cyber-and-careers

[undone shore]

Aha, the developers found impact then?

[flat sedge]

Only the impact I found, in that metadata for specific content would be disclosed using an IDOR technique.... honestly not sure why it got paid out, they were notified over a year ago that it was a potential problem. My thought was that the disclosed metadata was already available if one viewed the content on the platform via direct URL vs using the web front end to pull from the CDN.... but whatevs, that's not my circus

[hollow falcon]

Okay, I'm a little confuse now, I understand what everyone is saying, but what are the typical clients looking for?

[undone shore]

That's an interesting one to pay out over lmao

[flat sedge]

What do you mean? Client in which perspective?

[hollow falcon]

Just in general

[undone shore]

A report detailing the strengths and weaknesses of the system(s) in scope.

[hollow falcon]

Could be Amazon or some startup

[undone shore]

They're looking to see if there are any security issues, basically. That's what they want to know. The product is the report.

[flat sedge]

Not my circus! I did my due diligence, was told 'ok cool man' and then nothing until we saw the bug bounty payment. Half considering it's a payment just to keep the bug hunter engaged tbh

[flat sedge]

Clients in general aren't really a thing. Web client is different than a customer who is a client, vs a contractor who has a customer that is being paid by a client for the contractor to do work. It gets really really confusing if you want to only talk in generalities

[hollow falcon]

Got ya!

[hollow falcon]

Lets say a client that is looking to have their network breached so that they can patch whatever the fault may be

[undone shore]

Let's go with the most basic definition and assume that the customer has engaged you as the consultant (or, your firm) to conduct the pentest

[hollow falcon]

(Not website)

[flat sedge]

Ok... so time to explore your question from that perspective. A network pentest doesn't really care about applications except if they can be leveraged or pivoted from to gain access to private network or networks behind the secure boundary.

[undone shore]

Well, you just answered your own question there.

Chances are they would be looking for an external infrastructure review in that case.
You would look for issues in whatever infrastructure they scope, then report on that.

[marble elm]

Lol

[flat sedge]

So the client is looking to see the exposed ports and IP addresses, what the threat landscape looks like from that perspective, and what the potential consequences are of having those ports be exposed. Network topology can play a huge role in that threat landscape, especially if that network environment is used to be a giant monolith block of somethign like a /10 that has all the internal devices on it.

[undone shore]

Then again, if your marketing team are on the ball, chances are you get an internal infrastructure test scoped in as a separate phase lmao

[hollow falcon]

Would you say that, for the most part a client would feel less confidence in your ability to identify a potential breach? Wouldn't this damage your firm's reputation?

[undone shore]

Wdym?

[merry axle]

You’re being very condescending and that’s not okay. I can vouch for Zumi. I know that he’s an experienced penetration tester that works as one professionally.

[flat sedge]

I recently did a pentest of 120+ network devices which had specific routing rules to only accept connections on certain ports from specific IP addresses. Would you consider it a finding that we were not able to find open ports on the public facing side of those devices?

[hollow falcon]

Lets say I have a small Cybersec firm and we got a contract by a client requesting a pentest engagement. If I were to take that contract and, after sometime could not find a breach. Wouldn't that make the client feel less confident in me and my firms ability regarding pentests?

Again, not trying to flare up anything, really looking for opinions

[flat sedge]

You should work for someone else in the industry before you try to start your own pentesting business, if that's where you are going with this. Get the experience of what's reasonable first hand instead of farming theoreticals which may not match reality.

[hollow falcon]

Not my plan, just was for demostration

[flat sedge]

As a pentester, you should not be finding breaches, you should be causing them (within allowed scope)

[hollow falcon]

I was curious on it eariler today

[flat sedge]

Any time you have a finding of "I didn't find anything" you should have a caveat that just because you didn't see it today, doesn't mean that it doesn't exist. The test is a snapshot and does not guarantee security either before or after the test is completed.

[hollow falcon]

Okay, I understand!

(Sorry if I was being annoying with the questions)

(Needed some input after reviewing some course work.)

[marble elm]

Nah you weren't they just decided to give you the encyclopedia of responses to answer your question

[undone shore]

He's been a junior pentester for roughly 6 months last I checked.
Frankly, I don't care about that. It's valuable experience, and that's a good thing.

Where it becomes an issue is if you start spewing rubbish to people with less experience who are looking to learn.
Where I take personal exception is if you then turn around and double down on said shit. Repeatedly.

At the end of the day, the statement was wrong. Worse, it was an easily disproven opinion presented as fact. Any semi-experienced pen tester will tell you that.
The correct response was "oh, yes, those examples make sense. I will bear that in mind".
The incorrect response was "agree to disagree".

I have limited patience, and I do not suffer fools for long.

[undone shore]

Pretty much what Juun said, yeah.

If you don't find anything then it's really important to explain what you did, why you did it, and how you reached that conclusion. Basically for that reason.

A pentest starts with a methodology. Most teams will have their own methodologies for specific test types, built out over an extended period of time.
You follow that methodology, and expand on specific issues or points of interest when you find them.

If that methodology doesn't turn anything up then that's okay, as long as you communicate to the client that you have followed it.

[hollow falcon]

Understood! Thank you.

[serene umbra]

Gave +1 Rep to @undone shore (current: #10 - 862)

[undone shore]

And yes, there's always the points that:

1. You have finite time for testing. A threat actor does not.
2. They could introduce a new vulnerability tomorrow.

Both are worth mentioning

[mortal ether]

You seem to be indicating that completely secure systems, within the scope you check, exist and your inability to find a vulnerability is indicative of the lack of holes in the system. I’m pretty sure all Zumi said is that vulnerabilities that you aren’t able to find more often than not exist.

The way you’re condescendingly disparaging a member of the community without even bothering to understand what he’s conveying is crazy

[flat sedge]

That's a very naive way to read what Muiri said. There's a huge difference between "we report no vulnerabilities, checking for X, Y and Z at this time" and "there are no security gaps in the software."

The second is actually impossible, as it would require effectively infinit time to test all possible inputs.

[undone shore]

He literally said that it's impossible for a system to be completely secure.

There is no way to misinterpret that. And it's incorrect, yes.

He then said (and I quote) "if you truly cannot find a vulnerability of any kind there is some kind of knowledge skill gap that needs to be fixed".

Again, that cannot be misinterpreted. Again, it's rubbish.

R/ the first point, I provided examples of how a test could legitimately have no findings somewhere above in this chat.

[mortal ether]

Are you referring to this message?

To clear up misunderstandings

[undone shore]

R/ the second point: yes, it could be a skills gap. But it's a long way from being the only possible explanation.

[undone shore]

That being the message containing the paragraph I quoted, yes lmao

[mortal ether]

I dont see where Zumi said finding no vulnerabilities due to a skill issue would lead to someone concluding that a system is completely secure.

[undone shore]

Oh, and while we're at it, suggesting that's the case is a really good way to fuel imposter syndrome

[mortal ether]

If it’s not possible for a system to be completely secure, then yes it could always be attributed to a skill gap. Unless you think otherwise

[mortal ether]

This argument makes sense

[undone shore]

It's perfectly possible for the scope of a test to be completely secure* based on the point-in-time snapshot you've taken.

I put an asterisk there for a reason. The key part is point in time.

Let's say, for example, that your entire scope of testing is a single web page, with a few input fields, for one reason or another.

You can check for a whole range of injection issues, including weirder payloads from your methodology, but you find that everything comes back clean.
You can check TLS config, and server headers -- the low hanging fruit -- but you find that they've been hardened. No issues.

So you write up the report.
Based on existing knowledge and your standard methodology, you haven't found any issues at the time of testing.

A week later, log4shell drops and the form is vulnerable.

That's not a skill issue.
The vulnerability was there, sure. Turns out the application wasn't entirely secure.

But pentests are point-in-time. They're a snapshot.
How the hell were you to know about that vulnerability in the backend logging library before it was released? You're a pentester, not a security researcher.

At the end of the day, your point in time snapshot did not contain any vulnerabilities. There was no way for you to know any different.

And that's fine. That's just how the job works.

[mortal ether]

So it boils down to your opinions on a system being totally secure(at a point of time or in general). Zumi believes that there is always a some vulnerability while you believe that the vulnerabilities you check in some finite amount of time might not exist. Then it can also be argued that you should have been able to know which vulnerabilities to check for at that time. It just becomes a matter of semantics after a while of arguing and I think that’s why Zumi said to agree to disagree

[undone shore]

No, that's not the point at all.

There's always scope for something to be vulnerable. That's a given. Your application code base is completely fine, but someone finds a vulnerability in the reverse proxy next week. It happens.

I'm not disputing that.

I am absolutely disputing the two points that Zumi made.

1. It's impossible for a pentest to legitimately return zero findings.
2. It's a skill issue if it does.

Both of those are just blatantly wrong. There's no wiggle room there. No room for debate.

Then it can also be argued that you should have been able to know which vulnerabilities to check for at that time.

Yes, absolutely. Not disputing that at all. If a vulnerability is known to affect the systems you have scoped then you should absolutely be evaluating whether it could apply to the test.

Again, no one said any differently.

It's the vulnerabilities which are not already known which you can't test for (obviously).

Again, using log4shell as an example. I would not expect a pentester doing a webapp review of a Java application in 2019 to have gone and audited the entire log4j library. That would be insane.

I would absolutely expect them to check for log4shell in 2025

[mortal ether]

You’re misquoting horribly. He did not say it was impossible for a pentest to legitimately return zero findings. It’s by definition possible if zero findings are returned unless you mean that a perfectly done pentest can not possibly return zero findings. And for the second point, you seem to have agreed here

[undone shore]

No. That is not a skills issue.

That's the whole point lmao

It's not the pentester's job to go find previously unknown vulnerabilities in third party components, or anything which isn't explicitly scoped. If they happen to find a CVE while doing a scoped test, then that's awesome. It's not the goal though.

I will say that this is an impossible scenario, you will find vulnerabilities...

Which part of that was misquoted?

[mortal ether]

I think the major divide here is that you seem to be talking about going through a checklist of vulnerabilities and them not existing while @hallow sparrow was talking about every possible vulnerability in general, whether previously discover or not

[mortal ether]

“It’s impossible for a pentest to legitimately return zero findings.”

[undone shore]

Yeah. I'm talking about a pentest, which is what the OP was querying.

God only knows what Zumi was talking about.

[mortal ether]

So you just made the assumption that he was referring to what you were thinking about and “corrected” him based on that?

[undone shore]

I made the assumption that he was attempting to answer the question he was replying to, based on his own pentest experience.

I think that's a fair assumption to make, wouldn't you agree?

Rather than just dumping a random security research answer in response to said pentest question.

Which of those two scenarios seems more likely?

[mortal ether]

Perhaps but I wouldn’t go condescendingly berating someone without clarifying further

🫡

[undone shore]

Also, those are the same thing, with slightly different wording smh

[mortal ether]

No, they really are not

[lone dune]

@hollow falcon Take in the responses you have read on here, compare them to your uni courses. Then, apply it when you get into the field and make adjustments as you navigate the cybersecurity world.

[mortal ether]

Best advice

[undone shore]

Perhaps I wouldn't be condescending if he didn't do this every five minutes (hyperbole, for the pedantic in the room) lmao

And again, clarifying the obvious is just dumb.

[merry axle]

https://tenor.com/view/gif-gif-23738466

[undone shore]

What's the difference then?

[undone shore]

Absolutely this

[mortal ether]

One is dealing with just the scope of your pentesting while the other is referring to every possible vulnerability

[undone shore]

Okay, and what exactly, in that original message responding to a question about pentesting, makes you think that it's not talking about pentesting?

[mortal ether]

“If you truly cannot find vulnerabilities of any kind”

[undone shore]

Okay, and now put it in context of the question. Which, again, was about pentesting.

[mortal ether]

Making the assumption that a response directly follows the context of the original message is a fair thing to do but completely disregarding the context of the response itself as well as not bothering to clarify further is disingenuous

[undone shore]

As a general rule, conversation does not flit about between topics. It is built on context. The first message leads to a response, which leads to another response, etc.

I cannot believe I apparently need to explain that.

[mortal ether]

Anyways
That’s about my opinion on the matter

[undone shore]

Okay, I ask again. What, exactly, in that message, leads you to believe that the context has been dropped?

[mortal ether]

Are you aware of how condescending you are to everyone

[undone shore]

Because to anyone sensible, this would read as:
“If you truly cannot find vulnerabilities of any kind [in the hypothetical pentest we have been discussing for the last 5 minutes]”

[mortal ether]

And this is just not true at all. This deterministic view implies that the direction of a conversation is completely decided by the first statement or chain of statements

[undone shore]

As I said. I do not suffer fools.

I am perfectly lovely when not confronted with idiotic arguments made for the same of arguing.

[mortal ether]

Apparently not

And you seem to be arguing for the sake of arguing after I just explained to you what Zumi’s message was referring to

[undone shore]

It is.

That doesn't mean that the topic of conversation won't change throughout the conversation, but the new topic will always be linked to the previous one.

Even if that link is something as tenuous as "Oh, by the way, on an unrelated note..."
Which continues the same conversation seamlessly.

[mortal ether]

That is not how human conversations work at all

Might be different for you

[undone shore]

So, what, someone says they think the weather is good, and you reply by saying that you rode an elephant last winter?

... That actually wouldn't surprise me.

[mortal ether]

There is some relation usually. Hence why Zumi didn’t reply with the mass of the sun to his question

[undone shore]

You know full well that Zumi's message was talking about pentesting. You're arguing for the sake of not losing smh

[muted terrace]

https://tenor.com/view/puppet-awkward-looking-what-side-eye-gif-15476992

[undone shore]

As per.

[mortal ether]

It’s a simple concept. Not surprised you’re arguing

[mortal ether]

I can’t lose because I don’t have a stance here. I simply explained to you what happened since you apparently couldn’t understand it on your own

As per usual you’re arrogant and confused

🫡

[undone shore]

Right. Okay.
Let's clear this up.

What happened was that Zumi responded to a question about pentesting, with an answer which contained zero indicators that it was not about pentesting.

If, in fact, it was not about pentesting -- which I grant you is possible -- then it should have given even the slightest indicator of that being the case. It did not. Therefore it can be assumed, without further clarification, that it answers the question which was asked.

That is a basic principle of communication.

If it turns out that it was not about pentesting then it is up to Zumi to clarify that. He did not.

The only person arguing otherwise is you.
So in this instance you are telling me that Zumi meant something to which he didn't so much as allude to, despite him not giving any indicator of that himself.

Ergo, you're talking shite.
Hope that helps 🫡

[mortal ether]

The only judge of what Zumi meant is Zumi @hallow sparrow
Ergo, your argument is total bull as usual

[undone shore]

Oh sweetie. That's exactly what I just said.

[mortal ether]

Hope that helps

He can come and clarify that

[undone shore]

Wanna re-read that and try again?

Mhm. He is more than welcome to do that.

[mortal ether]

Reading through your text just once is more than enough for me

[undone shore]

Until then, how about we accept the obvious, and indeed socially normal interpretation, rather than spewing a whole pile of bull on his behalf 🙂

[mortal ether]

I don’t think you’d know what’s socially normal. How about you use slightly more nuanced context and stop thinking your opinions are facts

[undone shore]

How on earth is it abnormal to think that the answer to a question should address that question?

[mortal ether]

It’s telling that you’re being insulting towards not just the original person of question, but someone who is simply elaborating something to you

[undone shore]

You're not "simply elaborating something" and you know that full well

[muted terrace]

typing a novel over here

[mortal ether]

I’ve already presented my stance. Go back and re read if you want, sweetie

[mortal ether]

See how you’re arguing for the sake of arguing

[undone shore]

And on that bad faith note, I'm going to go and find dinner.

Zumi, if you're planning to make a sensible response, please feel free to ping me.

No, that's actually a much better response imo ♥️
I'm not going to "rip that to shreds".

