cyber-and-careers

[flat sedge]

Indeed, zip recruiter, etc. Or, a a third-party recruiting firm you can talk to. Direct messaging on LinkedIn has not been a good way I've found roles in the past; although I have heard from people who were able to get jobs that way.

[static topaz]

What do we think here about setting up a self-website? I see a lot of tech people doing that

[opaque karma]

I have no luck in those things 😕

[trail nacelle]

Can anyone tell me if one can get job as DevOps engineer remotely being a fresher

Also what is the pathway to learn skills that are used to play CTF like king of the hills

[static topaz]

Learn the tools, then learn the process of using them

Like learn hydra and JTR and then watch someone doing a CTF where they use them, youtube youtube youtube

[trail nacelle]

These two willbe enough

To get started

[mossy bone]

Just post a bit about stuff you do, I get recruiters in my inbox quite regularly, and my linkedin is all but optimized for it

little things, projects, stuff you saw - just not the usual "People of the world, hear what I have to say!"

you'll get the attention of a network rather sooner than later

[surreal barn]

Are you guys having a hard time finding remote work?

[shut trout]

Hi Guys, I wanted to get a beginner level role in cyber starting with IT to get practical experience with the fundamentals of networks and operating systems. I saw these guided projects on Coursera on TCPdump, Wireshark, etc to build a portfolio of experience. But the catch is that those are expensive ones. Can anyone recommend me a cheaper but effective way to do this?

[mystic drum]

you need to get real work experience in IT to get in cyber. I would recommend studying for A+ or Network+ and applying for sys admin/HD position

after you start making a living, spend your money on cyber projects and go into cyber position after 1-2 years in

[static topaz]

any work at all lol

[opaque karma]

If I get experience in a cybersecurity office for 3-6 months will it help my resume to actually get a job or is anything less than a year not good?

Like a fellowship/internship type of thing

Or masters with placement

Which one will help my chances more?

[radiant jay]

My experience in looking for a job with CompTIA cybersecurity+ cert in hand. WITHOUT having A+, Networking+ and at least a bachelor's degree in actual computer science.... YOU WILL NOT BE CONSIDERED. Mind you, I started this pathway with strong encouragement from a friend who is an actual Network Engineer working in the top levels of the field. It simply does not matter what you have in hand as no company is hiring without the extra criteria. I have been applying NONSTOP and have received ZERO call backs. This is beginning to look like a rip off and you may as well just go to college and start from there

[tall frigate]

thanks for your transparency and sharing your experience.

[serene umbra]

Gave +1 Rep to @radiant jay (current: #2553 - 1)

[radiant jay]

I received my cert end of Feb 2024...

[tall frigate]

Sec+ cert?

[radiant jay]

Yes

[cinder orbit]

same, and I have the A+, Net+,Sec+. tracking several job listings that keep getting reposted but at lower and lower pay ranges. Hr is pushing market value down

[tall frigate]

I read that before starting my bachelors in Cyber. Idk if you've looked into it but, WGU offers a pretty good Cyber program.

[radiant jay]

This is not a good sign for anyone trying to change carreer paths

[mystic drum]

I agree on the most part of what you said, but college is rudimentary imo

[radiant jay]

It is absolutely and yet no company is hiring outside of it

My experience at least

And that is with insider knowledge too

[tall frigate]

From my experience in university, the beginning is very rudimentary. I'm a little over 50% completed with program. After Net+ I'm beginning to really get into core Cyber concepts. Learning about how to do things like using tools, learning attacks, learning how to encrypt files. If you have a lot of time on your hands and can commit to a lot of studying, WGU is competency based, so if you understand the concepts you can take your test whenever ready, saving you time and money.

[cinder orbit]

i have a BSc and comptia trifecta

[radiant jay]

What would say is the barrier to your career?

[tall frigate]

How long you been applying?

[cinder orbit]

9 months

[cinder orbit]

ATS?

[radiant jay]

You listed all you have and still say you are applying for jobs but haven't gotten any. My question is what do you think is holding it up?

[cinder orbit]

Applicant Tracking System is my answer, because i'm left unsure

[radiant jay]

That's why i was trying to clarify with your opinion versus the metrics

[cinder orbit]

well, the reposting jobs at lower salary ranges is an observation i've made from tracking job listings and what stats i get from applicant totals(depending on the job board)

[tall frigate]

I've consistently read from numerous people that landing a job in the field is really competitive. There are so many factors behind why a hiring manager chooses the candidates they do, it's tough. Continue building and I think you will strike opportunity eventually.

[radiant jay]

Strange, I observed higher qualification barriers to lower paying jobs in the field. Higher demands yet lower wages

[cinder orbit]

as well as insider knowledge from a friend that works in another industry, but for HR and thats what they do to find salary ranges. when the applicant pool drops below a certain threshold, thats when they start iterviewing

[cinder orbit]

there is also that, 18yr experience for slightlly above minimum wages

[radiant jay]

It is indeed tough but for an entry level position it is basically cutthroat

[cinder orbit]

or a gishgallop of technology proficiencies that sometimes require being a part of the actual dev team to have that experience

[radiant jay]

Agreed....

[cinder orbit]

i mean, that is basic statistics, just hoping its before retirement

[charred surge]

Are you uk or USA

[tall frigate]

Wish I could be of more help. Sounds like you've done a lot already. Hopefully things work out for the best. Goodbye.

[radiant jay]

I respect the tryhackme community but all this really is a promise of a dream, but it's carried out to you on a wet paper towel. Without ample pre-field experience, a tenured resume that is written perfection, demonstrating that you sacrificed your life for your career, and literally a person inside pulling strings for you..... It's not going to happen.

[radiant jay]

US if you were asking me

[charred surge]

Im in the uk. The advise I've been given is grab a help desk role whilst going for certs, build some experience at the same time

[radiant jay]

Funny that was mine too.

And a year later after applying to all types.... Nada

[charred surge]

May be different in the US, but the jobs markets here seems we don't need a degree for entry level

[radiant jay]

In the USA they will lie to your face and say you don't but then disqualify you because you don't have a degree

[charred surge]

Then you stay entry level for abit gain experience get your certs then get into Cyber Security properly

[radiant jay]

All entry level postings have almost a journeyman level of skills and experience you need to bring

Indeed, Linkdin, all garbage lies of entry level stuff

[charred surge]

I've also been told to just apply for everything, apparently alot list alot of stuff but would take less just to weed out those that try to wing there way in

[cinder orbit]

[entry level position!]: please hold a CISSP

[radiant jay]

THANK YOU

[serene umbra]

Gave +1 Rep to @cinder orbit (current: #431 - 13)

[fierce acorn]

CISSP, CEH, CISM, CISA, GCFA, GCFE, GCNA, GCIH, OSCP for $18/hour lmao

[radiant jay]

Exactly. This game is officially rigged

[charred surge]

Don't they all require years of experience on the job?

[cinder orbit]

yes

[radiant jay]

Trust and believe I have done so. I would probably make better money and hours as a car salesman

[radiant jay]

That's the kicker, ENTRY level is just that, entry level, zero experiencce

[charred surge]

You gotta think money long term, making a career change generally means a pay cut initially

[radiant jay]

I would graciously accept the cut...if it was available

[charred surge]

Yea I'm happy to accept a year or 2 on less for a career on substantially more

[radiant jay]

That's exactly my point as well. I am very happy to take the step down in pay so long as it actually leads to an actual career in the field.. It's just after everything I have found, come up against, networked over.... All I can say is good luck to you all, who are struggling to find work in this field

[flat sedge]

Internships in the US are expected to be part time, or 3-6 months. If it's a full time job, make a move to a new role within a year is somewhat of a warning sign. Not necessarily bad, but you could expect an interviewer to ask questions about it.

I'll throw my $0.02 into the hat on experience and getting into cybersecurity - multiple employers I've worked for have hired based on attitude and perceived ability to learn, not experience and knowledge.
Having a lot of great qualifications doesn't do anything to get the job offer if the candidate's attitude doesn't align with what the hiring managers want in that role.
Skills can be taught, but attitude cannot.

[cinder orbit]

I agree, how does one measure this without an interview though?

[flat sedge]

Not speaking for everyone, but I've found the language used in the resume or CV to hint at the candidate's mindset. If the resume doesn't speak to the recruiter for the role, you'll never get past that filter without an 'in'. Entry level for security also is not the same thing as entry level for IT; it's best to treat security as an entirely different type of job, with the expectation that the candidate needs more background and knowledge than something like entry level help or support desk.

[cinder orbit]

what kinds of things on a resume speaks this language specifically? projects, certs.. i mean, resumes are pretty limited in actually voicing anything. do you mean in the cover letter?

[flat sedge]

How the candidate chooses to format things, and the way that items are presented speaks to what the candidate thinks is important and how much time is spent optimizing the resume for this role. If I get a boilerplate resume that has everything and kitchen sink on it, it usually goes into the bin while the tailored resume does not.

[opaque karma]

I have a degree but no certificates

[radiant jay]

You're further ahead than a lot just starting

[radiant jay]

Like the resume written to perfection as previously mentioned. You can simply use one word or another and it won't matter. The person reading the resume is what makes the decision and it's biased at best, arbitrary at worse

[mystic drum]

I think AI is filtering resumes nowadays

[flat sedge]

That's not what I'm talking about.

AI is no better at filtering resumes than the typical regex, to be honest. In a lot of ways, it's worse. Having the right keywords that the recruiter can filter on is the most important step to having a human look at it.

[radiant jay]

And yet that is precisely what I meant in my previous statement

[opaque karma]

I don't think attitude counts because I present myself as someone willing to learn but I have no experience so I never even get to the interview stage

[radiant jay]

Exactly

[mystic drum]

I'm sorry, but everyone is claiming to be "passionate learners" now and it doesn't separate you from anybody else

[flat sedge]

First steps are getting through the filter - once you get through that, recruiter makes a decision to get a basic interview to see if you've been honest with the resume. If you make it through that, there is typically at least 1 more interview for technical and possibly another one for personality/team fit.

[opaque karma]

Exactly so you agree

[radiant jay]

👍

[flat sedge]

Strongly recommend working for at least a year in a related IT domain before making the jump to security, assuming you don't have other background (such as an AS or BS in related area of study).

[mystic drum]

100% agree with that

[mystic drum]

not really, it's more how you say it, not what

[opaque karma]

So having a cybersecurity internship isn't gonna help me at all?

[flat sedge]

Having a home lab that you do some interesting things in can be used as a substitute for experience, but 90% of the time, security is looking for attitude and having a lab where you've done proof of concept for enterprise stuff is HUGELY beneficial to the team

an internship is usually reserved for students

it will definitely help you, if you have an internship

[radiant jay]

This is eactly what I am saying. They say everything that the surface level tells you otherwise

Intership: good!

Except its not

[mystic drum]

obviously, having internship is better to have none at all

[opaque karma]

I don't say I'm passionate learner per se I show it with my projects maybe I'll say something like that in like a cover letter but I'm showing more than saying

[flat sedge]

I'm also aware there are differences between internships in the US and europe, and I assume the rest of the world. In the US, internships are reserved for students and recent graduates, usually if you didn't graduate the previous semester or if you aren't currently enrolled, you won't quality for a US internship

[radiant jay]

And no algorythm will pass that along, like I've been saying

[radiant jay]

Are you USA based?

[flat sedge]

It's totally fine to have a Personal Learning or Continuing Education section that you include your homelab and other projects in

[mystic drum]

@flat sedge you mentioned the key words in resume; are you just reading job post and extracting those? or something else

[opaque karma]

Internships are for students, I'm thinking of doing a masters

[mystic drum]

I would hold on that

[radiant jay]

Good luck with that! Hope you succeed

[flat sedge]

You can often have keywords in your CE section that will help you escape the filter trap, assuming you can speak reasonably well about how that applies. Such as, "I set up a home lab environment that included a basic devops pipeline" or "homelab had a AD/DC that I hosted a local domain on and had different types of workstations and servers join"

[flat sedge]

Last time I wrote a job req, i gave the recruiter a list of keywords and synonymns to look for

[flat sedge]

if you are are enrolled in a MS in compsci or security, you would qualify for that internship

[radiant jay]

And theh answer to you being USA based ...is?

[opaque karma]

Nothing is clear in this industry is it

[cinder orbit]

US i assume, as they spoke of knowlege of the US intership program and not europe

[radiant jay]

I don't assume

[mystic drum]

how do I know what words to use for my bullet points based on job req?

[coral crow]

Hello, im just curious how long have you been into cybersecurity?

[flat sedge]

job req has tasks in it; what do you know that checks those boxes? it's OK to not have 100% coverage or to substitute equivalencies

[radiant jay]

By the mere avoidance of the question, it seems like they are not US based and so are merely speaking on things they don't really know of here.

[flat sedge]

I don't answer questions that are obvious in context

[radiant jay]

So just purposely obtuse

[opaque karma]

Depends how you see it I've been studying it since 2021 but I never gotten a job in it yet

[radiant jay]

No we know why the career fields are affected so

Seems like a gatekeeper of sorts

[mystic drum]

thank you for that; almost all of the employers include softskills in their requirement section. Should those be outlined in the resume or they are tested during the interview?

[serene umbra]

Gave +1 Rep to @flat sedge (current: #11 - 794)

[opaque karma]

The problem with matching words to the description is that they say to give out hundreds of applications but If you tailor your CV everytime and customise your cover letter everytime it would take like an hour to apply to just one job and then nothing happens anyway

[radiant jay]

Making all thhese keywords pretty damn arbitrary

[coral crow]

Thanks for the response, im really new into it but I think I have the correct roadmap to follow, have you achieve important achivements like certifications or projects besides your studies?

[serene umbra]

Gave +1 Rep to @opaque karma (current: #2553 - 1)

[flat sedge]

QA and security have some things in common..... Everything is contextual. In a lot of ways, an infosec or cybersec team needs to be able to have a broad and contextual understanding, and be able to explain why two identical findings in different contexts result in very different triage and handling

[opaque karma]

I've been doing tryhackme and now I'm studying for sec+

[mystic drum]

that's actually a great start; I did the same thing

[coral crow]

got it thanks 🙂

[opaque karma]

Since graduation

[flat sedge]

So I get that you are getting frustrated by the employment processes you've been through and I sympathize with that. But if I read your resume and it doesn't tell me how you're qualified for the role you are applying for, you are definitely not getting a call

I've also had read and interviewed candidates that had service industry and restaurant work on the resume. Because the candidates were able to relate tasking in those jobs to security concepts and familiarity with some of the security tasks on the job req

[coral crow]

Juun you seem very knowledgeable. are you a reclutier?

