cyber-and-careers

[severe furnace]

Like OWASP top 10?

[jaunty gorge]

Yep

[severe furnace]

I have seen some stuff on it but not confident

[jaunty gorge]

Learn all of that

[severe furnace]

By doing labs or watching videos?

[jaunty gorge]

Both

If u like think u good as it then go bug bounty or a ctf

Do a lab more better

[severe furnace]

Ohhh alright and where can I practice them? THM and TCM?

[jaunty gorge]

Portswigger

Have a ton of knowledge

And ut free

[fluid kindle]

Hey there, isn't the format in which portswigger has shifted to a bit confusing?

[jaunty gorge]

Not sure but it have a lot knowledge

Maybe tcm

[severe furnace]

I have not explored Portswigger yet. I will definitely do it today after my shift

[severe furnace]

There labs are good but difficult, I ended up just watching it but not doing the hands-on practice

[jaunty gorge]

Portswigger it easy to difficult

[severe furnace]

That is definitely helpful, thank you so much!

[jaunty gorge]

No problem 😃

[severe furnace]

[civic roost]

is jr pent tester considered a beginner path?

[obsidian rose]

Yes.

[craggy jay]

yep, but I don't know any good resources to learn from.

[dreamy surge]

i thought one has go for soc analyst and then jr pen like climbing the lader and the pen mostly req 2 to 3 yrs of exp

[obsidian rose]

Oh I thought you meant the jr pentest path on TryHackMe.

[dreamy surge]

what the best cert for an entry in to cybersec i am thinking sec+ but i am not to sure any thought's

[dreamy surge]

👍

[jade bough]

same i heard from u the first time , just googling and llm usage

[stone flume]

I'm also a language teacher hoping to change careers 🙂

[severe furnace]

Heyy, which one?

I teach English

Also I completely get it, the pay is shit the conditions are shittier 🙂

[azure crater]

I want to get into software and cyber infrastructure, but it is so hard without a degree

[spring swift]

I have a question, I hope this is the right channel. I have a BSc degree where in my honors year I took cyber security path where I learned the basics. I worked as software dev after that for 2 years.

Now I'm trying to get PT1 certification. I completed Presecurity and Cyber Security 101 modules and I tried a little bit of the current CTF, and I feel like I am not even close to being able to do that exam, even if I finish Jr Pentester module. My question is, will it be enough to take that exam after finishing Jr Pentester module?

Btw I did my MSc with major in Cyber Secuity, but didn't learn anything from there because yeah, that's the kind of univeristy it was.

The more "easy" rooms I try and can't solve, the more disappointed I get. I don't know if this is supposed to be normal at this stage or not.

[granite hornet]

my impression is the Sec+ is a decent starting place. It's affordable and covers some foundation concepts. CCIE would be more prestigious but correspondingly more difficult and expensive. There are some GIAC certs that look rather pricey. Some certs have industry experience prereqs, but anybody can sit the Sec+. Net+ could be worth working towards too.

[granite hornet]

maybe work more on defensive rather than offensive to begin with?

[spring swift]

Is that necessary?

I find the SOC path very boring.

[granite hornet]

if you want a job. You need to know what measures and countermeasures the blue team is employing. If it's boring you should be able to progress pretty quickly.

[spring swift]

So should I do soc level 1 module before going down the offensive path?

[granite hornet]

Yes. The other thing I would suggest is doing some supplementary reading in offensive techniques to fill in the knowledge gaps. There's a book called 'Go Hack Yourself' which is fun.

[spring swift]

Thanks. I will try to go down that route then.

[undone shore]

Oh God. Hot Potato, Juicy Potato, Rogue Potato, Sweet Potato, and now Charming Potato.

Too. Many. Potatoes.

[spring swift]

I just... love potatoes

[fair sleet]

Anyone have a line on some job openings, I can drop my resume

[unique sage]

Hello everyone.can someone help me ?is someone have experience or already run about decoding speech from neural signals.?like neu speech decoding or something like same thing.let me know if someone already has.thank you

[fervent haven]

Does annyone get job with PT1?

[keen tundra]

Check out #jobs-board 🙂

[tired minnow]

Right now I'm a student as you guys are experienced in Cybersecurity what you think of what you need the most. I would like a project for my college on this please help.

[sleek sedge]

Mr Potato

[tawny cedar]

Hi Guys, I already got 3 certificates now!
Im working on getting my 4th now; after that, I wanted to get the Google CyberSecurity Certificate and the CompTIA Security+.
Is that a good way? Let me know your opinions!

[full elm]

Don't go for Google cybersecurity

Comptia is good enough

[swift rain]

dose anyone completed ejpt certificate

[patent badge]

I'm doing CompTIA Security+

[obsidian rose]

https://tenor.com/view/pick-me-blake-shelton-the-voice-choose-me-over-here-gif-16888083

[tough ether]

Hello, I'm excited to be here and eager to learn while making connections in this field. I look forward to sharing ideas and collaborating to tackle challenges together.

[warm hinge]

Hey everyone! I'm just wrapping up the SOC Analyst 2 pathway on TryHackMe after completing the Google Cybersecurity Certificate and the ISC2 CC course. I'm currently deciding between pursuing the SAL1 certification or CompTIA Security+. For someone on a SOC analyst track, which one would you recommend as the better next step?

I'm a bit torn between going for the SAL1 cert on TryHackMe or the CompTIA Security+. From what I see, Security+ is more widely recognized by employers, but SAL1 seems to showcase more real-world, practical experience. For someone aiming for a SOC analyst role, which would carry more weight or open more doors?

Considering maybe just doing both, thoughts?

[exotic otter]

are there any good study resources? aside of obviously doing the tryhackme rooms?

[floral hollow]

I've seen a lot of people say professor messer on YouTube is good for comptia stuff. I'm only a noob too though

[granite hornet]

In these days of ai-driven recruiting, I'd suggest both, if you can afford it. Sec+ will be good to have on your resume; the new THM certs may not be on their radar yet. First line human recruiters often know nothing about the field other than what they've been told to look for.

[stoic cave]

Do you have prior professional experience in the computer industry/similar or a STEM degree?

[warm hinge]

Yeah I was leaning towards both like you mentioned, it defintely would be a boost if i was to get both. I think the SAL1 is ore impressive but just not recognized as well as the comptia+

thank you

[warm hinge]

I honestly dont have a stem degree, and no prior experience either with cybersecurity. I pivoted from Data Analytics, which has some overlap but not much.

[stoic cave]

OK, you're going to want to relate your data analytics experience to cyber in some way on the resume. Security+ is the baseline cybersecurity certification and really the only one that I recommend people pay for themselves.

