get an interview. That I'm interested in for a junior.
Rank? Not so much.

[warm hinge]

Eh, I don't know about bootcamps though

[undone shore]

Also, if you put THM, HTB, or home labs anywhere near your experience section, I'm with Juun -- that CV is getting binned lmao

All excellent extracurricular activities, but not a substitute for real world xp

[warm hinge]

Would you say the same about HTB's Certs?

[undone shore]

In the experience section? Yes.
I'd say the same thing about virtually any provider's certs.
Those go under certifications.

... which segues into the whole "certifications" vs "certificates of completion" thing as well lmao

Experience is hands-on, industry experience relevant to the role. I've yet to see a cert which accurately reflects an enterprise environment. No matter how relevant the vulnerabilities they include, the exam environments are:
A) Always exploitable (not the case IRL)
B) Nothing like the scale of a real enterprise environment, and
C) Not populated by humans. Exams are clean -- real networks are messy. Regardless of how well regulated you keep it, you're always gonna have some moron opening up a fileshare with an important password in it. The potential for unexpected vulnerability goes up massively when you add humans into the mix

[pseudo creek]

I looked and their faq specifically says they don't guarantee a job, they say they will provide you the tools

[fallow tundra]

of course it is never guaranteed. But they claim they only get the money after you landed a job which is a plus.

[pseudo creek]

but they don't specifically say what the job has to be

I looked, course is $8k normal route, $20k if you pay them after you get a job

[proven wyvern]

@undone shore does HTB work with both blue team and red team? Whats the best site for Blue team hands on experience?

[pseudo creek]

ok first of all, I'll say sure people say all sorts of things. As someone who has been involved in hiring decisions, THM/HTB are kind of like an extra bonus on your resume but not counted as experience.

Secondly, I'll say just because someone claims to be ex-NSA and claims to be an ex-hacker working for the NSA, doesn't mean its true. I'll say he has successfully built his brand but its wild that he goes around saying that. To each their own.

[pseudo creek]

why are you asking here what HTB has?

[proven wyvern]

Where should i ask it?

[pseudo creek]

there is a HTB discord or you could look at their website

[undone shore]

Haven't a clue -- I'm on the red side

[fallen heron]

They have a path for blue teamers on academy and a blue team cert, as well as Sherlocks which are the blue team equivalent to boxes on the main platform, so yes

[proven wyvern]

Thanks!

[serene umbra]

Gave +1 Rep to @fallen heron (current: #65 - 104)

[abstract hearth]

Hi, does anyone know a website where I can apply for internship or mentorship? I want to get some real experience in cyber security

[modern sundial]

Hey, I'm a student and looking for training. What training might be interesting to become a web pentester (in France or the USA).

*and certification

[wooden salmon]

hey guys i was joking am not a white hat hacker am a grey hat hacker

by the how do i hack a network so i can see the dangerous stuff in that network on a windows 10 operating system?

[mystic kiln]

@linkan1.1 if you search for cybersecurity interships there will be lots of results. Try to find ones that match your interest. If you are school there are plenty that look for graduating students.

[mystic kiln]

There are nunerous penetration testing certs. Id look for web specific if you already have the fundementals otherwise focus on fundemental certs and build from there.

[whole field]

quick question is there a way to share my tryhackme achivements on my profile with potential employers would i just send them the profile url or would not work? i got links to badges but they time out after a few hours any help is greatly appreciated

[modern sundial]

examples for some fundamental certificates?

[mystic kiln]

Check this out and find the section of cybersecurity you are interested in. Build from there. https://pauljerimy.com/security-certification-roadmap/

[modern sundial]

ok, thanks man

[serene umbra]

Gave +1 Rep to @mystic kiln (current: #1034 - 3)

[mystic kiln]

No problem

[whole field]

i figured it out, the image was broken had to reload it:)

[rotund hatch]

Hi just wanted to ask what certification i should get first,
i thought about OSCP, OSWA and OSWP . But im not sure

[broken idol]

Well, where do you want to go?

[rotund hatch]

Basically everything around Pentesting

I just don't really know what certifications I should get first, to start

[broken idol]

Probably best starting off with CP then,

[rotund hatch]

Alr thanks! I'll have a look at it

[serene umbra]

Gave +1 Rep to @broken idol (current: #1 - 2201)

[fickle grove]

Do check Portswigger's Web Security Academy

[warm hinge]

I just got done with my ccna,the plan was to do the comptia security+ next

But apparently one of my uncles works in the industry and I got to speak with him and he told me the security+ isn't good?

What's your opinions

[vestal tulip]

should i learn jr pentest first or i can just lear SOC 1?

[fiery harness]

better go with soc 1

sec+ is def good to have

unless u already have 10+ years of exp

[vestal tulip]

thanks

[serene umbra]

Gave +1 Rep to @fiery harness (current: #2068 - 1)

[vestal vector]

it also made me think, if you're job hopping, to be safe you would wait to tell your boss/company that you're leaving and actually quit your job after you signed a new contract, and not after you simply accepted a new job offer?

or what do people in that situation usually do

[rose moat]

I've got some help desk experience but weak networking. Not sure if I should start with Sec+ to land a job, or net+ for foundations. Thanks!

[hexed helm]

why is it so hard to get a cyber seucrity job in the UK ?

[broken idol]

Are you applying?

What sort of certs do you have? Experience etc?

Could be your CV.

[hexed helm]

I have already completed CCNA and CCNP in R&W and got a masters in applied cyber security. and got experience as a IT analyst in HCL

[broken idol]

Is the masters making it hard for entry level?

[hexed helm]

yea, i think so, i applied more than 150 vacancies (Even for the junior vacancies), and still I haven't heard from anybody

[warm hinge]

#general message

[rose moat]

just bumping this, thank you!

[broken idol]

That could be why for entry, masters will make you too advanced for entry certs.

Post a redaction cv in here and somebody will review it.

(Screenshot preferable)

[woven mirage]

Am i correct in thinking that cyber threat intelligence is more of a role than a career path?

And it would fall within dfir?

[pseudo creek]

yes, and it depends on the org where it'd fall but its a blue team role, but could be outside of DFIR but DFIR informs threat intelligence and vice versa

[modern sundial]

Hey, I'm a French student. I have questions about cybersecurity training in France. If there is a French person who is into cyber here, please go mp me

[proven wyvern]

Wouldnt they want someone who is overqualified?

Goes to show there are hundreds of thousands of positions open but every HR manager is extremely picky with what they want.

Nobody can get jobs

[broken idol]

They feel like they need to pay a masters student for an entry job.

[proven wyvern]

Ah you mean Masters degree wage for entry level job?

[broken idol]

That is pretty much what I said.

[undone shore]

That and they think you're more likely to leave quickly.

Put it this way -- you have a degree (which would usually correspond to higher pay) but no xp, meaning you struggle to get a job.
Company hire you for a role you're overqualified for at a wage fitting for that role. 6 months later (after they've trained you up), you now have xp, want a higher pay, so jump to another company.

[proven wyvern]

So he is screwed is what your saying

[undone shore]

Those 6 months and all the training they gave you are now wasted time for the company. They now need to start again from scratch with someone else.

i.e., it's a big risk for them, so why bother?

Same thing can apply to certs as well, to a lesser degree. I got lucky.

[proven wyvern]

Why bother getting a Masters degree, exactly.

This is exactly why there will always be a shortage of Cybersecurity jobs. Nobody wants to hire anyone

[undone shore]

I mean, aside from contributing to academia?
They're good for a pay increase a lot of the time. Good for your own knowledge. Etc

[proven wyvern]

Dosent matter if you cant land a job LMAO

[undone shore]

And that is irrelevant if you already have a career

[sleek sedge]

That's why you usually get professional experience before getting a masters

[undone shore]

That ^^^

[proven wyvern]

But you cant get experience because nobody will hire you without experience until you get experience

[undone shore]

A lot of companies will actually pay you to go and get a masters

[sleek sedge]

Juun already answered this question

[undone shore]

Cyber is traditionally not an entry level field.

You get experience in other sectors, then transition in

Usually, anyway.

[sleek sedge]

#cyber-and-careers message

[proven wyvern]

Yea yea It help desk then It admin then if your lucky branch into CS 🤷🏻

[undone shore]

(Thank you Juun)

[sleek sedge]

Right answer, Muiri 😂

[fallow tundra]

Lets assume someone worked 10 years as a C++ programmer. Why would that make him any more competent as a penetration tester?

[undone shore]

For a start it makes them well placed to understand security flaws. It means they'll be able to read and understand code (I.e. good for code reviews).