[mortal ether]

Now that everything’s clarified, enjoy your dinner

[undone shore]

A disclaimer on every post is a bit much lmao.
What I would ask though, is if you aren't sure of something, put it in context, and express it as an opinion.

e.g., basically what you just said.
So in the original context "in my experience with specifically testing hardware systems, it would be very rare to not find anything. I'm not sure about traditional pentesting."

There's absolutely nothing wrong with saying that. No one is expected to know everything, and it's absolutely fine to lean into what you know.

The only time anyone will attack a statement is if it's presented as a fact and it's wrong -- especially in here where we have predominantly people looking to improve their experience.

[alpine marsh]

Hardware based pentesting such as OT pentesting you'll find a lot of vulns speaking from experience

[undone shore]

Yeah, lots of things are clearer cut 😄

Pentesting is a good example. There are a wide range of recommendations which we can give for a specific issue. That can make it feel fuzzy, but at the end of the day, it just comes down to experience as to which are actually sensible.

For example, to fix an SQLi, the obvious (standard) suggestion is prepared statements. Only thing stopping you from saying "remove the whole system" is experience and common sense.

[muted terrace]

pentesting report remediation reccomendtation: Just turn everything off

[undone shore]

But on the flip side, I have legitimately had a case where my recommendation has been to decommission and replace the system.

[muted terrace]

you cant get hacked if its turned off

[alpine marsh]

When I see a windows 2007 server

[undone shore]

Simply because it was so broken, and so sprawling, we could have been there for literally years testing it and still not found every issue.

[undone shore]

Very true, yes. I did say that earlier lmao

[alpine marsh]

It was too much text, didn't feel like reading

[undone shore]

That... is extremely fair

Oh god damnit. It's 0220. Reckon that's too late for dinner. Ah well

[alpine marsh]

It's breakfast

[undone shore]

... Now there's an idea

[alpine marsh]

But yeah, I've had experiences with my friends running nmap and breaking a whole production environment cause OT devices can't handle it

[undone shore]

Yeah, uh, I know a guy who did that to an oil rig.

[alpine marsh]

Know or "know"

[undone shore]

Know personally

[alpine marsh]

More as in, someone else, or yourself

[undone shore]

Oh, yeah, no not me lmao

Alumni from uni

Alumnus, rather

[alpine marsh]

Lmao, yeah, there's a reason why I don't deal with OT

Just one small bug is a CVE in OT

Speaking of, I have a whole new network detection system to learn about this weekend

Got a budget of 8 hours

Welcome to consultancy, we deal with budgets in hours

[chrome spire]

Where you located

[eager frigate]

Any tips for the SAL1?

I have taken the SOC simulator and I always get a low score the classification section even tho the AI it's good here is my overall analysis by the Ai
"
Your reports provide a detailed analysis of the incident, covering most of the essential aspects of the 5Ws. However, there is room for improvement in how you present this information. The structure could benefit from a clearer distinction between repeated details and unique incidents to prevent redundancy. Additionally, ensure each report stands alone with complete 5Ws coverage to improve readability and precision in communicating critical incidents.
"

Should I make separate report for each distinct alert even tho they are coming off from the same user?

For example:

Data exfiltration with the use of .exe with (multiple same reports)
Access to sensitive files using the commandline

So what should I do is make separate report for each distinct alerts? and did you guys ever use Splunk or any other tools provided in the SOC simulator? I just found myself using their imitation of VirusTotal tool I don't remember it's name.

Thank you for your help!

Copy and pasted from #infosec-general

[noble mortar]

I'm french

[tame scroll]

Hello! 👋 Looking for the best starting project. Something worthy of posting on Linkedin or X after completing.

Completed my CompTia Security + cert and want a good starting project

Working through the curriculum on tryhackme

[keen tundra]

What do you mean by project 🙂 ?

[noble mortar]

I'm converting to cyber, so I don't have any professional experience at the moment

[tame scroll]

Want hands on projects is all I am looking for instead of cyber security theory

I have the theory and IT experience. I need cyber hands on projects

Workshops, labs, practice environments

I apply for positions but I need to bolster my experience with hands on so I can add things to my tool box. Try hack me is providing that, however I put it out there so I can get into the weeds and learn core fundamentals

What will get me hired

I thought that was the whole premise of the try hack me methodology

[keen tundra]

You can check a list of network labs on THM on the link below 🙂
https://tryhackme.com/hacktivities?tab=network

[tame scroll]

I see all the channels now

I also see the learning paths

[keen tundra]

Nice, focus on challenges/CTFs and try to learn and practice as much as possible 🙂

[tame scroll]

On the website is what you are referring to correct?

I have my Security + so the info seems basic however I like completing the rooms and earning the badges

[shut zinc]

anyone know a good resume template?

[graceful cradle]

google 😉

[wide mica]

Security + doesn’t really delve into pen testing at all does it

[calm arch]

Is it worth getting all CompTIA A+ certs for a level 1 job

[wide mica]

Methodology wise

[wide mica]

I’m sure that would look impressive on your resume

I’ve only read the first 3 chapters of sec + but it seems much more theoretical than thm material

[stoic cave]

AwesomeCV is good

[stoic cave]

If you don't know or cannot articulate the parts of a computer, their functions, and troubleshooting methodology then I would say maybe. If you can do the above then my answer is no.

There is also only one CompTIA A+ certification, it's just made up of two exams

[stoic cave]

You're correct in that Security+ is not an overly technical exam and does focus on theory. It's purpose is to ensure you have a baseline level of security knowledge.

[shut zinc]

how good is AI at translating english to manager speak?

making a new resume

[rugged delta]

You should look at various websites and tools about the correct way to arrange and formalise your cv. Manager speak isn't really the goal The kinds of content you want are clear, accurate, descriptive speech about your work and educations history, certifications you've been awarded, skills you have, projects you've completed, professional development, related pursuits/hobbies/pastimes/achievements if you still have space. Ultimately, you're just trying to show you have the skills they need to hire for

[shut zinc]

so i can skip all the fluff and buzzwords?

good

the word spearheaded makes me cringe

[rugged delta]

Sure, there should be no fluff, or buzzwords. Just accurate records of your abilities. Stating that you did a certain job, and your responsibilities/achievements were x, y, & z, etc. That you hold certification a from org b and it's valid until time c. That you know how to use systems 1, 2 & 3. Including a blog or writeups or other personal projects can help; such as competing in CTFs, building a home lab for various projects, etc...

[vital laurel]

Medical device

[alpine marsh]

Indeed

[gloomy prism]

Has anyone here ever worked as a Network technician? If so, how is the job? Also, would it be a good starting point for someone who wants to become a network engineer later down the line to advance my career?

[rustic atlas]

I’m applying to tons of cybersecurity internships, still have 1 more year left.

I got 1 interview so far, and was wondering how I could improve and get more faster?

I’ve been using jobscan AI in order to improve my resume to match with the company position description and get through ATS.

Does this method work or do I need to be doing more to get through ATS?

[tame scroll]

Yes. That why I like try hack me

[shy plinth]

Hi there is it better to build a kind of all around knowledge while focusing on red teaming for example or to completely focus on red teaming

[whole frigate]

Imo try to get the resume past the filters maybe finding referrals. Or try to get in touch with hiring managers

[kindred prairie]

I’m interested to know the answer to this too

[lone plume]

Personally i'd say completely focus on it so its just that for now. That would work better for me

[gloomy prism]

Has anyone here ever worked as a Network technician? If so, how is the job? Also, would it be a good starting point for someone who wants to become a network engineer later down the line to advance my career?

[shy plinth]

I guess that makes sense. If you start focusing on other things you might lose focus from the main thing

[rugged delta]

I worked several years in a data centre NOC, monitoring networks, servers, connections, installing copper and fibre cables in/between data suites, to telecoms providers, installing, maintaining servers, VMs and virtual/cloud platforms. I got to work with a broad range of technologies. If you want to work as a network technician/engineer, you would most likely be expected to pursue the CCNA/CCNP routing/switching certs as you progress. They'll teach you a lot of the skills you need, as most orgs use Cisco equipment, and a lot of non-cisco equipment uses a similar interface. It would also be beneficial to learn about Windows/Linux, scripting with Python or bash and more as you progress, but take your time with it

[tame scroll]

Comment about Security +. If you actually study the material it absolutely helps you understand the cyber domains and verbiage used. If you are just studying to pass a test then that’s not learning a profession. That is simply showing you are a good test taker.

[tall frigate]

I am a network technician and the experience you will get working as a technician, working with networking tools/equipment on different worksites would help your understanding as a network engineer in my opinion. I don’t know much about what the network engineers in my organization do aside from monitoring/logical controls of our network but to my understanding yes it will translate. A little of what I do: workstation setups, installing and deploying printers on our network, re-imaging pc's, responding to and closing help desk tickets, repairing ethernet wall outlets, replacing voip phones, installing/replacing WAP's, and using logical tools to reserve IP's for devices like printers on our network.

P.S. I enjoy my job, as a caveat your enjoyment will likely depend (largely) on the organization you work for.

[ionic osprey]

Hey guys! 👋sorry to bother you but does anyone can guide me that what should i do after JR pentesting path.. i just don't want to stuck in tutorial hell and do something with value

Any suggestions on what to tackle next? Also, when’s a good time to dive into bug bounties or start earning a bit on the side? currently it feels a bit overwhelming

[keen tundra]

If you're interested in bug bounty check out Web Fundamentals and Web App Pentesting Paths 🙂

[ionic osprey]

Thanks

[serene umbra]

Gave +1 Rep to @keen tundra (current: #1 - 4297)

[undone shore]

Just out of interest, what do you think that "red teaming" actually is?

[gloomy prism]

im curios do you guys travel a lot or it's more of a work at the job rather then hybrid?

[tall frigate]

It’s mostly traveling to affiliate sites and responding to their tickets

[gloomy prism]

ohhh so im going to have to travel if I wanna be one

was it hard when doing internships for it?

[tall frigate]

I think it just depends on where you work. You may not be required to travel and I did not intern for the position “)

[gloomy prism]

thanks again sorry for the constant questions btw it's just so hard to choose what field to take 😩 so many options.

[serene umbra]

Gave +1 Rep to @tall frigate (current: #256 - 29)

[tall frigate]

No problem at all, I’ve enjoyed discussing it with you. You’re on the right track by asking questions.

[gritty arch]

hello there, So currently I am a student pursuing my bachelors degree in cyber security and I have learned all the basics and have finished the Jr pentester path on tryhackme and i have solved only like 3-4 ctfs and want to improvise more as currently I am stuck and I do not know what to proceed with next. Which are all the beginner level ctfs i could start and How could i improvise my skills as I have my job placements coming up by the end of the year and I want to be prepared to land my first job? Could anyone help me out on this?

[shy plinth]

What I meant was pentensting

[swift mulch]

Hello everyone, please i will like to get your ideas as far as my CV is concerned. Im looking for an internship or apprenticeship in cybersecurity domain. Can I share it here to have your views ?

[whole frigate]

Do share, we are here to help

Just block out personal info

[swift mulch]

Alright

I can here

[stoic cave]

You'll need to verify. Make sure to post it as an image as people don't like having to download files

[crude sphinx]

Discord: How Do I Verify My TryHackMe Account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

Mar 31, 2025, 2:37 PM

[undone shore]

Pentesting != Red teaming, although my point applies to both.

Remember that any kind of hacking is just applied knowledge from other technology domains.
It doesn't make sense to "just learn hacking". That won't get you anywhere.
You need to learn as much as possible, about as many topics as you can. That's what makes a good hacker.

e.g., for pentesting. Let's say you have a piece of networking equipment, or a web server. How are you meant to identify vulnerabilities if you don't have a good idea how to configure the thing properly yourself?
Methodologies are good, but pentesting should never just be a checkbox exercise.

[distant pier]

Hello, we have a Cyber Security Learning Roadmap on the site that might guide your journey: https://tryhackme.com/hacktivities

[honest kindle]

Do you think the content available on TryHackMe equips you with sufficient skills to have a decent chance at completing bug bounties?

[daring wind]

I recently moved to Canada with my family and have been applying for IT support roles to gain local experience, but so far, no interviews. I have 5+ years of experience as a Service Desk Technician II, recently earned my Security+, and I’m working on my CCNA.
I’d love some advice on breaking into cybersecurity here. Do employers prioritise experience over certifications? What’s the best way to transition from IT support into security roles in Canada?

Any tips on positioning myself better and landing a stronger opportunity would be hugely appreciated!

[shy plinth]

I understand what you are trying to say, it's important to know the ins and outs of systems and networks...etc I can only try and do my best to grasp this vast amount of knowledge. As someone without without any formal learning and a late begginer I can't help but feel as it's abit of a race against time. I've gotten some ideas on how to continue to improve. Thank you for taking the time to answear and help.

[serene umbra]

Gave +1 Rep to @undone shore (current: #10 - 863)

[shy plinth]

Yes I am aware of the roadmap. I have completed the penetration tester path but I feel that there is still a lot to learn. I've gotten some ideas on how to continue now, I might complete some other paths too as they also seem interesting. Thanks for the help

[serene umbra]

Gave +1 Rep to @distant pier (current: #19 - 526)

[broken idol]

We don't allow members helping with academic work, sorry.

[dawn wind]

Hello out there. 3 years as a Geek Squad agent, 6 years as sysadmin, love cybersecurity. IRL tower attack/defense. Just finished BS in cybersecurity, earned a few certs Sec+, CySA+, Pentest+, SSCP, and looking to make a career change. Just started studying for provisional CISSP. (No Endorsement)Any guidance would be appreciated. There are so many directions to go from here. Thanks everyone.

[short sigil]

ah ok, im sorry. thanks for letting me know

[serene umbra]

Gave +1 Rep to @broken idol (current: #2 - 3583)

[thorny light]

general question for the helpers in here: In my circle (linkedin etc) many people say that junior positions in tech are in a really bad spot right now, especially in cyber. How do the people in this discord feel "From the ground?"

I've had a really hard time trying to get into cyber at a junior level

[flat sedge]

You're going to hate this reply.

Entry to cyber- and info-sec is not entry level to IT. For most SOC entry level positions, it's assumed that someone has experience reading logs and at least jr system or network engineer skills.

Right now, businesses are asking "can junior engineers be replaced with AI?" While I think the answer is not really, the businesses don't understand that the ROI for AI for that kind of work isn't feasible in the long term.

[rugged delta]

Hiring is in a strange state of flux in a lot of places at the moment, with many roles asking for several years of experience and a lot of responsibility with a broad tech stack for a junior position on junior salary. Most people starting out in cybersecurity have some experience in IT/programming or another related area, and many people will start out on helpdesk/tech support before moving into a more advanced/responsible position. You do need to gain experience and grow into the role, and as @flat sedge states, cybersecurity isn't usually the place most people start their career, even in SOC.

Being familiar with Windows/Linux administration, understanding and growing your coding skills (e.g. bash/Python/C), learning about networks (the Net+ or CCNA study guides/courses are helpful here), Also, the SOC 1 & 2 paths combined with a certification like the SAL1, BTL1, etc., can show your abilities. Cybersecurity is an ongoing learning journey

[thorny light]

I have IT exp as a dev/engineer and I'm still struggling trying to transition.
I just started getting CNO dev / Vuln researcher interviews and they're hard. I don't really know what to expect

Just for reference; i wrote a working LKM rootkit in C for x64

[granite sable]

hello chat i hope every one is doing good. Chat right now i'm looking for a job as a security analyst or intern just too start my career. I have done CEH v13 and master's in cyber security if any one knows any job openings in cyber security please do ping me. It will be highlhy appreciated.

[rugged delta]

While this channel is a good place to find advice about how to pursue a career, it isn't a recruitment or job seeking channel. You can check out the #jobs-board or your preferred recruitment sites to find roles in your region

[fickle grove]

It does give you the foundation, but you still need to build on it. By that, I mean you need to create your own methodology on doing recon, enumeration, exploitation, etc. You'll also need to consider which programs and targets to choose from (more competition means lesser chances for you to find a valid bug), among others.