[opaque karma]

I don't know how to write a CV some people tell me it's perfectly fine some people say it's not optimised

[flat sedge]

It's not a hard and fast rule, but tailoring the resume increases the chance you'll get called back

Several of us here regularly review resumes and CVs, feel free to redact and post screenshots here and if anyone is around, they will likely take a look and give you feedback

[radiant jay]

Person does not answer questions so obvious in context

[coral crow]

I dont like to assume thinks

things*

[flat sedge]

Not a recruiter, team leader and now a security manager. I have been a sys admin, developer, security engineer, software quality engineer for devops-ish.

[radiant jay]

Well they're an @$$hole and a liar

Thanks for making it more obvious

[cinder orbit]

that makes perfect sense, but i think what (atleast) i am talking about. is having all the listed necesary experience, and often more, and still no calls. so, the search can seem rigged. and having round-a-bout answers to the questions isn't really helpful

[opaque karma]

If its bad, Is there someone who can put my experience into words for me, maybe for a fee? I'm not very good at writing these sorts of things

[flat sedge]

I totally get that. I wish I could give definite 'you should do X' but so much of job roles and resumes is contextual. Having a job req you are applying for and a sample resume to go over can be really helpful.

[flat sedge]

No, that's fine. People do it all the time.

[opaque karma]

Oh I can't upload photos

[flat sedge]

You'll need to verify your THM account to post photos

[crude sphinx]

Discord: How do I verify my TryHackMe account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

Jan 3, 2025, 11:04 PM

[flat sedge]

I wouldn't put the THM stuff in Experience

I would also separate the things you got compensated for in a different section than Projects

formatting is ok, but very MS word standard. Don't add certifications unless you actually ahve them, or you anticipate actually having the cert by the time you expect to start work (generally less than 30 days)

Office, Adobe, AXIOM aren't skills, those are products. If you want to show competency with a product, be sure it's listed in the tasking for the role you used it in

Skills are also an area that is kind of polarizing - I personally don't care one way or the other, but a Skills section should be things you are good at and not a list of things you are good with, if that distinction makes sense

[merry axle]

@flat sedge can I get the Pentest+ rank 🤔 please

[flat sedge]

You mean role? Sure, link me to your comptia page to validate. You can DM it.

[merry axle]

Appreciate it

[flat sedge]

It's also kind of sus to have a skill in something listed but no project or job tasking that uses it

[opaque karma]

Uni?

And everyone knows how to use office

[flat sedge]

If it's a thing everyone knows how to use, you don't have value in listing it to be honest

Put things that are differentiators down

[cinder orbit]

unless you are being filtered by it

[flat sedge]

If an IT role is filtering on MS Office, you are better off not working for that company

just my hot take

[cinder orbit]

https://tenor.com/view/jobies-funny-itsalwayssunnyinphiladelphia-bitter-unemployed-gif-4766778

[flat sedge]

I would expect that if you list Ubuntu as a skill, you have some part of your resume that describes the tasking you did in ubuntu that demonstrates that competency

[opaque karma]

That's real

[charred surge]

So good quality labs can be a good substitute for the work experience, paired with the right attitude, tailored cvs and I guess some certs won't hurt to prove your knowledge a little further

[flat sedge]

that's a good takeaway. But be careful about what you call Work Experience; there are a few exceptions, but the hard and fast rule is that if you were not compensated for a job, it wasn't work history

[opaque karma]

How do you fit all your university projects into one cv I thought it should be concise?

[flat sedge]

So here's an unpleasant truth about certs: they are not a demonstration of competency, they are a checkbox on the business requirements side of things.

[cinder orbit]

whats your take on freelance/contract how do you incorporate this into a resume

[charred surge]

Yea so I'm thinking get some good quality labs/projects done and evidenced well. Should help me stand out and hopefully negate for lack of in job experience

[flat sedge]

It should be as long as it takes to communicate what you did. For the first job, you don't have much. I expect a page, maybe a little more if there's a lot. Like if you were an overachiever like @undone shore or @quick forum .

[flat sedge]

If you can document your lab on a git forge, that's a cool thing to see as well.

[opaque karma]

I'm so bad at documenting my work, I always think I need to do something massive to be able tosay something

[flat sedge]

It's work experience, but I wouldn't include every freelance contract. Relevant contracts only. "full history available on request"

[cinder orbit]

in this case then, dates are not an important factor?

[charred surge]

Exactly, so I could be up front and honest and say I have no in job experience but general experience through labs/projects, maybe link them to a portfolio to see it.

To me that would show the attitude to the industry and continous learning/development.

Hopefully an employer could see if I can do it well in labs etc on my own back, then it all needs is a few tweaks to whatever systems they use

[flat sedge]

They are still important, because technology moves quickly and being a sysadmin 6 years ago is several kernel versions back. Things have changed, and you need to show how your knowledge is up to date and relevant. Some thigns are timeless (database design) and some are not (initv vs systemd), depending on what you used then.

[flat sedge]

I would not call it experience; that sets the wrong tone from the start. "Personal Projects" "Continuing Education" etc would be my preference instead of calling a home lab "Experience"

Alright, I need to go run a couple of errands. Local gamestore has my order in, so I need to go make a pickup and get dinner.

[charred surge]

Good point, and do you think if I had enough, good quality ones I'd stand a chance to negate work experience

No worries, thanks for answering

[cinder orbit]

thanks for the perspectives Juun

[serene umbra]

Gave +1 Rep to @flat sedge (current: #11 - 795)

[flat sedge]

"Negate work experience"? That doesn't make sense. You can replace work experience, in a limited way, with projects. But your expertise in projects that you weren't paid for will never fully replace work experience in that subject

[charred surge]

I think I'm trying to say like make up for lack of the work experience I guess 🤣

You'd hope they'd see the value in projects you do in your own time. I'd imagine people put out some pretty solid stuff from home projects

[flat sedge]

It can fill the gap, a bit. But you will never learn a thing as robustly as actual work you were paid for compared to a personal learning project

[charred surge]

That sounds like a challenge 😜

[sterile trench]

Hey guys, I am looking for advice to get a career in cybersecurity. I'd appreciate if you guys have some advice. 🙏

I am a second year college student, and a few months ago decided that a career in cybersecurity would suit me the best

I have since then started preparing myself for the field, exploring. And found THM, which has been an incredible asset in my learning journey.

But now I am looking to get an internship, not only as a college requirement, but to actually get real world experience.

But the thing is, it's really hard to find one, as most postings are for full time jobs only. I'd appreciate it if you guys could help me out to where I can get internships.

[tall frigate]

the fact you wrote $0.02 instead of two cents says a lot about you.. I'm just not sure what

[undone shore]

Other side of the pond but I would agree with that one (for pentesting at least)

[fierce acorn]

where are you located? in the U.S., you can use Handshake to find internships

[sterile trench]

Not in the U.S., no. I am in India.

[fierce acorn]

then speak with your professors, university counselors, mentors, industry professionals, or friends in India

[sterile trench]

Already doing that. But no tangible results, unfortunately. That's why I reached out over here.

[shut trout]

Thank you for the tip, I have set this year as a target to prepare for a job in IT so that I can start 2026 with a change in career. I read that people recommend getting the A+ before Network+, and I also saw a resource by Professor Messer for A+ preparation. Could you give me any more suggestions on the exam and preparation?

[serene umbra]

Gave +1 Rep to @mystic drum (current: #872 - 5)

[sterile trench]

Appreciate the advice, nonetheless.

[turbid herald]

Hey so I wanna go into cybersecurity. In high school I missed the security+ by 6 questions I wanna try doing it again with more preparation this time but should I also go to college and get a degree or should I just go straight into working? Like what would be the benefit of doing the years in college over just working, I am worried because project 2025 is being put in place and I don't want to be overrun by college debt because I didn't have the gpa to qualify for scholarships in HS.

[rugged delta]

You'll have to decide for yourself whether going to college is beneficial for you. I understand that it is ridiculously expensive. You do deserve an education, but while a degree in computer science might benefit you in getting a job and an increased salary, you can still get a job by being passionate about cybersecurity and doing things like certifications, CTFs, participating in communities, going to events, maintaining a blog, doing writeups, generating and maintaining an interest in the field.

I would suggest reading the Trive of Hackers books to see the kinds of things you need to pursue to benefit you most

[lusty cobalt]

hi can i get a opinion about CEH ver13

[static topaz]

Theres a lot of people who have gotten jobs without degrees, if you have the initiative, and frankly if youre still in highschool so you have a ton of freedom and time, you can individually work on certifications and skills to move into I.T and then security

Years in i.t support or sysadmin are gonna do miles more towards security than a line on a resume saying you went to X superfluous college

[grave spruce]

I agree with this. Extensive experience in IT, including roles as a system administrator and being in the armed forces, has been invaluable in ways a course or certification alone cannot provide. It not only offers theoretical knowledge but also shapes the right mindset and attitude.

[mystic drum]

Depends on how you like to study - books, videos, etc. there is no wrong or right answer as long as you studying lol. I’ve been studying on THM. If you struggle with a topic, you can dive deeper using ChatGPT or YouTube

[languid rover]

I was curious to know what current professionals think of this BAS my community college offers: https://rrcc.smartcatalogiq.com/en/current/catalog/academic-programs-and-areas-of-study/computer-science-program/computer-science-degrees/secure-software-development-bas-degree/

I'm wrestling with doing something like this, or just going for the CS degree

[fierce acorn]

frankly, most employers will check if you have a degree with an appropriate title, not so much the classes you take

no one has the time to audit and check every course you have taken in a degree program, nor do they have the time to audit and check the learning material to know the curriculum taught in the classroom

[fierce acorn]

just don’t

CEH is good only in India, and you wouldn’t want to associate yourself with the EC-Council regardless

[rain harness]

Hey guys, I am looking for advice on how to get a career in cybersecurity. I would really appreciate it if you gave me some suggestions. I completed a cybersecurity course and interned as a technical support in a company. But now I am looking for a starting career in Cybersecurity. I have tried many ways to get a job. It's been almost five months, and I'm continuously looking for a job. All were needed experienced people with two years or more. If you can please give me some suggestions to get a job. it will be more helpful for my starting career.

[fierce acorn]

get a certification like the Security+, consider a degree program (if you can afford it, but I assume you already have a degree by virtue of an internship), create projects such as a home lab, build connections and network with others, upskill, etc.

[old fossil]

It's a cliché advice, but I'm always suggesting to start looking for sysadmin roles at companies who have a working SOC and pivot from there. Another viable route could be to join an older shop with on-prem infra which let's you build a SIEM/SOAR for them in your free time. I've done this and it was great - Wazuh, OpenVAS, TheHive, MISP. It will look great in your resume.

[neon nest]

Hi, I am a graduate student with no professional experience in cybersecurity, but I am a Tryhackme user. Can anyone give me an idea of leveraging my Tryhackme participation as experience on my resume?

[broken idol]

THM should only factor in to hobbles really.

[languid rover]

I'm really more worried about whether or not this curriculum appears to be garbage. The idea of minimizing non-related classes is attractive, but I don't want to was years taking classes that aren't going to teach me anything useful

[fierce acorn]

what I meant is that the degree requirements for most jobs are mostly like an HR checkbox, in which they check and verify (1) if you have a degree and (2) if you majored in something directly or similarly related to the job role

employers don't have the time and effort to go through every class and verify if the class taught you the required skills for the job, which is why they give you technical assessments (such as LeetCode problems) and interviews

as far as your question of "whether or not this curriculum appears to be garbage," that is mainly on you to research about the program and ask others about it; through a quick skim of the curriculum, it looks like a good program, but any university can make their program sound like the best program in the nation

[stoic field]

the degree is the first important goal as @fierce acorn said you can grow up your skills there is a lot of open source information in the Internet . for example if you have BCs CS cert the HR know that you have the main concepts about the computer and then they will just test you in other things that need practicing like problem solving & Design Pattern & algorithm .... this is in the programming career and it's the same with any other technical majors

specific in technical majors the cert as it important it's also not important in the same time it depend of ur skills too

[daring veldt]

Hey guys. Do you think the need for cybersecurity professionals will decline with the advent of genAI ? What will the future look like for us when generative AI becomes very strong.

[median flame]

Hi everyone, my name is V, and I’m a 23-year-old computer science student passionate about cybersecurity. I have my CompTIA Security+ certification and am currently studying for a networking cert. I need to find a job to support myself, ideally starting with help desk or entry-level IT roles.

I’d love some advice on:

Which affordable courses or free resources to take.
What labs I should focus on (I love hands-on learning!).
Any tips to build my skills or make my resume stand out for entry-level jobs.
I’d also appreciate guidance on getting into roles like help desk or other beginner IT positions. Thank you so much in advance for your help and suggestions! 😊

[golden imp]

Hi, it may be just my opinion, but i think, after the initial hype slows down a bit, that genAI will give some new fields to work on, i.e. the AI is also something that could be attacked and needs to be secured

[golden imp]

https://tryhackme.com/r/resources/blog/free_path

[median flame]

Thank you, @golden imp! I really appreciate it!

[serene umbra]

Gave +1 Rep to @golden imp (current: #2556 - 1)

[golden imp]

you're welcome

[daring veldt]

True. But in that case, which aspect of cybersecurity should one focus on today?

[golden imp]

it's hard to predict the future even with a crystal ball. but i'd say, that all cyber topics might still be relevant. one might also watch into genAI, i.e. how they work, where are their errors, how are people misusing them and how can i protect a company against that

[outer prairie]

Did any used Whiterabbitneo?

[old fossil]

LOL, AVG is blocking app.whiterabbitneo.com as it is allegedly a phishing URL 😄
I was about to give it a try.

[outer prairie]

Really phishing?