Programming experience means they've got a big headstart in appsec.

[dense dagger]

Definitely

Reminds me, I have to study all the C languages before moving into CRTL & OSEP

[fallow tundra]

Well I do have some experience as programmer. No IT-sec guy ever cared.

[sleek sedge]

When you say experience as a programmer, do you mean as an actual career/job or just in general programming?

[fallow tundra]

work experience

[slow lodge]

Hi i have question , can someone help me ? im beginner

[broken idol]

Ask away

[slow lodge]

i am a software developer and i want to learn hacking , i passed some test in try to hack me
but i need help now

[slow lodge]

• Which team focuses on defensive security ?

[plush quiver]

🩵team

[flat sedge]

not just that, the entire degree process is really teaching the candidate the best way to learn in the domain, so the candidate already has all the theory - that's the hardest part to pick up.

Once the theory and abstract reasoning side can be properly applied, the experience puts everything into context and the candidate outgrows the role much faster than the business expected. This causes the business to have to spend more money to fill that role out of schedule and out of budget

[flat sedge]

Without knowing anything else about the candidate? Probably not.

[pseudo creek]

there are multiple teams within cybersecurity that focus on defensive security. Cybersecurity is not just blue team and red team but there are other teams. Network security team = defense security, Cyber security engineering & Architecture = defensive. If you looking for active defense such as looking for alerts, threat hunting, all that, then you looking for blue team

[broken idol]

This was THM room help.

[pseudo creek]

aha

[mystic kiln]

Or they could take a chance and see what the person is willing to make. Making presumptions based on someones skills, credentials, and experience is only doing companies a disservice. The stigma of overqualified is subjective and if the person likely wouldnt have applied if they weren't willing to do the job.

I am so tired of hearing the "overqualified" statement. Thats just an excuse by HR and companies to easily get rid of people they are threatened by.

[broken idol]

You sound like you're one of the people who gets turned away for being over qualified.

I got turned away for it by Barclays Bank,

They obviously wanted somebody with less skills than I.

[proven wyvern]

This is exactly why there will forever be a shortage in cybersecurity

Companies dont know what they want

Infinite amount of talent but nobody wants to hire anyone 🤷🏻

[proven wyvern]

And getting turned away by a bank who made 32B in revenue in 2024 / the wages they are paying clearly isnt the issue

[flat sedge]

Your opinions are wrong, and that is not the root cause of a shortage of cybersecurity professionals. Companies do know what they want, that's why roles are open. I've told you what the 'traditional' paths into the domain are; if you think that's incorrect, that's fine, but best of luck.

[proven wyvern]

So pretty much a masters in cybersecurity isnt enough so you have to apply for jobs like It desk and IT admin that your overqualified for in which they wont hire you anyway because they are scared your going to leave as soon as u get experience

Thats flawed 👏

[pseudo creek]

masters in cybersecurity are generally focused on management vs technical and yes it makes you 'overqualified'. Lots of companies have salary structures that take masters into consideration. Meaning if they hired someone with 1-3 years of work experience but no masters, or someone with no work experience and a masters, they may be "required" to pay the person with a masters more. also they may view someone as having a masters as someone who wouldn't stay there long in a low level/entry job

[silver moon]

Hello guys, i am a computer science student, currently finishing my second year with pretty good grades. I am in love with cyber security and networks and currently i am choosing college courses to listen to related to that field. I started tryhackme about a month and a half ago, and have only missed like 4 days. I have learned a lot of new stuff from the site, however i would like some of the more experienced people to give me a point/direction into my carrer path. I would like to get a Masters Degree in Cyber Security and/or Computer Networks, and would like for someone to suggest some good schools in Europe, and give me some tips for my future. Thank you all in advance 🙂

Edit:
I know i need to do certifications, and i will start doing them this year. I would also like some suggestions on the order for finishing the certifications.

[flat sedge]

I would not recommend pursuing a Masters in cybersecurity until you have gotten your first job; it's a checkbox on your career path, and won't help you much with getting your foot in the door.

I would also recommend looking at internships as soon as possible, although all the summer positions may be filled for this year.

[silver moon]

The thing is that in my country there a not a lot of internship positions in cyber security, a lot of them are just software development, machine learning and what not. Also i can take my degree either 3 or 4 years, meaning if i want to persue Masters in my country i can go 4+1, however my wish is to get a Masters outside my country (My country doesnt have that good of education) and most Masters degrees are 2 years in Europe. Any point if i should take the 3 or 4 year degree?

[flat sedge]

That's fine. All of those will help you in a security career. it is more common to start in another domain then move into security than to start in security directly.

You need a Bachelors as a pre-requisiite for many Masters degree programs.

[thin drift]

Thank you THM. i beginning to break the ice on bug bounties becuase of your help!!!!!!!!!!!!

[thorny lava]

Hello gents, in your opinion for now best certs "granting" interview?
Are we at the moment that ppl REALLY acknowledged HTB CPTS?
Would it be enough to get somewhere without real job experience?

Also few months ago when it showed up I was told it is go to, to get full scope in terms of what u should know to make A-Z pentest

[worldly whale]

Oscp

And that will be the standard for years still I think

[uneven ore]

Has anyone ever done a "screening" interview before? I have one coming up and I'm not exactly sure how to prepare

[fickle grove]

This will depend on what role and level you are applying for. I haven't been on the interviewing side, but a screening interview would most likely ask for some high-level information that you should know before you are passed onto the hiring manager for the actual technical interview.

[fickle grove]

It will take some time for CPTS to be the standard because only those that have completed the path or course are eligible to sit for the exam, thus in a way making it "exclusive".

[pseudo creek]

Usually those are interviews by HR, they generally will go over the job description and your resume. They may ask a few questions as well about your goals.

[vapid plinth]

You can DM me and we can talk about it since I assume we're from the same country ^^.

[coral vault]

His last name is 'grifter'

That is very unfortunate

[fallow tundra]

Ahh so thats why I am interested in IT-Security

[kind glacier]

How to Get a Job in Cybersecurity ,?
Here is the thing that , I am trying to learn CCNA and hacking and solving the HTB rooms , but the point is that , the company will not hire fresher like me ! ,
So what should i do ? To get the job ?

[shut zinc]

Has anyone had success with one of those AI powered job boards?

I'm thinking about paying for the service to automatically apply me to new jobs

[warm hinge]

Hello
I choose cyber security course
I don't know what I learn first
I think you are know better what I learn first

[gleaming scroll]

no

nothing has a success rate when the job market is shit

[broken idol]

Have you worked alot with the AI powered job board?

[gleaming scroll]

for india they don't work i have tried applying a few times

i don't know about the countries outside india

[frosty gyro]

anyone from kenya........................?

[cyan hearth]

[distant pier]

@primal ore Please no advertising services in this Discord.

[harsh owl]

has anyone here done bug bounties before? going for a sanity check, but what is some down-to-earth advice you can give for someone potentially starting on bug bounties? it seems like a promising side hustle, but i like to believe such things don't come easy

in addition to, what is some prerequisite knowledge i need? i need to checklist if im ready for this sort of thing

please @ me!

[broken idol]

It's not a promising side hustle at all.

You could go months without finding something, you could find alot of dupes.

[harsh owl]

what do you mean by dupes? i know that the hardest part about bug bounties is going against the many others trying to submit the report first too

[broken idol]

I've reported some bugs, but they're dupes as in somebody else has found it and reported.

That could be more than one person for the one bug

[broken idol]

However got any bug bounty questions etc.

We have our very own #bug-bounty channel.

[harsh owl]

oooh, i did not see that at all for some reason. its not on my channels list

let me put out my question there instead!

[broken idol]

You might need to hold in the server or right click show all channels.

[warm hinge]

Any Mobile Pentesters here? I just was wondering what’s the best resource to learn Java for Android to git gud at static analysis/reverse engineering?

[faint ice]

probably try and make some apps for android

or look at open source apps for android

[fiery harness]

Hey guys

I have just finished my Googles Cyber Cert

and I cant use the discount code from it for Sec+

anyone know why?

[faint ice]

well we could guess but there is no garantuees... either ask google or whoever certificates sec+

[shy hinge]

Can some one help me download kali on MacBook or asus laptop having issues thanks

[pseudo creek]

wrong channel and kali.org

[warm hinge]

how do i rank up

[dense dagger]

if youre talking about tryhackme, just gotta do the rooms with points

[shadow laurel]

Hey so I've just gotten into cyber security today and ive only gotten into it using the roooms in tryhackme and didnt use any other programs but i feel kind of behind everyone, am I going on the right path or should I do more stuff to improve?