If you verify, you can post a redacted copy of your resume here as an image for review

[crude sphinx]

How to Verify as a Student Without a Student Email

Article Link

https://help.tryhackme.com/en/articles/10617468-how-to-verify-as-a-student-without-a-student-email

Jun 29, 2025, 11:49 PM

[stoic cave]

That's annoying

[warm hinge]

Awesome, yeah that does make sense! I'm definitely going to add a couple soc analyst portfolio projects to my github to stand out a bit more too

[crude sphinx]

Discord: How Do I Verify My TryHackMe Account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

Jun 29, 2025, 11:50 PM

[warm hinge]

are you a soc/cyber analyst now or not yet?

[grand gust]

‏Hello, my dear, I have a simple university project for network security through Cisco, a brief is to make a full virtual network , if anyone have experience in this field, can contact me

[keen tundra]

Sorry but we can't help you with school work #rules

[granite hornet]

I'd love some portfolio ideas. My gitgub is so neglected. I thought I'd add some bash and python scripts for parsing files and such.

[warm hinge]

yeah it definitely would give a boost to resume, I'm going to use ChatGPT or Claude.ai to give me some guided steps on a full hands on project from python to splunk etc and add a READme on Github.

Github Copilot is good for code

[stoic cave]

Personally, I wouldn't. Do the research on your own and put something together. If you're looking to use it under a projects section of your resume, you're going to need to be able to talk about it. Saying "ChatGPT told me to do x" isn't a good look, imo

[granite hornet]

I agree. It's really important to me that when I'm entrusted with a role, I can perform every task that I've claimed to be able to do. Sure there will be some learning required, but if it's on my resume, it's got to be rock solid.

I've explored LLMs extensively in my day job and so do not trust them at all; I've seen them produce some really problematic output. One thing I do find quite useful is asking the llm to explain what a particular line of code does - this can be useful when I'm trying to figure out what is going on with an unfamiliar or complex bit of scripting.

[warm hinge]

Yeah, I totally get where you're coming from. I wouldn’t just blindly follow something and slap it on my resume. But I think for a first project, a guided one can actually be helpful to get a feel for the tools and process — as long as you actually understand it and can explain everything you did.

My plan is to use the first guided project to build confidence, then start doing my own projects based on what I’ve learned — and of course look things up along the way like anyone does in the field.

I’m using guided projects to learn, not to cheat.

• I’m making sure I understand what’s happening.
• I plan to do my own projects after building a foundation.
• I’m not claiming anything I didn’t actually do.

Also, the idea that you'd tell an interviewer "ChatGPT told me to do x" I think was a misunderstanding. When you complete a guided project, you're not just blindly following instructions, you're learning tools, techniques that become part of your skillset

[granite hornet]

sure, that sounds like a good approach. I'd prioritise other sources, though, and just use ai as a last resort or cross check. Remember it's got a massive footprint in power and water consumption too.

[warm hinge]

Yeah exactly, not just saying i'm ONLY using ai tools.

I just think it's a good stepping point

[olive citrus]

Need help

Anyone here a SOC . or studying to be SOC analyst

[keen tundra]

Maybe somebody from #sal1

[dusk wedge]

Yeah, im a soc analyst

[olive citrus]

bro i have dm u

[turbid radish]

Hey guys can anyone help me i means just suggest i just choose cyber security path for my future

[barren pendant]

which area interests you?

which area do you enjoy working in as opposed to hating

if you're really good at analysing and finding those small detail SOC doesnt seem bad

[turbid radish]

I am totally new like i heard about soc today but i havw quite intrest in ethical hacking

[steel leaf]

sure is great for learning though..I have it generate code and explain what it did. or I have to understand parts to instruct it what to change

on this note.. what domain of ai and cyber overlap for an actual career I can apply to?

what do you guys think of this roadmap

[turbid radish]

Anyone?

[dusk wedge]

well whats your question?

[turbid radish]

What to go for pentesting or defensive security

[dusk wedge]

soc is an easier entry into the industry

[turbid radish]

Does it have high scope ?

[granite hornet]

Defensive security will have much more opportunities than pentesting, unless you're a pretty gifted hacker (imho). And once you get your foot in the door you can always keep developing offensive skills and then you'll be versatile.

Depends on your skills, interests, and background tho.

[undone shore]

That was literally made as a meme by a guy in here a few years ago

@rancid adder

Oh you are still here Tux 😆

[prime pewter]

Hey,

I just finished the eJPT course materials. Is this enough or should I practice other things aswell?

[dusk wedge]

@echo skiff sorry for the ping, but u did this one right?

[stoic cave]

I didn't even notice this was the meme lol

[junior cliff]

Advice anyone ?

I’m currently in a bootcamp which is blue team based

This is what u study and it started today , Week 1: Understand Cyber Security Principles
• Week 2: Threat Intelligence in Cyber Security
• Week 3: Cyber Security Testing, Vulnerabilities, and Controls
Week 4: Cyber Security Incident Response
• Week 5: Understand Legislation and Ethical Conduct within Cyber Security
• Week 6: Professional Skills and Behaviours for Cyber Security

How good would you say this is ?

I eventually want to purple team for sure bc red team is my fav but understand you need to go through blue first

Obviously I’m a beginner so I was thinking should I add python along side my bootcamp with some try hack me rooms (the free version )

To prepare for job interviews (unrealistic) and lvl 4 apprenticeship to actually get on it after my bootcamp

[dawn ravine]

pretty good, depends on how deep the topics go and how much practical experience is being offered here though

what sort of assignments are you being given? are you being made to work on a sandbox or some sort of lab?

[junior cliff]

Honestly no practical experience

Just theory basically

[junior cliff]

I can show you the type of assignments

I had my first class today

[dawn ravine]

sure, can dm me if you don't wanna share it here

[junior cliff]

It ends on the 22nd if august

Ohhh beautiful bro thanks so much

[frail stirrup]

I'm currently learning cybersecurity on my own, and I'd love to connect with others to share experiences and lab work. Collaboration makes the learning process much easier!

[arctic jacinth]

Guys, as a beginner, how long can we rely on free resources to learn pentesting and other things that there in hacking???

[shut zinc]

what job boards have y'all had the best luck on?

[ivory fossil]

F

[granite hornet]

you want the Looking For Group sub.

[granite hornet]

well at some point you're going to have to pay for the exams. But there's loads of good cheap stuff out there. I bought a Udemy course for a few bucks and several humble bundles with official prep texts, as well as good books on hacking and programming. The thing I like about coursera/udemy etc is that there's no adverts and that courses are well organised, thorough, and professional. Not amateur clickbait. Same goes for books - instead of trawling through the web for bits and pieces, you've got a well organised, edited, sequential delivery of information.

Btw do you know about Cisco Packettracer? Such an awesome networking resource.