[lusty cobalt]

Thanks but i'm in Myanmar(burma) and i want to have some cert as well for me i want physical class to have connection with, the CEH ver 13 has physical class (and i have limit online resources due to our country situation )

[serene umbra]

Gave +1 Rep to @fierce acorn (current: #339 - 17)

[lusty cobalt]

if not what should i get or do
i'm currently still learning cyber security by myself
i have diploma in IT from TMC academy (i'have been a jr odoo dev for a while)

[winter umbra]

Should i start with learning path: Pre security or The ultimate guide for begginers

[keen tundra]

Yes , why not 🙂 ? It's a great place to start your journey 🙂

[humble cosmos]

try to look into some of the fundamental certs you've been reading about A+, Network+, Security+, etc. while you still look for a job. I would recommend still looking for Technical support gigs....mainly in IT...help desk support, desktop support, etc. as this will help you pivot into Cybersecurity as well.

Don't get discouraged of what experience requirement these roles ask for. I'd recommend to still apply for them either way.

A book that helped me fight to get into Cybersecurity was the Tribe of Hackers (the 1st one). If you can, get a hold of that book as I'm hopeful it will encourage you and give you a better insight as what to do next.

And lasty, keep networking. Go to local meet ups if there are any, keep talking to people online, in forums and get involved with your LinkedIn profile. This will help you get exposed and sometimes that's another avenue for landing a gig in Cybersecurity.

[harsh bolt]

I did the free Certified in Cybersecurity by Isc2.. it was pretty basic, but the way they worded questions ticked me off. lol

[mystic drum]

that's a good start

[cobalt escarp]

Why not help here so everyone else can benefit from the advice? 😄

If you have the certs, I would be happy to add them to your account so users know your advice is the real deal.
I don't see you in the OffSec community 🤔

[fierce acorn]

you just have to transfer him 0.001 BTC before he helps 😂

[cobalt escarp]

I know who you are 😆 No need to lie to me

[mystic drum]

https://tenor.com/view/fishy-gif-18064542

by looking at his profile pic, you would need to play a game before you ern your cert

[wispy talon]

Anyone online here work for epic, ubisoft, riot, etc? Looking for advice on the most beneficial overall resume points that would make me stand out for these employers. TIA!

[stoic cave]

Prior professional experience is probably going to be the biggest factor, given that they (the companies) are seen as "popular." I would also go in with the understanding that the job will likely grind you into paste.

[wispy talon]

Thanks for the input!
I have been a mobile home installer for over 10 years, so i cant imagine it can be much worse lol. But i def understand what you mean. "Its a privilege" kinda thing.

And i think you might be right. Im trying to find a career i enjoy, and also make a decent living. im certainly willing to put the work in to climb the ladder, but i dont want to be anywhere that i cant even get on the ladder to climb.

[serene umbra]

Gave +1 Rep to @stoic cave (current: #19 - 488)

[mystic drum]

Unlikely you will land a job there with no prior experience. You can look at common requirements for sec positions in gaming industry and find something relevant that you can land on; then after couple of years of experience, go there

[rancid sage]

Hello All

I am looking to forge a career in cybersecurity and I am looking for all methods to obtain stair step training that will lead to a 250k salary in 254 months as well as recruiters, recruitment firms, and organizations that provide direct hire opportunities for cybersecurity engineers any direction is greatly appreciated.

*I am looking to forge a career in cybersecurity and I am looking for all methods to obtain stair step training that will lead to a 250k salary in 24 months as well as recruiters, recruitment firms, and organizations that provide direct hire opportunities for cybersecurity engineers any direction is greatly appreciated.

[stoic cave]

?

[rancid sage]

yes did you google what is your question

[cinder orbit]

I also would like 250k salary in 2 years please, thank you in advance

[stoic cave]

It's 11 years and some change

254 months

I see their second message says something different

[cinder orbit]

i'll accept 1.5 years no less

[stoic cave]

I am confused by your messages. Are you asking for a job? Check out #jobs-board. Are you asking for career advice? I am going to assume English isn't your native language, not an issue, sentence structure is just a little confusing.

[rancid sage]

Maybe a bad discord question, nevertheless thanks for the reply and job board link. Have a great evening.

[storm geyser]

Is a Security+ worth pursuing as an undergrad student trying to secure an internship?

[stoic cave]

Just apply to the internships, you don't need certifications for internships.

You also don't need to do internships in Cyber, they should still be in the computer industry, if you want to work in Cyber. So don't limit yourself when searching.

[storm geyser]

That helps a lot because I've seen plenty of software engineering that I've kind of veered from for the sake of focusing on IT/cyber

[steel ivy]

Yes. I did it last year, and it's a good, "Foot-in-the-door" kinda cert. Amazing for internships, but requires other cert pairings and projects, for full-time jobs.

I may also need help in knowing where to go from the Security +. I want to secure contracts or even a full-time job. I don't know if I should go for SOC Analysis, or Pentesting.

[meager bear]

hey guys , anybody here who is interested in becoming a cuberSec engineer?

[stone cove]

Good morning guys

From Nigeria

[clear flicker]

Probably some, why?

[meager bear]

i wanna become one

[merry venture]

Hey everyone, I'm looking for the first role as a SOC analyst. Do you know of a remote job for this role? without experience

[rugged delta]

You can find roles like this on LinkedIn and other job sites, as well as the #jobs-board channel occasionally. You might need to demonstrate your abilities and skills with various tools and technologies, as well as an understanding of cybersecurity, IT and networking in-depth. Prior IT/cybersecurity experience, a degree and/or relevant certifications can be a requirement and would certainly help demonstrate your abilities

[merry venture]

Yes, I'm looking every day on LinkedIn for new opportunities but there are not so many in Israel at the moment, so I started looking beyond the sea

[exotic dirge]

If you are looking for remote opportunities you can expand the location to be out of israel

[rugged delta]

Not necessarily true. For security roles, there is generally a requirement to be positioned in the country where the role is available, due to security/regulatory restrictions. An organisation might have an office in a country providing international services but they would have resources and a legal mandate to do so

[exotic dirge]

ohhh

[undone shore]

You, uh, know they're free, right?

[icy pollen]

can anyone recomend a good way to get a pentesting apprentaship in the uk or start the career with out needing to got to uni as i not the biggest fan of school but doing my a-levels now

perferably physical

[undone shore]

Physical pentesting is not common. It can be part of a job role, but it's unlikely to be the entire role.
I don't think I've ever seen an apprenticeship for pentesting either, granted. Remember: cyber security is not an entry level sector in IT, and pentesting is not an entry level job role in cyber. That doesn't mean that uni is necessarily the way to go, although a degree does go some distance towards bridging the gap.

The closest I've seen in the UK are apprenticeships which rotate through various job roles in cyber -- generally alongside a degree.

I suspect you'd have more luck trying for a software dev / sysadmin apprenticeship then aiming to migrate from there.

[icy pollen]

aright thanks

[icy pollen]

Dumb question but do you think they will take THM as a reconised coruse or should i start doing other things aswell

[indigo coral]

anyone hiring devsecops consultants? The company i was consulting to just announced their closure 😦

or devops, am flexible..

[keen tundra]

Try to take a look at https://discord.com/channels/521382216299839518/775144008853749770 🙂

[stoic cave]

Depends on the organization.

[stoic cave]

Depends on the role.

[edgy coral]

Heard people here are mostly coming from I.T. fields, wanted to make my way over and say hello 😄

I'm in hardware service and slowly heading towards network administration

[undone rune]

Currently 19yrs in IT professionally. Not counting the time spent in my teen years taking advantage of AOL and other ISPs on dialup in the 90's during my teen years.

[keen tundra]

Well , I have a CCNA cert. which is kind of network related 😄

[edgy coral]

I'm heading towards that certification myself! How tough was it for you? My employment also wants me to get a cert of that value

[keen tundra]

It was fairly easy imo 🙂

[edgy coral]

With how much networking knowledge prior?

And did you take the exam online or in person?

[keen tundra]

Well I had some but nothing special , I learned some new things on my CCNA journey . I took exam online 😄 .

[edgy coral]

Lovely to read, gives me hopes for myself 🙂

[keen tundra]

It's a foundational cert. at the end of the day, it shouldn't be hard 😄

[edgy coral]

Oh I see, thought it was more of an advanced one. I've been scared to set it in motion for a while haha 😅

[keen tundra]

Well people are overexaggerating CCNA online , it's maybe harder than other foundational certs. but nothing special 🙂

[edgy coral]

How much time did you spend studying? And what resources did you use?

[keen tundra]

I used official guide , took me around 3 weeks to prepare . People are also recommending course from JeremyITLabs , you have it for free on YT 🙂

[edgy coral]

I shall make it a goal of mine to get the CCNA before summer then 🙏

[viral oak]

Haking please

[keen tundra]

Good luck on your journey , feel free to reach out if you need any help 🙂

[edgy coral]

I love the support you give, you also have a friend here! Reach out to me for anything 🙏

[edgy coral]

Love the initiative!!

Let's hack friend

[keen tundra]

Thank you 😄 .

[serene umbra]

Gave +1 Rep to @edgy coral (current: #579 - 9)

[undone rune]

Current job role: Sr. IT Systems and Network Administrator - but also handle 90% all things security related here.

[tall frigate]

Does your organization hire Junior Sys Admins? As someone with their A+ & Net+ (about to have Sec+) I'm curious what kind of tools/processes someone in a junior role would use. Things like AD? Thanks in advance.

[serene umbra]

Gave +1 Rep to @undone rune (current: #874 - 5)

[tall frigate]

Anyone with knowledge on my question above feel free to share. I'm planning to apply for entry level/junior roles after I earn my Sec+.

[keen tundra]

Check out https://discord.com/channels/521382216299839518/775144008853749770 😄

[tall frigate]

thanks

[serene umbra]

Gave +1 Rep to @keen tundra (current: #5 - 1841)

[flat sedge]

The CCNA content is intended to be entry level. If you know enough to go through a home wifi router and ensure DHCP is turned on, you are prepared enough for to learn the material, IMO.

[edgy coral]

Oh wow, yeah I configure routers for businesses so I suppose it's time 😅

[tropic cedar]

CCNA? 👀

I am here for that too.

[tropic cedar]

That's noice.

[cinder orbit]

oh wow, i didn't realize that. and cisco has free training for it avail on netacad

[undone rune]

No they don't. It's just a small construction company. I oversee 35 work stations - 1 physical server with 3 Hyper-Vs, 8 saws and tables all connected via PLC at 2 different plant locations here in Florida. 12 Printers and 3 large format printers.

[indigo coral]

PLC-connected saws? 😄

[tepid radish]

Hello everybody guys, i passed the EJPT exam 😄 i would like to know where to find my first job as junior pen tester, do you have any country/company reccomendation? any tips would be great ty really much

[undone rune]

Yup... Here in the main office it's all Truss (roof and floor) designers and an engineer... Out at the plant locations we have multiple PLC Saws and tables for cutting the wood, laying out the cuts to put the connection plates on and rollers.

[wide mica]

How much was that test ?

[stoic cave]

You're going to want at your countries preferred jobs board to see what they're requiring. Do you have anything else besides the EJPT, such as a degree or prior professional experience in the computer industry?

[stoic cave]

Costs adjusted for location are available on the EJPT website

[wide mica]

Thanks , chatgpt ses 249$

Was just looking for a roundabout

[stoic cave]

Sounds unethical and potentially illegal...

[fierce acorn]

I hate this new generation of people who use a potentially (and often) incorrect GPT/LLM than actually spending the 10-30 seconds to Google the correct answer

[normal zinc]

nostalgia ... i could just hear the famous dialup tone which most of them would have never heard in recent days 🙂

[tepid radish]

No, i just have the EJPT, no technologies background

[tepid radish]

I paid 249$, but now should be in promotion at 200$

[daring veldt]

What do you guys think. Picking up cybersecurity as a career or as a hobby?

[golden imp]

Pick one and it could also lead to the other

Do it for career and you think it's so much fun you'll also do it for hobby. Do it for Hobby and then think why not earn some money that way too

[keen tundra]

Both 🙂

[lilac jacinth]

Hi everyone hope all is well, currently a service desk analyst trying to get into cyber security. Doing the level 1 soc training course and I’m really enjoying it. learning more blue team stuff. If any one had any pointers for me to study on it’ll be much appreciated:)

[remote viper]

Just got an interview to a pentesting company. I'm applying for Jr-ish position. I've been given 3-4 days to pentest a web app and write a report. Any tips n tricks or should I just do everything the same way I've been doing in all web app ctfs?

For context I have no prior job experience. I am graduating as BSc. this spring and been doing quite a few ctfs lately

[tall frigate]

Congratulations! This sounds like an awesome opportunity. I hope all works out well. I don't have specific advice to give except for use GPT as a tool to help you pentest/write that report. Best regards!

[undone rune]

Right!?

[undone rune]

Now to find some of those roles as remote work.

[broken idol]

@agile igloo Hello, I'ev recently pinged you, and you've ignored me, please DM or ping me when you're here.

[proper girder]

hey hackers, i am not sure if this is the correct thread to post in , but i was wondering if anyone would like to help me with finding experience opportunities. I just finished my CCNA and i am looking for a job/internship to start collecting IRL experience.

[broken idol]

You should consult local jobs board.

LinkedIn

And TryHackMe's job board on LinkedIn

[proper girder]

I have a LinkedIn account that i do read on a daily basis and i will be checking out the THM job board. My main concern is what job title should i be looking for that will give me a good opportunity to learn about networking while actually having no field experience.

[keen tundra]

Congrats on getting CCNA 😄 . You can check out job-board here https://discord.com/channels/521382216299839518/775144008853749770 🙂

[static topaz]

Anything other than CCNA?

[smoky oak]

Hello I need guys I need help. Have you guys completed J.Penetration Course ? I was studying and came to walking through application part and could figure out how to change password . Could you guys help me?

[tired wyvern]

Hello all,
I'm currently taking the tryhackme cyber security 101 and google cyber security courses and have gained significant knowledge thus far. I'm currently in the restaurant industry and would like to find something in the I.T. field(remote jobs) now as I continue to further my cybersecurity knowledge, or would it be best to continue working in the resturant until I gain a certifications? Thanks in advance

[edgy coral]

You could gain valuable experience for your CV through I.T. helpdesk jobs, that's where I started! Spent some time in telecommunications helpdesks as the foundation of my career. Do work on certifications in the meantime! Best of luck

[undone rune]

In addition to what @edgy coral mentioned, you could also see about getting a job at a local computer repair shop that also does managed services or handles jobs for the local governments and businesses in your area. That is how I started out for professional experience back in 2006 vs my previous hobbyist experience.