[north garnet]

Hello! Actually just had a quick question, but for anyone that actively interviews or knows their stuff, what are some of the entry-level certificates for IT work and SOC that companies nowadays look for? I’m assuming CompTIA+ is a given but since I’m still pretty new to this I wanted to start a list of what I could look at possibly acquiring in the near future

[lilac fulcrum]

After A+ Sec+ or Net+ would be the next places

[ancient prairie]

CompTIA tri-fecta is always a good starting place but don't get too hung up on certs and try to complement the theory with some experience by setting up labs to simulate specific scenarios in an enterprise environment

[keen tundra]

Please don't adverise here 🙂

[tepid citrus]

My bad... this is not an advertisement. It's a free program. But I understand

[solid tundra]

Hello, can you help me with my presentation?

I have a problem with my VBA code

[keen tundra]

Which presentation

[rapid pecan]

ok help me to guide which domain is suitable and best for cyber security which has lots of available jobs and less competition

[rugged delta]

Cybersecurity is a highly competitive area. You're best looking at recruitment sites close to your location, or large job sites like LinkedIn

[torn wind]

Hey, can someone advise on the best path to take after Pre-Security? I'm interested in becoming a penetration tester/offensive security specialist, but I'm unsure which beginner path to follow next. Options like "Complete Beginner," "Intro to Cybersecurity," and "Cybersecurity 101" seem to overlap with topics already covered in Pre-Security. Given that, what would be the best next step to build on my existing knowledge

[tacit kelp]

Complete beginner is being phased out iirc tomorrow.

There will be some overlap but they go further into the topics a bit

It's all foundational knowledge

There is a Jr penetration tester learning path

[torn wind]

Do you think it's better to go directly to the Jr pen tester path or take another beginner path such as intro to cybersecurity or cyber security 101 ?

[tacit kelp]

You could go look through the intro to cyber or cyber 101 and see what wasn't covered in the pre security

[torn wind]

Thanks a good point, thanks Thor!

I guess I got thrown off by the overlapping chapters

[keen tundra]

Cybet101 definitely 🙂

[pulsar meadow]

Hello everyone 👋🏻
Is there's anywhere accepting juniors and teach them or any intern position?

[keen tundra]

Try to check out #jobs-board 🙂

[oblique night]

Is anyone well versed in colleges and able to possibly help me pick out what might be a good option/route for me?

I’d thought about doing WGU Bachelors and then switching to SANS for a Masters, but also I could do WGU until I get the 70 credits needed and then finish my bachelors at SANS. Does anyone have an idea on the differences other than certs and what might be the best path?

[tepid elm]

Hii

[meager perch]

Hi everyone!
Can you recommend me a good CyberSec book for beginners ?

[keen tundra]

Hi , for book recommendations try to ask in #bookclub channel 🙂

[rugged delta]

WGU has a reputation for good teaching/training, with the expectation that you'll pass a number of certifications. You can just go and get those certifications at the normal cost for an individual independently. While having a BS is an advantage, it's only a slight one. What employers want is knowledge and experience, hands-on ability. If you don't have any qualifications, you can read the study guides for, and do the exams for various CompTIA, ISC2, ISACA certifications, for instance to show you've learned the theory. Cisco has some practical training involved in their certification paths (with software to facilitate it). Hands on certifications like OSCP, CRTO, CRTP/CRTE, and others in the field give you exposure to actual use of the tools you might use in a role.

The SANS training and university are both considered excellent and highly sought, but they're also on the very expensive side, and you'd usually expect an employer to pay for such, but high quality training and certifications are available for much lower cost. The most important thing is getting hands on and learning the theory, tools and technologies. Having resources like THM, building a home lab with spare computers/virtual machines/cloud environments is a great way to learn as well. And there's lots of specialised training available along the way.

I'd suggest reading the Tribe of Hackers books, as they have a series of interviews with professionals in various roles in the industry with excellent info about how to pursue those roles

[oblique night]

Thank you! I have the GI Bill along with TA I can use, so SANS is an option if I decide to go that route, just unsure if I should finish my BS with WGU and then look towards SANS master program or do switch to SANS once I get 70 credits and continue from there.

I have both THM and HTB academy as well as in the process of building a homelab using a router and raspberry pi and just making do with what I can until I can upscale and add more.

I just didn’t know what path to consider or which path may open more doors for me later in the future, but your input is greatly appreciated.

[serene umbra]

Gave +1 Rep to @rugged delta (current: #21 - 488)

[rugged delta]

If you're doing your BS with WGU, then by all means finish it, and if you can do your masters program with SANS, then do that too. They'd certainly help you get recognised. I've chatted with SANS course trainers and they have an excellent reputation for quality work. The WGU BS is recognised by employers in the US as a quality source of knowledge, so having your piece of paper from there along with one from SANS isn't a bad situation to be in overall

[oblique night]

Understood, thank you! Is the WGU BS preferable to the SANS BS? I had thought about doing half of my BS at WGU and then transferring, but wasn’t sure if that would be the right move or if I should just finish it out with WGU to get all of the industry certs and then doing the SANS masters, since both the BS and Masters offer relatively the same certs as well.

[serene umbra]

Gave +1 Rep to @rugged delta (current: #21 - 489)

[rugged delta]

The SANS BS is probably more widely recognised, the WGU one is still recognised widely. If you transfer, you wouldn't have a qualification from WGU. I'm not sure about the process of transferring, you'd need to enquire with both colleges about their policies, etc.

[oblique night]

Alright, thank you. If the SANS BS is more widely recognized, then I may try to transfer there once I hit there 70 credit threshold and then go for their masters as well. Thank you for your help!

[serene umbra]

Gave +1 Rep to @rugged delta (current: #21 - 490)

[rugged delta]

Best of luck with it

[mellow bobcat]

Is it a good idea to have a one page resume or two page is still okay

[mellow bobcat]

I've heard alot of good things about the sans master. Just letting you know it's very expensive and you might have student debt from it.

[undone shore]

Opinions differ. I would say two pages is okay but be aware that very few people will ever read the second page.

Or the second ⅔ of the first page for that matter

[tacit kelp]

It also would depend on how much experience one has

[vapid thunder]

Hey, from a masters in compsci, what certs would be achievable for me to pursue first to aim for a career in cybersec? (I want to be a pentester or a cryptographer ideally).

I'm not sure what certs I'd need given I'm not starting from 0 (no experience at all). I'm wondering what would be pointless to spend money on given my background also. And because of how many there are, its overwhelming/confusing knowing what to start pursuing. Any suggestions? Im pretty sure my lecturer said something about OSCP.

Also, it may sound slightly stupid, but would a criminology degree help me with employers? My BSc was in criminology. I was wondering if it's worth applying to cybersec jobs in the coming few months given I've got both crim+compsci within my background as a competetive edge against others trying to break into entry level cybersec. I want to know if it would be worth sinking more time into certs/study rather than just trying to apply for jobs

[smoky hemlock]

So I’m studying cybersecurity principles and network administration right now. I am also using tryhackme to advance my skills. I am trying to earn an entry level position as IT support or help desk. What are the skills specifically associated with IT support?

[ember cedar]

To the pros out there, genuinely asking, what will be the better OS to rock cyber security in penetration testing? I heard that linux will mainly become the OS, but should I go with mac machine or windows machine to run the linux OS?

I’ve been confused for quite a while, any help will be very helpful. thank you

[flat sedge]

Honestly doesn't matter. Having a good methodology is infinitely more important than having the perfect distro.

You can build and install tooling, you can only build methodology through experience.

[ember cedar]

It’s good to know that having the right skills will eventually solve tooling issues.

However, I guess having a good investment will help lessen the confusion since I am still new at this. Maybe from this point of view, any preferences or considerations?

[flat sedge]

Not really. OS choice might be of more importance for specific devices, but I think it's better to focus on learning how to use one of the OSes (or distros, flavors, etc) for penetration testing. Understanding how the tooling you needs interacts with your OS will also teach a lot about how things work as well. Including drivers and permissions.

[ember cedar]

I see then, so it is better to stick for what i have now and to learn with it thoroughly, since all OSes work with pen tests on their own ways right?

[warm mauve]

Will a certificate help me get a better collage?

[fickle grove]

certificate on what exactly?

[warm mauve]

Like "Cyber Security 101" 😅

[fickle grove]

If I am understanding your question correctly, I don't think it will impact your college application.

[warm mauve]

Oh, alright 😅

[rugged delta]

Your college application is going to be based on your previous academic performance, and in the US, how much money you have, or can borrow

[warm mauve]

Got it, Thanks for the information.

[rugged delta]

But, you can still learn a lot by doing rooms/paths in THM, if cybersecurity is a route you want to pursue academically

[warm mauve]

Yeah, I am currently starting "Cyber Security 101" as my basic/foundation.

[turbid walrus]

OS doesn’t matter but I would recommend staying away from the silicon chips. I have witnessed and experienced to many problems since they have issues working with .exe files

[flat sedge]

honestly, you are still new enough to it that you could swap without losing anything really

[shrewd sable]

Any one here that they are already cracked cybersecuruty job in india?

[wanton arrow]

Hi there! I'm getting interested into the GRC analyst role. I don't have any experience in cyber sec or IT field. Do you guys have tips where i should start with? I was considering to do the cybersec google certification but i don't know if is worth it. I will wait for your replies and thank you in advance!!

[hardy harbor]

It does. I'm currently in the 4th module and I can confirm it worth it. I already have Sec+, Net+ and CCNA, and if I have to recommend an starting point for someone without any IT related experience I would always recommend it. Even I'm enjoying it, it's just the way the course is designed, adds a lot of value. Downside of it, is that it is not recognized as much as other entry-level certs, but in terms of knowledge it is the perfect starting point.

[wanton arrow]

thank you so much! im aware of the fact that is not super important as certification but i need that mostly in terms of knowledge. Can i make you some questions in private if is not a problem for you?

[serene umbra]

Gave +1 Rep to @hardy harbor (current: #1386 - 3)

[blazing wyvern]

if you had to refresh your knowledge in the quickest/efficient way for web app security. what would you guys recommend? review of web fundamentals path and OWASP Top 10?

[hardy harbor]

Sure anytime

[wide mica]

What’s the quickest way to get a decent job in the tech field ,IT?

[stoic cave]

Depends. Do you have a degree? Assuming you don't have prior professional experience, in any industry, based on what you're asking

[wide mica]

been a train operator for 11 yrs, did 5 years of supervision in those 5/ help desk type/ assignments office stuff.

no degree/ college drop out 12 units from associates

part of accident committee, training team, other bs titles

was thinking the quickest way would be to get the network+ cert, apply for an entry lvl IT job

[stoic cave]

You wouldn't need any certifications if you're applying for tier 1 helpdesk

You should be able to explain what the parts of a computer are, what they do, how to replace them if necessary, and troubleshooting processes. If you're not able to do that, I would probably recommend A+

The biggest thing that will help you in the long term is to relate your current experience to the job you're applying for

[wide mica]

im not sure if tier 1 would pay the bills

[stoic cave]

Entry level IT is tier 1. That's why I mentioned that it was important to leverage past experience, as it can get you past that entry point.

[wide mica]

im thinking 65k a year or a better would be the lowest i could for a couple of yrs

does tier 1 pay that much?

(usa)

[stoic cave]

Depends on location and a bunch of other factors

[wide mica]

california

what other factors to consider?

thanks for your answers btw @stoic cave

[serene umbra]

Gave +1 Rep to @stoic cave (current: #20 - 503)

[stoic cave]

You're going to need to do research here. California is still too broad, you're going to need to look in your specific locale. Other factors include what other experience you bring, the organization itself, etc

[wide mica]

yep, well not rdy yet still wanna finish thm/ get the sec+ maybe a+ do some bug bounties/ hit HTB

then find a path

[stoic cave]

Right, but that is in my opinion, spending money just to spend money.

Certifications without a degree or prior professional experience don't really do anything. They're used to quantify said professional experience and don't necessarily stand on their own.

[wide mica]

right

[stoic cave]

You need to build your professional experience if you're not going to do a degree

[wide mica]

so

actually the help desk lvl 1 is not bad in my area

[lilac fulcrum]

You could easily do a LinkedIn survey of what helpdesk jobs pay in your area on average.

See what people ask for and what they want out out a hire and tailor your study to that

[wide mica]

Ah ok cool

[lilac fulcrum]

I'd honestly say helpdesk is like 20% technical skill. Knowing how to talk to people and explain things is more important.

[ember cedar]

Thank you @flat sedge @turbid walrus

[serene umbra]

Gave +1 Rep to @flat sedge (current: #11 - 829)

[tall frigate]

i think you're onto something here, not sure if I'd say its 20% but agree its very important. You may know this, but for anyone that doesn't, how you work with others on your team is incredibly important to management. What some may call "little things", like smiling when passing someone or acknowledging someone's presence is often noticed, and can create a healthier work environment. ")

[hardy harbor]

100%. I had a mentor that told me that it is easier to address a technical knowledge gap than some other skills like empathy, collaboration, kindness, communication, etc.

[tall frigate]

Sounds like you had an insightful mentor. For most of my adult life (which legally is only about all of 10 years XD) I had a skewed view on what mattered most to employers. Yes it’s important you’re qualified for the job, but there will likely be many candidates that are qualified for the job. What sets them apart is largely the skills you mentioned, and a good hiring manager will notice the “little things”, and choose the candidate with the skills you mentioned over one they didn’t observe with those skills. Which leads to first impressions and interviews, but that’s a whole other story! XD

[lilac fulcrum]

Good IT interviewers have always asked me technical questions they didn’t really expect an answer to. Just to see how you could talk through it and break down your thought process.

[wide mica]

@stoic cave can I dm you a question ?

Been looking into companies in my area and have a friend in one that could refer me , but would like to see your thoughts on the possible qualification w just A+

[stoic cave]

No, sorry, I prefer conversations to remain here in order to benefit the community.

[olive relic]

Anybody here have any experience hiring for entry-level Cybersecurity jobs?

[stoic cave]

If you have a question, I would just ask it

[olive relic]

I will just ask my question but my question is really intended for employers.

I’m new to Cybersecurity and have decided on blue team.

What’s certifications, skills, experiences etc will stand out the best when trying to land an entry-level blue team position?

I have a lot of spare time on my hands and my primary focus is to build a collection of skills that will put me above the competition. I’m not interested in sitting in a pool of applicants applying for 300+ jobs.

Employers, what will make someone stand out who’s trying to enter?

[wide mica]

Ah ok - np

[ancient prairie]

people with IT/helpdesk backgrounds or general curiosity/enthusiasm always stand out to me - otherwise I don't look at resumes and just administer technical assessments which gives people a chance to shine regardless of background

probably not the advice you are looking for but generally be able to actually do the thing you are applying to do, which sounds obvious but it really isn't based on the people I sometimes interview

[wide mica]

Besides an A+ cert , what other certs would help get an interview ? Sec+?

(Don’t have a degree)

(For IT tier 1)

[ancient prairie]

CompTIA trifecta is always advisable, but if I was in your position (which I previously was) you are much better off spending time attending conferences and networking

[wide mica]

What would be the third to complete the trifecta ?

That’s a big ass cup of comp Tia I gotta drink !

https://tenor.com/view/dynamite-thirst-gif-25897410

[wide mica]

Any websites good for tracking upcoming local conferences ? I’m in Southern California

[ancient prairie]

infosec conferences is the main one, depending where in SoCal you should almost definitely have some local DefCon/Bsides/hacker meet-up groups nearby

[wide mica]

Never heard of besides

Defcon is wen

[rugged delta]

BSides was created in Vegas to run the same week as Black Hat/DEFCON because a lot of people had great talks that didn't make the cut for those other conferences. BSides refers to the b side of a record... There might be one near you somewhere in the world
https://www.google.com/maps/d/embed?mid=1SVstK4xuz46-3tcOrKlGBzQh_Og&ll=18.035300090585988%2C-53.521324499999935&z=3

[lilac fulcrum]

This is great info

I'm in the position of being a decade into being an Level 2-3 IT guy looking to convert to Cyber security probably SOC work. Its hard to get anyone to take me seriously as anything but IT

[keen tundra]

Wow I didn't know about this at all . Thanks for sharing 🙂

[serene umbra]

Gave +1 Rep to @rugged delta (current: #21 - 491)

[olive relic]

This was a really helpful answer, I appreciate it!