[south monolith]

True

Do Ccna instead

[keen tundra]

For a long time , plenty of free resources out there 🙂 . Majority of content on THM - around 60% - is free . Many platforms have tons of free resources , depends on what you're interested in particular 🙂

[snow oxide]

Hi i completed google cyber security professional certificate and i'm in my last sem of BS.
it's almost 1 month , i applied on LinkedIn but didn't got any interview call or job.
but they advertise 2k+ jobs open
etc.. bla bla bla. so similarly if i do oscp it's also useless? i want to know because i prepared almost 36%, and it's tough. i don't want to waste my time

[hearty jay]

hey @void prism, saw you are CEH certified..may I know how recently did you give it? and was it the theory one or practical

[frank palm]

Hey guys i just wanted to get hands on cybersecurity . As a begginer can anyone help me like where should i start.

[keen tundra]

You can follow this roadmap 🙂
https://tryhackme.com/hacktivities/

[west knot]

Hello everyone. Is there someone from THM team I could speak to? I'm trying to get subscriptions for all my class, we are a cybersecurity school but the school have limited fundings and most of the sponsors money goes into the location of the building and the paiment of the teachers, so I'm trying to arrange something for all of us

please dm me so we can speak a little, thanks !

[grim agate]

Hey everyone, I am kinda new to cybersecurity and still feel like a total newbie 😅
But I’ve finished a few certs___ like the Google Cyber Security Professional, Cisco Ethical Hacker, EC-Council Cybersecurity, and some Coursera courses.

Any advice for someone starting out?
I’d love to hear what helped you when you were new! 😃

[turbid radish]

Hey anybody online?

[grim agate]

Hola!

[turbid radish]

U r newbie u will not able to solve my issue

[prime pewter]

How rude! You did not even ask a proper question, just if anybody is online

[sacred badge]

So question right, if you're a security analyst should you not have a functional understanding of how to red team and blue team?

[low olive]

Try me for size, what is it?

Also questions go into infosec-general or room-help

[stoic cave]

General technical/infosec questions go in #infosec-general and questions about THM content go in #room-help (unless they have their own channel). If they have say, a career or career related question, that would go here. There are other channels as well, like #programming for programming related questions

[low olive]

Thanks

[serene umbra]

Gave +1 Rep to @stoic cave (current: #20 - 520)

[real copper]

I need a senior person in cybersecurity who can guide me and review my resume bcoz am in my 3rd and searching for internships it will be really helpful

[median lava]

Hey y'all, I wanted to ask for some tips. I'm studying mechanical engineering, but I'm a bit stuck between cybersecurity and automation. What kind of skills should I learn to continue my journey?

[cunning tide]

automation. you’ll incorporate mechanical engineering into it soon enough

[keen tundra]

Hey , please be respectful to other community members

[keen tundra]

Try to reach out to support on the email below

[crude sphinx]

TryHackMe's Email

TryHackMe's support email address.

​

[e-mail]

TryHackMe Socials · Jul 1, 2025, 11:10 PM

[velvet mauve]

hey everyone im new here just looking into learning more about cybersecurity to make a career out of it, any help would be appreciated. dm me

[keen tundra]

Welcome 🙂

[flat sedge]

Blue team yes, red team not so much. Assuming you mean actual blue/red team and not the marketing nonsense.

[frank palm]

as a beginner i started my cybersecurity journey from cisco am i doing right?

[fleet flame]

Hey! A fellow GICSP holder!

[sacred badge]

Offensive and defensive security yeah

[flat sedge]

Red team is very niche and very advanced. A SOC Analyst I or even Security Engineer I is not very likely to understand much down that path.

[frank palm]

if i dont know anything about CS should i start with THM pre security path or i should learn anything before that

[lapis cairn]

pick a language and stick to it for a bit

build some small personal projects

and come back

[foggy gust]

You seem to be on the right path. The Cisco Ethical Hacker is fairly new, so it would be interesting to hear your input on it. I've found that it's better to be stick with what everyone suggests, such taking on the THM courses since they're very beginner friendly and give great hands-on experience. What I'm also starting to see, from a personal experience, is that if you want get your hands dirty and chase extra, knowledgeable details on any topics you're trying to learn is Hackthebox, along with their CTF events. I'm not trying to advertise or say that its better, but again, from a IT standpoint, thats what I've seen. I'm a premium user on THM and the pathway has been pretty knowledgeable so far. I've already learned a lot more from this than the past few years of just working IT, but that's because I was unsure of what I wanted to do with my career. Now I know what I want haha

[frank palm]

learned python already

[tacit robin]

It's interested👍 👍

[lilac sigil]

hey all, my company is currently looking for a senior security engineer. How are such requests handled in here if they are even allowed?

[fickle grove]

There is a #jobs-board channel for it, but I suppose you need to have the Recruiter role to post there.

@keen tundra Can you assign the role to him or should it be Jabba?

[keen tundra]

I can't , it needs to be @cobalt escarp 🙂

[cobalt escarp]

Drop me a DM please

[real fulcrum]

Hey how hard is it to get a tier 1 help desk job with certifications..be honest am i going to be applying for months

[vocal wasp]

@crude sphinx
Hello everyone

[stoic cave]

Tier 1 helpdesk doesn't require anything, start applying

[real fulcrum]

Srsly? Wouldn’t I be competing with ppl better than me for a job though? Like with certifications and stuff

[dreamy surge]

guys i got a simple question like what are the ways can hacker or cybersecurity person or ethical hacker earn except (job, internships, (bug bounty takes a lot of time and not guaranteed) consultation for big pros, freelance have to be intermediate and and difficult to find work in places like in upwork or so ))

and yes i forgot not to make money by seeling (course or bloging or tools

[glad needle]

I got a question, what certs would you recommend to get for blue teaming after the SAL1. Like what other certs exist besides the btl1 that you would recommend. I want to try and land a job as a SOC level 1 hopefully

[vivid thorn]

IDK, get the CompTIA Sec+/CySA+ combo to get whatever the stacking cert is those two things apply to

and the SAL1 is harder than both of those combined so you could probably study for like a week and pass them both

The CSAP, thats what those two certs stack into

[vivid thorn]

You US based Dre?

[oblique mason]

Just did asssessment centre for cyber sec role it was so stressful

4 ppl including me were there and 1 role available 😔

[fiery halo]

anybody online?

[idle flicker]

hello

I live in India. Is it possible to get a cybersecurity job without the CompTIA Security+ certification? Also, should I invest individually to take the exam, or is it better to wait until I join a company that might sponsor the certification

[fiery halo]

It is for sure possible to get a job without Security+ or any cert. The main thing that matters is that you know what you say you know in the interview and have some solid skills, if you have that, it wouldnt matter if you have any cert or not. And yeah it is better to do a cert while your in a cybersec role in a company and go for more advanced certs as their cost can be covered by the company

[barren condor]

.