[edgy coral]

True that, this was my second step and where I'm currently at as I'm growing my qualifications. Our firm takes jobs for the government's projects occasionally and it's a great addition to your experience

And that's also the point where you'll ACTUALLY learn things.

[undone rune]

SO TRUE! That's where I learned more about digital forensics and data recovery tactics.

[edgy coral]

Bless my coworkers for teaching me their secrets hahaha. Before being hired I had no idea about routers and their management, now I set up vlans and firewalls for businesses. Do you use data recovery software on Linux or Windows?

[undone rune]

Both really, depends upon a few factors. Main factor was how much the customer was willing to pay. Some wanted to know if it could be done and would pay just the diagnostic charge of $165 USD - so we'd use OnTrack DR software for that. If that didn't work out, then I'd use a linux based tactic and if it panned out we would charge them just for the recovery media and give them their data. If it didn't work out and needed to possibly go out for DR to a 3rd party then we'd let them know. (This was all 2006-2014 pricing) Thankfully no longer doing that work for that company, hated telling people bad news as to why we couldn't recover Fluffies pictures

[edgy coral]

Hahahaha I get you, thankfully data recovery is a tiny part of our service shop, but we do get the occasional bad news. I once recovered data from a corrupted drive for an old couple that does shows on the radio, got myself a shoutout on-air 😂

[undone rune]

Awesome! My favorites were when someone would come in for DR or even a virus removal. Then comes along the husband asking if we could make the information disappear (before we would even start processes). Only to find out some shady crap going on... either cheating or pedophilia crap. We always did 3 fold backups of machines when they'd come in for DR or Virus removals because you never knew what you'd find. The 1st Backup done was always a forensic image with writeblock enabled, then tossed in our safe under lock and key. Then the other two backups were incase something didn't go as planned and had a restart point. However once something like child p**n came up or any other crime fitting the bill, work would stop immediately and law enforcement would be called. Then they'd have us continue the work, do chain of custody and they'd come up with a reason why to "initiate traffic stop" or something off of our property.

[edgy coral]

That's crazy, I've not been employed long at my place but I don't think we ever had freak stuff like this. We do get the occasional pink videos from computers, big deal or whatever, but we never had that... I don't know how I'd deal with such findings mentally

Was it a frequent occurrence for you?

[undone rune]

Happened twice as for PC drop offs... But at the time we did all the digital forensics for the Local PDs and the County Sheriff's Department there. Until they started getting their own IT staff that could do the work

Most of what we got when they'd come in from the LEO's would be usually just investigation for stolen money from an employer or spousal abuse that was documented but the spouse attempting to destroy the PCs and such.

[edgy coral]

Yeah you guys got a lot more serious work than we do.. ours is just businesses or family computers not turning on or being too old to function

This year we got tons of outside work for some European/Government projects going on which isn't the most pleasant but my god if I had to deal with such illegal content I'd pick ladder climbing and rack placement any time of the week

[undone rune]

Lol. I actually (to an extent) enjoyed the illegal content side of it. Until it involved kids, that is where it was a gray area for me. Mainly because of the whole "cannot pass judgement" and go on a "vigilante" kind of thing.

Now I enjoy a not so quiet life as a Sr. IT Systems and Network Administrator of a roof/floor truss construction company. Handling all things including but not limited to cybersec and even basic web design for the company web page

[edgy coral]

That's amazing. I want to live life in your field one day 🙂

[undone rune]

I don't even want to live my life here. Lol, rather be on the pentesting side of things... Speaking of cybersec, gotta enroll some new employees into knowbe4

[edgy coral]

Hahaha we can trade 😂 jokes I wouldn't last a day

Knowbe4? You aren't the person on the subreddit who posted some job listings for tennese and such right?

[undone rune]

Nope

I enrolled everyone in this company here (the administrative, clerical and truss designers) into KnowBe4 phishing training because back in 2021 (before I came on board) the company was nailed with ransomware.

Come to find out they were using all the same username/password on all computers including the SERVER! And the previous admin was keeping the backups plugged into the server instead of removing them after the backup jobs completed. So even the backups got nailed

Even recently used the Phishing topic from the AOC2024 task in a short video showing them all what happens on the backend and how it happens. Been slowly working on a lab setup at home using a Dell Server and 4 HyperV's simulating our work environment to show just what could happen if that ever happens again

[edgy coral]

How hard is it for them to absorb that information in your personal experience?

[undone rune]

And yet I still find time to go fishing, play video games, go hunting or spend time with the GF... lol

[edgy coral]

That's the spirit.. 8 hours a day of work?

[undone rune]

Bingo!

[edgy coral]

With my 8 hours I barely have enough time for gym and 1 hour of cybersec learning

[undone rune]

And honestly its harder for those that do not grasp the technology side of things. I only have a couple of them though and they're not afraid to ask me questions

OR those that are afraid of change.

For those users, (as well as the others) I try to keep it short, interesting and relevant. Which is harder for me because it's a lot of information to convey at times.

[edgy coral]

So, would you say that you don't really enjoy what you do at the end of the day? Or are you just chasing an opportunity better suited for you?

[undone rune]

At the end of the day... on the Admin side of things.. No I don't... On the Cybersec side, yes I do.
A lot of my day here is spent twiddling thumbs, going through THM/HTB or other resources until someone pages my desk phone with an issue.

I personally thrive in a high stress environment like a SOC or a Major Incident Coordination center. I find a certain peace and calmness, can focus and work. Much like Hurricanes, I find a certain peace and calmness within them and within myself during them (I live in Florida)

[edgy coral]

Ahhhh that explains it, I found your secret

You're a Florida man!

[undone rune]

Lol... Born and Raised native

[edgy coral]

So how often would you get paged during the day? 5-6 times?

[undone rune]

I WISH! on avg... Maybe 5-6 times a week! I'd say maybe 2xs a day unless we rolled out an update to the Alpine Software. Like we did in December, then it's a crap shoot

[edgy coral]

Hahahaha so you practically get paid to be on THM and HTB 😂

[undone rune]

Yup

[edgy coral]

jesus that's 1 incident per a day+ 😱 I think that means you're doing well at your job!

[undone rune]

Yup, and you factor in there are probably 35 workstations (thats counting my 5 remote employees as well). 15 Printers (3 large format printers), multiple Saws and tables connected to computers, 3 locations (2 plant locations and the office here), 1 Server running 3 Hyper V's.

The rest of the employees are laborers so they don't really touch the computers other than the ones on that are used for the saws and tables and those are on isolated networks.

[edgy coral]

that's a lot of potential vulnerabilities that you've thought of 😎 Did you study cybersecurity?

And by study I mean took a dedicated path straight out of school

[undone rune]

Nope... I actually started as a hobbyist. Building and repairing computers back in the 90's (my teen years) and poking around things that I shouldn't have been on the old AOL Dialup days. It grew from there, constantly learning and toying around where one shouldn't (according to the status norm).

[edgy coral]

Hahaha so essentially you didn't learn ethically (despite not actually having malicious intent)

[undone rune]

90% of what I know I learned on my own or from on the job. I just took my certification exams to get certs back in 2017 because it became increasingly hard to find work and prove it all.

[undone rune]

EXACTLY

[edgy coral]

Any certs that you'd say gave you an edge?

Sorry for the interview style questions, I suppose you understand your knowledge is invaluable 😅

[undone rune]

Oddly enough, my CompTIA trifecta and the CySA+. My CEH is basically just a dust collector... Lol

[edgy coral]

Ugh I'm so not looking forward to getting the CompTIA trifecta 😭

[undone rune]

The trifecta as long as you grasps the concepts was fairly easy.

[edgy coral]

What about CYSA+?

[undone rune]

I don't know with the current exams in place, but I know when I took the Net+ and the Sec+, the Sec+ was easier for me than the Net+

[edgy coral]

I actually hear that a lot. Net+ has a lot of focus on materials used for networking

[undone rune]

CySA+ was a cake walk compared to CEH

[edgy coral]

whaaat!

[undone rune]

Yea. But I'm going to say what helped me prep for it was the Pentest+ room on THM and DionTraining Cysa+ training videos.

CEH was mostly laws/regulations and a few outputs asking what the tool was used. Very little to do with pentesting, the CEH practical I've not done. Only because I'm going to by pass it completely and go after OSCP

[edgy coral]

Hahaha I suppose it really puts the "E" in "CEH"

[undone rune]

It's supposed to, however they themselves weren't (probably still aren't) all that ethical. There's been some plagarism and sexists things that have happened with them.

28mins and log out for the work day!

[fierce acorn]

CompTIA exams are ironically the easier exams compared to the vendor-specific or specialized exams

[undone rune]

So true, however those vendor-specific ones will test you on their tools and usage a lot more than CompTIA will. Yet, the CompTIA Pentest+ is supposed to be more difficult than the CEH. Not sure though, as I took the beta version of the latest and didn't pass it... Missed it by 5 points

[edgy coral]

Those 28 minutes rarely ever pass quick 😭

15 mins left though

[undone rune]

So true! But this helps as well as the occasional text from the GF while she’s stuck working in the hospital helps too. lol

[edgy coral]

Ahh, sounds exhausting what she goes through :/

Is she a nurse?

[undone rune]

She’s a respiratory therapist

[lucid fern]

does this look good so far for the isc2 section? this for my resume i already had the rest of my resume looked at

PLEASE PING ME (this channel moves fast)

the blacked out parts i got help with too but i m just asking aout hte certification

Edit yes its called isc2 certified in cybersecurity certification

[orchid raft]

Hey. I hear a lot about certs but nothing about the clearance you need also. Do you need a security clearance to work in cybersecurity?

[keen sapphire]

unless you're doing any government work, no you do not need security clearance to work in cybersecurity

[orchid raft]

Isn’t most of the work government… I mean I live in Washington DC…

[iron whale]

The vast majority of cybersecurity work is done for private entities, and does not require an official """security clearance""", though those private entities might have their own version of it.

[orchid raft]

All the jobs on indeed need clearance it looks like

[keen sapphire]

what are your search terms?

[orchid raft]

Cybersecurity

[iron whale]

Well yeah the first option on the list requires a TC/SCI clearance because it's government work

Specifically national security

[keen sapphire]

is there a specialization you're looking to do? because cybersecurity is a pretty broad term. Also being in the DMV area, it's a lot of government jobs in that area. If you search somewhere else like New York or San Francisco, you'll likely see less government jobs that require clearance

[iron whale]

There's also a T-Mobile position that only asks for a GCIH cert

It all depends on where/what you're looking for.

[orchid raft]

I need to look in the private sector then

[iron whale]

Yeah any public sector stuff is gonna need clearances for the most part.

Which is entirely possible to get if you can find a sponsor, it's just tedious and time consuming

[orchid raft]

I’m just need in anywhere really public private it don’t matter

What about a degree? How come nobody wants a degree?

Certs certs certs…..I got certs up the wazhaaamm

[iron whale]

The cyber security industry is... Weird.

Some people value degrees, some certs, some just proven ability, some want tons of experience regardless of any of those things, some want all of it

And sometimes you just get lucky

[keen sapphire]

there's no real degree path in cybersecurity, because the landscape is changing so much. As long as you have the knowledge of how systems work, networks interacting, or how applications work, you can find a job.

In my experience a lot of the certifications also have different tiers of recognition of your abilities too.

Idk if I can post links here, but here's a pretty comprehensive list of certifications you can get https://pauljerimy.com/security-certification-roadmap/

with a tiering system of how each certificate reflects your experience level

[fierce acorn]

you live in the center of the federal government, so obviously you will see a lot of jobs requiring a security clearance

you get a clearance through employer sponsorship if you enter the federal workforce as a civilian

[fierce acorn]

it isn’t that nobody wants a degree, but it’s just that some have differing views on the value of a degree

and you don’t need to spam certifications for no reason either

[stoic cave]

Where you are, yes.

If you're interested in Government work, you need a degree

[faint abyss]

Guys this might sound strange to ask but this youtuber got his account supposedly "hacked" since he cant log in. He emailed youtube and this is what he got

oops i cant upload pictures here

[stoic cave]

You need to verify, but I'm not sure that would go in this channel anyway

[faint abyss]

is it fine if i can post the email that he got in any way?

[stoic cave]

Just to clarify wording, I would probably change federal, in federal workforce, to public/public sector if you're referring to both contractors and federal civilians. Federal civilians are those directly hired by insert agency and receive a paycheck from the United States Government, which is typically what is meant when someone says federal workforce.

It's a small, somewhat annoying, difference

[stoic cave]

I'm not sure what you're trying to do tbh, we don't really do drama here. This is the careers channel

[faint abyss]

my mistake then where can i ask my question?

[warm hinge]

a degree is not a government job requirement. some positions it is not flexible on, however, there are a lot of personnel with no degree working federal jobs.

[stoic cave]

I don't know what you're trying to ask?

[faint abyss]

a youtuber that im friends with (he has a channel about "Learning Arabic") somehow he cant log into his account, he emailed youtube and he got an email back by saying we dont have enough proof that your the actual guy (I can send the whole email that he got if thats fine). My question is (because im trying to help him) how can he get his account back ? Do you guys have any knowledge with this specific situation

[stoic cave]

If you're talking about the government as a whole, sure, there are positions that do not require a degree. If you're talking about any sort of systems engineering, cyber engineering, cybersecurity, etc etc I can almost guarantee that it's required. The caveat there is that DOD 8140 is changing things a little in the defense sector, so you'll start seeing requirements change over time. Wouldn't expect anything drastic though.

[warm hinge]

this isn't a tech support channel...sounds like he will have to take it up with Google/YouTube

[stoic cave]

That's automated and they need to provide enough information to recover the account.

Which means remembering their password

Other than that, contact Google support.

[warm hinge]

I'm don't mean to nitpick, but I spent over a decade as a 2210 in multiple gov agencies, to include DoD. I made it as high as the GS-14 level with no degree of any kind.