[kindred prairie]

Lol 😂

[kindred prairie]

Have you looked into volunteering opportunities? Might be good to get some experience on your resume.

I am anticipating getting the comptia trifecta… right now though, if I don’t pass both a+ tests by September, I am going to focus on network+ and then circle back to a+ when there are more study materials for the new version of the exam

[golden spoke]

gonna need some certs or projects or do a masters in cyber and intern during that time

[kindred prairie]

I have also been studying python, and worrying that I’m doing more of that than I should be since it takes away from my cert study time

[kindred prairie]

I would love an example of the type of project someone would do to enhance a resume when they have no infosec job experience and want to get hired in infosec

[static heron]

I guess it depends somewhat on what sub-branch you're aiming for. If you just want to get your foot in the door in a SOC, idk what you do, but it probably helps if you used to be an eve online player. Or a triage nurse!

• Set up ELK stack / sysmon / veeam / pfsense and log problems and solutions encountered
• Configure nginx until it gets an A+ on ssllabs
• Get an old consumer router and practice cracking WPS and WEP; blog
• Write a script that hashes new processes and queries virustotal
• Explore static/dynamic analysis tools (windbg, pestudio, ghidra, hybrid analysis, joe sandbox) and blog about things that come up
• Explore adversary simulation/emulation tools, stage a security incident in your lab, work through an incident response playbook, and write a report

(I happen to think these are almost kind of cool ideas (or not entirely terrible ideas) but I also have never hired anyone and am guessing)

[cunning badger]

guys, what do you think about PJPT certification? Is it a good certification for find a job?

[lilac fulcrum]

These are good ideas. I have my a+ sec+ and some MS certs. Working on the CySA ands the SOC path on THM. Trying to do some experiments on my own with those topics as I go.

[kindred prairie]

Thanks @static heron

[serene umbra]

Gave +1 Rep to @static heron (current: #243 - 32)

[dusty veldt]

thats alot of certifications. Do you have a job in cybersecurity field or you are trying to get some experience through THM?

[lilac fulcrum]

I've been in level 2/3 IT support for over ten years. Trying to make a transition.

[dusty veldt]

wow. I graduated in graphic design and recently aquired security+ and trying to get into cybersecurity field. I feel hopeless after hearing 10 years

[lilac fulcrum]

I mean I've only been trying to transition actively in the last year or two

[dusty veldt]

[severe arch]

Hey everyone! It's been 24 days since I transitioned from healthcare to TryHackMe, and I have no prior IT experience. My goal is to work in cybersecurity, but I'm wondering if I should start with certifications like CompTIA A+, Network+, and Security+ to build a solid theoretical foundation.

For those who’ve been through this journey, do you think these certs are necessary before diving deeper into platforms like TryHackMe? Or does TryHackMe provide enough foundational knowledge for someone starting from scratch?

I’d love to hear your thoughts and advice!

[rustic depot]

Network + and Security + are gonna be some strong ones I personally reccomend
but you can also go through 'Pre-Security' to get a primer on some of those subjects

Also get a cheap raspberry pi and VM Workstation // Virtual Box to play with what you learn

[rustic depot]

Congrats on the Sec+

[dusty veldt]

hey bull, I think certificcations definetly helps with theoretical knowledge while tryhackme helps with grasping the practicality of projects.

[severe arch]

Thanks

[serene umbra]

Gave +1 Rep to @dusty veldt (current: #2795 - 1)

[severe arch]

Thanks

[rustic depot]

Something I should also add is basically there are not a ton of junior positions for quite a bit that doesnt mean there is no hope
My friend who used to be Chief of sec for a big platform shared this with me and helped me better understand the Cyber job market
https://tisiphone.net/2025/04/01/lesley-what-happened-to-the-cybersecurity-skills-shortage/

[nocturne temple]

I have a question:
I want to learn AI red teaming / AI security specialist and also aiming to use AI tools for hacking. Can you help or guide me on the jobs I could target for in Canada? And any mentors who are active on this field please help and guide me. I'm really passionate about this field and would like to explore the possibilities.

Please tag me when replying.

[rustic depot]

Not to discourage but I def thing with hardwork we can make it ✊

[severe arch]

I understand

[dusty veldt]

👋 yes to hard work

[nocturne temple]

What's the best approach into AI security? And what jobs can be targeted?

[rustic depot]

AI red teaming is a topic that I am seeing on some platforms
maybe that might be a topic of search

DevSecOps maybe?

[keen tundra]

Don't rush for the certification straight away , use free resources like THM and try to learn as much as you can for the beginning 🙂

[severe arch]

Thanks

[serene umbra]

Gave +1 Rep to @keen tundra (current: #1 - 4395)

[kindred prairie]

How would the raspberry pi be used?

[nocturne temple]

This sounds promising. How to structure my approach into this field? And what jobs can be targeted?

[rustic depot]

basic web server, you can play with and reconfigure for vulnerabilities.
Its the start of something called a "homelab" gives you the abilities to make your own network
of devices to experiment and play with to give you that practice experience

[rustic depot]

AI cybersecurity analyst
GenAI Security Engineer
AI Redteamer

All different specialties but with AI involvement

[kindred prairie]

Thanks @rustic depot

[serene umbra]

Gave +1 Rep to @rustic depot (current: #2795 - 1)

[nocturne temple]

Is there job possibility without experience persons in this field in Canada especially?

[rustic depot]

YOU MEAN WITHOUT CYBER SECURITY?

[nocturne temple]

Thank you so much for your insights, really appreciate you guiding me.

[serene umbra]

Gave +1 Rep to @rustic depot (current: #1388 - 3)

[rustic depot]

You mean without cybersecurity?

[nocturne temple]

I know... but when I did a LinkedIn search on few job titles I couldn't find any in Canada.

[verbal plaza]

Hi everyone, I have a question regarding the cybersecurity career. I'm currently a rising junior (undergrad) and I'm interested in cybersecurity and plan to look for internships next summer. What would yall recommend as the best approach for preparation? I'm starting with Cybersecurity 101 currently and plan to do Sec+ this summer

I took an enterprise security course this semester at school - planning to self-study over this summer vacation, current plan is tryhackme & hackthebox + cert(s)

[slow sandal]

Hey guys

[rugged delta]

Seems like a good progression path. There's lots of stuff in THM to keep you busy. The Sec+ generally takes people 2-3 months to study/prepare for, but do it at your own pace. Keep progressing with what you're doing and you'll be in a good position. You'll see the variety of roles available in the field as you progress, but most people start out doing helpdesk/tech support/IT/programming roles on the way to cybersecurity, and in cyber, most will begin in a SOC role and progress through from there. There are always opportunities to show your growing abilities in other ways, such as project work, blogs, writeups, participating in CTFs, and bug bounties as your skills grow and you progress. Take your time enjoying the journey

[soft drum]

Anybody here been to a security conference before? How was your experience? I'm attending one this year because my university is covering the cost of tickets, this will be my first time ever attending one

[cunning grove]

Should I learn the blue team or the red team, I'm confused I like the red team but there aren't a lot of entry level jobs

[keen tundra]

Depends in which path do you want to pursue a career . Maybe it is a bit easier to get a job on a blue side 🙂

[glacial rampart]

Dm sir

[cunning grove]

Blue team is kinda boring for me, but I also have to get a job first

I'm soo confused

What rooms do I have to learn? My college doesn't have a specialization for cyber security, i have to rely on the internet totally and there's a ton of knowledge i get confused

[west python]

which country are you from

[keen tundra]

Which field are you interested in the most 🙂 ?

[cunning grove]

I'm interested in the red team
But entry level jobs are hard to find🙂

[keen tundra]

You can ask here so users witg the same/similar problem can find solution in the future 🙂

[cunning grove]

Me?

[keen tundra]

bug bounty or pentesting ?

[west python]

Entry level jobs are always hard to find

[cunning grove]

Pentesting for a job and bug bounty for passive income

Kinda both

[west python]

they want experience in entry level jobs as well lol

[cunning grove]

Everyone has manipulated me for a job in the red team you'll have to gain experience and many certifications

[cunning grove]

I'm from India. The education system is so old and dead. I don't even study the college curriculum a bit there's no specialization in cyber sec

[finite estuary]

when u thought u are good at sth, theres always an underpaid indian out there better than u

[west python]

Yes you will need certification but not many'

Indians are fucking genius

[cunning grove]

Can you tell me which one's?

[cunning grove]

I agree but not because of their college specially in cyber sec

[west python]

for SOC analyst ?

[cunning grove]

I'm not talking about Indians, I'm talking about the education system of India

[cunning grove]

What should I choose an analyst or pentest, i personally wanna go with pentesting

[west python]

Cyber security applicants are less, but most of the openings fills internally

[cunning grove]

ig have to learn both

[cunning grove]

I see a lot of dudes without skills getting hired because of reference from inside the company

[west python]

I am in Sales, but want to switch to IT

IDK how many years it will take

[cunning grove]

You won't believe there was a friend of mine, who don't even know how to put windows 10 in a computer and still secured a job as a soc analyst

[cunning grove]

Depends how fast you learn

[west python]

my background is commerece

hahaha

[cunning grove]

My bg is biology

But I didn't like to do boring stuff like nursing....

[west python]

yeah i did biology in 12th from UP Board hahah

[cunning grove]

12th from patna👍🏻

Then i shifted to delhi

[west python]

Greater Noida

[cunning grove]

As you said saled, i guessed 80% chances are that you're from greater noida

[west python]

why

i work in delhi

[cunning grove]

There are a lot of dude shifting to noida for sales or call centre jobs

[west python]

sales are everywhere

[cunning grove]

Ig you live near mg road or iffco chowk

[cunning grove]

Agree

[west python]

CrompTIA Security+

[cunning grove]

Tell me what I should learn first, soc analyst or pentest?

[cunning grove]

I have taken an Udemy course for this, after some time I will buy the exam vouchers

[west python]

Idk bro, i just realized 1 hour ago that i can be a Cybersecurity analyst lol

[cunning grove]

After an hour you'll probably think this was just a mistake, jk

[keen tundra]

Check out Jr.Pentester path on THM 🙂
https://tryhackme.com/path/outline/jrpenetrationtester

[west python]

Udemy certifican will not gonna help

[cunning grove]

Then?

Udemy just for learning I will buy the comptia sec+ exam voucher

[cunning grove]

I'll check

[west python]

google which certifications will help

[cunning grove]

Sec+, Ceh
It costs a lot🙂

[west python]

yeah good for dollar guys

[cunning grove]

And my family is not that kinda supportive of this course

[west python]

i will also purchase but later when prepared with this

okay love you

[cunning grove]

Same here

[cunning grove]

Love you too dude👍🏻

[west python]

i am choosing less coding

and i guess SOC is one

[cunning grove]

yes but with coding you'll have a upper hand

[west python]

I dont know anything about coding

it will be like learn from Apple

B for Ball

[cunning grove]

know one knows coding or anything from birth you'll learn if you want to

[west python]

hmm we will see it later, Getting inside is tough if backround is not technical

[cunning grove]

+1

[west python]

that is why COMptia is imp

if have money

and can pass

[cunning grove]

certs are always good

[west python]

if they comes with less price

[cunning grove]

but they don't

[keen tundra]

Please don't advertise here 🙂

[unique gyro]

hello fellas, Is the cybersecurity industry stressful?

im finding my pathway

thank u!

[finite estuary]

do ctfs give out certs or just an awards

[bright sequoia]

Ohh...I'm sorry I didn't know.

[keen tundra]

Which CTFs ?

[keen tundra]

It's ok 🙂

[bright sequoia]

👍

[gleaming rampart]

Hi you guys. My work just asked me if there are any certifications I wanted to get and I was wondering what the best ones are. I don't even have security+ right now

[stoic cave]

You should get the certification(s) that directly relate to your current role first

Best is also subjective

[gleaming rampart]

it akes sense that its objective. they are actually asked me what department i was interested in moving into and if i wanted any certifications to support that

so i guess idk i can start with security+ i guess

i know certifications are more for proving what you already know

i guess

i was also considering either software or network engineer too lol its hard to choose so i don't even know if im gonna go this way. this is more of a hobby i thought lol

they said any of the above is possible lol

Its kinda funny that somtimes you get really good at one thing so they start trying to figure out what you should do instead lol

[kindred prairie]

Check out the free professor messer videos for security+. There is also a discord for study groups.

[lilac fulcrum]

sec+ or network+ will probably apply to jsut about any network or security job

[verbal plaza]

Thanks for this! Would a Sec+ and THM experience be enough to qualify for intern-level positions, or is there anything else you recommend I do?

[serene umbra]

Gave +1 Rep to @rugged delta (current: #21 - 492)

[verbal plaza]

I don’t have US citizenship as well, I’m Australian. I’m worried that can affect my future internships / jobs as well

[ancient prairie]

Its a bit niche but Australians are great for large international orgs with SOCs/NOCs because of timezone and you will also be able to easily coordinate with any Asian counterparts

[tall frigate]

I didn’t know this, thanks.

[serene umbra]

Gave +1 Rep to @ancient prairie (current: #43 - 220)

[south oriole]

yes we can

[olive relic]

I’m down @ionic shore

[verbal plaza]

That sounds good! However I'm studying in the US and looking for jobs in the US, but open to jobs in AU if things don't work out here

I'm curious as for what level of skills are expected for intern-level roles?

[flat sedge]

None

Internships are focused on learning and giving a student a sample of what life in that department is like

Interns should be doing a mix of work that is drudgery and fun, so that a balanced view of the life is seen and experienced.

It's also a try out for both the company and intern for who is a good potential fit for a permanent role

[warm rapids]

Transitioning from software dev to cyber security... currently doing the Cyber Security 101 path on TryHackMe and some CTFs here and there. Any tips or suggestions?

[rugged delta]

Keep going with your studies. The paths are a great way to develop your skills in a gradual and guided way. Take a look at roles in your region to see the kinds of skills and qualifications they're looking for and gradually work towards them. While I believe it's an employer's duty to provide education/certifications, some organisations may require you to hold certs for various roles. You may still be expected to have pursued a particular cert with your own effort

[warm rapids]

thank you for the guidance... i'll consider it surely

[serene umbra]

Gave +1 Rep to @rugged delta (current: #21 - 493)

[fossil summit]

If I complete jr penetration tester path on thm, how many chances do I have to find job?

[broken idol]

Not likely, unless you have a good network.7

[fossil summit]

i am going to do this path, then CPTS and then apply for jobs

[sleek otter]

Same here, 3 yrs as software dev switching to cybersecurity. I did the google cybersecurity cert. Thinking of doing one of the compTIA coz it seems HTB and google cert is not enough for job 😦
May the force be with us

[sleek otter]

I agree with you, in interview they want hands-on-experience but most company ask for certs so without them we don't get shortlisted, interview comes next. Right ! Maybe HTB or Home labs comes next. Maybe I am wrong

Yea, I was thinking of preparing for sec+ (I started blogging my sec+ journey with notes, might be helpful to others: https://gourabdg47.github.io/) then prep for SAL1 coz of hands-on soc experience, lets see where the universe takes me. Cheers

awsm, do share once deployed

[lone abyss]

Guys will certifications from IBM get u a job?

[sleek otter]

Dam, this is really great

[lone abyss]

Do you know where I can build cybersecurity projects from?

[hardy harbor]

I had heard that Forage is a good way to get some experience, as it offers like intership experience, but I haven't try it yet.

[knotty bridge]

is that like a remote thing?

[rain hedge]

@stable coyote @willow gate is there someone I could chat with about potential podcast sponsorships?

[broken idol]

Reach out to support.

[crude sphinx]

TryHackMe's Email

TryHackMe's support email address.

​

[e-mail]

TryHackMe Socials · Apr 7, 2025, 3:14 PM

[merry steppe]

I’m asking about the OSCP can anyone here give me a good path to pass the exam !