[idle flicker]

@fiery halo it means a lot :}

[south monolith]

[velvet mauve]

hey im new here and want to get into pentesting, and need some info on it. can any pentesters dm me

[waxen haven]

hello I am new here and want to get into pentesting, and need some guildline help please

[rugged delta]

You should start by logging into THM and checking out the Learning Paths. Go to #start-here to see the first steps you can take on your journey. You can do a lot of the rooms in the paths for free, beginning with the Pre Security and Cyber Security 101 paths. As you progress you'll find yourself pursuing many of the other free walkthroughs and challenges. You get access to more as a subscriber

[rugged delta]

Also, check out #start-here and folow the tips in the message above

[keen tundra]

Welcome 🙂 . You can follow this roadmap for the beginning 🙂
https://tryhackme.com/hacktivities

[silver vapor]

Hi everyone, wondered if you can help me with some advice. I'm a software developer (fullstack web using javascript/typescript, sql, all 3 cloud providers and have python knowledge) based in the UK who has 3 years experience working in the field. I have dabbled a bit with tryhackme and even started doing the ISC2 CC preparations for the ISC2 exam when I was between jobs but stopped when I started my current role. I am now back on tryhackme and have started from scratch as it's been a while.

I really want to pivot to cyber security at some point as I am very interested in the field but don't know where to start as most of the advice online is for beginners and doesn't account for some people like me who are developers looking to pivot. Some people have suggested Application Security given my background but still not sure what certs I would need.

What would people advise I do to pivot into cyber security given my experience?

[obsidian rose]

as most of the advice online is for beginners and doesn't account for some people like me who are developers looking to pivot.
The same kind of advice applies to you as you're still considered at the same level as them - even as a developer. Unless:

• You have solid networking knowledge: TCP/IP, OSI, Handshakes, Network flags, Wireshark usage etc...
• You have solid OS knowledge: Windows, Linux. (No, just knowing how to use windows does not count. We're talking Registries, Kerberos, LDAP, NTLM, SMB Shares etc.)

Having programming skills (nowadays) will be of very little advantage compared to other beginners unless:

• You're looking to go deep into Offensive Security. (Tool Development, Exploit Development, Maldev | For pentesting most tools are already developed.)
• You're in blue team areas where coding (without AI) is preferred and a big + : IAM, SOC Tooling etc.

[tough rivet]

Hi everyone! 👋

I'm completely new to cybersecurity and I have a background in computer science. I'm very interested in becoming a Cybersecurity Analyst , but I’m not sure where or how to start.

Could someone please guide me on:

• What are the basics I should start learning?
• Any beginner-friendly or free platforms/courses to begin with?
• Which certifications are helpful for freshers?
• How to build hands-on skills and improve my resume?

Any roadmap, advice, or resource recommendations would mean a lot. Thank you so much in advance! 🙏

[rugged delta]

You should consider starting from scratch with the basics of IT (Windows, Linux, bash, Python, Networking). You need to understand quite a lot of IT tech in the field to progress, as much of offensive and defensive security relies on those skills. You can start with the Pre Security and Cyber Security 101 paths on THM. Much of it is free. There's also tonnes of free content on every topic. a subscription will get you access to more indepth topics, including most of the Windows content, networks, etc. You should go to #start-here to get yourself set up and see how you can follow the paths to develop your knowledge and skills

[serene mesa]

i want to learn pentesting and i almost learned linux now what should i do next

[fervent haven]

does coursera cyber certification has any value for remote job?

[vocal pulsar]

Completely new here. Going through the pen test path on cybersec 101 for now and going through. Also work on comptia A

wanted to know if anyone in this group has had success getting a job going through the program and what they would suggest.

[silver vapor]

@obsidian rose thank you. I'm currently doing the cyber security 101 and will continue on with that

[serene umbra]

Gave +1 Rep to @obsidian rose (current: #36 - 270)

[ocean birch]

Need some job hunting advice. TLDR, I'm a little over 2 years into my cybersec career. I'm in the U.S and looking for a new job that let's me be closer to my family. I've applied to dozens of jobs and have gotten nothing but rejections or heard nothing back. It's gotten to the point where I have resumes tailored to every specific job field I apply to (Cloud, Risk, regular infrastructure, etc).

I'm starting to wonder if I should have my resume reviewed by a professional recruiter or take a resume review writing course, but that costs a lot of money and finances are tight right now. I wanted to know if this is something that everyone's dealing with before I spend anything.

[obsidian rose]

Coursera stuff aren't really recognised as something that'll get you a job or even help you get you picked by HR.

[obsidian rose]

Do you have any HR friend?

[ocean birch]

1. I can't speak to Coursera, so I'll leave that to someone else.
2. As for remote jobs, unless you can only do remote work, I'd heavily consider an onsite or hybrid position. Remote is great, but you don't learn as much in an office environment.

[ocean birch]

None I can think of.

[obsidian rose]

To be fair the market is rough. I don't think a course about resume writing would benefit. Each HR is different and will have different preferences. The "Ideal basic CV with no colours and images" is just a myth.

Some HRs will say it's bland, others will say it's better for readability. Courses won't help IMO.

You have 2 years of experience in what?

[ocean birch]

Mainly infrastructure management. Palo Alto NGFWs, Panorama, firewall configuration, VPN tunnels, a tiny bit of load balancing, log analysis, also the Armis Centrix & ViPR tools (for network/asset discovery and vulnerability remediation assistance)

[ocean birch]

Even courses from a former professional recruiter?

[obsidian rose]

Won't this recruiter give you their advice based on their own PoV ?

[ocean birch]

Yes, but his PoV is that of a professional corporate recruiter with years of experience.

[obsidian rose]

Does that mean that the other recruiters will have the same PoV? And if not, then they're not a professional corporate recruiters?

It's just a few questions to make you think.

Not to target or anything.

[ocean birch]

I understand your points, but I'm stuck right now and I need to figure out if there's something I can do to improve it.

[obsidian rose]

So a pretty technical role. What have you been applying to?

[obsidian rose]

The only thing I can think of is the automated HR system filtering out your CV. (In case you have a lot of no replies) It's called ATS.

[ocean birch]

SOC, incident response, some cloud positions. Anything I can think of that matches my experiences.

[obsidian rose]

You can do ATS-Friendly CVs. Search about it.

[ocean birch]

It's actually illegal in the U.S to have an ATS auto-remove resumes. Employers have to actually look at your resume before sending it up or throwing it away.

[obsidian rose]

Well that's very much good news then.

Looking at your expertise I'm not sure how it would fit to roles such as SOC though.
From what I understand: You have big experience in everything related to FW configuration as well as overall network conf. (VPNs, LB etc.) with very little experience in log analysis.