You are correct, DoD 8140 is their directive for establishing qualifications with regard to their cyber workforce. Outside of the defense world, with the exception of the IC, if you are applying for your first federal civilian role (cyber or not) you can leverage a degree or you can use experience. And if you have no basic experience, well, you can plan on landing yourself a role in a SOC, if you're lucky, doing tierI support. Most likely you will have to begin in a help desk support function if you're that green.

anywho...government cyber jobs and federal contracting roles are very competitive. And if you have no clearance to begin, it's tough for many to get sponsorship (especially in the DMV area) where there is a lot of cleared talent.

[stoic cave]

I don't mind and don't think it's a knitpick, it's just that the landscape has evolved/is evolving, even moreso over the last 4½ years I've been in the space. I literally couldn't bring people on because they didn't have a degree. I also understand that that workforce code is a bit of a catch-all, so it doesn't really give me an idea of what you were actually doing . I will say, to make it to 14, without a degree, is rare now from my annecdotal perspective.

[warm hinge]

true! 2210 is the black hole of government technology roles. I held a few...INFOSEC, APPSYS, ENTARCH.

for sure on that last part...I may have been an exception to the rule. I do know at that level, and being a supervisor, I didn't want to go any higher lol

[stoic cave]

Lol, yeah, you basically have to have the incumbent leave/retire/pass to get to 15. I don't even want to know how to get to SES

[granite fractal]

Hello!!

[proper girder]

thank you very much!

[serene umbra]

Gave +1 Rep to @keen tundra (current: #4 - 1880)

[proper girder]

comp tia security+

[keen tundra]

Hello , welcome 🙂

[granite fractal]

Hi guys! It's my first day using try hack me and I'm excited! I think I can learn a lot of things here!

[humble cosmos]

yea you will!

[granite fractal]

I have a lot of free time, and all the time! Today I sat for over 8 hours!

[humble cosmos]

living the dream

[static topaz]

Job market is rough, apply local

Thats plenty

[keen tundra]

Of course you can 😄 . Feel free to ask something whenever you need help 🙂

[late anchor]

I wanna create a website/blog to document all the stuffs i'm doing, is it okay to have it under my online username or is it better to use my real name

[quick sierra]

Hey guys! I was just wondering if anyone could tell me if I’m wasting my time applying to jobs on LinkedIn and indeed, is there another place or way I should be applying?

[whole frigate]

You can check out company’s career pages too

Linkedn has like stagnated some roles and sometimes easy apply feels like a scam

[quick sierra]

Is there anywhere I could go to see what companies are hiring for specific roles or do I just need to jump around and find out on my own?

[whole frigate]

What i do is wait for news if a company has some open roles, check their feed out on Linkedin and then check out their site to see of they do have open positions

[quick sierra]

Okay I’ll try that out, thank you for responding!!

[serene umbra]

Gave +1 Rep to @whole frigate (current: #2573 - 1)

[whole frigate]

I am not sure if theres a place like that, even i am searching for it

I have many contacts working in Software so i usually ask them if there are open roles in security alone in their team or something that way i know if there are openings or not

[keen tundra]

No , I don't think you're wasting time 🙂 . You can also check https://discord.com/channels/521382216299839518/775144008853749770 channel maybe you can find something interesting there 🙂

[quick sierra]

will do! Thank you!

[serene umbra]

Gave +1 Rep to @keen tundra (current: #4 - 1882)

[short prism]

i neeed job soc analyyst

[proper girder]

what certification carries the most "respect" in the cyber community? also what sector of cyber security would you expect to see the most grown and in demand in the next 5 years?

[tall frigate]

The CISSP is difficult to earn, I’d argue it’s one of the most respected Cyber certs.

[proper girder]

thanks for you response REV!

[serene umbra]

Gave +1 Rep to @tall frigate (current: #1269 - 3)

[tall frigate]

Tis mine honor, sirrah.

[keen tundra]

Maybe OSCP is the most respected but again it depends on the field of cyber security . BTL is respected on blue teaming side . Comptia certs are also common 🙂

[proper girder]

thanks for the response, i will be considering this! what sector would you say is in most demand right now? red teaming or blue teaming? feel free to go in extra detail or PM me

[serene umbra]

Gave +1 Rep to @keen tundra (current: #4 - 1895)

[orchid raft]

Hey. SOCs and NOCs have 24 hour shifts right? I mean cybersecurity is a 24 hour industry?

It’s not just a regular 9-5 right?

[winter umbra]

Guys what course is better for ComptTIA + ? Myke Meyers or Proffesor Messer

[keen tundra]

A lot of people are recommending Messer 🙂

[keen tundra]

I think it's easier to land a blue teaming instead of red teaming job 🙂

[winter umbra]

But I saw that in messer's course he has only 9 hours of content and Myke has like 30 why

[keen tundra]

Why don't you watch both and see which one better suits you 😄 ? I always try to combine a few different sources when learning something 🙂

[proper girder]

awesome to hear!

[orchid raft]

I watched both . And read the book. Mike Myers wrote the book. Messer gives a little more insight into the material

But Mikes book has links to study practicals and software

And Mike has visual aid in his videos also

[lusty fog]

Hey all, I was wondering what the main difference between pentesters and red team was? As I’ve recently learned they aren’t the same thing.

[undone shore]

Yes. They generally work in shifts.

Not a whole lot of point in only monitoring 9-5

[keen tundra]

Red teaming is a broader range term , pentesting is one of the red teaming activities 🙂

[undone shore]

Pentesting looks for vulnerabilities, usually in a specific application or system (including a wider network, etc). A pentest is generally only interested in technical vulnerabilities (even if the impact of those vulnerabilities may be social).

A red team engagement is more about the wider security posture of the organisation. It's taking into account things like social engineering, and generally executes most of (or a complete) killchain. A red team op is generally adversary emulation (i.e., mimicking TTPs used by a specific group)

[undone shore]

That is incorrect

[wheat dawn]

Is course careers worth it? does it give you that extra push? or should we just focus on comptia certs

[undone shore]

If anything a red team engagement is a more specialised form of pentesting, not the other way around.

[undone shore]

Course careers?

[wheat dawn]

https://coursecareers.com/explore/it?campaign=1jl&a=6c6aa2eb

wait, isnt that considered a bootcamp

[undone shore]

Heck if I know. I've never heard of them if that tells you anything 🤷‍♂️

If I saw that on a CV I wouldn't glance twice at it. That said, that doesn't mean it's not more recognised elsewhere

[lusty fog]

Okay so red teamers go through a more intensive process from a wider scope to identify what the threats doing compared to regular pentesting? Sorry i’m kinda new to it all just trying to understand all the career paths.

[wheat dawn]

yeh i was just looking around and stumbled upon it

[undone shore]

Essentially, yes.
A typical pentest is a week or so max. They can be longer, and they can be shorter, but that's a rough ballpark.
A red team exercise can take months. There's usually a full research stage at the start, and the scope is generally significantly wider.
e.g., the org might ask a red team to emulate a current threat which they are particularly concerned about. The red team will then go and develop capabilities to emulate the tactics, techniques, and procedures used by that group. If they're doing initial access testing (doesn't always happen -- sometimes it's an assumed breach scenario), they generally do OSINT / footprinting in preparation for an initial access phase as well.
Then in the actual hands-on portion they execute the kill chain and basically see what happens. It's scenario testing of the organisation as a whole (whereas a pentest focuses on finding all technical vulnerabilities in the scoped system).

[keen tundra]

Oh , my bad then 🙂

[undone shore]

All good 🙂

[lusty fog]

Ahhh okay I see thank you! Sorry if it was a dumb question 😭

[serene umbra]

Gave +1 Rep to @undone shore (current: #10 - 816)

[storm geyser]

Very broad question, but what can I expect from a phone screening for a cyber intern position and how can I prepare?

Should I expect to answer technical questions?

Again, apologies for how broad the question is, I know it varies widely from company to company

[undone shore]

Nah, all good 🙂

[undone shore]

I would expect to answer some simple technical questions, but remember they won't be "out to get you" -- they'll just want to establish who you are, your attitude to the work, and roughly what is your level of technical knowledge.

It will likely be more of a chat than a formal interview for an internship

[storm geyser]

Awesome, thanks for the insight

[serene umbra]

Gave +1 Rep to @undone shore (current: #10 - 817)

[loud marsh]

It is likely going to be introduce yourself. What makes you a good candidate for the role.

You will tell them your experience. They will take note and send it to hiring manager. Recruiter doesn't do technical interview

[undone shore]

Who says this is the recruiter?

[broken idol]

Probably a chat to make sure you're a legitimate applicant.

[mystic drum]

Does anyone have an input on vendor specific certs? I’m debating on Az-500 or CCSP. The main goal for me is to get a broad knowledge and to have an advantage in a resume. I’ve started preparing for AZ-500; however, it seems like they just want you to know how to click buttons in Azure. Thank you!

[limber crown]

anyone here TRYING to learn Python and feeling really overwhelmed? Uggg.... I HATE python! Linux and windows command line I'm going well with by python SUCKS!

[storm geyser]

Sounds good, thanks

[serene umbra]

Gave +1 Rep to @broken idol (current: #1 - 3219)

[whole frigate]

Wait till you start learning java and c💀

[sand mason]

Hi. I got a "chance" to get into a Cyber school. 2 Year school. Vocational school .. Sadly it cost 15k Dollars for 2 years. But its studentloan freindly in Norway. So it wont ruin my economy. . Im enjoying try hack me, but i feel the school is "basic" when it comes to Cybersecurity. The theme and the subjects they go trough. But its probaly easier to get a job with that maybe ?vs Tryhackme "hard" for 2 years + get certifications. Dream job is SOC, but i can also take a entry level IT job to start there

[limber crown]

I don't know that I'll be doing those. Lol

[whole frigate]

What is your end goal for learning python?

[limber crown]

I'm looking to get into digital forensics but when I started just at a general cyber career, many sources said to learn python so I started to try to learn it. But idk that I'll need it for digital forensics?

[orchid raft]

I haven’t met anybody that has a actual job in the field of study. Does anyone on here have a job in cybersecurity?

[stoic cave]

Plenty here do

[fierce acorn]

we’re all grifters pretending to have a job in cybersecurity /s

[sand mason]

Does most people here have education or coming from selflearned?

[snow basalt]

Learn the basics before learning python. There’s a lot to learn outside of python coding. Check out the cyber defense path it’s pretty in depth

[stoic cave]

You're going to need to build professional experience if you dont have any already and are not intending on doing a full 4 year degree. IT Helpdesk is a common starting point and Tier 1 doesn't require anything other than an interest in the space.

[stoic cave]

Digital Forensics is difficult to get into, frankly. Not to discourage you, just to give you a heads up on what's ahead. If you're new and looking for content to learn, take a look at the #pre-security-legacy-path on THM

[warped sparrow]

Hey there! New here and new to cyber-security. I have recently finished the presecurity pathway and on my way to Cybersecurity 101. I have an interview incoming and they would ask questions like this :

User input: filename and keyword (both strings)
It had a Powershell scripts which includes these two parameters.
Then some more code to create a tempDirectory and run powershell.exe from that temp location.
We have to tell if there is any vulnerability and how to exploit it.

and

A user has reported that they have found a vulnerability for an open source project hosted on GitHub. That source code has a storage account (blob storage) endpoint mentioned. The hacker has shared a screenshot of the output of nslookup <FQDN of storage> with us.
In the screenshot, dns name resolution is failing. We have to explain if this is a valid vulnerability.
Which course/section do you guys recommand me to focus on? The job posting is for Security Researcher.
Any help would be greatful. Like what sections/ path or any other resource or any input. Thanks.

[limber crown]

Why is it tough to get into? Any thoughts on what 1 step below that would be? Lol like another goal to aim for but keeping on the same course?

[rain raptor]

hi guys hope y'll are well. please i need a clarification on this: what is the difference btn a soc analyst and a cybersecurity analyst?

[keen tundra]

SOC analyst monitors and responds to incidents in real-time/near real time while cysec analyst is broader range term reponsible for a broader security posture of an orgnaization and risk assessment 🙂

You have a career room on THM which explains positions/job roles in cysec 🙂

[rain raptor]

thank you KGB

[serene umbra]

Gave +1 Rep to @keen tundra (current: #4 - 1919)

[keen tundra]

Here is the room link btw 🙂 , sorry for my late response 😄

https://tryhackme.com/r/room/careersincyber

[rain raptor]

Thank you

[serene umbra]

Gave +1 Rep to @keen tundra (current: #4 - 1920)

[dawn delta]

Someone like me who is going to give CEH , also doing tryhackme labs daily , and trying to do some projects , as a 3rd year what are the important aspects that i need to take care along with the CEH before applying for internships ?

[storm geyser]

If i remember correctly, the mentors told me certs aren't necessary for internships, that the best thing to do is just go ahead and apply, especially if you already have academic experience

I would clarify with them just in case

[dawn delta]

I am currently doing Btech in CS , but just a decent CGPA(7) , i was thinking heavily to do ms in cyber in germany . Am I thinking in the right direction ?

[storm geyser]

That would be a question for the mentors. I'm just a cyber student myself but was lending a hand with your last question. If Did You Google? is online later, they can give you more solid advice

[dawn delta]

I had done quite some googling , first I came with doing Mtech in India , but I didn't saw much hope here , so gave a thought to outside MS , I also took some advice from some experts like Rijul Jenjen , he said ireland , new zealand were some great options cause , here in India we get not enough salary . Well thanks for your time !

[serene umbra]

Gave +1 Rep to @storm geyser (current: #772 - 6)

[storm geyser]

Of course man. Good luck on your journey

[dawn delta]

Thanks man

[small mural]

Hi everyone,
I've a question for the community, today I failed my GPEN exam from 1%... I paid myself with their study programm but while I'm pissed to have spent so much money, I'm wondering if it worth it to do a retake. I've the knowledge, I just poorly managed my time on this one that led to some question that remained unanswered (skipped...). I've already a foot in the cyber world and two other GIAC cert's (GNFA & GCFA) and not really planning to go red teaming/pen testing soon.

Thanks in advance for the advises

[tall frigate]

I'm not qualified to speak on this because you're at a much higher level than I, but from my surface level perspective I think $900 is a lot of money to spend on a retake if you don't plan leveraging that certification. At the same time, I believe you would pass it if you took it again, and GPEN is, from what I'm reading, a prestigious certification to earn. I suppose it comes down to how much do you need that $900?