[rain hedge]

Thanks!

[serene umbra]

Gave +1 Rep to @broken idol (current: #2 - 3609)

[wanton arrow]

For someone who doesn't have IT experience and want eventually to work in cybersec field, should i start from comptia A+? i'm reading a lot of roadmap on internet but im so confused from the different opinions haha

[keen tundra]

Do you have any experience with cyber security 🙂 ?

[merry steppe]

I started tow months ago and about to complete the jrpenetration tester path

[dusty raft]

Hello, I want to be a Cloud Security Engineer and I started with the red team part of the job, but I know that I need to look at the blue team and cloud technologies, are there any resources you can recommend?

[raw pelican]

Don't know if anyone has looked into the isc2 website, but they're offering free training and exam for entry-level in cybersecurity if anyone is still at beginner level. Definitely worth looking into! (https://www.isc2.org/landing/1mcc)

[keen tundra]

Check out SOC 1 and 2 paths 🙂
https://tryhackme.com/path/outline/soclevel1
https://tryhackme.com/path/outline/soclevel2

[merry steppe]

@keen tundra

[keen tundra]

You're on a great path , keep up the good work 🙂

[wanton arrow]

up

[sacred lintel]

I have completed the jr pentesting path in tryhackme , made numerous python scripts regarding keylogger , port scanner but Im still unable to get an internship can someone guide me??

[dusty raft]

Is Soc2 path really required to become a Cloud Security Engineer?

If so, I'll learn it, no problem.

But wouldn't it make more sense to finish the cyber security engineer and devsecops paths first?

[keen tundra]

It isn't required but it is a great resource to learn from 🙂

[hardy harbor]

I'd try getting a cert or even completing other THM paths to continue gaining knowledge until one intership lands.

[quaint wren]

Hi guys, I’m sure this is asked often but: I’m 20, a few years ago I went to a semester of college but due to family issues had to drop out. I started self-studying security a few months ago and am currently on the jr pen tester path. I’m thinking about going to college next Fall, but at the same time if I could land a relatively well-paying job by the end of this year I feel like that might be better overall for my future.

Would starting college severely slow my career progression compared to just studying and going for certs? As of right now I’m studying 16+ hours a week minimum and I feel like I have a decent grasp of all the info I’ve been exposed to so far

I should say that I would prefer to go to college as I do want that life experience, but my main goal is for the quickest progression of my career.

[verbal plaza]

Thanks for this!

[serene umbra]

Gave +1 Rep to @flat sedge (current: #11 - 831)

[night notch]

Thoughts on getting a masters in Cyber Security? I'm a veteran (U.S.) so it's paid for. I have an IT and tech background and am concurrently working on getting my CEH, OSCP, and a couple of other certifications.

[hardy harbor]

Once someone told me, if you want to be a practitioner go for certs and if you want to become a manager in this field go for the Master. Hope it helps

[gleaming meadow]

Sorry if this comes off as whining or anything, but I just wanted to throw this out there and see if I can get some advice or responses. I have an associates and bachelors in cybersecurity and networking. I put going for my masters on hold for right now, but do plan on perusing it. I have a few certs (still studying for CySA+ since I have a voucher) and have hands on SOC experience through my college. I am struggling with finding anything in the field though. I know that it is saturated, but after hundreds of rejections I can’t help but feel like maybe it’s me or partially me. Has anyone else been experiencing the woes of the job hunt and if so what are you doing to get past it? For those who did find an opportunity what advice do you have for us still searching?

[rustic atlas]

Well shoot

My degree is not fully related but I’ve been struggling to find an internship too

[rustic atlas]

What about projects, IT work?

[ancient prairie]

If you are getting hundreds of rejections then yes, it is most likely you. If you are getting interviews but not making it past those, you likely need to work on your interviewing skills. If you are not getting callbacks/interviews at all you need to either work on your resume (maintain a master copy and tweak on a per-job basis) and/or apply to more entry-level type roles (SOC, NOC, helpdesk, desktop technician, etc..)

Failing those factors work on networking and putting yourself out there; maintain a technical blog, contribute to notable FOSS projects, attend conferences/local meetups

[stoic cave]

You can post your resume here for review. Upload as an accepted image format as people don't want to have to download files. You will need to verify.

[crude sphinx]

Discord: How Do I Verify My TryHackMe Account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

Apr 7, 2025, 11:26 PM

[stoic cave]

What was your MOS/Rate? Can you expand on your IT/tech background?

[stoic cave]

If you have the ability to complete an accredited bachelors degree, I would do that. Degree holders generally make more than their non-degree counterparts, won't have issues applying for jobs where a degree is a contract requirement, etc etc. The thing with certifications is that they don't really stand on their own. They are meant to quantify professional experience. Your two best courses of action are likely going to be getting that degree or going out and getting a job now, ie on a Helpdesk, to build professional experience.

[night notch]

Oh I was infantry but I landed a help desk job right when I got out worked there while I got my degree in information systems and somehow pivoted to product management for a couple tech companies.

[night notch]

Yeah I agree. I should state, I’m getting a masters degree either way. I’m just wondering if the value is there to get it in Cyber Security

[stoic cave]

I personally don't know that I would get a Masters in Cybersecurity, there is too much variability in the curriculum between schools. You can definitely get a not great experience.

I'll defer to Juun, if they pop in, for your case.

[quaint wren]

Gotcha, I think I'll stick with the degree for now then and maybe find some type of part-time tech support role (though those seem rare). I just didn't know if I'd be slowing my career progression down drastically if I were to go for a degree

[stoic cave]

Nope

Look to see if your school offers a work study program

[quaint wren]

I'll be doing community college for the first 2 years, but I know the university I'll be going to for the last 2 years has a very good work study program

[jade reef]

The link says it is free only for U.S.

or is it merely stating the price is $ 0.00 ... ?

[south oriole]

Any cybersecurity related jobs in India, please let me know
Thanks

[keen tundra]

Try to check out #jobs-board 🙂

[lone abyss]

Oh yes I tried their simulation

For IAM SOLUTIONS

Thankyou

[loud urchin]

Hey I have a question. I found a Boolean-based Blind SQLi on a prestigious target but I couldn't extract any data because of the tough WAF. sqlmap constantly failed and none of both intermediate and advanced payloads worked. The web page crashes on true condition after 6-7 seconds delay but it loads normally on false condition. Do you think reporting this would get me recognition? I don't even care about money, I just need an LOR or something like that for reputation. What are my chances? Should I keep trying exploiting?

[fickle grove]

Do you have a permission to test it in the first place? Depending on where you are and your target, they might get back to you legally (which can land you to jail).

If it is a part of a bug bounty program, try posting it in #bug-bounty .

[heavy stag]

Wanted to ask if Security+ from CompTIA would be something I should get? I have an A+ already, problem is, no hiring manager so far that I went for job interview knew or ever heard of CompTIA, or thje A+/Sec+. Dunno if I should learn for knowledge and not get the cert, and instead pursue something more valuable, like oscp (and still learn for Sec+ for knowledge), or forget the certs all together. I live in Eastern Europe if that makes any difference.

[loud urchin]

Yeah I'm participating in their VDP, using their specific header in my requests with my own special token they gave me.

[dapper depot]

It is surprising to hear that HR hadn't heard of those certs. They are pretty standard baseline certifications to enter the IT and cyber fields around the world from my understanding.
I know certain certs are more valuable in different areas so perhaps check with people in your country before dedicating time and money to a specific one. I can't imagine sec+ would be a waste of time though.

[heavy stag]

I actually once asked pros from my countries about how I can approach this. They mentioned oscp as a choice. Though I realize that that exam is pretty though, hence why I wanted to "achieve" Security+ beforehand

[heavy stag]

because literally, so many hr people and people who are from cybersec I've talked about, never heard comptia certs, only 1 or 2 ppl

[dapper depot]

even people in the field hadn't heard of CompTIA? that's kind of unbelievable.
Mind sharing what country you're from?

[civic roost]

yo is "Tryhackme" an actual good source?

like if i finished the courses there

am i atleast average

in cybersec

[keen tundra]

Yeah it is

[idle pulsar]

HTB is definitely more advanced than THM in terms of machine difficulty

Both platforms are good and worth studying for

THM will teach you more or so from the ground up

for HTB, its better to go for it a little later

or you can just go for it from beginning, your choice

[gleaming meadow]

The feedback I keep getting is that they love my resume, they like the certs and degrees, but they don’t like the fact that I do not have any paid IT experience. Across the board that’s been the unanimous answer so far.

[terse merlin]

Hey guys I'd like some feedback if possible.

So I'm about 2 years into my first IT Job, Helpdesk role.

I have Network+ and CCNA that I studied for during my time here, and now pursuing Sec+, I'll have it in about 2 months I think.

in the mean time I've been applying for non helpdesk roles (mainly looking for network related roles and also browsing / saving SOC roles for future reference) and also just started doing home labs.

I just finished setting up Splunk and Sysmon on a Win10 VM and tried delivering reverse shell payload via a Kali VM, then checking out the logs generated in Splunk.

My question is should I put this in my CV, it feels like a tiny project where I didn't do much, perhaps I should expand on the project and cinfigure more stuff / add to it before I do so?

[heavy rover]

I would still definitely put it on your resume as a project. The easiest thing to do would be stating it and leaving it more as a talking piece in interviews so that you show you know what you are talking about

[terse merlin]

aye that makes sense. shouldn't sell myself short i suppose

[ancient prairie]

you can create utilize a "Personal Development" section in your resume for things like this - and yes I would definitely try to expand on this project a bit more, try to stand up a full AD environment and begin running through common exploits and full triage afterwards, then document your findings in a technical blog somewhere to solidify your knowledge and work you put in

[gentle urchin]

Can anyone help, and suggestions for my resume??

And I'm looking for an internship, does anyone have any lead

??

[coral wharf]

Hello all i want to ask that How did most of cyber security analyst/engineer got in the field through certificates or degree

[rancid yew]

Hey guys, I'm currently studying for the the CompTIA Sec+ after having completed the Google Cybersecurity Pro Cert on Coursera and passing ISC2 CC Exam.
Would it be better for me to start with the Network+ or CCNA to get a strong foundation in networking? Or is the Sec+ not that heavy with the networking stuff. My networking experince just stems from a LinkedIn short course and some coursework. I would appreciate any feedback I could get.

[civic roost]

might be replying too late but i know python fundametals , lua and ive gone kinda deep into game development using gdscript which is very close to python do u think all this past knowledge might help in this field?

[olive relic]

Anybody here help with resumes at all?

I’ve been working as a Behavior Technician the past 6 years and don’t necessarily feel that my skills are applicable to cyber for future entry level work. How do I go about incorporating the fact that I do in fact have many years of professional experience without listing work experience not relevant to cyber?

[terse merlin]

hmm alright I'll do some research tonight. cheers for the guidance

[ancient prairie]

I believe you can post a redacted image of your resume here for review - I dont really know what a Behavior Technician does but I would wager you have developed some soft skills or maybe have led a team/project/initiative all of which can translate into cyber

[proud bison]

Have you tried working with ChatGPT ? It does wonders

[olive relic]

To expand further. Cyber is something new for me but I fully plan to get relevant certifications for blue team and “hands on” experiences that I can add to my resume to help land entry level.

[olive relic]

@proud bison I did try ChatGPT but the answer I got there was very much along the lines of “yes of course you can add new skills on your resume!” Which was not helping much lol

[static heron]

That totally sounds like it translates into social engineering aptitude or something, so if it doesn't, just remove details until it does, lol

[heavy stag]

sorry for not responding, I live in Lithuania. The only people who heard about CompTIA certs were my cybersec teacher in the university and everyone else was like "What's that?"

[broken idol]

Hi @sleek abyss we don't allow help with acedemic work, or survays to protect the our members, also helping with acedemic work is against our community rules.

[olive relic]

Yes, everything is under HIPPA compliance. Six years, no violations. Never occurred to me that might be valuable. That was helpful, thank you!

[serene umbra]

Gave +1 Rep to @cunning warren (current: #1121 - 4)

[wanton arrow]

is comptia A+ important for cybersec or should i skip it and go for security +?

[rugged delta]

If you're new to IT, you should definitely understand all the content in the A+ study guide, as well as the Network+ and Security+. You can cover all the content in Professor Messer's free content, for instance. CompTIA certs are good theory sources. While the certs are not essential, being able to demonstrate an understanding of what they teach can be important to particular recruiters. CompTIA certs are considered junior level theory in most instances; essential knowledge in the space but you'll be expected to go much deeper as you progress

[wanton arrow]

thank you so much for your time! 🙂

[serene umbra]

Gave +1 Rep to @rugged delta (current: #21 - 495)

[spring kraken]

what is the current situation of job market in cybersec

[icy wasp]

hey I'm looking for some honest opinion/advice... I'm aiming towards a carreer on DFIR and I'm a beginner in the subject. Is the THM premium subscription the way to go?

[wraith vault]

Anyone have any advice on how to go about taking certifications if you can't afford them?

[undone shore]

Get someone else to pay for them. i.e., your employer. Most certs are priced for companies, not individuals

[wraith vault]

The thing is that I'm not employed at an IT job atm and I don't think my current job will pay for them but I'll check.

[undone shore]

Well, you might be out of luck then.
I would work on getting an IT job and using that to pivot into cyber, potentially via certs.

[rancid yew]

Anyone has any advice about the CompTIA Sec+ and Network+? I'm currently studying for the Security+ but am still deciding between getting it first or the Network+ first. I've watched NetworkChuck's video about Cybersecurity roadmap in 2025 and he recommended on taking the Security+ then the Network+. Does anyone have any suggestions about that?

[sharp torrent]

do you really really ned it?

[rancid yew]

I heard it's really beneficial to get for ppl starting out in the field so I'm aiming to get it.

[sharp torrent]

just get a lot of experience first(not in jobs)

[rancid yew]

I'm pretty new to the field but I have received the Google Cybersecurity Cert from coursera and passed the ISC2 CC exam, also been doing TryHackMe here and there.
But how would you recommend that I do that, to gain more experience?

[sharp torrent]

oh dude, if you're new to the field, i PERSONALLY would advise you to not reach for a job yet.. but rather get your hands dirty with hacking(just do a lot(whatever it is, just do it so you can learn from mistakes))..
either red or blue team.. or maybe you want do go another route in this field, such as reverse engineering or whatever..

[sharp torrent]

but keep in mind that there is no "right way" to do anything.. you kind of have to find a way to do how it's best for you

[rancid yew]

I appreciate the feedback. I'm aiming to get into the red team with the pentesting. I know that cybersecurity is a vast field and there are so many stuff to learn, but i'm really passionate about it and want to reach my goal. Thanks again!

[serene umbra]

Gave +1 Rep to @sharp torrent (current: #2798 - 1)

[rancid yew]

Thanks Triv! I have been watching some of his videos and they are really beneficial. Also I have heard a lot about Jason Dion so I'll definitely check him out as well.

[sharp torrent]

no problem 🙂 and just so you know, THM has A LOT of good stuff!
i've started getting active on THM 2 weeks ago to refresh a bit here and there and as i do some of these rooms, i keep thinking to myself "oh wow, this is really insightful! beginners are gonna need and love this"

[rancid yew]

Tell me about it! Icl, THM has really helped me become familiar with many of the core topics at the beginning ever since I got into cybersecurity. The gamification of the modules really makes it fun to learn and definitely a valuable source for beginners.

[quartz trellis]

hey, starting last year i got very eager to learn about itsec and get a job in cybersec at some point.
i am currently a sysadmin with focus on network and itsec in germany, started working at my current role a bit over 2 years ago and finished my apprenticeship in 2022.

as for now, i can not decide what exactly i wanna do for a living.
red teaming, blue teaming.. equally interesting for me. how did you decide?

[karmic badger]

Has one used or heard of ITcareer switch?

[fossil summit]

can someone tell me how's the every day life of a penetration tester or blue teamer?