[ember meadow]

Yes the rooms are great although if you havent #start-here

After that just do the intro rooms and expand from there

[shadow laurel]

Alright thank you

[shadow laurel]

How much time does it take to get to an average level and whats the average age group in here?

[ember meadow]

Im barely older than you and id say im a little below average, took me about two to three months of on and off learning and i can hack slightly misconfigured machines. It juts takes some time

[shadow laurel]

Oh wow

[ember meadow]

But honestly age plays no factor, just make sure you’re learning to be an ethical hacker not a bad guy :)

[shadow laurel]

I just feel really far behind considering my age

[shadow laurel]

👍

[ember meadow]

Yeah youre honestly getting into it earlier than most so dont

[shadow laurel]

Ah alright, thanks!

[serene umbra]

Gave +1 Rep to @ember meadow (current: #522 - 8)

[ember meadow]

Anytime!

[trail jasper]

mate youre 13

most people start when theyre 18 or something

[sleek sedge]

How old are you?

[fallow tundra]

Great now I feel old

[hybrid ginkgo]

same...

[fiery harness]

let him cook

[coral vault]

My brother in christ, I was 25 when I started. I have people in my classes who have a solid shot at jobs who are in their thirties

[shadow laurel]

Ahh, it's cus I keep hearing all these stories about people starting from 9 or smth

[shadow laurel]

oh

[trail jasper]

thats so unreal

afaik most people start when theyre like 16-17

and age doesnt really play that much of a role

[coral vault]

I wouldn't have managed learning this when I was 17... I wasn't near mature enough to handle it... the chances I would have crossed the line and gotten into serious trouble would've been huge. Assuming I'd have gotten to a serious level enough to land into trouble to begin with

[sleek sedge]

Certainly not 9, where did you hear this from?

I started at early 14, but I'm a bit of an exception to the typical route

[shadow laurel]

Idk, multiple commentaries talked about how certain currently professional people started ata very young age and it was a key factor for there success

but either way I really enjoy cyber security and i dont think i'll stop

it can be hard sometimes but im aiming to be a penetration tester or a red teamer (maybe malware analyst? idk alot of cool careers out there)

[sleek sedge]

I mean, I guess I could say I started at 10 but that was just programming - really depends on how you'd define starting imo

[shadow laurel]

oh wow

[sleek sedge]

Nice, passion will get you far!

[shadow laurel]

well, I learned some python at 11 and recently i have gotten kind of decent in this language called verse

so i think im mentally prepared and my problem solving skills should be above average to get into cyber security

[chrome juniper]

Hi, could you tell me what's the difference between 'unix_passwords.txt' and 'rockyou.txt'?

[fallow tundra]

Companys want you to start at 4 and get 7 phds at the age of 18 or else you won't land a junior position!

[trail jasper]

• you have to cure cancer as an extracurricular

[trail jasper]

thats not really a good mindset to have

just becuase someone started younger, doesnt mean that theyre going to have a brighter future in it than someone who started later

[shadow laurel]

aha

[trail jasper]

its very good to have an idea on what you want to do though especially at a young age

[shadow laurel]

Well at first I wanted to be a programmer but after learning about cyber security and how it uses programming and alot fun stuff it definetly caught my eye

[trail jasper]

keep at it

buy the sub if u havent yet

wont regret it

[clever lagoon]

At that age you can't really have any idea of what you are doing with your life, and that's okay
Some people switch careers in their 40s and are fine
If you enjoy infosec spend time on it, don't obsess over it necessarily being your career path

[hazy dove]

Does anyone know of any companies still hiring internship positions for IT or cybersecurity? I’m a freshman in college.

[warm hinge]

How can i become an ethical hacker after 10th

[fringe spade]

10th of what?

[warm hinge]

After 10th std

[last oar]

anyone familiar with the popular mssps in Germany , whether they're local or international companies

trynna find a soc position here

[sleek sedge]

What does std mean?

[last oar]

sexually transmitted disease

[cobalt escarp]

Keep it appropriate please

[iron knoll]

He means to say after 10th standard or grade whatever you guys call it

[stark pumice]

i m looking at ways to protect PII Data from architecture perspective

[slender hearth]

just complete ur 10th std after take diploma(cyber security) or do 12th in arts,commerce,science and learn side by bout it from onine platforms play games related to it n get the flags n etc just start that's the thing

[warm hinge]

Ok any languages to be learned

Is btech in cs necessary

@slender hearth

[rugged delta]

Programming can be useful, but is not essential when learning pentesting. Being familiar with bash/Python/SQL/Powershell etc can really help your progress, and you can pick these up as you learn new skills. You should also consider learning Linux/Windows/Networks; you will be introduced to a lot of new skills and tools as you learn and progress. THM has learning paths to help you develop from the basics onwards and the community can provide you further advice with how to progress as you go

As you learn new skills you might develop an interest in a particular skillset where programming can be beneficial. A degree can help you to get a job in cybersecurity, and while it might highlight your abilities, it isn't 100% necesary if you are able to demonstrate your skills and abilities in other ways. There are many certifications that can help show your skills, as well as participating in activities like CTFs or bug bounties, keeping a blog of your progress, etc

[fickle grove]

This can be looked at or interpreted in a lot of different ways depending on the specific need. Maybe start looking at TOGAF or SABSA?

And #infosec-general might be a better channel for this.

[noble summit]

Hi everyone.. I have an interview tomorrow for SOC support engineer. After 2 years on tryhackme (in top 4k now) and some other websites where I did lots of investigations and got BTL1 certificate I decided to try and get a job in the field and already I have few opportunities 🙂 I would like any advice for the interview like what could be the questions, what should I ask of them etc.. The company provides SOC as a service, among other services, for costumers and according to their website, they are moslty using Splunk as a SIEM solution, which Im quite familiar with. Any advice or help would be much appreciated. Thank you all 💪 ❤️

[rugged delta]

There are tonnes of questions you might get asked and you can use your preferred search engine to find sites with lists of questions they might ask you. You could ask specifically what tech they're using, if they haven't told you, maybe ask why a particular solution, if they have particular processes/training they'd like you to understand, what their requirements are for the role, schedule, work/life balance, team compatibility etc...

[raw heron]

Good luck🍀

[kindred kindle]

Good luck 🍀

[wintry juniper]

Hello, I am taking the google cybersecurity certificate on coursera to get foundational knowledge in cybersecurity. My next step upon completion is to move over to Google Cloud Skills Boost learning site. I am wondering the order of courses I should take on Google Cloud Skills Boost if I want a to pursue a career in cloud security? Thanks!

My current plan (in current order of planned completion):
Phase 1: Foundational Knowledge (~6 Months)

• Google Cybersecurity Professional Certificate (Coursera) (Currently on course 5/8)

• CompTIA Security+ Certification (Discounted upon google cybersecurity certificates' completion)

• Google Cloud Security Operations (Cloud Skills Boost)

Phase 2: Google Cloud (Unknown completion time)

• Google Cloud Digital Leader Learning Path (Cloud Skills Boost)

• Google Cloud Architect Learning Path (Cloud Skills Boost)

• Google Cloud Security Engineer Learning Path (Cloud Skills Boost)

• Google Cloud Network Engineer Learning Path (Cloud Skills Boost)

INFO ABOUT ME:
(Started learning cybersecurity ~ 4 months ago, have a Bachelor of Business Manegment w/ a minor in Pscychology, 23 in june, Canadian).

[cedar peak]

I’m not sure if this is the spot to post it, but if you live in Tucson, Arizona IBM is hiring and Global Cyber Risk and Resilience Lead.

[split merlin]

Please can Anyone give me a clue of what to specialize on in Cybersecurity.... i have been studing the whole topic and it gets tiring... anyone please

[fervent hamlet]

nobody can tell you what to specialice in but you can just look at the different paths/jobs in the cybersec field
THM for example has the Careers in Cyber room where they go over this

and if you want to make it in the field you will have to study all your life/career

[split merlin]

Okay, this helps... thank you

[serene umbra]

Gave +1 Rep to @fervent hamlet (current: #1379 - 2)

[stoic cave]

Do you have any professional experience in the field or in the computer industry? It doesn't really make sense to specialize before you even start working. Specialization generally takes years of learning a specific topic/process/etc.

The advice out of this is to focus on the basics. The basics are your foundation and you need a solid one to build off of. Then, after getting in to the industry if you're not, start building your professional skillset. Working in a professional environment is a lot different than self-studying. Once you've decided in a general direction, start to focus in, and over time (period of years) you'll build that specialized skillset.