[fierce acorn]

SANS/GIAC is a prestigious organization known for their world-class training and is considered to be the cream of the crop of InfoSec training, so yeah, it sucks

but as mentioned, it comes down to how much you need that $900; otherwise, you will have to get funding from somewhere else, most notably from your employer

people usually expense SANS/GIAC certs/training through their employer

[small mural]

Will reflect on it... Thanks for the advises!! 🙂

[heavy lantern]

Hi everyone

I need your opinions/suggestions about my progress in cybersecurity. Who may help me?

[keen tundra]

Everybody here want to help you 🙂

[heavy lantern]

In 2023, I graduated as a Telecommunications Engineer. In 2024, I decided to start a new chapter in my life, focusing on specializing in cybersecurity. Below, I’d like to share the achievements I’ve accomplished so far:

1. I started learning Linux and Python at the Hack4u academy. Highly recommended!
2. I participated in my first CTF organized by Cisco Latam, where I also completed the Junior Cybersecurity Analyst Career Path course. I managed to rank in the top 100.
3. I completed and earned the Google Cybersecurity Certificate.
4. I’m currently studying the learning path and premium labs on TryHackMe and LetsDefend, with an active annual subscription. This is my main focus at the moment.
5. In December, I participated in and completed the Advent of Cyber 2024 by TryHackMe.
   My next goals include obtaining the Security+ certification and a certification in AWS or Azure.
   My objective for 2025 is to land my first job in cybersecurity. What do you think about my progress so far? Any suggestions or advice to keep advancing on this path? I look forward to reading your comments!

[tall frigate]

Congratulations by the way, on being like a top 0.1% of the ethical hacking community. Best regards, may thine journey bear good fruit.

[tall frigate]

What do you think about my progress so far? --You're way ahead of me, and I've been doing this a few months longer than you have. Sec+ should be a breeze for you, and I think you can absolutely land a job in Cyber this year. Any suggestions or advice to keep advancing on this path? --You clearly have the right drive to learn so I presume you will continue in the right direction there, begin networking locally if you haven't already, go to local events pertaining to Security, Networks, anything related to roles you want to assume. Work on your resume, and being interacting with individuals in your area that are in the field. Always keep in mind, "how can I add value to this organization?" Practically, you want someone to pay you to help them do something.

[heavy lantern]

Thank you so much for the kind words and encouragement! It means a lot to hear that I'm making good progress. I'll definitely take your advice to heart and focus on networking locally and refining my resume. Your support and suggestions are truly appreciated!

[serene umbra]

Gave +1 Rep to @tall frigate (current: #538 - 10)

[tall frigate]

You're welcome . Coincidentally, I am preparing to take my Sec+ very shortly. If you have further questions, feel free to message me.

[warm hinge]

Does anyone know if the eJPT cert is worth it? My main reason to get it is to prove to myself that i'm learning and that i'm on the right track. Will the cert provide any other value in the experiences of the people here? Any insights would be appreciated.

[fierce acorn]

not really in terms of HR checkboxes (i.e., an HR professional will most likely not know what an eJPT is if it isn’t specifically in the job description)

you can mention it in an interview, and if a hiring manager is aware of it, then it can be a bonus to your candidacy/resume

[warm hinge]

oh thanks for the reply - from what i've read on reddit people say its pretty basic the content, however, again, i just want to use it to demonstrate to myself i'm better than who i was a few months ago as the prices isn't that horrible. I will keep your second point in mind when i'm interviews then!

[serene umbra]

Gave +1 Rep to @fierce acorn (current: #321 - 18)

[fierce acorn]

you can also check out TCM Security’s PJPT, which is more hands-on and requires report writing

iirc, the eJPT has multiple-choice questions, while the PJPT requires actual compromise of the AD Domain Controller and a written report regarding methodology and findings

TCM’s PNPT has some HR clout, but it’s much more vast because it has an external portion to it, and it requires a debrief

[warm hinge]

does the PJPT teach you how to write reports in their path? as i've never really written one before

[fierce acorn]

yeah, it gives you a template, and it shows what to include in the report

other than those two certs (eJPT and PJPT), there aren’t really any “entry-level” pentesting certs I can think of

[warm hinge]

wow, thanks for mentioning about PJPT - im looking at the website right now. Thanks again for your pointers today

[fierce acorn]

just keep in mind that these two certs (and other “entry-level” pentesting certs that I didn’t mention) won’t have a lot of HR value; you will have to move up to the OSCP, GPEN, eCPPT, CRTO, CPTS, etc., for that

and obligatory reminder that pentesting isn’t really entry-level, so it will be a hard road ahead but anyone can do it if you have the correct mindset

[warm hinge]

i will remember this message [edit i have saved the mentioned certs in my notes app]. My current main focus is the A+ exams whilst learning pentesting along side (admittedly the ratio is a bit wonky atm ha!)

[woeful tinsel]

Do we have a pentesting/ethical hacking certification roadmap here on the server? I'm trying to decide which certifications to go for first, like eJPT, PJPT, Security+, or maybe a networking cert, idk. I’m not sure which ones would have the biggest impact without jumping straight into big ones like the OSCP, for example. Also, considering my budget, since I’m still a student

[glossy dock]

Not a roadmap but an outline of certs that are divided into categories of difficulty.

https://www.linkedin.com/posts/mohammad-abubaker-281b14214_cybersecurity-certification-guide-credits-activity-7227123257085165569-ZNNL?utm_source=share&utm_medium=member_ios

[fierce acorn]

that list is interesting lmao

the Security+ and CySA+ are so out of place when compared to the rest in their categories

[undone shore]

Oh please no. That graphic is shite

[fierce acorn]

PNPT as beginner lol

[undone shore]

i.e., rubbish

[fierce acorn]

whoever made that should be in HR

[undone shore]

It's almost as bad as Tux's roadmap from a few years ago, and that was literally made as a meme

[fierce acorn]

I saw this on LinkedIn a few months ago, and I was shocked at the number of likes it received

[undone shore]

OSCP is generally considered entry level, but as Juun likes to say, you probably shouldn't be paying for that yourself.

The "standard" certification chart is here:
https://pauljerimy.com/security-certification-roadmap/
Full disclosure -- this is also arbitrary and makes some interesting decisions, but I've yet to see anything better, or more comprehensive.

[glossy dock]

My bad haha but thanks for the input @undone shore and @fierce acorn

[serene umbra]

Gave +1 Rep to @undone shore (current: #10 - 818)

[undone shore]

All good lmao

[undone shore]

Also, christ alive that Twitter card is out of date.

Make sure to actually click the link rather than using the embed

October 2020. That would do it

[cursive thistle]

Anyone on to ask a couple questions ?

[woeful tinsel]

Thanks, guys! eJPT > Security+ > CEH > OSCP? Is that a valid path? idk, I’m kinda lost when it comes to certifications. For example, I was thinking of getting the eJPT or Security+ while I’m still in college

I’m basing it a bit on the job requirements in my country and the certifications they ask for

[cursive thistle]

Muiri you got a minute?

[regal wyvern]

is coursera good to get certs and get hands on experience for entry level jobs IT

[fierce acorn]

personally, I would recommend Security+ first as a baseline level of knowledge, as it isn’t hands-on and is mostly theoretical

and what is “my country,” if you don’t mind sharing? in the U.S., where I’m from, the Security+ is a requirement or preferred certification here

and, in general, CEH is mostly valuable only in India, but if you’re basing it off where you’re from, then pursue that

also check out TCM Security’s offerings (PJPT/PNPT), Hack The Box’s CPTS, and Zero-Point Security’s CRTO, but again, you have the right idea with following your job market for certifications to obtain

[fierce acorn]

keep in mind that Coursera courses give you a certificate of completion, not a certification, because they don’t have a high-stakes exam associated with them

they mostly won’t give that much resume value in terms of HR checkboxes, but there is good learning value (and you can mention them in an interview if you think that would make a good answer)

so “get certs” is incorrect, but “get hands-on experience” is a possibility

[woeful tinsel]

Oh, I'm from Chile, South America. Here, the cybersecurity industry is something relatively new. Just last year, we updated the old cybersecurity law that had been in place since '93. Right now, there's a shortage of professionals in the field

[fierce acorn]

ah, then I recommend talking to industry professionals there (which I assume you are) to shortcut your way into the industry

and, yes, if you see Security+, CEH, or some other certification in the job market there then ask about it

[regal wyvern]

so whats a good place to study for projects and learning and goof value overall

[woeful tinsel]

Thanks, I go to all the talks, events, and CTF competitions I can. I'm not a professional yet, I'm a student, but I want to prepare as much as I can to land a good job when I graduate. For now, I’m a 'Programmer Analyst,' it’s a technical degree here.

[serene umbra]

Gave +1 Rep to @fierce acorn (current: #312 - 19)

[woeful tinsel]

So, I’ll focus on Security+ first and then eJPT, at least to take them while I continue studying in parallel

[keen tundra]

There's path on THM for those who are interested in Comptia Pentest+ certificate 🙂

[woeful tinsel]

Really? thats awesome

Oh you're right!
https://tryhackme.com/r/path/outline/pentestplus

[fierce acorn]

TryHackMe (you’re here already!), Hack The Box, Udemy, TCM Security Academy, LetsDefend, Splunk training, Microsoft Learn, AWS Skill Builder, etc.

even YouTube has decent video courses and ideas you can find

[keen tundra]

Yeah , there's also a learning path on THM 🙂 . You can check it out on the link below 🙂

https://tryhackme.com/r/hacktivities

[woeful tinsel]

thank you !

[serene umbra]

Gave +1 Rep to @keen tundra (current: #4 - 1940)

[sonic surge]

Hack the box and install splunk for siem testing is a good place to start

[hoary verge]

I want to study for the oscp but I can't afford PWK-200 right now. What are some free resources and stuff I can do online to prepare?

[fierce acorn]

https://tenor.com/view/flightreacts-cringe-gif-19831193

[hoary verge]

thank you!

[rain raptor]

hey guys hp y'll are well. woow thanks so much for this. i was about to ask about this. i aspire to work in cybersecurity as a blue teamer and presently im preparing for my ceh exams then undertake CSA cert. i wanted to ask if it was enough to get an entry level role, seeing this just clarified everything. once again thanks alot guys

[serene umbra]

Gave +1 Rep to @glossy dock (current: #2578 - 1)

[fierce acorn]

please do not follow that roadmap

it's clearly made by a person who is not knowledgeable of the InfoSec certification industry, nor the level of depth of what those certs cover to make a reasonable categorization of the difficulty of each cert

this is a much better visualization of the various certs in the InfoSec industry, but there are some interesting decisions and caveats
https://pauljerimy.com/security-certification-roadmap/

additionally, anything other than the CEH are not valued EC-Council certifications, if you consider EC-Council to be valuable despite their history lmao

[rain raptor]

thanks

[serene umbra]

Gave +1 Rep to @fierce acorn (current: #280 - 22)

[slate pier]

Hi I'm from Chile also 🇨🇱 Happy to help you if you need anything 🙂

[woeful tinsel]

Wow thank you! that would be so helpful! can i DM you? 🇨🇱

[serene umbra]

Gave +1 Rep to @slate pier (current: #466 - 12)

[slate pier]

sure, go ahead

[idle lake]

If I was interested in working with law enforcement (doing blue team work, like Digital Cyber Forensics), should I still do red team exercises? Advent of Cyber was my first introduction fyi

[keen tundra]

Why not 🙂 ? You need to know how the opposite side is thinking 🙂

[lean cypress]

Any ideas on what skills will be beneficial besides programming ? I was thinking AWS............

[idle lake]

Very true haha. Thanks KGB!

[serene umbra]

Gave +1 Rep to @keen tundra (current: #4 - 1958)

[keen tundra]

More knowledge won't harm 🙂 . Never 😄 . Grasp as much as you can 🙂

[gusty cloak]

Hey, I have a question. Can you get your foot in the door in cybersec solely off of THM ? and By "foot in the door" I mean things like internships and the like. If so, how would someone go about that ? Like how do you include it in a resume if you even can include it in a resume.

[broken idol]

If you have a really strong network, it's not impossible but it won't be easy.

[remote laurel]

Which learning path would you guys recommend for someone aiming to become a Sys admin?

[keen tundra]

I don't think THM has a path related solely to sys admin role but you can check out SOC1 and SOC2 paths 🙂

[remote laurel]

Yeah I was just thinking that maybe some of the knowledge will overlap with what sysadmins do

[keen tundra]

Yeah , it will , I would recommend you to also check some networking rooms on THM but be aware that sys admin is definitely not a beginner role 🙂

[storm geyser]

Do you have any advice as to what some beginner friendly roles would be? What should I pursue with a Bachelors?

I found a security engineer role that asks for 4 yrs of experience and although i think it would be a reach I'm thinking about applying for it

[keen tundra]

Well to be honest , I don't feel competent to answer on that question but somebody from the industry will probably reply to you shortly 🙂 . I can only tell you that it may be easier to land a job related to blue team than to red team activities 😄 .

[rain harness]

Hy guys, Is Comptia+Security Certification really helpful for a starting job career in Cyber Security.. Everyday iam applying for many jobs. .. and connecting many people through LinkedIn . Everyone needs experience(minimum 3 years) in specific fields. how can a person get an experience without getting a chance for work??

[tall frigate]

you cant, its impossible. but that doesnt mean that an organization wont hire you. try to showcase your skills by showcasing independent projects/labs you've completed that's relevant to the position you're applying for.

[gusty cloak]

Ah alright thanks mate

[serene umbra]

Gave +1 Rep to @broken idol (current: #1 - 3235)

[gaunt meteor]

Hey Guys i have a interview for this position what will you guys recommend to go over to best prepare for the interview here is the job description

[gaunt wave]

Hello everyone. I don’t know if this the right channel but I need some help.
Three days ago I ve been a scammer victim to a website where I have made some crypto transactions.
The site is still available and I have login access to it with my account.
I known some fundamental hacking but I ask for help if anyone can help me get my money back or at least have access to their system
Thank wall and the channel of course

[keen tundra]

@broken idol

[broken idol]

If you've been scammed, contact the police, revenge hacking is illegal, as per our community rules we don't discuss/help/teach.

[gaunt wave]

Oh sorry I didn’t knew. Thanks for the reply

[serene umbra]

Gave +1 Rep to @broken idol (current: #1 - 3236)

[glossy dock]

TCM Security has a help desk learning path that’s free.