[rugged delta]

Most people entering the cybersecurity profession will move from a role like yours into a SOC position to begin with, as many orgs are required to perform risk management and security to a certain standard. The knowledge in the SOC 1 & 2 paths are good for beginning in such a position. Certs like the SAL1, BTL1, etc. can be good indicators of your ability to operate in such a role.

Red teaming/pentesting is a highly competitive area, usually requiring a lot of knowledge of Windows/Linux/networks and various applications/systems. The OSCP certification is usually considered a good demonstration of your abilities for a junior pentesting position, but you will have a lot more to learn as you progress.

While certain certifications like OSCP/CISSP/CISA/CISM might be frequent prerequisites, they can be quite costly and some employers will facilitate your training/certification. Many others will expect you to have a certain minimum level of qualification before that stage. You can also do things like making a blog about your activities, having a home lab (some old computers/a few virtual machines/cloud environment, etc.), participating in CTFs, bug bounties, conferences, meetups; various activities to help show your participation in the community.

Meeting people working in the field, or in organisations that have a cybersecurity division can help significantly in your job search. The skills you learn in red/blue roles can facilitate moving to other roles in the field as you progress. I'd suggest reading some of the interviews with cybersec professionals in the Tribe of Hackers books by Marcus J. Carey, or reading some of the success stories from the THM blog:
https://tryhackme.com/resources/success-story

[glad zephyr]

Okay people need your opinions here-
I have an electronics degree from a tier-1 college, but with a low GPA due to disinterest in circuit design. After graduating, I aimed to get any job and, thanks to a Python-heavy internship at a startup, landed a role on the blue team at a financial firm. Since there was no prior cybersecurity setup (everything was managed by a Big4 consultancy), I got broad exposure across InfoSec and discovered I really enjoy the field.

Over 2 years, I went from not knowing what an IP address is to conducting secure architecture reviews. I’ve earned Security+ and CEH and handled policy fine-tuning for DLP, EDR, proxy, firewall, and other security tools. However, the team relies heavily on MSSPs and has limited technical depth, so I feel I’ve outgrown my current environment.

Now, I’m applying to mid-level roles, but most require 24x7 SOC experience, which I lack since our MSSP handled that. I’m torn between quitting to fully focus on advanced certs like CySA+ and OSCP, or staying until I get another offer. Early in my career, I could manage studying while working, but now with more responsibility and tougher material, I think taking a break to upskill might be more effective—even without a job lined up. What’s the better move?

[undone shore]

For a start, I'd avoid calling CySA+ and OSCP "advanced certs" when you're interviewing...

[glad zephyr]

Noted👍

[undone shore]

If you've been doing sec architecture in your current role then I would suggest aiming for those roles when you move. See if you can get your current org to put you through your CISSP (assuming you've got the prerequisites). That should help there.

I'd usually ping Zojja here, but uh, she's taken the mod strike one step further and outright left lmao

[glad zephyr]

My CISO actually offered me the same, but I am 23, don't wanna get into management so soon and without having any hands on red-teaming experience

[undone shore]

Why would CISSP force you into management?

[glad zephyr]

imo CISSP is generally done by those aiming for CISO position

[rugged delta]

Pursuing the OSCP would be a good thing to aim for, it's mostly a prerequisite for many pentesting teams. You'll likely need to do more to get into pentesting; perhaps participation in CTFs, maintaining a blog, partaking in conferences/meetups, or networking with people in the field. OSCP is a junior pentesting cert, but yes, there is the expectation you have a lot of IT knowledge already, which your current role indicates, at least up front.

[undone shore]

I mean, it can be used for that, but that's not its only purpose.
It's good for demonstrating a mile wide, inch deep knowledge of cyber. That's a good foundation for security architecture, which you then build on with specifics -- e.g., AWS / Azure / GCP security certifications, or equivalent accreditations in other areas (kubernetes, VMware, etc. Whatever you're using).

[neat garden]

Anyone knows a good place to look for remote junior pentester jobs in EU? I have tried few platforms and there is nothing there.
Yes I have checked LinkedIn. There are no entry level positions and searching on it for positions outside of the country of residence is a true nightmare.

[glad zephyr]

agreed, now that I have started to follow more content about offsec I see that college sophmores are getting OSCP. So the bar is high

[undone shore]

Gonna struggle with that one I think.
Local conferences are probably your best bet. People are less inclined to hire remote juniors than they are to hire remote seniors though, for obvious reasons.

Do you have previous IT experience?

[neat garden]

Yes I have. I just need a chance :/

[rugged delta]

Well OSCP level knowledge is going to just be expected, and having/maintaining the OSCP+ will be an expectation for a lot of organisations. A lot of orgs will help facilitate the expenses of such things, but you might be expected to contribute, and/or remain in a role for a certain period as well

[neat garden]

I did go to few conferences but companies there mostly advertise themselves and do not look for workers

[undone shore]

Doing what?

[neat garden]

Administrating, DevSecOps, Programming( a bit) and some risk management.

oh and testing

[undone shore]

Okay, that's a good basis. So how are you presenting that when you apply for pentest jobs?

[neat garden]

I don't, because there are no entry job positions and for mid and senior everyone thanks me without even inviting me to interviews.

[serene umbra]

Gave +1 Rep to @undone shore (current: #10 - 868)

[neat garden]

You know the drill. Thank you for reaching out but we look for someone more experienced, blablabla automatic emails.

That's what I get when applying for mid/senior roles because that are the only ones visible on job platforms.

[undone shore]

Are you only looking at remote roles?

[neat garden]

No

[ancient prairie]

which ones? every b-sides I've been to typically has resume review/mock interviews and have found a lot of folks practically begging to fill roles in their company

Its a bit hard to say where you might be going wrong without seeing your resume and knowing what are the exact job titles and roles you are applying for

ah nvm I saw you are applying in the EU for junior pentesting roles, all I can say is good luck, its a small market over there with a ton of regulatory oversight and knowledge needed which makes things more difficult - it may not be what you want to do but would highly encourage you to look for entry-level SOC roles within an international org, follow-the-sun models of operation require competent EU folk so the US counterparts can sleep soundly lol

[fierce belfry]

im making a career change from mechanic to it, im currently a master diagnostic tech that my body is giving out on me, ive been kinda a foot in & foot out with trying to become a soc analyst, i understand that i would have to work my way up again but would it be better to go back to help desk and work my way up or get a bachlor's and try to go into it with no experience? any advise would be amazing 🙂

[neat garden]

confidence, sekurak

[split tapir]

Is SAL1 interesting for a lot of big names?

I kinda want to get SAL1 after Security+

And then maybe CCNA

Does that sound like a asolid plan?

[ancient prairie]

apply for both SOC positions and helpdesk/desktop tech/junior sysadmin, realistically general IT jobs will get your foot in the door to security either but theres nothing stopping you from "jumping the line" as long as you have the technical knowledge and ability

as an aside I see that seasoned mechanics generally have excellent analytical skills so you will fit in nicely with whatever role you find in cyber 🙂

[sterile lodge]

Other then App Sec what other roles mix well with transitioning from SWE? Id still like to code and it looks like detection engineering is a good area?

[ancient prairie]

DevSecOps is generally a good transition - DetEng would be a good fit too depending on the maturity of the team and if they are already utilizing some sort of Agile practice

[sterile lodge]

I've been recently working on a small little SaaS that monitors webhooks and slowly adding security driven features like HMAC verification log auditing with logflare/vector all containerized to be built up with Docker. And its been pretty fun so far

Idk if its a good "highlightable" project

I am just unsure if it comes off as odd since I have about ten years of exp. half as IT/SysAdmin and the other as a dev. So I am not sure where I fit in exactly.

[ancient prairie]

You have an ideal background to transition to cyber so your success will really be dependent on your actual skillset - as for that project it doesn't hurt to file in a "Professional Development" section but is probably overkill given that you have enough experience to build out a respectable resume that will generate callbacks

[hardy harbor]

Sounds good! People usually starts with Networking skills, but there are no rights or wrongs in this. Whatever works for your goals.

[sterile lodge]

I am working my way through security + but I am not really sure what to work towards afterwards and what recruiters/potential employees look for with my skillset?

[ancient prairie]

Sec+ is helpful but not totally necessary with your experience - assuming you apply for a DetEng role you most likely will be fine from a SWE pov, there is a lot of overlap, however you will need to shore up your incident response skills to really be effective

I dont keep up with certs and typically dont really look at resumes much since I typically administer technical assessments for candidates so I'm not really the best informed on what you need nowadays to get past the initial screening

I would assume GIAC certs are still the gold standard in that regard, I don't know of any other hands-on certs that really cater towards blue team and have widespread name recognition - hopefully SAL1 will get there

[sterile lodge]

I guess I can start by looking into the Incident Response related rooms on THM. Is there a good source on building your resume in how to format/ what recruiters are looking for?

My current resume is mostly tech stacks and development related projects and I think I need to better highlight my IT experience now.

[wise valley]

hi guys was hoping i could get some guidance. i’m currently a second year studying comp sci, but i realised i wish to pursue cyber. any tips in starting out you can share with a friend? any help will be appreciated 😊starting from 0 here as i have no prior experience

[keen tundra]

It is pretty new certification , we need to give it some time to gain recognition 🙂

[keen tundra]

You can follow this roadmap from TryHackMe 🙂
https://tryhackme.com/hacktivities

[wise valley]

thanks alot 😊

[serene umbra]

Gave +1 Rep to @keen tundra (current: #1 - 4466)

[lethal cloud]

Finish your degree, do some THM, and work as a developer for a year or two. Then you’ll be in a great position to be an Application or Product Security Engineer.

[lusty nest]

hey guys I'm pretty new to cyber security right now im taking the google coursera cyber security course im a little over halfway finished im wondering what everyone thinks of it and additional steps i should be taking to get into a cyber security position thanks guys

[viscid mauve]

hey guys newbie here & too in cyber sec learning

i have recently made a noob kinda direnumerator tool

would like suggestions and improvements -

[sterile lodge]

Honestly at its base its just automatic memory management(Garbage Collection) is something done for you in high level languages and in low level languages you can control the allocation/deallocation for performance gains. This is the way I've always looked at it because the only other big difference is direct hardware access(low level) vs not(high level)

Beyond that its just levels of abstraction

[split tapir]

Well, at least I'm sure it will verify my practical skills

Cause Comptia Sec+ theoretical

Given how good THM is in general

[crude lichen]

Hey everyone I’m in the middle of a career pivot from a non technical field. I passed my sec + recently but I think I eventually want to end up in a more technical devsecops or security engineering role however as we all know, entry level roles don’t exist in this space.

Ive been wondering if I should shift my focus to learning AWS and getting a AWS developer cert. I do a lot of python projects on my own, would switching to cloud now be a better way of getting an entry level job where I could eventually pivot to a security role?

[rapid marsh]

If anyones familiar with cyber careers in the military I could use some advice here.

I am looking at the DOD 8140 Directive that outlines these qualifications needed for a cybersecurity role as a comissioned officer. I plan to USNCC my associates in CyberSec from WGU and then STA21 the rest to a bachelors degree with a focus on Cyber Analysis as this would keep me primarily shore based, however want my package to be as competitive as possible so I would like to go after qualifications as well.

Looking at the qualifications required as only certain partners meet the guidelines set by the DoD for the qualifications, who would I go with in this instance? as the DoD doesn't offer there own course, the certifications I would need are:

CEH (Certified Ethical Hacker
CFR (CyberSec First Responder)
GCIA (GIAC Certified Intrusion Analyst)
GCIH (GIAC Certified Incident Handler)

Note I only need one of these coupled with my bachelors to comission the route I want to take.

[safe crag]

Need some SANS advice from y'all.. these are the 4 I'm considering getting, ordered from most desirable to least.

SEC511
SEC573
SEC598
FOR498

This will be my first SANS cert.. any advice on which one to pursue or any other really solid courses I might have missed?

[fickle grove]

Who will pay for the exam / training fee (as SANS / GIAC ones are too expensive to pay out of pocket)?

[spring kraken]

is bug bounty hunting a lucrative career choice?
how difficult is it for a beginner to get started and start finding bugs?

[fickle grove]

Before looking at certifications, can you give a brief overview of your background and interests? It's hard to say without really knowing anything as context is just as important

[safe crag]

Sure, I'm a security engineer in purple team threat hunting/incident response space. Interested in upskilling think AI attack chains, mitre frameworks, any kind of "new" threat landscapes. I have a background in netsec, appsec and a fair bit of reverse engineering.

[fickle grove]

Will your employer be footing the bill for you if you happen to select one?

[safe crag]

Yeah

[civic roost]

sup , im currently 14 yo trying to get into the field early , i have prior experience in game dev which prob helps a bit after searching a bit about cybersecurity , im kind of into pen testing (i know this might be cringy and every single beginner prob thought the same but ye i jus like it)

im thinking of going with the pen tester thm roadmap , but alot of youtubers said its just not enough and idk they just said these companies are scams etc , also i thought about doing pre-security and then the secruity+ course but yeah i cant even take the exam at my age lol.

any suggestions?

[tall frigate]

First suggestion is always stay ethical, don’t get you or your parents in trouble. Second just go through the THM paths and pursue self learning, you have 3-4 years of YouTube university & internet learning before you can do much else.

[rugged delta]

Bug bounty hunting is a good way to learn and develop your web pentesting skills, but pay is unreliable. While you will see that there are people who have earned millions, you need to take into account that competition can be quite fierce at times, and there may be a lot of people trying to find the same bugs you are on the same targets. When you do find a bug, you might not be the first to submit it, your submission might not be up to their standard, or they might just lie to you, tell you it's already been claimed and use your findings to claim it themselves (so there can be some dishonesty out there).

Also, many bug bounties have low payout levels, so expect to need to make several submissions per day (5-10 perhaps) to have a decent chance of payouts, and some bounties only become available once youi've achieved certain reputation on a platform like HackerOne, or Bugcrowd

[stoic cave]

So you're not currently in?

[stoic cave]

No and very difficult. The vast majority of people participating either don't see money at all or very little. It's a very unstable source of income.

[civic roost]

Is thm paths worth the time tho ? I'm kinda scared of wasting time on it and then realising it's not useful

[stoic cave]

Finish school and be a kid. You're not going to be able to work in the field since you're under 18. You can't sign contracts. Pentesting also isn't entry level to cybersecurity, which isn't entry level to the computer industry, so you're going to need to work your way up in the industry once you're the appropriate age. Do THM and some other learning for fun, but you need to focus on the near term which is graduating high school and being young.

[forest holly]

But he could just do bug bounty hunting on hackerone or similar sites?

And say he didn't get a job, he can spend his free time doing CTF competitions, which isn't only fun and helps in the learning process but he can also get prizes from it

The idea of "you're too young to start learning" is just broken, there's no age limit for learning anything, if he understands it then why not

[forest holly]

You're talking as if the life of a human starts at 18, if he already has experience in bug bounty he doesn't need to start his career from the absolute bottom.
Also how is cyber security supposed to be entry to the computer industry anyways?

[spring kraken]

reaching a point where you're finding 5-10 bugs a day sounds difficult

[forest holly]

Reaching a point where you're finding 1 or more bugs a day sounds difficult

[rugged delta]

Yes, of course it's going to be challenging. Sometimes you'll find a lot of the low hanging fruit, but since you're working with real, active client systems out there in the world, and you are on a bug bounty, you can expect that the target organisation is instituting the bug bounty because they have made significant investments in security, but in the tools and systems that they roll out, and in the polocies they have in place to make their environment secure. They want it to be hard for you, because they want to know whether they're actually secure. If you can pick apart their web apps, the know they're very vulnerable. You'll only have a limited scope in most cases, because they'll have similar bugs throughout their enterprise and knowing a certain insecure behaviour exists means they'll have to probably stamp out the same setups in multiple places.

If you find bugs, you might get a reward, and some people do, but those people who do get multiple payouts, and who do hit the million dollar mark are working at a rate where they can comfortably deliver 5-10 results in a working day, probably within 5-6 hours, which is about the amount of time you'd probablty spend hacking as a pentester several days a week, and how much you should probably be studying if you're doing a big cert

[fringe spade]

That's some awful piece of advice... If they want to start early, then why not? In multiple countries it's possible to work with parents permission, so scoring any type of job or an internship before turning 18 is a huge headstart.