[pseudo creek]

I agree, I did a variety of things in cybersecurity before really finding my thing I love

[raven ether]

What was the thing you loved and why ?

[fervent hamlet]

https://tenor.com/view/hey-stranger-deadpool-ryan-reynolds-hey-gif-8183762

[pseudo creek]

I knew I liked design portion after trying my hand at a variety of operations stuff. Then cloud came along and decided I'd enjoy that and then I officially moved into architecture a few years after that so basically cloud security architecture

[raven ether]

Thank you, I will keep that on the list of things to explore

[serene umbra]

Gave +1 Rep to @pseudo creek (current: #15 - 478)

[faint bridge]

would it be better to get a bs in comp sci or IT for getting into cyber

[pseudo creek]

comp sci is generally considered better

IT, from what I see, teaches you tools vs concepts, comp sci teaches concepts. Tools fade into and out of favor and often what schools may use may not even be tools widely used in the industry

[abstract hearth]

Which entry level jobs in cyber security can be done as freelancer and remote?

[fringe spade]

Usually remote freelancing is done by more experienced specialists. I’d recommend checking out SOC positions, some offer entry level remote jobs, but that’s not really freelance

[abstract hearth]

Ok. I thought searching remote or freelance job. In my country I can't even find apprenticeships unless you are at most 1 year for completing a Uni degree. I'm not even halfway of my degree, so I thought looking outside as freelance or remote

[fringe spade]

Do you have any other experience in IT?

[pseudo creek]

usually remote jobs are within country. It is extremely rare to find remote jobs to another country

[abstract hearth]

Like professional experience? No, I'm trying to get professional experience. I learned the basics of web development and completed Google IT support certificate

[rugged delta]

The Google certificates are a good indicator of very basic knowledge, but certificates of completion aren't the same as certifications from a known exam provider. Certifications like Security+ or CISSP show that you've read and understood a bulk amount of conceptual knowledge about the field. Sec+ can be done as entry level but CISSP requires 5+ years experience. Neither is a good indicator of your practical knowledge.

You can build your skills using Try Hack Me, to tackle new challenges in various areas of cybersecurity. Your aim should be to include and work towards some form of practical certification like OSCP, or partake in CTFs (I notice you follow PicoCTF), it's a good idea to keep a blog or other record of your progress and experience in THM and with other technologies and tools. Doing things like installing a Linux server and using it to test various programs, applications and protocols and writing about it can really aid your learning.

You should also consider doing helpdesk, QA or other IT/programming roles to gain experience in various tools/technologies and to see how processes and procedures work in the real world

[brittle pier]

Are internships more of a outside college type of thing

[stoic cave]

What do you mean? They are specifically for people enrolled in some form of education typically.

[abstract hearth]

Thanks for the advice

[serene umbra]

Gave +1 Rep to @rugged delta (current: #21 - 377)

[abstract hearth]

Thanks. I appreciate your input, will look the SOC path and job

[abstract hearth]

You mean apprenticeship? They are a thing, but I haven't found a position outside US. I would love to have that kind of opportunity in my country

[brittle pier]

Yes and no. Might have misunderstood

[brittle pier]

Wait so you can be enrolled and also have a internship?

[stoic cave]

Yes? Internships are usually held between semesters in the summer. There are other types, some run during the school year.

[brittle pier]

Ooo

[flat scroll]

It dipends, what do you like more, red team or blue team?

or purple team? in my case, i really like to attack, that''s why i choose penetration testing

If u like to defend, you can maybe become a SOC Analyst

Or as i said if u like both you can do it, for example even if my profession is Pentester, i have to do also a bit of soc at work, it can be helpfull to know both of them in anycase, but at one point you have to understand where you want to focus more

[split merlin]

Thank you for the advice, I am a newby, I get confused on where to focus…. I just sent you a request

[serene umbra]

Gave +1 Rep to @flat scroll (current: #2076 - 1)

[flat scroll]

It's normal to be like that at the start, i've been in your same situaton a pair of months ago, i had just some basic fundamentals but what i did in these 4 months bring me to have no work, to work as a pentester

So if you want i can reccommend to you a simple path that u can follow since you define yourself as a beginner

[fiery oar]

Guys I'm trying to learn the fundamentals of cybersec... I heard I should learn networking , os concepts.. when I saw networking it's overwhelming with many concepts...can anyone say which are the most important topics in networking I should focus on so that I don't waste too much time in this..if I miss out any other fundamentals let me know plss

[stoic cave]

Look at the content for the CCNA Certification by Cisco. That's your baseline.

Networking is a cornerstone of security.

[fiery oar]

Thanks... That gives an idea

[serene umbra]

Gave +1 Rep to @stoic cave (current: #20 - 394)

[fiery oar]

What about os?? Should I go into theoretical things or just practical stuffs like knowing to use linux and windows?

[coral vault]

I just finished a forensics class and the deeper the understanding of an OS the better you will be in offensive or defensive stuff.

But in the beginning, focus on using it and the basic workings

[rugged delta]

Cybersecurity doesn't just require you to know the basics of using things like Linux and Windows and networks. You should be capable and competent with these things to some degree. It's something that takes time to learn and constantly improve. While you might not need to know how to build and scale enterprise networks full of multiple, intermingling systems, knowing how to set up a Windows or Linux desktop and server are considered fairly rudimentary stuff.

Learning how to poke around, install and use different software and services is part of the learning path. getting to know protocols and how they work is going to be part of your journey. You're going to learn about things like web servers, databases, email, file servers, TCP/IP, VLANs, firewalls, antivirus, standards, processes, laws and regulations, Active Directory, and loads more. Take your time and enjoy the journey

Things like CCNA or Network+ will teach you lots about how networks function and how they might be configured in the real world. The Security+ study guide (and videos from people like Professor Messer, etc) give you a general understanding of the cybersecurity landscape. There's lots to learn, and you'll find the things that interest you mostly

[south monolith]

I heard if you do ccna network + not worth it ?

[ocean pawn]

Can i get a job as a 16 year old in the field

[stoic cave]

Probably not, considering you cannot legally sign a contract (if you're US) or really be held responsible for major mistakes. Companies would be taking on a high degree of risk.

That's not to say you can't find a job somewhere in tech, like potentially a part time IT position (probably in the same risk boat) or something like Geek Squad

[polar aspen]

I would say it is worth it, if you don't have a strong basic understanding of them

Network+ is more broad and general, whereas ccna is more Cisco focus related

And provide more in depth in networking

However it is still worth taking as a good refresher (you can read the books and don't have to take the exams)

But some jobs will look for those 2 cert usually ccna is bit more favorable

[south monolith]

Yeah I was thinking to do network + Udemy Dillion course I already purchased so just go over it

[polar aspen]

Yup that's a great start, I bought the book by Mike and listen to professor messor

[ocean pawn]

thank you

[fiery oar]

Understood... Thanks mate

[serene umbra]

Gave +1 Rep to @rugged delta (current: #21 - 378)

[woven mirage]

Sorry if its a bad place to ask, do you guys know other discord servers in which i could learn and connect to people in relation to cybersecurity

Specifically more serious ones, most of the public ones i found seem to consist of mainly younger folks pretending to be hackers

I am in the sys admin server already

[broken idol]

We don't really allow advertising any servers in here, if a discord server is posted It will get blocked and muted.

[shy hinge]

Hey everyone

[rugged delta]

Well the CCNA is certainly more indepth than the Network+, so if you go for CCNA, you won't see any benefit from Network+. The Network+ should be sufficient to teach you what you need to know. CCNA is a little more complex

[broken idol]

Interesting name.

[woven mirage]

Interesting bio

[crisp wraith]

Hey everyone if I wanted to work as a Soc analyst what would be some projects that would stand out on a resume ?

[dense dagger]

I would build an environment that has a SIEM and XDR enabled and conduct attacks on it to see how detections can happen

[south tulip]

Anyone here working with Compliance?

[pseudo creek]

no but if you have a question, you should ask

[south tulip]

I've been hired as a Security Specialist by a small IT company. My primary job currently is to help implement Compliance frameworks like NIS2 and ISO27001. I dont have experience in the field, which my employer is aware of, and I am really looking for some example documents on Risk Assesment Procedures and IT Security Politics etc. was wondering if anyone had any great resources.

[dense dagger]

damn, good luck

i have limited experience with compliance so take it with a grain of salt but in my current work, we have someone that creates internal documents and policies. try to look at internal documents that they have also too

[south tulip]

Thanks, its a huge task. And basically I have been hired because they see great possibilities in me (Their words btw). They needed someone with the interest in learning and taking responsibility of the frameworks and their implementation. Which is why they hired me, through mutual connections.