[ocean birch]

https://www.reddit.com/r/recruiting/comments/y2md65/do_large_tech_companies_use_ats_or_some_other/

[obsidian rose]

You want to shift completely or are you open to like more network/os roles?

[ocean birch]

Let me clarify, I have access to our enterprise firewall system, which includes all of our firewall rules. We got a lot of tickets and hunt group calls asking us to build out firewall access or to troubleshoot a connection.

[ocean birch]

I wouldn't mind a networking job. I'm lacking experience there and it would definitely improve my skillset.

[velvet mauve]

would it be best to go red or blue team to get a career?

[flat sedge]

what's the current project management strategy? Waterfall, agile, devops?

[ocean birch]

Depends on what you're looking for and which one has the most job opportunities.

[velvet mauve]

ahh im shooting for the red team

[worn tinsel]

hey whats going on everyone?

new to all of this.
ive made it to sapphire league but am having troubles remembering what ive learned.

i havent been taking noted because ive never taken notes my whole life.
im thinking i need to but not sure how to do them without copying every word i read.

also is there a way to start all the way back over in THM?

[zealous plume]

Imo it's good to do challanges related to topic you did without using given materials and trying figure out based on what you learned

[worn tinsel]

Explain please

[stone flume]

After you do a section on one of the learning paths, try one of the challenge rooms which tests knowledge you have just learnt.

For example if you have just been learning about Local File Inclusion, find a challenge room which focuses on that

[ocean birch]

Yes and no, it's good to use reference material. In the real world you'll often use instruction guides to configure applications or hardware. Having notes/guides to fall back on is never a bad thing and you'll be doing it a lot on the job anyway.

[obsidian rose]

Oh ok. @stoic cave Hello there, I assume you're from the US. Any take on this short conversation between Asmadeus and I? You probably have a clearer idea of the US market and could maybe provide some kind of insight.

TL;DR -> #cyber-and-careers message

[silver vapor]

We currently do agile

[woeful coyote]

i am just a begginer in cyber sec field. WHat would be best course to start with ?

[fickle grove]

Do check #start-here

[flat sedge]

If you have a dedicated security team askn your manager and that teams manager if you can shadow what they do for team

[dreamy surge]

dow anyone know where to download the new evilginx pro version from

[sturdy quarry]

I just completed 2nd semester. Doing cybersecurity
I can't decide where to focus
Read team blue team soc forensics
Any direction

Like which path I should take

[dreamy surge]

fornfree

[viral marten]

i had a question for you guys, i am confused.
HAVE YOU EVER GIVEN A DAY TO DO TRYHACKME ONLY?

and if yes? then how many rooms you complete in a day?

[keen tundra]

The one you're the most interested in

[hybrid tinsel]

I was able to do 2 rooms. 1 hard and 1 medium

Both were of Forensics

And I was new in them so was exploring by Google and reading deeper also trying on the attackbox to get some experience. So took a little more than was required

[hybrid tinsel]

Better to get your foundational knowledge first. Network, windows, linux, then move to either of them.

Could follow certification course knowledge pathway A+>Network+>Sec+ side by side learning about linux and windows file system and processes.

[shell jasper]

What do you guys think about the value of a source code disclosure discovery and ethical report on a resume? Big?

[rain heath]

Hey I'm a recent graduate looking to land a role in cyber, but I feel a lot of my knowledge is limited from the lack of practice (I'm halfway through cybersec 101 and a good chunk of it is stuff I learned in school)

I'm looking to set up a "home lab" so as to practice what I learn, but no idea where/how to start. I currently have a couple VMs in VirtualBox but unsure if VMs are the way to go. Does anyone have any beginner-intermediate resources on how to do so?

Apologies if this isn't the right place to ask

[fickle grove]

It certainly is a plus, but it would still depend how you present your resume as a whole.

[viral marten]

got it, i also caould do 2 to 4 medium mostly, so i was wodering if i am slow, i am a beginner.

[fickle grove]

I wouldn't compare your pace with other users as you would have different backgrounds and your learning styles might be different.

[viral marten]

yeah that's great

[shell jasper]

Awesome. Thanks. Guess I'll need to pad up my resume with more things like that.

[serene umbra]

Gave +1 Rep to @fickle grove (current: #11 - 840)

[tough rapids]

hello guys i finished 3 years of cybersecurity and digital and i did 1 year in software development and games i have no work experience which i regret because i should of been looking for one is it better to apply to be as an intern or just get a job in it

[shell jasper]

Going to pass on to you what little info I've gathered so far:

Job market is severely oversaturated, there's a ton of talented competition, and you need something to show for your work. So:

If you have a strong resume, an awesome portfolio of your work, and you can demonstrate technical/applicable ability rather than pure theory, these will give you a leg up, but you may find that "just getting a job" won't be that easy, nor will interning. Create a list of all of your relevant skills, figure out what sector they fit into/what you're interested in, tailor your resume to fit the objective keywords to pass AI inspection, then work on becoming not just a student or a would-be, become a real, working professional by strengthening your existing skills, learning new ones, and synthesizing as much new/relevant information as possible.

Lastly, I'm told that if you understand ML on a fundamental level and can apply those concepts even at that level, that's a huge bonus. If you are good with programming/understand Python, C, C++, Ruby, PHP, etc. then you can specialize further with those, and it gives you an even better chance.

This is my current working knowledge as a beginner myself, so take it with a grain of salt, but this is what I have learned so far via networking and research. I hope that helps, and hopefully one of the vets can give you more/better info.

[tough rapids]

🙏 thank you

[shell jasper]

You're welcome. 🙂

[warm hinge]

That helps a lot. Thank you. Do you feel like on LinkedIn it would be helpful to add that you're also a regular developer? Say I have a small brand and like to ship some code and the site will update and grow over time.

[serene umbra]

Gave +1 Rep to @shell jasper (current: #1948 - 2)

[shell jasper]

I would say that any sort of experience you have is relevant, so long as it pertains to computer science in a broader sense. From there, I would personally try to approach things from the perspective of: okay, so, I know WHAT I want to get into. How does my regular development cycle inform potential employers, network contacts, or any other prospective individuals about my intrinsic skill compared against what they're looking for? To make that a bit plainer: What skills do you bring to the table? How is that stated in your work? What level of documentation do you maintain? Do you have a fast or slow development cycle, and why? A lot of this information can be conveyed by, yes, stating that you're a regular developer (however that comes across for you, I'd be more specific). In this case, I can identify that you're a either an application dev or a web dev, but if I'm wrong, that's where you want to be pursuant of more detailed/richer information. I think those are some solid start points, but I digress.

To answer your question: yes, I do feel that would be helpful. Anything to show that you have the aptitude, the applicable skill, and the drive to maintain that course.