[spring kraken]

that was my line of thought as well
that if they're rolling out a bug bounty, they probably think about their security quite a little bit, and so finding a bug would be difficult

however, how often do you find low hanging fruits still?

[tall frigate]

you're likely to get helpful advice for this in this channel

@tame lagoon do you have a list of the job responsibilites/duties/skills required? Is it hardware or logical based IT work?

[tame lagoon]

yes i know what the responsibilities and skills are, like laptop imaging, IT asset management etc. its IT hardware. i have hands-on experince of months on IT hardware, configuration and troubleshooting. but im afraid ill forget evrything

i dont think this is solely IT hardware. there will be a panel interview. i know i can do the job but im just nervous about the interview

[tall frigate]

my advice as someone whose interviewed multiple times with different HM's in the past 6 months: dont overcomplicate things. Bring notes. Smile, greet everyone, even if just a smile/nod. Be familiar with PXE boots since you'll likely be doing that for imaging laptops. Try to discover what software they use for asset management. Do something that gets you active and blood pumping the day/night before you interview, it will help stimulate your brain and relax you.

always expect the obvious, use the OSI model for troubleshooting (layer 1 physical, layer 2 data link, layer 3 network, etc.)

be able to talk about the boot order in BIOS, some laptops may not image properly if the boot order isnt correct. In my current position I do a lot of reimaging, so not exactly the same - but being able to talk about it will help you stand out of other interviewers

[tame lagoon]

ngl thats some solid advice.

[tall frigate]

are they chromebooks?

most of reimaging i do is related to problems due to low storage, so knowing how to do a powerwash of a chromebook may prove useful - ctrl+atl+shift+r

[tame lagoon]

but i dont know anything about laptop imaging, my role is more like asisting them with (Re)imaging and IT asset management, distribuition, etc. and i didnt know i could bring notes? wouldnt it be awkward to looka t notes and then like look at them or turn pages or something ?

not chrombooks, they are dell and microsoft laptops.

[tall frigate]

from my experience, having notes is a good sign to HM's - shows you are trying to be prepared. Don't look at them while theyre talking tho

[tame lagoon]

HM?

[tall frigate]

hiring manager

[tall frigate]

ok, since you likely wont be able to tell how they reimage (likely pxe or using a usb drive to image) learn about them both

[tame lagoon]

oh its with IT operation leader and engineer i think and maybe HR, not 100 percent sure

[tall frigate]

sorry, when i say HM i just mean the person who is interviewing you. Im probably not using that term correctly

[tame lagoon]

oh alright, what about the general questions? are they gonna ask the famous "tell me about yourself" or "strenght and weaknessess"?

ahh no problem

[tall frigate]

another thing, never respond to a question with "i dont know", its okay if you dont know something - dont lie, but a better response would be "i havent tried that yet, but im excited to learn more about [x]"

[tall frigate]

sooo thats super important, and likely the first question they will ask

[tame lagoon]

i agree!

[tall frigate]

good response is concise, without oversharing, and nothing too personal. Give yourself a title like "im an IT specialist with experience doing [xyz], eager to get more hands on experience and help [insert their mission statement]

[tame lagoon]

errr so i have to tell them about me. i think background, name, experience and course i do would be a good start for first question?

[tall frigate]

yes

avoid talking about your personal life

in my opinion

[tame lagoon]

yeah i dont plan to, that wont be relevant

[stoic cave]

You can say you don't know. After saying you don't know, respond further with how you would go about getting the information needed to either learn or complete the question/task they gave you.

[tall frigate]

something that may prove super helpful as well is drafting some practice questions/responses for yourself and having something like chat-gpt read the questions/responses you've drafted aloud - so you can practice verbalizing your responses.

[tame lagoon]

i will google

[tame lagoon]

yes i'll do that i have it prepared but its just my first interview, my mind is calm but my heart isnt. quite odd

[tall frigate]

totally normal, i think you'll do great given you have experience and are preparing beforehand

[tame lagoon]

i think so. and is it okay to redact names of other members from a document before sharing it with the HM? for privacy reasons.

[storm spindle]

Hi everyone! Anyone from Wiltshire, England, UK?

[spring kraken]

@keen tundra

[obsidian rose]

@broken idol Sorry for the ping, I think there's a bot here. Or some sort of spam.

[spring kraken]

they seem to really want to help everyone today

[obsidian rose]

How generous

[tame lagoon]

lmao

dm for a yes or no question

[tardy lance]

Is that person spreading malicious python script?

[keen tundra]

Don't interact with him , they usually have malicious intentions 🙂

[tardy lance]

I have came across someone before and get him banned from a different server.

[spring kraken]

@keen tundra Can you do some KGB stuff on them

[tardy lance]

I am asking. I don't come across anyone in THM

[keen tundra]

He's mutted for now , upper management may take further actions 🙂

[spring kraken]

coming from someone with your nickname, i wouldn't want to be in the wrong end of upper management

(ik i've made this joke several times now)

[weary beacon]

hello everyone, hope everyone saturday is going well.

any fun careers to talk about

[serene umbra]

Gave +1 Rep to @obsidian rose (current: #508 - 12)

[bleak egret]

CCNP worth? Dm pls

[rapid marsh]

I’m am currently in

[rapid marsh]

The navy has certifications programs like navycool that would cover the exams and training I simply just need to express interest

[obsidian rose]

Only if you want a long term job as a System/Network engineer/admin

Not worth it for CSec

[wanton mesa]

Hey everyone! I’ve been working as a caregiver for the past couple of years, but recently I decided to transition into cybersecurity — specifically aiming to become a SOC Analyst.

I’m currently earning my Bachelor’s degree in Cybersecurity and Computer Science (should graduate by May 2026), and I’ve been grinding through TryHackMe rooms and the free roadmap in my spare time to build up hands-on skills.

Still early in my journey, but I’m really enjoying the learning process and want to take this seriously. If anyone here made a similar switch from a non-tech background or has tips on getting started in SOC roles, I’d really appreciate any advice. Thanks in advance!

[fickle grove]

If you aren't certain yet whether you prefer the blue or red side of things, GCIH could be good, but if you are leaning more towards DFIR, GCIA would be great.

[rapid marsh]

I believe red side of things would be better for me, protecting americas interests and keeping her and her allies safe from adversaries wishing to cause undue harm sounds more up my alley.

But I still would like to explore both and see which im actually able to comprehend better

[bleak egret]

Thanks for reply bro,

[serene umbra]

Gave +1 Rep to @obsidian rose (current: #306 - 22)

[dire palm]

To pursue a carrier in cyber security, Which should we choose between bachelor of computer science or bachelor of cyber security??
Which will be best and suitable? please give some advice.

[gloomy mortar]

4 years is a long time! Take some time to think away from the computer and do your preferred option

[lunar sail]

In my opinion skill is more valuable than degree so if you want a job I suggest you upgrade your skill and bug bounty companies will increase their hiring rate when they see the skill more than a degree

[undone shore]

You, uh, know many companies which focus on bug bounties?

Doesn't seem like a sustainable business model

[lunar sail]

Huh?

Bug bounty and skill he was talking about degree

@undone shore

[undone shore]

You said (and I quote), "bug bounty companies will increase their hiring rate".

Are you suggesting that they will be hired by a company with the express job description of completing bug bounties?

[lone abyss]

Guys what certificate I should get after cybersecurity fundamentals

Please

[spring kraken]

what do you mean by "cybesecurity fundamentals"

[obsidian rose]

None. Fundamentals are not enough for you to directly target professional certifications. Learn more first.

[stoic cave]

"That's some awful piece of advice..."

Cool, great way to respond to someone. Let me ask, are you currently working in the industry? If so, how long? Based on your message, I am going to assume that you're on the younger side, potentially. Please read further to see my responses to your response.

"If they want to start early, then why not?"

I did not outright say they couldn't start, I said they could do THM for fun, but anything past that would be unrealistic, in my opinion, given their age.

"In multiple countries it's possible to work with parents permission, so scoring any type of job or an internship before turning 18 is a huge headstart."

You're correct in that it is possible to work with parents permission in some countries. However they come with strict laws, using the US as an example, regarding the use of children in the workforce. Everything from where they are allowed to work, how they are allowed to work, how long they are allowed to work, etc etc. Then you have the states adding additional requirements, such as needing to obtain permission from the school in addition to the parents permission. All of this, and more, is only a portion of the legal aspect. 

Getting into the risk aspect, no sane business would hire a minor to do high risk tasks, ie pentesting. Mistakes, that they would not be able to be held liable for given they are a minor, can lead to real consequences that can harm the business financially, their reputation, etc. I am not even sure business insurance would cover a business hiring a minor in that capacity either.

[stoic cave]

From the business' perspective, why would they hire a minor when they could hire a FTE? They won't be able to support traditional working hours. You mention internships, which do exist for those in high school, but they are typically reserved for students in the back half of their high school education and accommodations are made in their school schedules to support that. On top of that, cybersecurity internships (not just pentesting) are highly competitive and few, typically requiring you to be in higher education and over 18.

Closing Thoughts

My recommendation to focus on completing schooling first and focusing on being a kid still stands (and it's the same advice I've given to people in my 3+ years as a community mentor here on THM). They need to complete school in order to even get to the next step, so they should focus on it. You only get one life, so be a kid while you still can, don't just sit inside on a computer missing out on life. Getting those life experiences, while simultaneously working on things like social skills, will help you when it's actually time to work a job and better prepare you for life ahead.

[stoic cave]

Given the fact you're currently in, I would talk to people running the STA-21 program or a local rep if you have one, for questions. They are going to be able to give you a better idea of the ins and outs of the program and what is actually available to you. I would also try to find any mustang(s) in and around your duty location to get their perspective(s) and path(s).

[stoic cave]

"But he could just do bug bounty hunting on hackerone or similar sites?"

They would need to check their TOS and EULA as well as the legal documents of organizations putting themselves on said sites. You need to be of the appropriate age for all of that. On top of that, if the program does allow minors, they would need to get their parents to sign any legal documentation. This permission would need to be given with the understanding they they would be held legally and financially responsible for all actions conducted by their child. Any violations of scope could/would result in legal actions against the parents and saying "little johnny didn't know" isn't a viable defense.

[stoic cave]

"And say he didn't get a job, he can spend his free time doing CTF competitions, which isn't only fun and helps in the learning process but he can also get prizes from it"

They said "get into the field early." When someone discusses the field they are in, they are typically discussing their employment, unless they're literally standing in a field. You can compete in CTFs, but I wouldn't go into one expecting to earn a prize. CTFs are also not really representative of real life.

[stoic cave]

"The idea of "you're too young to start learning" is just broken, there's no age limit for learning anything, if he understands it then why not"

I didn't say that, I even said that they could do THM for fun. The advice I give and have given here on THM is based on reality and setting realistic expectations. It's not just the understanding part, which they will have pieces of, it's the whole picture. There is more to it than just "knowing how to hack."

[forest holly]

Yeah, so what?

[stoic cave]

"You're talking as if the life of a human starts at 18, if he already has experience in bug bounty he doesn't need to start his career from the absolute bottom."

For all intents and purposes, surrounding working in a professional corporate setting, it does. I also wouldn't consider bug bounty professional experience unless the individual is consistently reporting valid bugs (not automated scanner stuff) or putting together novel attack chains/discovering new exploits.

[stoic cave]

"Also how is cyber security supposed to be entry to the computer industry anyways?"

Cybersecurity is not entry to the industry, meaning the computer industry as a whole. Entry for the computer industry can in be found in IT, ie Helpdesk roles. For cybersecurity roles, you're expected to bring a base set of knowledge and have prior professional experience in the computer industry. Degrees can shift the timeline a little bit and also open up opportunities that you can take straight out of school to get into cyber.

[lapis cairn]

50 years in Java and looking for 18 year olds is the normal

Also holy u wrote a lot

[stoic cave]

Job postings are often not written by the technical team. In a lot of cases, they're asked what they're looking for in general and then those asks get passed over to HR. They are not necessarily technical people, which is how you get those postings.

[lapis cairn]

Yeah, that's true most of the time

[stoic cave]

When it comes to applying for said roles, I would look and see if there is a level attached to the role, ie Level 4 Engineer, or use role names to try and parse what they're actually looking for. If say, they're looking for a principal, that role is likely looking for someone with 10+ years of experience in the area they are in.

As for entry cyber roles asking for experience, they're looking for people with degrees or prior professional experience in something like IT, ie sysadmin

Same idea when you see an entry pentest role. They're looking for people who've been in the cybersecurity space for a number of years as pentesting is a niche within the cyber industry

[lapis cairn]

Mm fair enough, but connections can help a lot too. But ofc it makes sense to look for very experienced ppl from the orgs view point

[stoic cave]

I was responding to multiple pings over the past few days, so that's why. Most of the time it's singular responses.

[stoic cave]

Which part are you saying "so what" to?

[kindred prairie]

Nice username lol

[dull sand]

I am thinking about, starting a career as a red teamer, focusing in social engineering and maybe ethical hacking, but it is kinda hard to find anything else than mere descriptions. Is there anyone here, that already has some real experience with this and can help me, understand this Type of Job better?

[keen tundra]

You can learn more about cyber security jobs on the link below 🙂
https://tryhackme.com/room/careersincyber

[serene umbra]

Gave +1 Rep to @obsidian rose (current: #257 - 29)

[haughty patio]

Hello guys, hope you are doing good.
I need your advice. I hold OSCP+, PNPT, eJPT and am an ex-maths teacher. I've never worked on the field. I've sent my resume nearly 60-70 companies around the world (mostly Europe), checking Linkedin/Glassdoor etc and nobody is returning back. I think my CV is polished nicely, though.

What would you advice me ?

Thanks in advance!

[quartz canyon]

so no real experience ? I see the best deal here is to search for a short-term internship, or start getting skills for helpdesk/IT_support roles

[neat garden]

How is OSCP different than OSCP+. Does someone look at the + when considering candidates for job position?

[neat garden]

I'm in the same spot. Sent hundreds of resumes and no one cares, but I have no certification. All I can advice to you is to not give up and keep trying.

[haughty patio]

They are not different, it's just how offsec names it.
Noone looks at the + for the job position.

[neat garden]

so what's the point of + in the first place?

[haughty patio]

I did that too, for the helpdesk roles they want x years experience, knowing lots of stuff..

[haughty patio]

Bro, you can just google Offsec's web site.
oscp+ is for 3 years. If you don't retake another exam in 3 years it turns into oscp.

[flat sedge]

The + is because certain orgs require certs to have an expiration and maintenance, to ensure up-to-date content and material

[neat garden]

seems like cash grab

cybersec is a field where everyone need to learn constantly or they lose position so I see no point in forceful reevaluation.

[quartz canyon]

@haughty patio maybe start bug hunting ? you can show your skills in pentesting/red_team in real world scenarios

[rapid marsh]

🙏

[cinder pagoda]

Cybersecurity is the future??

[stoic cave]

This is contradictory...

How are they going to be reevaluated if they aren't taking an exam (or obtain CPEs) to reevaluate their knowledge?

[errant anchor]

Hello guys, hope you're doing well.

• What do you think sets a cert apart from the rest?
• What makes you look at a cert and say: "Yeah, that's the one."?
  Would love to hear your takes - whether you've got one, working toward one, or just opinions to share!

[heavy rover]

Good Afternoon everyone, I just wanted to receive some feedback on my resume and some improvements I could make. I am having a hard time like many others finding a job and want to fix as many of the problems as possible! If you have any questions or personal feedback/advice feel free to respond/tag me/ or DM with anything at all. Thank you all for your time!

[blissful dagger]

if this is your real resume and you cant find a job im just gonna be erp admin for the rest of my life

[heavy rover]

i'm having my second interview on wednesday but i've been applying since January.

[blissful dagger]

what country do u live in??

[heavy rover]

US

[blissful dagger]

okay now everything's clear

[heavy rover]

time for me to cross the pond?