[hidden hare]

Hello there! I recently started upon my path in IT and am aspiring to study IT-Security end of this year. Right now I started a learning plan I laid out myself and would like some feedback: At the moment Im finishing my google IT-Support certificate, afterwards I will do the Comptia A+, before I start in the university I want to finish either CCNA or Security+ so that I can do THM and HTB on the side. What are your opinions? Much thanks for everyone trying to help newbies like me! :)

[remote laurel]

Did you try it?

[keen tundra]

Well CCNA and Sec+ cover different fields , so they aren't exactly comparable , maybe Net+ is an equivalent to CCNA 🙂

[remote laurel]

I have the A+ and I'm gonna do Net+ and then Sec+

[hidden hare]

Of course! But Im still contemplating if building a strong networking foundation would be more worth my time instead of the sec+

[hidden hare]

Nice^^ How long did the A+ take you?

[remote laurel]

Yeah its recommended to do it in the order i wrote

[remote laurel]

Like 3 months but only because I gave up in the middle and then I got motivated again and finished it

[hidden hare]

Alright! Thanks for the feedback :D

[serene umbra]

Gave +1 Rep to @remote laurel (current: #2581 - 1)

[remote laurel]

btw Sec+ is much easier and more fun than both A+ and Net+

[hidden hare]

Did you do it full time while working on it or did you work on the side? I do it atm while doing 8/5 weak

[remote laurel]

Half of the time I had a job and the other half I was at home studying full time

you can DM me for tips

[hidden hare]

I can imagine! haven´t even touched anything comptia related but heard lots of opinions that its quite dry and multiple choice focused

[hidden hare]

thanks for the offer ^^

[keen tundra]

Yes but I think that Sec+ also covers some networking fundamentals 🙂

[tall frigate]

I've recently taken 3 comptia exams, A+ (101 & 102), and Net+. I'm taking Sec+ sometime in the coming weeks. The study material you use will determine the dryness to a large degree. The program im in at university includes CertMaster Learn, which includes PBQ's & labs. So it's not all multiple choice. There's also a fair amount of book reading. The positive thing about CompTIA certs is they're accepted (perhaps a better word is respected) by most organizations.

[tall frigate]

I feel the same way. A+ and Net+ build a solid foundation for Sec+. I feel like most of the topics for Sec+ were review, especially because of how extensive I felt Net+ was (with regards to what I see on Sec+).

[tall frigate]

If you don't mind answering, is your job in tech?

[orchid raft]

I had my second interview and She didn't give me an offer, said she waiting on funding.

Should I send an email asking for a time frame. I need to give my current job 2 weeks to find a replacement and she got me in the dark.

She said Id make a great addition to the team but no offer

I lowered my asking price. The average is 85000 so s he cant say no

[stoic cave]

Not sure what this means, but the company doesn't have to pay you what the industry deems average...

[orchid raft]

i was just saying I asked for less based on what the average pay rate is.

the lowest i seen for entry was $85,000

[stoic cave]

Send a thank you for now, it does take time for an org to put together some sort of package.

[serene umbra]

Gave +1 Rep to @orchid raft (current: #2582 - 1)

[stoic cave]

This is high, even in the US.

[orchid raft]

It seems a little to much for me. I have no experience in the field.

[wise island]

You would get paid this after 3-5 years of cyber experience in the US.

[orchid raft]

So if they ask me whats the lowest id work for what should I say?

Bachlors, and 7 certs, no experience

between 50-60 i think

[wise island]

In all reality, 65k to start is good. The Bachlor's and certs only get you into the door. They don't dictate what you would make paper tiger.

[stoic cave]

You've already put yourself at a disadvantage in the negotiations. You've already reduced your initial ask without prompting. What you need to do is calculate your expenses and come up with an ask that is above that number, but not so ridiculous people don't call back. Not saying your ask was ridiculous, it's not for super high COL locations, but you need to research each market you're applying to. In the future if someone asks for your range, you can ask what their intended range for the role is if they haven't published it.

[flat sedge]

Agree with what has been said. "Entry level" can mean different things depending on the org and what the role actually is - SOC Analyst/Engineer roles are considered entry level, but often require experience in a non-security domain.

I should say, non-security specific. Other IT experience is often the way to get your foot in.

[true ruin]

65 is typically what I would offer someone like you with 0 exp

If you came in with those same stats and a few years of experience I would be offering between 85-120k depending on where you were technically and if you have about 5 years experience or realllllly impressed me at 3 I would offer around 130-150k usd also it would depend on certs. 7 certs is fine, but what those 7 are matters.

[true ruin]

Yea when people ask you that it’s typically a trap if you’re newer on the industry. If you have more experience and more established if someone asks you that it’s because they know you will come in high and want to calculate if they can afford you based on budget.

[true ruin]

For example if I know my range can go up to 65k for an entry level position, and you say you want 30-40k to be happy that’s a steal for me and you shit yourself in the foot

I try not to operate like that personally but plenty of people do

[twin sage]

I'm trying to transition from QA tester to cyber security currently I am studying for my Comptia sysa exam. Any advise ? Thanks 😊

[storm geyser]

65 for 0 experience? I wanna work at your company buddy lol

[stoic cave]

I took that to mean 0 cyber experience. For entry cyber it's not unreasonable, at least on the East Coast in the US.

[stoic cave]

I wouldn't go so far to call it a trap, it's a negotiation. Trap, at least to me, infers? attributes? some level malice to the hiring organization. When in reality both sides are bartering/negotiating to strike a deal.

[warm hinge]

65k US sounds nice, My country gets the equivlant of 50k usd starting for entry cyber jobs, 40k usd for entry IT

[stoic cave]

You have to remember that raw salary is not take home as well. You have county/state/federal taxes, retirement, social security, etc etc

[storm geyser]

Thats wild I need to get on game and start applying lol

[true ruin]

There is definitely negative aspects to it some cases that aren’t malicious per se but walk the line. When I say trap though I mean as in a self imposed trap. You walk yourself into a corner you are trapping yourself more than anything.

[true ruin]

This is correct it was meant to be for 0 cyber experience not 0 work experience in general let alone in tech to some degree

[verbal girder]

I want to be a security Analyst and for that i am doing the tryhackme soc level 1 and level 2
Gonna get CCNA CISSP NET+ and SEC+ certifications.
Also gonna create a project on super Lab in cisco packet tracer.

And i have been taking notes of every step in the soc level 1, i was thinking of creating articles after every big heading in soc level 1 like cyber defence frameworks and cyber threat intelligence etc.

I am also doing a degree in canada from Fraser valley in computer information systems with majors in cyberSec.

Do i need anything else or like i am on the right pathway? Or like is this enough for an entry level job for a security analyst? I just need a bit more guidance.
I am currently in my 4th semester, 4 more semesters to go.

[fierce acorn]

CISSP requires 5 years of documented work experience (4 years if you have a qualifying bachelor’s degree, which you are currently pursuing), and you will most likely need work experience at a help desk or a similar entry-level IT role to be considered for security roles

frankly, TryHackMe is good for learning new tools, but in terms of resume value, it isn’t that valuable considering that TryHackMe rooms can be easily cheated

however, creating blog articles and documenting your learning are good things, and you should keep doing that

[verbal girder]

I see

[late anchor]

is there a time in my career where certifications will no longer be usefull or is it better to always pursure more certitifiactions if I have the resource and time

[verbal girder]

Soo even after i do all this i’ll be only able grab something like a help desk job in the beginning and work my way through it?

[fierce acorn]

yeah, it’s when your years of work experience speaks for itself

however, you should be pursuing intermediate/advanced-level certifications such as SANS/GIAC certifications at that point in your career

and your employer should be expensing them

[fierce acorn]

it’s still possible to obtain an entry-level security role with 0 experience in security, but the help desk > security pathway is the usual pathway for aspiring security analysts

work experience and skills are king in the security industry

[verbal girder]

If you don’t mind answering, like who are you and what are you doing in cyber? Like are you an instructor or working somewhere?
I am new in this server that’s why i am asking

[verbal girder]

I’ll keep that in mind, thank you.

[serene umbra]

Gave +1 Rep to @fierce acorn (current: #272 - 23)

[fierce acorn]

I’m currently a SOC Analyst for a university, and if that hurts my credibility or something, then someone else can chime in and/or concur

[verbal girder]

Oh that’s nice, i just asked it because like i said i wanted to be a SOC Analyst.
Soo you followed same kind of a path or did something different?

[late anchor]

so certifications will be usefull only for the first few years of my career

[fierce acorn]

no, you pursue certifications according to your employer, the technologies you’re using, and/or your level of experience

if your employer says to get X certification and they’ll pay for it, then you get that certification

[verbal girder]

Did you also start your journey from help desk?

[fierce acorn]

yes, and many others have as well

[verbal girder]

How much time did you work at that position?

[fierce acorn]

I’ve worked there for a year

[verbal girder]

I would love to connect with you on LinkedIn if that’s okay?

[sacred remnant]

Hello, quick question the SOC simulator for premium members (the one module), is it something that can be added as project on the CV?

[keen tundra]

I think that you need to be a business user for SOC simulator 🙂

[sacred remnant]

The first module premium members can do it 🙂

Phishing Unfolding

[keen tundra]

Oh my bad then , sorry 🙂

[sacred remnant]

No worries haha, I was wondering if that can be classified as project if someone can enlighten me on that. Since it's a simulation of SOC for Phishing (Hard), 1-2 hrs

[broken idol]

No, as you didn't create it.

[sacred remnant]

Got you, thank you.

[wraith vault]

How did you add those certifications to your discord profile?

[brittle pier]

Contact a mod or admin

[wraith vault]

Gotcha thanks

[serene umbra]

Gave +1 Rep to @brittle pier (current: #64 - 133)

[sick briar]

anyone here working as pentester ?

[whole frigate]

But it can be added as extracurricular or something ig?

[broken idol]

Not really.

[whole frigate]

Hmm

[broken idol]

THM should only come under as a hobby.

Since there is no way to prove you done the work.

[whole frigate]

Yes could be this too

[whole frigate]

Makes sense tbh

I listed most of my thm paths under extras on my resume but it does show the recruiter some effort put by the candidate in learning

[wide mica]

i get what scrubz is saying-nowadays anyone can finish the pathing by cheating so its not a valid way to validify your knowledge

also the amount of material absorbed is dependent on the student so not everyones retention will be =

but surely the knowledge gained can help you get creds that do validify your knowledgge/skills

[lavish wren]

I've seen this statement "anyone can just cheat their way through THM" a few times now, recently. Do you just mean that someone could give you the flags? Or is there a problem with cheating on the site of late?

[merry axle]

There’s many write ups online where you can grab the answers

[lavish wren]

Ah

[fierce acorn]

there are a lot of Medium blog posts of writeups

which is fine, but that obviously invalidates anyone who attempts to use THM as proof of learning

[pearl scaffold]

should i include THM in my resume (student resume for college-specific scholarships?) I wont include rank or anything, but just as a proof that I am a motivated learner and take time out of my day to learn?

[keen tundra]

Why not 🙂 . I don't think it can harm in any way 😄

[fierce acorn]

just put it somewhere that isn't education or experience, as anyone can cheat the rooms

[pearl scaffold]

Alright, I thought it would look good to include

[fierce acorn]

but I do know that some companies love to see THM

[pearl scaffold]

Hobbies(?)

[fierce acorn]

ReliaQuest, an MDR company based in Tampa, specifically asks if you use any training platforms

CrowdStrike asks you too in internship interviews (source: I've interviewed for them)

[pearl scaffold]

this is for a university in Tampa wouldnt you know it

😁

Thank you

[fierce acorn]

USF?

[pearl scaffold]

yeah

[fierce acorn]

nice

yeah, for college-level applications for scholarships/internships, it's fine to put THM

you will be better than 90% of the applicants right off the bat for actually doing stuff outside the classroom lmao

[pearl scaffold]

Should I also include any classes I took as part of dual enrollment which may tie in as well?

I took some office classes and programming as well

[fierce acorn]

sure, if you need to fill in the whitespace and it relates to whatever scholarship you're applying for

I haven't heard of needing a resume for scholarships though

[pearl scaffold]

its weird, all of the scholarships ask for it and then theres a followup essay or question

[fierce acorn]

essays are to be expected

[pearl scaffold]

yeah, resume caught me off guard though

[lean tundra]

Need suggestions from you people
Is it worth doing CCNA or Red Hat system administration certification, if one has an aim to pursue his career in the blue teaming side?
Are these certifications worth spending money and what's their industry recognition specifically in context of blue teaming or network security?

[keen tundra]

CCNA is more network than security related although it covers some network security fundamentals 🙂

[fierce acorn]

those certifications are for network administration and system administration respectively, but the CCNA is a given for a career in networking (or, at least, the start to a career in networking)

[lean tundra]

Do they have a worth in the blue teaming side that's my main concern?

[keen tundra]

Not really , maybe try to go with BTL1 if you're interested in blue teaming 🙂

[fierce acorn]

I would say so in terms of networking foundations, but I also feel as if saying that is a misunderstanding of the purpose of the CCNA

the CCNA is a certification meant for associate-level networking administration

whether that plays a role in a career in network security depends on your job responsibilities (i.e., if you put on the network admin + network security hats in your role)

I think the better answer is that there are much more suited certifications for "blue teaming," such as the CySA+, BTL1/2, INE certifications, TCM Security's PSAA, SANS/GIAC cyber defense and/or incident response/threat hunting certifications, Splunk, etc. (and each of these certifications have wildly different skill levels and resume value)

"blue teaming" is a vague term; it would be best if you find out what interests you in the cyber defense side of security then certify from there

[lean tundra]

I agree 💯 to your points.
But the scenario is such that all other certifications are much more expensive than CCNA, with institute CCNA will only cost I guess something $125.
Now what to do based on such circumstances 🤔?