[warm hinge]

Thank you! That helps with the entire perspective. I've gone to bootcamps and learned full-stack, but (reiterating to the career/budget), I don't really have a sass or ship too much. I'll take note of all that so I can keep it in mind. I have experience beyond that so I really have focus and not overdo it either. I know for actual resumes they will be more tailored to the employer. Fast and slow, there's several factors. I'd say a bit slow now as I am focusing on cybersecurity, but I've had jobs at a web agency (NDA) but it was pretty basic. I'll keep in mind my last professional job as far as work flow and what I have to offer. These days I'd rather keep things safe than do a regular developer job unless it's a mixture of both (and it should be). Not sure if those jobs even exist anymore.

[serene umbra]

Gave +1 Rep to @shell jasper (current: #1473 - 3)

[shell jasper]

Glad to have been of help! Ultimately, I think that pivoting away from pure full-stack development is a wise move, but you should always remember where you started, and, in the helpful advice of chick3nman , understand and lean into your niches. Make them work for you. Finally, understand that cyber (and IT in general) is leaning more and more into the higher-level, more technical roles that require over-all stronger programming or other relevant skills. Personally, if I had your skillset, I would attempt to translate the core skills that I am best at, and use those as the "abs" of your LinkedIn profile and resume while also using them as the "methodology" for further training them. Show off your skill, but be humble, and learn more before you say more. That, from what I've learned in life, is best practice. And for that reason, I will now digress and allow expert minds to weigh in further if necessary or desired.

[spring meteor]

hii everyone.. wanted to ask a question (hopefully im not being dumb. Or am i? 😭😭) im new in cybersecurity and tryhackme too. i currently am doing pre security course. wanted to ask should i really do cyber security 101 course or directly jump into penetration testing module? will penetration testing covers all the necessary topics from the previous modules or do i really need to complete those previous modules too to get comfortable with all the knowledge of penetration testing

[shell jasper]

Do Pre-Security, do Cyber 101, then attempt Pentesting. That's what I'm doing, albeit with a slightly different path.

[patent night]

same boat as you. But we will get there

[patent night]

do all the basics even though you may feel like you know them. might end up learning something new even a new functionality in case of rooms that has tools of the trade

[analog crag]

https://www.youtube.com/watch?v=lV2zsCOLX30&t=2s

[sick crater]

after doing comptia sec+ should i do that roadmap by thm for blue team? is it helpfull

[hybrid tinsel]

Yes it's really helpful to build your foundation

You could also explore rooms like windows internals, linux internals to explore OS working

[bleak kiln]

Hi guys, I would really like to get a job in cyber security but I would like to know if AI is going to "replace" it ?

[tidal panther]

🤣

[hybrid tinsel]

😆

[silent cradle]

I just completed the SQL injection modules & want to test the skills Can any one suggest me some rooms of easy or medium level

[pastel quest]

i'm trying to get a jr/level 1 SOC analyst job do anyone have promising project idea plz?

[wise harbor]

It won't. You'll be fine. Be more worried about oversaturation of the market and competing with others.

[wise harbor]

Homelab

[dusk wedge]

Setup an NDR system, setup your own siem etc

And for that you'll need as plingplong said a homelab. It can also just be done with vms

Homelab makes it easier tho

[long merlin]

Most likely no, AI will help automate things and make tasks easier but it can't full replace individuals because again you need someone to look at alerts and verify if it's a true-alert and not a false positive, at least this is my understand im still a beginner so feel free to correct me if I'm wrong anyone

[dusk wedge]

I would do the 101

[flat sedge]

Audit and compliance

[keen tundra]

Try this one 🙂
https://tryhackme.com/room/jurassicpark

[undone shore]

Better question: how tf do you have CISSP with no prior experience?

5 years xp is literally one of the requirements to get it

[trail crystal]

I don't yet but I can work towards it with entire course being covered and training for free but ig it's too big a jump

I got offered a tonne of stuff from a company which they can cover and it just seemed like the highest level

Ig technically u can pass the exam and be an ISC2 associate but ye doesn't seem ideal

Every single one of these I can have covered for free

• CCNA and CCNP

[trail crystal]

Sorry for the dumb question tho I'm just wondering the like career path order and how the certs fit in around it

That's why I did if, I didn't mean to act like I had it

[flat sedge]

You literally cannot be certified by ISC for CISSP until you have 5 years experience, or 4 years + a higher education degree

[fickle grove]

I think one of the first things you ask yourself is what role or specialisation do you want to focus on?

CISSP or any certification for that matter are mostly a plus (though it can help you bypass HR filters), but wouldn't be the sole consideration when applying for jobs.

[flat sedge]

if someone has a CISSP cert but has zero experience in industry, that is a huge red flag

[gloomy briar]

Hey everyone, I’m 16 and from Romania. I’ve already completed the Pre-Security path on TryHackMe and I’m currently working through the Web Application Pentesting path. After that, I plan to go through PortSwigger’s Web Security Academy and start focusing seriously on bug bounties.
I’m in a tough spot right now. I have the option to apply for Romania’s National Cybersecurity Academy. It offers a structured path, access to resources, and strong government connections. Sounds great at first — but there’s a huge catch: if I go, I’m basically locked into working for the Romanian government or institutions for around 10 years. That means less freedom, limited salary, and working in a system that’s known for being bureaucratic and sometimes outdated.
My alternative is to skip college entirely and go all-in on bug bounties and practical experience. I want to build real skills, earn through bounties, and eventually maybe even start a business in this space. My older brother isn’t in tech (he’s a video editor), but he can support me financially if I want to go full focus on hacking.
I’m trying to figure out what path will actually lead to better long-term growth and freedom in cybersecurity. Have any of you faced something similar — or skipped university to go straight into bug bounties or pentesting? I’d appreciate any advice from people who’ve been in the field longer.

[trail crystal]

So I'm being offered these certs to help me train for a SOC level 1 role specifically so I want whatever can help me achieve that

[fickle grove]

Is this your employer or a company that offers training to land you a cybersecurity role?

Note: I read your original post, but confirming to be certain.

[trail crystal]

It's a charity that's paying for the certs + courses/training for the certs too and they also have links to companies for jobs too

To be extra specific I did first year cyber security at university but a little bit into my second year I was forced to drop out to care for a terminally ill family members for multiple years and I got refused to student loans/funding to go back to finish my degree so I have to find alternative routes

[rustic heart]

Hello everybody ... hope you are find . Do you jnow any god books for learning web security ? I first look at something like "The Web Application Hacker’s Handbook Second Edition" but it's too old so I would like you to give me advice please

[keen tundra]

Try to ask in #bookclub channel 🙂

[rustic heart]

Thank sir

[meager glade]

I’m an Indian student pursuing a BTech in Computer Science and currently relying on an education loan. I’m really interested in cybersecurity, specifically Red Teaming, and want to earn industry-recognized certifications. However, due to financial constraints, I’m unsure which certifications to focus on. Can someone help me with any advice on affordable yet credible options.