[blissful dagger]

if you cant find a job with resume as good as yours and you really want to get a job, i would consider doing that

but idk hows the job market in other countries aswell

except mine

your resume is impressive, keep applying and you'll get it sooner or later

[heavy rover]

i appreciate it a lot, thank you. just gonna keep putting my head down adn trying!

[blissful dagger]

keep up that attitude

[blissful dagger]

im looking at it again and if i were you i'd probably consider putting there more practical projects, and maybe even wait few months to get that round 1 year of computer systems analyst experience

[heavy rover]

I was thinking I should do a few more projects. I just want to make sure it stays around 1 page. I also agree with the 1 year of my job, I don't plan on leaving other than for a SOC analyst position that I'm trying to move up into. Thank you so much for the feedback!

[serene umbra]

Gave +1 Rep to @blissful dagger (current: #2801 - 1)

[blissful dagger]

you're welcome!

[amber blaze]

Hi everyone im a newcomer can i have some advice for a newbie?

[lone abyss]

Introduction to cybersec its needs, types of attacks ,defenses, jobs/roles ,future of cybersec alongside ai and quantum computing

Please can you advise me ,should I pursue cybersecurity with tryhackme learning modules for Jr penetration tester?

[neat garden]

I have no idea what to do and would want some opinions. Some time ago I did apply for a pentester position. I did go through 1st an 2nd stage of the recruitment and had appointment for 3rd one. Between each there was quite long time before answer but it did get to me after few days. Now recently I did participate in 3rd stage. Sadly there were technical issues on my side and we agreed to reschedule the meeting for different time. The person told me I would get the new appointment soon, maybe in 3-4 days from HR. Right now it is more or less a week and a half later from that time and I got no response.

Should I be bold and just write to their HR and ask about this appointment and if the position is still open?
Should I additionally ask for a feedback or not?
Or maybe it would be better not to write to them at all and consider it lost case?

I do not want to look desperate and be an ass. What would you people do in my place?

[olive relic]

What’s up y’all. I have a few questions relating to Cyber careers that I could use some help with. I’ve talked to some of you briefly.

1. Cyber is pretty new for me. THM is my first step into the field. Just finished my pre-security course. Most of my life so far I’ve worked in the healthcare field. As a Registered Behavior Technician. The primary population of people I’ve worked with have been children with Autism, ADHD, Down syndrome etc. Providing behavioral therapy. Everyday I spend time collecting and analyzing data in high pressure environments. Also, everything I’ve done over the past six years has been within HIPPA compliance / confidentiality. Is collecting data and maintaining confidentiality valued in this field? Would be worth mentioning in a future resume where I’m looking for entry level cyber work? (I’m going blue team. Hoping for SOC when I have the tools)

2. I’m planning to build a skill-set committed to blue team work. I somewhat-ish have a path planned for utilizing THM to accomplish that the best I can. My question is, once I get a bit further through paths, what should I really be focusing on? Meaning certifications and hands on skills / experiences?

Appreciate the help.

[dire moon]

What type of work are you looking for? Security Analyst, something within a SOC/Security function?

Professional Summary:
Where did you get 2 years of experience in IT? Writing "actively working to finish Bachelor's /.../" has a weird ring to it (imo); perhaps writing "currently finishing Bachelor's in Cybersecurity while working as a...". You give no real information or even mention your current employment; this is where you could shine a light on current skills, actual value and problems you have solved towards improving something. Good to mention certification taken, don't know about the rest ( i.e WordPress) - should be a bit more focused towards whatever you're searching for.

Professional Experience
No information under Computer Systems Analyst; here's your moment to shine. Write at least the same amount of information as you've done for your previous work. If you need to remove or shorten something do that with the other three.

Education
When did you start your Bachelor?

Training and Certs
Great to have, so good you have that on there. There are other awesome certifications i can also recommend; depending on the potential employer the more practical a cert is - the better and CompTIA arent really known for their cybersec specific practical certifications.

Pratical Projects
I wouldnt consider THMs SocSim a personal project. Like you guys already mentioned more personal projects would be a good idea. Setting up a lab environment, playing around with wazuh/splunk etc. are great starting points.

Goes without saying though: good overall resume. Short, concise and to the point. One pagers are always the way to go. Good luck on your second interview, you'll do great! 💪

[dire moon]

You should absolutely write to them and ask for an update on the third stage interview! There could be any number of reasons why it's taking time for them to respond.

Determination; not desperation. 😄

[dire moon]

" Is collecting data and maintaining confidentiality valued in this field? Would be worth mentioning in a future resume where I’m looking for entry level cyber work? (I’m going blue team. Hoping for SOC when I have the tools)"

Absolutely! However short you write it on your resume you can always expand on in during an interview.

Confidentiality and handling of sensitive information not only goes hand in hand with a Info/CyberSec culture within workplace/function/team but it's also most likely regulated within rules, laws and policies. So showing an understanding of that is always positive.

[raw pelican]

Nah it’s I’m in Europe so it worked for me.. you just have to cancel out any other product that doesn’t have a $0 amount in the cart and then you get it free.

[spring kraken]

if you go to the learning road map tab, you can see a recommended road map of doing the pathways
i will suggest you follow that as it is

while doing challenge rooms on the side to reinforce what you learn

[kindred flame]

You should wait like 2-3 days more if there is no response then you can email them

[fickle grove]

Go ahead and drop your question here. Someone who has an insight on it will surely respond.

[zinc girder]

If anyone knows of somewhere (UK) in the Hertfordshire to Edgeware/ north london area that would be able to take an A Level student for a Weeks work experience in June please @ me

[cobalt escarp]

Would love to hear some thoughts here^^ :)

[olive relic]

This was helpful, thank you!

[serene umbra]

Gave +1 Rep to @dire moon (current: #2803 - 1)

[dim goblet]

hi im an ongoing 2nd year college student in cybersecurity what are ways i can market myself after i graduate? i only know of credly with digital certificates, can you market yourself with a tryhackme account?

[wild stirrup]

Bele bele :3

[brittle pier]

Projects

[dim goblet]

ok

[dapper depot]

Good question. Is this in relation to SAL1?
In terms of entry level certs, I'd say applicability and notoriety/reputation. In other words, what cert is applicable to a range of positions and is most recognized or well know.

As an entry level job applicant you definitely want something that is plain and simple going to give you the best opportunity to land your first job. Just my two cents.

[jade reef]

I don't have any other $0 project/product in my kart... that's why it is more confusing

[raw pelican]

You should look at their certifications and then look at the entry level course and apply for their free training and exam offer, it should guide you through how to get it, which requires you to get an account with them..

[distant iris]

I’m a BTL1 holder and a long time premium subscription user is there any way I can still have a chance to try SAL 1 for free?

[keen tundra]

I think that this promotion ended on March 31st 😦

[distant iris]

ik but like if any possibility

any idea to whom to reach out is cool aswell

[keen tundra]

Follow THM socials and Discord server for new updates 🙂

[grave spruce]

3rd week in as a SOC analyst, feel free to ask me any questions.

[olive relic]

Do you work remotely or on-site?

[grave spruce]

I currently work on site standard office hours, but about to be 24/7 and so I'll be hybrid working, mostly from home and in the office for 4 in 16 days lol

[olive relic]

What kinds of hands on experience and certifications made you feel ready to start applying for SOC positions? Do you like it so far?

[grave spruce]

It was a bit of a leap, but I really wanted to move on from helpdesk work — I felt stuck in my last role. So I just applied for a position I came across. Honestly, with how competitive cyber is and the fact that this company is massive and has loads of awards, I didn’t think I’d get it, especially with my lack of experience. But yeah, I got it — and I love it. The company’s great and the people are super sharp, which helps keep the number of alerts low most of the time. That said, it can get busy and sometimes I have to drop what I’m doing to focus on triaging the alert queue.

It works out though, because it gives me time to focus on building my notes and knowledgebase for now — that’s my priority at the moment so I’m ready when it’s time to properly start triaging. I know others are keen for me to get stuck into triaging soon, so I’m aiming to get everything set up as quickly as I can. This will also help me in the long run when I become 24/7.

I don't hold any degree or fancy certs. I came from a military background, transitioned into IT helpdesk and completed an apprenticeship, where I went on to staying and doing tasks of a system engineer. I completed MS-900 and AZ-900 and I'm soon preparing for other certs like SC-200, AZ-500, etc. I may even consider SAL1 in the future.

And Sec+

I’d say experience is much more valuable than a degree or cert — those just prove you can do it when you probably already know you can. I think that’s what helped me land this role as a SOC Analyst. I was able to confidently answer questions based purely on hands-on experience. The way you speak, explain concepts, and communicate clearly with clients goes much further in my opinion.

[olive relic]

@grave spruce Sounds like your company has confidence in your abilities and also wants to help you learn new things which is awesome. This is helpful, I appreciate it.

24/7? Is that when you will be working Hybrid?

[dire moon]

Your company may already have a certification/education program they can help you with. If they don't but do want to assist in helping you (financially) with a certification I'd recommend a more hands on practical certification route i.e BTL1, SAL1 or maybe even CCD depending on your current role (rather than Sec+ and the like).

Congrats on your third week in cybersec, welcome to the fold! 💪 😄

[grave spruce]

Yes they are a Microsoft Partner and like to push us for Microsoft certifications. They have a list of vendors you can request, so because of this I'm unsure as to whether they'd be willing to fund the SAL1 course.

It would be sweet if they did though. I also noticed that SAL1 is marketed to helping people get into a SOC, so I'd have to assess how useful that would be to me down the line.

[dire moon]

Yeah if you've worked in a soc as an analyst for a bit you're quite comfortable with the SAL1 exam.

[slow abyss]

hi there,
hope you're doing fine. Am I at the right place if I need some help on "Nmap: The Basics" task 3 ?

[delicate nest]

This is for careers, you’re looking for #room-help

[slow abyss]

ok thanks 👍

[serene umbra]

Gave +1 Rep to @delicate nest (current: #2804 - 1)

[keen tundra]

Please don't advertise here 🙂

[keen tundra]

Thanks for sharing your xp 🙂

[serene umbra]

Gave +1 Rep to @grave spruce (current: #968 - 5)

[severe arch]

Hey everyone! 👋

I’m completely new to IT and just starting my journey. I don’t have any prior professional experience in the field, but I’ve recently been introduced to TryHackMe through a friend and I’m hooked! 😄

I just finished the Pre-Security Pathway and really enjoyed the hands-on learning. It’s confirmed for me that I want to pursue a career in cybersecurity. That said, I’m a bit unsure about the best path forward from here.

Given that I have no background in IT, do you all think I should try to start out in a Help Desk role to get my foot in the door and build foundational knowledge? Or is it possible to land an entry-level cybersecurity position without having prior IT experience?

I’d really appreciate any advice, personal stories, or guidance from those of you who’ve been through this or are currently working in the field. 🙏

Thanks in advance!

[grave spruce]

@severe arch Read my messages above

[errant anchor]

Hey! I appreciate you taking the time to share your thoughts - really helpful! 🙂 It's about certs in general.

When it comes to choosing the right cert, how do you figure out which one will actually give you the best chance? There are so many out there. Is it more about name recognition or proving you can actually think and work like a cyber professional?

[flat sedge]

Certs are a business thing, not an IC thing. Don't spend more than you absolutely have to to get into industry, because certs are how the business demonstrates competency for regulations, compliances, customers, etc.

If you really want to get certs as an entry point, look at the roles in your local area and see what the businesses are asking for

[viscid pulsar]

This could be a silly question, but for someone starting out with no knowledge, what is the best path to landing an entry level position in the field. I assume just using the rooms on this app won't be enough and will need to be paired with a college education?

[obsidian rose]

What part of the world are you from? It depends.

[viscid pulsar]

I'm in the midwest USA. Wisconsin specifically

[vivid thorn]

The cliche I've heard over an over again is that "there are no entry level cybersec positions because cybersec isn't an entry level field" and that has been my experience. You don't necessarily need a formal education to get into it but every little bit helps. I'm a Systems Engineer treated like a glorified Tier II, III, and IV helpdesk with no college education just a history of playing with Linux machines and I was smart enough to start my own LLC and "hire" myself as a sysadmin 6 years ago. I've got Sec+ and Pentest+. I have the knowledge to do lower level cyber jobs but all of my previous experience involved comitting crimes in high school that I don't necessarily want to cop to

[obsidian rose]

Oh ok. What part of CSec you wanna get into? Offensive or Defensive? It also depends

[viscid pulsar]

I'm a 25 year old construction worker that is tired of destroying my body. So this is my leap of faith at a career with longevity

[midnight ocean]

I agree with @vivid thorn , so long as you can show your skills, you should be able to find something without getting formal education. I went to college for programming, never graduated. Years later I was hired at an MSP in an entry level answering phones and help tickets. I've since been promoted to more field work stuff ie; setting up networks and the like. The leadership in my company hires for personality because they can teach tech.

[viscid pulsar]

Offensive definitely seems more interesting to me so far. It would seem that the offensive side of thing is more or less sub contracted in to different companies and would require travel, correct?

[obsidian rose]

Not necessarily. But you're lucky in you're in the US as a college degree isn't required as much.
For the path: Definitely start with the basics on THM. Learn networking/OS etc. Then get into pentesting.

You might have to start a job at a helpdesk or as a network/system admin but that's not universally the case.

For offensive security unfortunately it is VERY competitive. People are passing the OSCP to get into pentesting jobs.

[viscid pulsar]

I guess in the grand scheme of things it would be nice to get into offensive cyber security for sure, but with the position I'm in I want to gain experience through this app and the different rooms ( I have no problem paying premium if that is what it takes) so that I can get a job in the field because active working experience is always the best way to learn more.

[vivid thorn]

https://tenor.com/view/tiger-woods-tiger-woods-tiger-woods-big-dog-big-dog-gif-9857303185080451942

I also entered the tech field after being a lifelong hobbyist after leaving general labour. I was a crime scene cleaner and line cook

[obsidian rose]

This would never work in the EU, most specifically in France and Germany.
A Master's degree is a minimum as requirement, even with the OSCP.

If you have the OSCP but no degree, impossible in here.

[viscid pulsar]

General construction man. Everything from roofing, siding, drywall, floors, concrete, you name it, I've done it. "Hacking" has interested me since I got into video games as a young kid and I've always had an interest into this stuff. I'm glad to hear that degree's aren't universally required in the US becuase that seems to be more and more common which is sad because a lot of the time a degree doesn't necessarily hold as much value as hands on experience

[vivid thorn]

If you decide to go with a degree check out College Hacked and Degree Forum if you're a self-directed learner. They can help you get everything together to graduate with a Bachelors degree for under $10k and in way less than 4 years from legit accredited non-profit colleges. I'm on track to finish an IS & Project mgmt degree and when I graduate I'll have only been persuing it for 8 months

I'm a weird case though I had a lot of previous credits I was able to apply

[obsidian rose]

A degree is absolute trash compared to OSCP lol
I'd hire someone with OSCP anyday over someone with a master's degree
Unfortunately that's not how it works in the EU

Personally I focused on both degree and certs, and landed my first job ever in the CSec field at 22

Didn't have to work in anything related to help desk/ net/sysadmin before it

[vivid thorn]

Anyway I wandered in here to figure out how I GTFO of helpdesk. My titles keep getting fancier but that means I just end up at higher tiers of support and with more and more niche technology and I'm getting really frustrated trying to just land a SOC Analyst position even at a pay cut

[midnight ocean]

Does your company know you wanna do more?

[vivid thorn]

But it's given me better insight into the gaping holes in security that a lot of ERP hardware presents

[obsidian rose]

There's no way you can do it yourself - What I mean by this is that, after some time, you obviously have what it takes to switch. But your employer should do it for you (The switch)

[viscid pulsar]

I appreciate the insight guys. I'll make a note of those college options. Dag, I wish you luck in your pursuit!

[vivid thorn]

They've known from the moment I've been hired. I even set up the IAM system before they hired a dedicated person to do it that wasn't me for some reason.