[serene umbra]

Gave +1 Rep to @dense dagger (current: #22 - 369)

[south tulip]

Yeah I have tried this, problem is. ISO27001 and NIS2 are very specific in what they want to be a part of the documentation. But super vague in what that actually means. A national compliance cert states as an example " Risk Assesment Procedure should include, at minimum, the phases Identification, Analysis, Evaluation, Mitigation and Acceptance of new risk." But it has absolutly nothing on how to actually perform and write these. Which is why I was looking for examples.

[dense dagger]

yeah, thats why usually you'd get a third-party auditor to help you

[south tulip]

Yeah, and that is also still a possibility. I was just hoping to do as much leg work as possible before starting to pay for those expensive consultant fees.

[dense dagger]

you can start by documenting a lot of the processes people follow

[south tulip]

Yeah, that might be the way to go.

[crisp wraith]

Thanks for the insight! I think I’ll get started with that right now I may have done something similar before but it was on my old computer

[serene umbra]

Gave +1 Rep to @dense dagger (current: #22 - 370)

[trim mist]

If you're in need of virtual assistant or a social media management. I am available for the role.

[strong acorn]

are there any certs that i should try to get before looking into digital forensics/incident response?

[fickle grove]

The reason for this is that both ISO 27001 and NIST CSF are frameworks and are designed to help you create your own policies and program that best suit your organisation's context.

[stoic cave]

First question, do you have to report to any auditing body?

[stoic cave]

And not to be a pessimist but this also makes you the fall guy.

[south tulip]

I have understood as much. But somehow these frameworks are always written in a certain "law" language. And for someone who's native language is not english it's often hard to really understand exactly what I need to describe and implement. It seems to me their should be examples of ways to implement the aspects of ISO, but I haven't been able to really find any. I'm basically looking for something to make sure I'm going in the right direction.

[south tulip]

Eventually yes.

[stoic cave]

You need to map the frameworks to controls

[south tulip]

It could be that way. But it seems I have great leadership backing, and my immediate leader is one the founders. But they could still turn to blame me at any time probably.

[stoic cave]

The framework orgs are just going to provide a general "you should do this." it's on the orgs to take those frameworks and map them to their environment.

If you're going to be reporting to an auditing body, they aren't going to care that "oh I'm just learning" or "this was implemented incorrectly because I was unfamiliar with how it worked." This also isn't a one person task.

[fringe spade]

Law/legal education helps a lot with compliance positions in cyber

[stoic cave]

Keep records of everything and get everything you're asked to do in writing.

[south tulip]

Yes, and I am really trying to do so. It might be imposter syndrome, but I really need something to hold mine up against. To know that I am even going in the right direction.

[south tulip]

I have neither 😄

[south tulip]

I would agree to this, and I am not alone as such. But I am the only the one working solely on this.

[fickle grove]

Its tricky to give specific examples as these can be implemented in a couple of ways. However, I found these resources useful -

https://www.isms.online/iso-27001/requirements/

https://www.iso27001security.com/html/27003.html

[south tulip]

Hey thanks, I'll give them a read through 🙂

[serene umbra]

Gave +1 Rep to @fickle grove (current: #13 - 548)

[fickle grove]

If you have management support as well, getting a copy of the standards would be a ton of help

[coral vault]

If you can find a proper one, you can request an audit. If you have good leadership backing, they could agree to it. A good auditor will not cut you down for not being up to snuff, they will help you guide you to compliance

When I workd in aerospace operations, this was the case, at least and I have met government inspectors (in cyber) wih the same attitude

But you need significant tolerance in leadership for things not being right yet

[fiery oar]

i have a doubt. Is there any thing i can do to restore my previous instace or tabs in kali linux after shutting down or restarting the kali vm??

[dense dagger]

you'd need a third-party application

iirc tmux can do it

[fiery oar]

I heard about it and tried. But the session is not there after rebooting my Kali vm

[stoic cave]

@warm hinge please know that unsolicited DMs are prohibited. For the benefit of the community, please continue ask the questions and continue the conversation here.

[hazy cradle]

there are few custom scripts you can write for that

[worthy olive]

“- Basic knowledge in data technologies and analytical tools (e.g. SQL, Data Lake, Data Warehouse, PowerBI, Elastic, Kibana)

• Experience in creating dashboards and data visualizations (e.g., in Excel, PowerBI, Kibana) for reporting key metrics and stats would be an advantage
• Experience with programming in Python
• Knowledge of vulnerability management processes and solutions” These requirements are for a vuln management position but this comes under devSecOps right ? Should one focus on devSecOps for this specific role ?

[dense dagger]

Nah, looks like a data analytics role

[iron knoll]

Can anyone please help me with how should start my carrier in cyber security currently I am doing ug in cyber and everyone seems to be knowing so much more than me. Can anyone please help me

[dense dagger]

Start learning on tryhackme.com

[iron knoll]

Do I need to learn any language before starting that or I can just start with tryhackme

[fickle grove]

I suppose you could pick a language as you go.

[iron knoll]

Which one would help me more

[sullen charm]

Python

[warm hinge]

I'm not a AI hooligan but I think GPT 4o can already do that smoothly, except the vulnerability management

[worthy olive]

True….vuln management is the role tho…this is an intern position so more of a learning thing with easy work at the side

[brittle pier]

The basics help alot

[broken idol]

Let's not suggest it, ChatGPT can be very confidantly wrong

[iron knoll]

By basics do you mean networking, operating system, cryptography and linux

[polar aspen]

You don't have to learn any language before starting, but it does help understanding how it will function or work

To get started you probably need to know linux command lines, sql queries, and bit of bash scripting

Then you if you like you can go bit deeper into python (popular choice by many), rust, c, go, or a language you like

Recommend you learn the syntax when going into programming language to help you

As for basic yes, you need to know about network, the operating system, and how data flows

It is a lot of learning, so don't rush and don't be overwhelm, just practice over and over until you get some understanding

[iron knoll]

Do I need to do get deep into the language. Like learning about all the libraries and oops concepts

Thank you so much man really helped alot

[iron knoll]

Can you help with this too please

[rugged delta]

Learning the basics of something like Bash or Python will help you a lot. As long as you're able to follow the logic of how a piece of code is working, that can be enough, at least to start with. You can learn more indepth as you improve along the way

[polar aspen]

No

If you go deep in OOP then you are going more towards as being a programmer

Learn to know to at least how to code and read/understanding coding

If you want to go deeper than that, it is your personal choice

[fiery oar]

I want to enter cybersec and plannin to do certification . Should i focus on ccna or comptia network+ or comptia sec+ as a fresher ?? any other suggestions are also fine. ( i will be facing placements soonn)

[modest geode]

Either CCNA or Network+. Or the knowledge from those certs. Most areas of cybersecurity have to do with networks, so you want to know networking. CCNA is quite Cisco specific, but doesn't hurt. Also looks solid on your CV when you apply for jobs.

[fiery oar]

Sure.. im quite confused about choosing vendor specific (ccna) or vendor neutral. Also i heard about cissp. if there's something first to do , which one shall i goo?

[modest geode]

You need five years of work experience in security to call yourself a holder of CISSP. It's aimed at people in management. Personally I would do CCNA. It's much more recognized by employers, you might get interviews just because you have it. You will learn Cisco specific things you probably soon after forget, but it's worth it. Has all the network fundamentals you need, and more.

[fiery oar]

Thanks a lot... that cleared it out

[serene umbra]

Gave +1 Rep to @modest geode (current: #2078 - 1)

[fiery oar]

is comptia sec+ overhyped??

[modest geode]

Like most certifications it's "a mile wide and an inch deep". Covers lots of topics but barely scratches the surface. If you do courses for it on YT or Udemy you're basically learning the definitions of >100 terms, but without substance. And that's enough to pass. You don't need any practical skills for it.
I believe it's quite valuable in the US because the military and military contractors demand it. It depends where you're from. In Europe it's not worth much in terms of employment. But if you treat it as what it is, to get an overview of what's out there and what might interest you: Can be worth it.

[fiery oar]

Got it... Thanks mate

[serene umbra]

Gave +1 Rep to @modest geode (current: #1383 - 2)

[jade monolith]

Is eJPT worth getting?

[stoic cave]

Does the job you're looking at require it?

[jade monolith]

No

It's one of the cheaper ones and I want to get some certs to show off my "skills"

[stoic cave]

Do you have a bachelor's degree (STEM or really any degree) or professional experience in the computer industry?

[jade monolith]

Nope

CryingCool

[stoic cave]

Getting certifications without one or the other doesn't really do anything for you.