[wise harbor]

Since cybersecurity is not entry level and despite a passion for it, I want some opinions.
I'm graduating with a focus on cybersecurity but still a computer science degree. I'm thinking of trying to enter into backend programming or try and get into (after entry level IT) network engineering. Is there any reason why backend may not be ideal or could possibly restrict me from eventually moving into SOC? (I would still have projects, such as my homelab)

[velvet mauve]

the rooms that im doing is leaning more towards security operations.. does that job title pay well as an entry level?

[bronze lodge]

SecOps is a pretty wide field, but, say a SecOps engineer 1, which is the lower level or a SOC Analyst, will mostly depend on who you're working for and what market you're in, but not terrible pay(In the US at least), but as the message above you noted, cybersecurity roles are not entry level, IT is the entry

[dense dagger]

It's not the worst thing I'd say. It would not open you to other types of disciplines as opposed to other roles such as network engineer, IT support, etc. but its still ok and can be used to pivot into SOC

Ideally, you would get a role such as a system administrator or network administrator that allows you to gain experience with actual infrastructure

Backend programming is still good and can open a career path to these off the top of my head: DevOps, DevSecOps, Application Security, Penetration Testing

[quaint fulcrum]

Hi everyone If anyone can give me some advenced Oauth2 vulns? (not sqli or JWE tocken forgery ect... some serious vulns that I might forget to secure it in a website)

[dense dagger]

You can take a look at this: https://github.com/koenbuyens/Vulnerable-OAuth-2.0-Applications.

You can use #infosec-general next time also to ask for general infosec related questions

[quaint fulcrum]

okay thx ^^ and sorry for using the wrong channel

[serene umbra]

Gave +1 Rep to @dense dagger (current: #22 - 460)

[dense dagger]

no worries, theres a lot of channels so its easy to get lost

[wise harbor]

Alright, then I'm probably going to try and get into network engineering as a start(if I can, out of preference.), of course if I get a sysadmin job then I get a sysadmin job.
I highly appreciate it.

[hollow pivot]

I don't recommend doing bug bounty hunting but if u insist on doing it, prepare to face struggles a lot. And yeah I would never join that Romania cyber academy,.

[hollow pivot]

Cyber security is entry level ~ if u have the qualification and zero experience u could actually get in

[gloomy briar]

TY for the advice. What do u think I should pursue?

[serene umbra]

Gave +1 Rep to @hollow pivot (current: #1478 - 3)

[hollow pivot]

Soc analyst roles are easy to get but I can't say much since ur not in US

Some countries job require different thing

Or different methods

[blazing dawn]

Hello everyone,I'm 20 and currently pursuing bachelors in cybersecurity,and I want to build a career in pentesting ,I don't have a mentor to guide me ,so please share your thoughts..

[hollow pivot]

Connect with people in bigger servers

Join multiple

And make friends

Ask questions to people

And there ya go

You'll have a mentor one day

(I did it)

U can also reach out on LinkedIn

They actually help i

U

Also make sure u have multiple mentors I have 2 rn but I'm looking for a new one

[blazing dawn]

Noted brother thanks a lot 🙏

[serene umbra]

Gave +1 Rep to @hollow pivot (current: #1185 - 4)

[hollow pivot]

I do have request for mentoring but I be too strict and 😂 scare people away

[blazing dawn]

Would you please recommend some servers

[hollow pivot]

So find someone that meets ur needs

[blazing dawn]

I will be more than happy if you mentor me

[hollow pivot]

Trust me u don't want that 😂

[hollow pivot]

Most servers I'm in now are private and have restrictions like

Must be enrolled in OSCP

Or

[blazing dawn]

The ultimate goal is to gain knowledge

[hollow pivot]

Wait I have a great resource

Omg

I remember

So u can schedule a meeting for free

With anyone

For assistance

If u can get close to them u could build a private connection

You'll have to figure it out yourself but I'll just send u a server

[blazing dawn]

Yeah man that would be great

[blazing dawn]

Okayyy

And please recommend courses I can start with

[hollow pivot]

What have u done so far

[blazing dawn]

I have not completed much courses

I just did a Udemy introductory course for cybersecurity beginners

And in thm I have completed upto active directories

[hollow pivot]

What's ur goal?

[blazing dawn]

I want to be a penetration tester

[hollow pivot]

Stick with tryhackme complete the first course from tryhackme

And do a 1 box every 3 days to a week

Even if u don't understand

Review it and note it down

Have good notes

When ur done reach me

If u remember me by then

😂

[blazing dawn]

Nah brother you have been great help

I'll follow you so we won't forget eachother 😂

[warm hinge]

is it valid for me to continue studying security+? I have a IT assistant job where i often interact with network configuration, microsoft azure, microsoft administrator and MacOS to ensure business communication and productivity runs smoothly and efficiently. But I have no certification and im a CS undergrad student. Is it still valid for me to study security+ and skip basic IT qualifications considering im on my way to have bachelors degree and have experience/internship in IT

[wise harbor]

With how the market is and from most advice given, though I could get lucky and have that be the case, I cannot agree wholeheartedly. Thanks for the thought though.

[serene umbra]

Gave +1 Rep to @hollow pivot (current: #1021 - 5)

[wise harbor]

I would suggest you look at job postings for where you're trying to go and see what they require. Some will require x and others may only suggest y. If it requires A+ or other certifications, then you must have them.

[warm hinge]

i have no clue what part of cybersec i wanna go at but i do enjoy working im tech and breaking into systems is more than building systems. i really love this line of work

i just hate certs when its too theoretical like comptia’s ones but it has to be done

[wise harbor]

Then I advise you get some ideas of what you want to do and look at what they require. I understand you may dislike theory but theory is needed.

I'd also wager that it'll be less theoretical than what you've experienced in CS so it won't be that bad.

[warm hinge]

yea totally i agree. like stiff such as change management and gap analysus etc arent in thm.

[plain vector]

If u do like breaking then take a look at the practice cers like eJPT, PT1, OSCP

[wise harbor]

Oscp is like $800 💀

[plain vector]

I guess more

Its a solid one tho

[wise harbor]

I'd only recommend oscp if you're entering into the market and don't need to worry about CompTIA honestly.

[plain vector]

Depends on the role a one looking for

[wise harbor]

Better for the employer to pay for it than not

[plain vector]

Yes if possible

I don’t know what market u do have knowledge in but in EU its kinda hard for pen testing jobs

Without certs

[wise harbor]

It's hard everywhere right now.