[fierce acorn]

then look at job postings and pursue those skills, certifications, and other qualifications

99.99% of the time, the answer to "what certification should I pursue" is either "what your employer says or pays you to do" or "whatever your local job market says"

[cobalt reef]

any security engineers or people who deal with recruiting in here which can give me some feedback on resume?

i had a recruiter basically tell me previous experience wasn't specialized for security engineering or an analyst position, so I'd be lacking in experience but trying to workout what level i should be aiming for and and if it is an issue with experience/best way to get around it

[lean tundra]

Alright understood.
Thanks for your advice 😊

[serene umbra]

Gave +1 Rep to @fierce acorn (current: #266 - 24)

[pearl scaffold]

Resume complete, even I am impressed with myself

especially better since there are no soft skills that I have put down

[flat sedge]

I would take that a step further, and say that unless it's standard in a job market that a job specifically requires a cert you don't have, don't pay for it yourself. Certs are business requirements, and the business should pay.

As an employee and team member, the value to your career for paying for certs is minimal.

[tall frigate]

Anyone know how much having A+ Net+ and Sec+ will help my chances of landing a t1 help desk job?

I have a bit of IT customer service experience as well

[rugged delta]

It's a good indication that you know a little bit and are willing to expand your learning. Apply to any jobs you think yourself able for

[tall frigate]

Thanks.

[serene umbra]

Gave +1 Rep to @rugged delta (current: #21 - 447)

[tall frigate]

I mean I’d rather be in a SOC1 or similar cyber position i just feel unqualified given how much I realize I don’t know. The Sec+ resource im using to learn is great(certmaster), and I feel competent to pass the exam, but not that I’m proficient enough to succeed as a SOC without a lot of OTJ experience/training. In a way feel like I need to go help desk first to get more acquainted with system management/privileges/etc.

[radiant lodge]

Believe in yourself : you'll get accustomed fast. At least you're honest : you just have the impostor syndrome.

[tall frigate]

Thanks. Ill try to remember that

[serene umbra]

Gave +1 Rep to @radiant lodge (current: #637 - 8)

[radiant lodge]

If you go on learning with THM and other resources (as blue specialists, I like LetsDefend -it has a great SIEM simulator-, and I've heard of CyberDefenders, both are partially free) ... you have tons of those on internet, I'm not the expert in here, but you'll improve and feel more confident.

[storm geyser]

I'm also not an expert, but you shouldn't feel ashamed for needing OTJ experience/training. Everybody needs that to some degree to be successful and i have no idea why the job market these days is trying to act like that isn't the case. I guess companies would rather hire their talent instead of take somebody that they can mold into the perfect person for that role. I've never understood it myself and it's frustrated me.

But trust me, the fact that you understand you need real world experience is a good thing

[tall frigate]

thanks a lot. I would like to allocate more time to THM and other really great resources I've discovered, I just have to focus on the resources I've already paid for the time being, as I'm expected to finish certain courses by certain dates in my program.

[serene umbra]

Gave +1 Rep to @radiant lodge (current: #586 - 9)

[tall frigate]

Thanks for that. I understand it's an almost certainty any new candidate will need OTJ training. To what degree is my concern, I don't feel ashamed but rather I don't like when my times wasted - and I don't want to waste someone else's. For example it's one thing to train someone on a different SIEM tool who already has experience using SIEM's, vs someone who has theoretically learned about SIEMS XD. I feel like I'm over thinking things a bit though and should just let the hiring managers/HR do what they do while I continue learning/applying.

[serene umbra]

Gave +1 Rep to @storm geyser (current: #586 - 9)

[tall frigate]

I'm just ready for my financial situation to change.

[storm geyser]

I think you're right about that last part. The only thing in your control is to keep getting better and more knowledgeable day by day. The right team will provide you with what you need to succeed

[storm geyser]

I'm in the same boat myself, I know it's tough

[tall frigate]

I appreciate it. If you get into another boat, let me know I'd like to hear the story.

[storm geyser]

Haha will do my friend

[zealous fog]

This channel is to look for jobs or get career recommendations?

[keen tundra]

For career advice mainly , if you want to look for job , take a look at https://discord.com/channels/521382216299839518/775144008853749770 channel 😄

[zealous fog]

Thanks pal

[serene umbra]

Gave +1 Rep to @keen tundra (current: #3 - 2058)

[muted shoal]

Hi everyone I’m new in the community,just learning how to navigate it.

[keen tundra]

Hi , welcome to community 🙂

[muted shoal]

Thanks

How do I get to the jobs board?

[keen tundra]

https://discord.com/channels/521382216299839518/775144008853749770

🙂

[cursive thistle]

Question if anyone could answer “ would a professional diploma in cyber security be worth my time or is it just a waste of money genuinely curious”

[torn matrix]

A degree doesn't guarantee a job but it does help get past the HR barrier.

[humble cosmos]

Ditto on what @torn matrix said, Degrees and certs are mainly to get seen by HR/Recruiters. That's not to say you wouldn't learn anything if you go for either of them, because you will learn.

I ended up going to a vocational school, after a year and a half, I got my Associates Degree in Network Security and from there I landed a role in Desktop Support for a very small company. At that point, I just wanted to get a job and I didn't mind that it was in IT. If anything, I'm thankful I started off as a Desktop support because it made me learn so much about computers and made security just a tad easier to understand how I can secured computers.

Granted, that was years ago

pressed enter by accident*** but one more thing I would say

From someone who's interviewed different candidates within the past 2-3 years...I never cared so much about their diplomas, mainly looked for soft skills and see if I could work with them on a daily basis.

Now, if you don't like school, I would at least encourage you to go for certifications because on top of learning, you can still show that you're going after your education on your own which to me, it shows a lot.

[torn matrix]

@humble cosmos is spot on. My first programming job out of college was really crazy. It was for a local company. I had a degree from a no name university and the other guy that got hired got his degree from Harvard. We ended up at the same job. Where you get the degree isn't as important as people would have you believe. Certifications say a lot about a person. It seems like experience and certifications are what I keep seeing people push for cyber security.

[sudden spire]

hello i need to know . is knowing some html and or no code exp at all a problem to start THM pentester path? seems like THM is more web penstesting focused

[fickle grove]

THM has multiple paths, its just that interacting with web applications require some level of understanding to better appreciate what is happening under the hood (aside from what you can see from the browser).

[sudden spire]

True. I'm looking into it

[broken idol]

I hate trian Wi-Fi. video won't play. >:-|

[undone shore]

[broken idol]

I didn't even realise I was in this channel.

They ask, it's not "You must not" 😄

[undone shore]

For a reason!

Uses free WiFi for unintended purpose

Complains that free WiFi doesn't work very well for unintended purpose

Everyone else complains that free WiFi doesn't work at all because someone's using up all the bandwidth trying to stream a video

[broken idol]

The train was empty.

It was just me on the carridge lmao.

[undone shore]

Eh, fair enough. Strike point three 🤣

Wait, how the heck did you manage that in rush hour?

[broken idol]

Just lucky I guess.

[undone shore]

I was about to say, the obvious thing to do would be meter each individual device to a percentage of the available bandwidth

[broken idol]

If it helps, I was going away from Glasgow, were as the majority on my line go to Glasgow.

[undone shore]

Then it occurred to me that this might be exactly what they have done, resulting in your video buffering

[broken idol]

Nah, I was loading it off the GCU blackboard, it's pants at the best of time.

[undone shore]

Baha, fair

[hidden hare]

Heyho! Anybody got some book recommendations for someone starting out in IT and who aspires to become a IT security analyst?

[keen tundra]

Try to ask these guys https://discord.com/channels/521382216299839518/679099130320125952 🙂

[hidden hare]

uh thanks! couldnt see the room :D

[serene umbra]

Gave +1 Rep to @keen tundra (current: #3 - 2075)

[mystic cosmos]

Hello everyone. I am willing to ask for some opinions regarding the entry level jobs that serve as an experience to enter cybersec. Currently I have completed jeremys ccna course from youtube and completed all his labs and videos. Additionally I colloborated with one of my friends for his final year project in which he was building a secure campus area network it was a very long project that took us 1 month ig. Now i am planning to get an entry level role in networking then move towards blue team(soc) as i have heard it is an easier role to break in compared to other positions. After gaining some experience in defense I am willing to move towards Red teaming. I would appreciate some reviews if it's the right way i am thinking or not. TIA ^^

[warm hinge]

Is ICS cybersec.'s salary/stress/difficulty good compared to other cybersec. paths?

[cunning shadow]

Done!

[warm hinge]

do companies (in cyber) care about how many languages you speak (popular languages)? does it affect salary in any way? automatically offered more or have to ask for it / justify it? what if you learn a new language while working?

[storm geyser]

I'm no expert, but it could be important if you're looking to do global operations or want to have international career opportunities

Not sure about salary details, as I don't have experience in the industry

[fresh geyser]

How good at coding (e.g., Python) do you have to be if you want to work as a Penetration Tester?

Or any Cybersecurity Job

[prime quiver]

you need at least intermediate proficiency in coding, especially in languages like Python, Bash, and PowerShell. However, the required skill level depends on the type of pentesting you want to specialize in.

Bash / PowerShell → Automating Linux/Windows system tasks.
C / C++ → Writing exploits, shellcode, or malware.
JavaScript → Testing for web security vulnerabilities (e.g., XSS, CSRF).
Assembly → Reverse engineering and low-level exploit development

basic Python is enough, but you should aim for intermediate skills to modify and create exploits.
If you want to specialize in exploit development or red teaming, advanced programming skills are necessary.

[fresh geyser]

Alright Thanks alot for this detailed and straightforward answer to my question 🙂 . I'll have to get better Python knowledge in that case.

[serene umbra]

Gave +1 Rep to @prime quiver (current: #2591 - 1)

[keen tundra]

You need to familiar with some languages , especially JS if you're interested in web app pentesting. There're foundational rooms for both JS and Python on THM , check them out 😄 .

https://tryhackme.com/r/room/pythonbasics

https://tryhackme.com/r/room/javascriptessentials

[fresh geyser]

Thanks alot man I will check them out 😀

[serene umbra]

Gave +1 Rep to @keen tundra (current: #3 - 2091)

[prime quiver]

Can you guys prefer me a blue team member who have Good experience .?

[flint cairn]

Need advise. I have 9 months of web dev experience and I have masters in information security. So, I am applying for cybersecurity jobs but not getting interviews. I am thinking of doing cert to get into junior kind of penetration roles. Which certs should I go fo ?

[old sinew]

OSCP is the beginner penteset cert and all people I know in the industry who are high up say get that and you're golden, it's hard but once you have it pentest jobs are easier to get into, it's expensive but worth it as almost everyone wants you to have it in pentester roles (and for good reason)

Other than that the follow CompTIA certs are great boosters and sometimes requirements:

Great:

• Security+
• Linux+
• Pentest+ (similar to OSCP but is multi-choice so holds less weight than OSCP which is a 24hr exam to hack 5 boxes and an AD and then 24 more hr to do a full report and then you're graded and it's proctored the entire hacking time)
• EC-Council Certified Ethical Hacker (similar to Pentest+ but different company and not quite as known, but still good for what it covers I think, not much knowledge on this one just heard about it a few times)

Optional:

• CySA+ (more for defensive and administration)
  Network+ (more for network admins)

• A+ (more for IT Helpdesk but I've heard of HR's not letting people on unless they have it but I assume they would tell you that in interview and if you have the above this is basically a given to pass)

[lone kettle]

I dunno anything about certifications, but what kind of positions do you apply for?
Considering you have a Master in InfoSec I would assume you would be a good candidate for most roles except senior level positions.

[flint cairn]

Thanks for your certs recommendations.
I already have Security+; I am thinking to do PNPT. Is it recognized in industry?

[serene umbra]

Gave +1 Rep to @old sinew (current: #2592 - 1)

[old sinew]

Np! And no idea about it's weight, I've never heard of it personally

[flint cairn]

Right now, I am applying for SOC analyst or analyst roles but most of them requires experiences and CISSP certificate.
I want to go in offensive security but they also required good amount of experience in industry.

[flint cairn]

It's Practical Network Penetration Tester (PNPT) by TCM Security

[old sinew]

Yeah I looked it up, just never heard of them before personally

[lone kettle]

Ahh i see, could this by chance be in the US? Here its more common for the companies to just employ graduates from bachelors and masters and sign em up to take certifications from the start while getting paid.

[flint cairn]

I am in Canada

[rugged delta]

It's not as widely recognised as other junior pentesting certs, but the training they do is high quality. Reading reviews and discussing it with others would suggest it's not as intensive as OSCP, but might be a good way to ease yourself in if an OffSec cert sounds above your abilities at the moment

[zealous plume]

Hey guys

I have a huge dilemma and I need advice from ya'll . Im starting to get tired of not finding a job abroad in Europe in IT (help desk or support) . Since every country requires it's language before joining company. My question is should I return back to my country (Poland) and try my luck there or keep trying?

I wanna also pinpoint that I don't have on-site experience so I want to make this first step in the door and eventually reach my goal of SOC L1 position.

Any advice is welcome btw

[rain raptor]

hello guys trust you are all well. please i need some clarification. my career path, im heading for a role as a soc analyst. at the moment i am about to round off with ceh and csa. do i still need google cyber security cert and comptia security + or its not worth it??

[mystic drum]

Check out local job postings for a SOC position. I’m pretty sure they all are asking for sec+ and in my opinion having it will give you an advantage of getting an interview with another certs you already have.

[rain raptor]

thank you much

[inner cliff]

Hello guys, I'm passout at 2021 and two years I worked in marketing field, last 1 year I was in bed rest due to tuberculosis which bring back me zero again, now I'm thinking to restart my career in cybersecurity, but I'm not sure how can I start my career in cyber security , can anyone suggest me ?

[void harbor]

solve bunch of tryhackme free rooms! when you get familiar with its environment , feel free to pursue Certification by completing paths! once done! kindly explore more platforms and resources to enrich your knowledge!! never stop learning

[merry axle]

Start off with help desk or any other entry level job while building up your knowledge in the feild

[inner cliff]

Sure I'll do that

[inner cliff]

How can I get a entry level job ?

I want to learn and gain experience

[merry axle]

Just start applying to help desk jobs

Some recommend taking your comptia A+ but that requires a good amount of money

[merry axle]

If your main goal is learn and experience just use THM

Also professor messor has a ton of stuff on YouTube. Learn A+, network+ and Security + from him

[inner cliff]

Is there any mentorship course ?

[merry axle]

They have guided learning paths

Depending on what you want to get into. There’s three paths right now

They all branch off from one path so start at the start and while you’re learning. Figure out what interests you the most in the field

[inner cliff]

Is selflearning will be enough to get a job?