Certifications are used to quantify professional experience and say you are proficient to a standard.

[jade monolith]

Hmm

[stoic cave]

If you have neither a degree nor professional experience, and you're of age (age to legally sign contracts) to start working in your country of residence, I'd recommend looking for help desk roles in order to start building that experience.

[dapper juniper]

Hi, I've just started trying Hackme. So, I have questions for you. In the Hacking Your First Machine Part 2. I transferred successfully, successful then when I write the account balance, 'your answer is wrong' the message comes out. Can you tell me what's wrong?

[pseudo creek]

try #room-help not careers

[dapper juniper]

ok thanks

[wise swallow]

Hi

[river stag]

Hello,
I am currently a sophomore doing CS, and I am very interested in cybersecurity and I wanted to know how start preparing because my college doesn't offer any cybersecurity courses just Standard CS Curriculum. I've checked out cybrary, hackthebox and tryhackme and I am still lost and can't figure out how to start.

Also are there any cybersecurity internships? which I could apply to after learning a skill or two

I am asking internships as a general question like do companies give out internships focusing on cybersecurity

[broken idol]

They do yeah.

[river stag]

oh okay thanks.
I asked that because I couldn't see any internships in my country

[serene umbra]

Gave +1 Rep to @broken idol (current: #1 - 2269)

[whole field]

most companies are accepting hacking/sec certs from tryhackme and hack the box nowadays in america im not sure where youre at

[flat sedge]

Please don't spread misinformation. Tryhackme does not offer certifications, and the HTB stuff is so new, the security communities barely know of it, let alone the HR and Business groups that actually post the job reqs.

[whole field]

youre right i used the wrong word, there are badges for completeing courses,to show what you know and to prepare you for certs like pentest+ and SOC1&2 roles. im not sure where youre working but my employer loves them, probably depends on the company

[winged haven]

Anyone on here have know of companies they work for that are hiring? I am a senior and I have less than a year left before I get my BS in IT with a specialty in Cybersecurity. I need to start getting experience and actually start working in the field. I have been working as a Technical Writer II for a defense contractor for 4 years and have a military back ground. I have been applying all over and have been having a hard time finding any job that I qualify for. Are their recruiters on here or anyone that has a company in North America that is looking to hire someone remotely? Any recommendations or help would be greatly appreciated. I am struggling horribly.

[broken drum]

I could have sworn I was applying somewhere (*.gov) and a TryHackMe reference was in the reply

Ah it was another site, that I shall not name.

[river stag]

I am from India

[broken idol]

Yes?

[strong anchor]

Hello , i have a question , how do i get a first experience in the computer industry:)?

[brittle pier]

well

if you dont have a degree many people start off in help desks

and work there way up

[pseudo creek]

even people with degrees often start off in help desks

[whole field]

I’m in America so the job market is gonna be completely different here, you could try your hand at bug bounty hunting on integrity, bug crowd or hackerone there’s a bunch of sites with bug bounty programs

[warm hinge]

Depends, in the company I'm working, there are people who pick up the phone (and help with little things), and people who give support with a bit more complicated things. The people without degree do pick up the phone, and the people who have a degree are the ones starting by giving support. Some people are growing towards support from picking up the phone.

[pseudo creek]

yes, it depends. I didn't say everyone does

[warm hinge]

True

[pseudo creek]

in my company generally the help desk is staffed by those with college degrees and they eventually move out of that position to something else. I never worked help desk myself, but my job in college was a lot of what you would call desktop support

[floral needle]

Does tryhackme do a good job of getting you ready for the workforce? Currently doing the Soc 1 path. Just wondering if I should stick with this or study for another cert.

[dense dagger]

It does enable you with the theoretical and practical knowledge of understanding concepts and technologies

A lot of employers look for that; people with basic understanding of tools, concepts, and technologies.

[stoic cave]

It's an additive, meaning something you do on the side bolster your knowledge. Professional experience and degrees are what actually matter and you need one or the other. Also, just know that certificates, like THM provide, are not the same as certifications.

[fiery oar]

i have a doubt.. Is it advisable to do CCNA or network+ first or go straight towards cybersec certifications like CEH or ej pt or somethin as a final yr student with networking and os knowledge ?

[broken idol]

Where do you live?

[fiery oar]

India

[broken idol]

Ceh would probably be one of the most useful

[fiery oar]

Okee... But recently I saw that ceh has some bad rep in industry. Is that true?

[broken idol]

Yeah, it's very much true, however India still use it as an HR request.

[fiery oar]

Finee

Even with these certifications in hand as a fresher , won't I get a cybersec job instead of a help desk ?

[dense dagger]

The hard truth about the industry is there is expectation that you have experience before coming into cybersecurity

But it is definitely possible to get into cybersecurity as a fresher. Its not just as easy.

[fiery oar]

Understandable

[fiery oar]

Is that only possible through referal coz I see every job profile with exp demand

[modest geode]

I don't know your local market but generally: you have to stand out from the masses. Pass OSCP, maybe CCNA just for the initial HR filter, have a successful YouTube channel, publish a blog with write-ups or discussions of the newest vulnerabilities, write tools and publish them on github, be very high up in the THM/HTB ranking.

[broken idol]

Ceh would be cheaper tbh.

[fiery oar]

Understood...I'll try it outt

[royal zenith]

i have done a few try hack me modules. Now that im in summer i want to study for a cert. Would it be advisable to study network+ or sec+. My curriculum is Electrical Engineering so I wont take any classes regarding networks or telecommunication until my junior/senior year.

i tried with sec+ at first but seemed too much to start with

also does anyone in the U.S know if network+ can help get you a network engineering / cyber secuirty internship with a 3.4+ gpa

[stoic cave]

Assuming you're in the US, sure, but you don't need certifications to get internships.

[modest geode]

(Almost) everything security-related builts on networking in one way or the other. It's highly advisable to first get networking knowledge. That doesn't need to be the actual net+ or CCNA cert, you can acquire the knowledge without passing the exams.

[stoic cave]

It's better to wait until you're about to finish your degree as well, that way you don't waste the time before the certifications expiration.

[modest geode]

If they did Net+ now and Sec+ later, the latter extends the former.

[stoic cave]

True, but then they're also spending more money. It's really going to depend on what their goals are.

[royal zenith]

yea but would the cert make me more likely to get an internship

[modest geode]

Certainly, all other things being equal. You're gonna stand out from the crowd, at least from the majority that doesn't have certrs. Nobody has data on how much more likely though.

[dense dagger]

IMO, yes, but it defeats the purpose of an internship.

[stoic cave]

You're in school in the US right? There are plenty of internships to go around. They may not be at FAANG or insert hot startup, but they will get you experience. Juun can articulate this better than I, but the purpose of an internship is to expose you to the professional workplace. Internships aren't expecting you to come in with anything more than what you learned in school and are more of a trial for you and the company to see if you fit.

[next minnow]

Hello

You can you givee a road map to learn Cyber security

[sleek sedge]

https://roadmap.sh/cyber-security

[next minnow]

Thanks brother

[rustic ember]

hey guys im timo from mrc i want learn cyber but i need someone to help me step by step cut idk from where i cant start

[modest geode]

https://tryhackme.com/path/outline/introtocyber
https://tryhackme.com/r/path/outline/presecurity
https://tryhackme.com/path/outline/beginner

That would be a start

[stoic cave]

You can also go to #start-here

[past furnace]

https://www.linkedin.com/feed/update/urn:li:activity:7198686772321517569/

[sinful sparrow]

Is cpts worth it?

[rugged delta]

If you're looking to become a pentester, you are expected to learn and understand a lot of complex topics. There are quite a few certs on the market that aim to teach you the skills you need to become a junior penetration tester, i.e. to teach you enough to be able to perform routine techniques up to a certain point.

The most widely recognised exam at this level by employers and their clients is the OSCP, as it has been around for a long time but there are plenty of alternatives. For a lot of people the OSCP can be prohibitively expensive. Many people will say that you shouldn't be the one paying for such an exam, but many employers in the field won't even consider you without it. The CPTS and others like the PNPT and eCPPT aim to provide a similar level of training at a more affordable pricepoint and can teach you quite a bit.

These certs can each be a significant time investment and will teach you quite a bit to gain the skills you need, so from that perspective, the CPTS and the others are worth the time and effort. There are, however, no assurances that having any cert will be sufficient knowledge and experience for an employer to consider you. You will need to learn those skills and techniques, regardless; so from that perspective, any of these certs are good ways to learn these skills, and you'll have the cert at the end of the course to show your efforts

[sinful sparrow]

Tysm for such a detailed explanation ❤️

[rugged delta]

Best of luck with your studies

[brittle pier]

How much experience do pentester jobs look for

Like if you have years in the blue team sector and you want to switch how much more likely will you get the job?

[fringe spade]

It depends, as everything, but I’d say at least a year, 2 would be perfect

But nothing stops you from applying to those positions even with 2 months of experience 😉

[strong anchor]

the good part on that Is that THM covering most topics

[brittle pier]

Thanks

[serene umbra]

Gave +1 Rep to @fringe spade (current: #254 - 20)

[autumn lark]

Thanks

[serene umbra]

Gave +1 Rep to @sleek sedge (current: #14 - 522)

[modest geode]

Is that common?

[rugged delta]

Is this part of a job application process/a bug bounty?

[undone shore]

For a job app?
We do it 🤷‍♂️
I'd be a bit wary given how open that is though. Anyone could own that domain, or the app it points to.
It's up to them if they want to use a public domain and not enforce things like IP restrictions, but I would be inclined to ask for a LoA in this context, just in case.

And maybe, y'know, a scope lmfao

[modest geode]

job application

[rugged delta]

If it's for a web app pentesting position, you might be asked to do a small sample pentest. It should be similar to an active application but it shouldn't be using any real business/customer data. They obviously want you to produce a report. It shouldn't take you too long

[modest geode]

it's a simple webapp indeed

[modest geode]

Ok so everyone, even if not authenticated, can set anybody's password to whatever they want. Can I stop the penetration test at this point?

[rugged delta]

We're not going to be able to help you with determining that. You need to follow the instructions you were given

[rain thorn]

Hello everyone! I need a bit of advise. I have worked in the restaurant industry for about 10 years now, and I’m ready to switch careers. I have a bachelor degree in IT that I got back in 2017. Then, In 2022, I got the A+, Net+ and sec+ and I’m currently working on the CCNA. I’m just not sure how to go about landing my first IT job. I have apply to help desk, but most of those jobs seem to want experience even at entry level. I applied anyway and I got one interview at out of the 50+ applications I have filled out. Nothing came of that interview, they just said that they moved on to another candidate. I did ask for feedback but was giving none. So how do people from other industries break into IT. Any advise is helpful thank you!

[modest geode]

Depending on the market 50 applications is simply not enough. People sent hundreds.

[rain thorn]

Yeah! I was just readying an article about that. That’s a bit depressing but most keep swimming, lol.

[stoic cave]

While the market does have it's ups and downs, sending that many applications typically means you a) don't qualify for the roles you're applying to or b) the more likely case, there is something wrong with the resume itself. 50 applications is honestly more than enough, especially if you tailor the resume to each role you're applying to. The people sending hundreds typically just shotgun the resume out, which is counter productive.

[stoic cave]

If you verify, you'll be able to post images. My recommendation is to redact your PII from the resume and post an image of it here for review. That way we can see what you're submitting. Tbh based on what you have, bachelor's and the certs, orgs may think you're overqualified for the roles you're applying for.

[crude sphinx]

Discord: How do I verify my TryHackMe account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

May 22, 2024, 5:29 PM

[rain thorn]

Thank you!

I will get working on that soon!

[lucid fern]

i saw mentioned earlier that sysadmin or netadmin are good ways to get tech experience before moving to cybersecurity
what other common names do listings for those positions use
i want to make a search on linkedin for these positions (i already know the search syntax so i just need the key words)
when i searched sysadmin and netadmin i didnt find many results

[modest geode]

system administrator

windows administrator

linux administrator

[lucid fern]

I will use those thank you 🙂

[lucid fern]

thank you (so you get your reputation)

[serene umbra]

Gave +1 Rep to @modest geode (current: #339 - 14)

[rain thorn]

Ok! So here is the redacted resume, I did work on it a bit tonight. Change things around, any feedback is appreciated! Thank you guys for been awesome! If my resume looks passable let know what jobs I should be looking at, maybe I’m just not applying for the right things.

[stoic cave]

I would convert the PDF to a PNG or similar. People here aren't going to want to download random files, especially PDFs

[viscid haven]

Post a job you're looking to apply for, I want to see some job requirements

[ember meadow]

Yeah cant say i trust random files on my computer

[rain thorn]

Sorry about that. Here it is.

[stoic cave]

Off the bat you can remove the phone number and put the LinkedIn there instead

[ember meadow]

Slight spelling error on the first line of the server / lead server section, it should be “Led” not “Lead” (im a big grammar nerd)

[stoic cave]

I don't like summaries personally, but others do.

Lots of whitespace

[ember meadow]

Organized appears twice in a row in the same section

Hey parrot can i DM you some of these grammar suggestions?

Theres quite a few i see

[rain thorn]

I can change lead to led. But Lead Server is the name of the position. That’s how it appears on my clock in sheets.

Yes please do!

[stoic cave]

Take this resume and drop it in to a template like AwesomeCV

It should fix the formatting a bit and reduce whitespace.

[rain thorn]

Ok!

[stoic cave]

The center justified roles does not work with the right justified bullets

As far as content, remove soft skills from the skills section. You're expected to have them. Also, anything you put in skills you should be able to discuss, at length, for 20 ish minutes

[polar aspen]

Education part can be 1 line

And I don't know about putting references there

Usually you don't add it, and if company request you can send them those references

This should cut you down to at least 1 page

[rain thorn]

Ok!

Guy guys are awesome! Thank you so much for the advise. I will sit down and rework it again with your advice in mind!

[stoic cave]

Once you fix everything we've gone over so far, post again

[polar aspen]

If you are not one page, you can combine comptia to one line: Comptia A+, Net+, Sec+

[stoic cave]

We'll go through your work bullets next

[ember meadow]

I also went through a handful of grammar changes with him to fix general errors and make certain parts a little more professional

[viscid haven]

I created a system to auto generate resume based on job descriptions

Takes a JSON file as input. Converts the JSON to TEX/LaTeX. Then auto generates using xe-latex.

I only have to copy and paste Job description from job ad into Chat GPT:

Step 1: Find job.

Step 2: Copy paste job description into Chat GPT (which already has my template for JSON and what it needs to do)

Step 3: Copy generated JSON from GPT to resume.company_name.json

Step 4: ./resume.php resume.company_name.json

Step 5: Profit:

$  ./resume.php resume.boa.json
LaTeX content has been saved to resume.boa.tex
PDF file has been generated: resume.boa.pdf

Just generated one for Bank of America:

Then you can go and clean up and regenerate I need to.

Here's my original resume as I come from software engineering background but always did security in the background

Here's one for York Space Systems.

Just as an example, if you're going to do something, do it right. If you're going to be doing a shotgun resume, like the shot gun dating approach, that won't work so well.

Every resume needs to be tailored for that specific job. Don't use a shotgun resume, meaning, one single sole resume for applying to every job.

In fact, when having an interview, mention that you wrote your own resume development software. Or not. Not sure how that conversation might go...

Give me any job description and I will turn it into a professional looking polished resume in PDF and PNG in less than 2 min. 😄

If anyone needs resume help, I'm available to help. Thank you.

[rain thorn]

That’s a really fun project!

[viscid haven]

Thanks.

[rain thorn]

Ok! So here is the edited version and I will post a job I was eyeing.

Perform routine testing and analysis of [company name] multiple Local Area Network (LAN) and Wide Area Networks (WAN) and associated network software. Provides simple to moderately complex technical support in the design, development and enhancement of [company] LAN/WAN. Participates as a member of a project team to ensure LAN/WAN are designed and developed according to prescribed specifications and system needs. Provides support, administration, and connectivity for ticket vending machines (TVM) and platforms communication networks. Provides administration and support of Microsoft windows servers for the ticket vending system. Provides simple to complex support of video conferencing system including implementation, maintenance and configuration.

Minimum Qualifications
EDUCATION/TRAINING
Associates Degree in Electronics, Computer Science or related field or related work experience required.
Cisco Certified Entry Networking Technician is preferred.
EXPERIENCE
One (1) year of directly related work experience in Computer Information Technology with demonstrated competence and knowledge of current versions of Cisco IOS, Microsoft NOS and video conferencing system support.
One (1) year networking experience in Ethernet and LAN/WAN environment; various networking software including, but not limited to, current versions Cisco IOS, utilities programs, Cisco Routing, and Cisco Switches is required.
Knowledge of security systems and their associated peripheral equipment, Ethernet, Fiber, and Gbit Ethernet is required.
Ability to effectively interact with technical and non-technical team members in identifying network system requirements and resolving related problems.
Requires technical knowledge and experience to support Network and Infrastructure Analysts in network system administration technologies, including miscellaneous associated networking software applications.
Ability to work under minimal supervision on duties and tasks that are frequently non-routine; adapting procedures, techniques, tools, materials and/or equipment to meet special needs.
Prior experience with videoconference systems and protocols.

[viscid haven]

Redo your skills to be more specific

Network Security isn't a skill.

[rain thorn]

Yeah! That’s the one I wasn’t sure about. Ok!

[viscid haven]

Hardening Networking protocols is.

[rain thorn]

I like that thank you!

[viscid haven]

Something like, secure networking setup, hardening networking protocols and server services for secure network communication such as nginx, exim, etc.

Be specific and detailed enough.

It's not okay to lie

But remember

It's perfectly okay to embellish

[rain thorn]

Yes! I mean they will know pretty quickly if I lie! I have seen that in other places when people lie so much on their resume and comes the first day they are completely lost. And I do not want to be one of those people, lol.

I do want to thank everyone that took time to look over my resume, and gave me advice. It was all helpful. I learned a lot tonight. I hope the universe repays you all with good karma!

[viscid haven]

Some ideas:

Technical Skills

Network Security: Knowledge of firewalls, VPNs, IDS/IPS, and network protocols.
Cryptography: Understanding of encryption algorithms, PKI, SSL/TLS, and cryptographic protocols.
Security Information and Event Management (SIEM): Proficiency in tools like Splunk, ArcSight, and QRadar.
Penetration Testing and Vulnerability Assessment: Experience with tools like Metasploit, Nessus, and OpenVAS.
Endpoint Security: Knowledge of antivirus, anti-malware, EDR solutions (e.g., CrowdStrike, Carbon Black).
Incident Response: Experience in managing security incidents, performing forensics, and creating incident response plans.
Identity and Access Management (IAM): Proficiency in managing identities and access policies using tools like Okta, LDAP, and Active Directory.
Cloud Security: Understanding of cloud security principles and tools (e.g., AWS Security, Azure Security, Google Cloud Security).
Application Security: Skills in code review, static and dynamic analysis, and tools like OWASP ZAP, Burp Suite.
Operating Systems Security: Securing Windows, Linux, and macOS systems.
Compliance and Regulatory Standards: Knowledge of GDPR, HIPAA, PCI-DSS, and NIST frameworks.
Security Auditing: Ability to conduct security audits and assessments.
Data Loss Prevention (DLP): Implementation and management of DLP solutions.
Wireless Security: Understanding of wireless protocols and securing wireless networks.
Blockchain Security: Knowledge of blockchain technology and its security implications.

Analytical Skills

Threat Intelligence: Ability to analyze and interpret threat data and indicators of compromise (IOCs).
Risk Management: Identifying, assessing, and mitigating risks.
Security Monitoring: Monitoring and analyzing logs, alerts, and anomalies.
Data Analysis: Strong skills in analyzing large datasets to identify patterns and anomalies.

Interpersonal Skills

Communication: Ability to explain complex security concepts to non-technical stakeholders.
Problem-Solving: Strong analytical and troubleshooting skills.
Project Management: Managing security projects, including planning, execution, and reporting.
Team Collaboration: Working effectively with cross-functional teams.
Training and Awareness: Conducting security training and awareness programs for employees.

[severe warren]

do you think my cv is sufficient enough and structured well or should i make some changes?

[modest geode]

I'd do A+, Network+, Security+. Those are the official names and who knows, companies might have automated filters for them

[modest geode]

Most of the points listed as qualifications are not qualifications

Intermidiate => Intermediate

[severe warren]

ouch, typo

[severe warren]

can you provide qualification examples

just a few

[broken idol]

Thm stuff would go into hobbies.

[modest geode]

A qualification is something you achieved in your professional career. You listed character traits. That you shouldn't list anywhere because everybody claims to be passionate, curious and responsible.

[modest geode]

https://www.youtube.com/watch?v=4GksU2jmKg8 Maybe useful for some here

[fickle merlin]

I wonder... I am about finishing "complete beginner". I wonder what to do next. I think that to start in cyber it would be nice to get some certificate. What do you think what should I aim for? I do not really know what career I prefer. I think I am better suited for blue team, pentesting is so much fun thou...

[broken idol]

Where do you want to go?

[final wadi]

Help me pls

[broken idol]

With what?

[final wadi]

a person scammed me out of 30 euros

[modest geode]

If you have the money OSCP. Nothing beats it. It doesn't matter what you want to specialize in later, that knowledge helps everywhere. And it opens doors that other certs don't.

[broken idol]

Contact your local law enforcement

[fickle merlin]

I do not really know. First I thought about Blue Team lvl1 certificate, but now I do not know. There are too many courses, I do not know what to learn before trying etc...

[broken idol]

Well

Blue team level one would be good for DFIR work.

[modest geode]

Only heard good things about it, you would certainly learn a lot. But it's orders of magnitude less well-known by recruiters. Depends what your reasons to get certified are.

[broken idol]

Although OCSP is an offensive cert, it can teach you some defensive qualities also.

[fickle merlin]

Reason - get firat work easier

I think for a start 1500$ is a bit too much for me 😅 But.. we will see.

[broken idol]

A cert doesn't assure you'll get a job.

[modest geode]

You could search for OSCP and BT Lvl1 on your local job sites and see how many results you get. Likely 0 for BT.

[fickle merlin]

Of course not. But it is also comperssed and systematised knowledge to get to pass exam.

[sleek sedge]

Where abouts are you from?

For example, in India CEH is widely recognised - while in the UK, CHECK is the way to go for pentesting, while in the US I think OSCP is the go to

[broken idol]

Is it also DFIR an area you want to work in?

[modest geode]

Europe. Might be different elsewhere, right.

[fickle merlin]

I think TryHackMe is fun but chaotic. I need something more... like a "book".
I am from Poland, living in Belgium. Consider Australia

[modest geode]

In Poland OSCP is big, that much I can tell you. If you buy the course+voucher you get a PDF with training. But in reality I don't think there's a straight path you can follow anywhere. It's always going to be chaotic in this field, you're constantly going to encounter things you don't know, so you have to learn those first, then go back to the main thing and apply them, later catch up on forgotten knowledge etc. THM is probably as organized as it can be.

With the learning paths

[fickle merlin]

Good to know

😅

And... If it difficuly to get that much for the start? Any advices?

Ill try but we will see

[modest geode]

Anybody with enough time can do it. None of the topics are very complicated, it's just a lot of stuff. Some people do it in 2 months, others need a year.

[fickle merlin]

I mean... I know that I can learn everything. But I think (maybe I am wrong thou) that good cert makes things a little easier

[dense dagger]

Do you have IT experience?

or are you in the workforce, currently studying, etc.

[fringe spade]

I can confirm that in Europe/Poland OSCP is big

It’s funny how the market changed, a few years ago OSCP was as more of a mid-level cert, and now it seems as it’s a minimal requirement for entry level positions

[modest geode]

At the same time I see loads of people putting "Top 4% THM" in their linkedin bio or that they are "pre security" certified. Which takes about a week of dedicated effort. What a mismatch of expectations...

[fringe spade]

I guess it’s mainly caused by a ton of articles stating unimaginable salaries for entry level cyber jobs + bootcamp/course advertisements everywhere

Even universities started monetising this trend

[modest geode]

Yep

[fickle merlin]

I am IT technician by school, but no work experience. :/
I am learning CyberSec because I found it really fun to learn and I want to try myself in that workspace 🙂

[silent raft]

Can anyone help me with the answer to this question . I’ve input the answer but keep saying incorrinf

What do you need to access a web application?

[modest geode]

a browser

Although that's not even 100% correct, you could also curl. But probably the answer.

[fickle merlin]

So... to entry lvl I for real do need OSCP? 😱

[modest geode]

You don't need it but depending on the local market it might significantly increase your chances of getting invited for an interview. Most people don't have it, requires a lot of effort, makes you stand out.

[dense dagger]

OSCP is mostly for penetration testing which is seldom an entry-level role.

[modest geode]

If 100 people apply and 10 have OSCP, they're likely the top candidates to get an interview, all other things being equal. You could be number 11. Companies have to heavily filter the boatloads of applications they get in the first stage. This is one way.

[broken idol]

Going forward, please use #room-help

[warm hinge]

I want to do penetration testing. I’m going to school for cyber security to get a degree. I can get the A+, Net+, and Sec+. Is this a good start with someone with no experience in IT. I’ve only started my career 3 months ago

I’m doing tryhackme. Learning python