[plain vector]

W r cooked chat

[wise harbor]

Cyber security isn't entry level, you have to kinda move horizontally in it.

[plain vector]

:d

[plain vector]

Yes

[wise harbor]

After doing some entry level IT honestly then you're fine. A lot of misconceptions on the Internet have propagated it as being entry level and I'm quite glad this server has dispelled such a myth.

However doesn't mean you can't get lucky

[wind thunder]

Like a programmer? And them specialize in cyber security?

[hollow pivot]

no worries, i did get my first pen testing job with zero experience even tho the job did require experience. same with a soc analyst position which i later declined

[wise harbor]

Must've been a different time Ali

[plain vector]

Which country ?

[hollow pivot]

wasn't - it required experience too, on top of that its a pentesting company so yeah and USA

BUT

[wise harbor]

I'm sure there are ways yes, though going through IT would be better.

[wind thunder]

Why did you decline it? (The reasons are interesting)

[hollow pivot]

id say this doesnt happen often most people start as a help desk

and move up to soc in a year or two

thats usually the way

[hollow pivot]

Pentesting is more my thing and higher pay too also was remote

[wind thunder]

I see

[wise harbor]

You could get lucky nowadays if you have some experience like in a homelab but even then the current climate is really difficult.

[hollow pivot]

HR is the only issue

[wise harbor]

So I wouldn't bet on being lucky.

[plain vector]

Hrs are broken

[hollow pivot]

yeah im gonna make a video on how the job market is LMAO

and how i got my job

people should know

its luck

LMFAO

[wise harbor]

Sorta. Hr is a main issue, however, to be quite honest, there are some things where it would be better to have an understanding and experience in IT, if I'm getting an application from someone who has experience and someone who doesn't, who do you really think I'll hire?

The job market not even for cybersec is cooked rn

It's across the board, at least for America.

[hollow pivot]

really depends on the person, if i show my notes and skills with zero experience everyone knows im overqualfied so its almost also about the effort u put in

im even opening my own pentesting firm

[hollow pivot]

i get the difficulty tho

[wise harbor]

Sure, however I must state I would still take someone with experience over someone who doesn't have experience in a professional setting, it'd only make economical sense. A lot of markets are having issues taking in entry level.

[hollow pivot]

most hiring manger dont care about experience they care about skills HR is usually the blocking thing. - I talked to many hiring manager

[wise harbor]

They most definitely care more about experience

[hollow pivot]

if u have zero experience and can demonstate ur skills

they prefer that even if u have experience

and no skills

[wise harbor]

A lot of them require it now.

Some may not, yes, however, a lot do require you to have experience in IT.

[hollow pivot]

its possible but honestly the odds are against you big time

forget about IT experience, i never even had a single job

[wise harbor]

I'd say the certs themselves are worse regarding HR

[hollow pivot]

and u have to be exceptional

pentesting isnt entry level

[wise harbor]

Or just willing to take shit pay

[hollow pivot]

soc analyst however are

[wise harbor]

Soc analysts are entry level for cybersec but not overall, yes.

In fact the ones I've looked into still require IT experience of at least 2 years. Sometimes 1.

[hollow pivot]

they say require but its not a firm statement - you should message the hiring manager or whoever is on the job posting

and doing home labs and stuff is normal

most people come in thinking ull get it like easily

[wise harbor]

Recommended is not a firm statement, required, is.

When a job posting says they require A+ certs, recommends experience in x, required is quite firm

[hollow pivot]

again i had interviews where it was required and i never met the requirement

it required certain certs

i applied without them

but show you have something tho

[wise harbor]

Homelabs my beloved

[hollow pivot]

yeah u should have them if your at lest into the field

[wise harbor]

I do

[hollow pivot]

thats good

blogs?

[wise harbor]

Good practice for experience.

[hollow pivot]

youtube?

[wise harbor]

Don't do blogs and definitely not YouTube.

[hollow pivot]

wait where u from?

[wise harbor]

Us my man

[hollow pivot]

we can a soc analyst poisiton open here,

i could have recommended you

but it closed a month ago

rip

[wise harbor]

Still gotta graduate with my degree so not a worry to me

[hollow pivot]

i see

thought u worked extra hard and couldnt get a job

from how it sounded

😭

[wise harbor]

It's definitely something I hear every day I can tell you.

Job market kinda cooked rn

[hollow pivot]

i hear it too but i think most people dont do enough work imo

they think getting A+ is enough

😭

and a home lab

[wise harbor]

Oh sure but this isn't even cyber specific, job market overall is kinda trash right now. It's not devastatingly terrible but the unemployment rate for college graduates has risen so far...

[warm hinge]

im halfway done with pt1

[hollow pivot]

okay yeah i agree job market is trash

def is harder

[warm hinge]

all job market is trash

[hollow pivot]

networking and making connection is so important now

[warm hinge]

cybersecurity aint as bad as others

[hollow pivot]

referalls are the way in

[hollow pivot]

yes all are and its beeen that way for awhile

you hear it every year

[warm hinge]

recession, ai, global job market, employees now being forced to wear multiple hats

[wise harbor]

Every year and what's going on statistically aren't always what matches.

[hollow pivot]

i cant say enough since i havent compared it to others

but i would say id probably agree

[wise harbor]

There is an actual issue with the job market after covid and more than ever now. It depends area to area of course and how willing you are to take shit pay or conditions though, to be fair.

[warm hinge]

apparently entry level cybersecurity jobs are flooded since its the bot shit rn but there is a huge talent gap in mid and senior cybersec roles

[hollow pivot]

everyone wants in

[warm hinge]

ali u shia?

[wise harbor]

I think cybersecurity is not that bad once you have some experience. However, even IT, especially IT is suffering in this market.

[warm hinge]

lmao i got my IT internship via family friend

[plain vector]

I have deleted so called linkedin, its a really weird place people are like NPCs

[warm hinge]

i met few people in Owasp London

may go Owasp meetup in paris

[hollow pivot]

no

[plain vector]

yea thats the thing for networking

when is the owasp in paris ?

[warm hinge]

september

but i dint speak french

so idk if i should go

[wise harbor]

I don't think the internship area is bad, just the jobs themselves.

[plain vector]

I also doesn't

[wise harbor]

Though internships are definitely not great for CS rn especially.

[plain vector]

I may go

[warm hinge]

no interns are bad aswell

cos lot of CS majors

[warm hinge]

did u go to one in london?

[plain vector]

nah

wait he speaking only be in French in OWASP Paris ?

[warm hinge]

not sure

[hollow pivot]

back

[warm hinge]

YA ALI

[hollow pivot]

r u shia

oh

[hybrid tinsel]

Is it ok to be so open?

Just curious

[plain vector]

:d

[ancient prairie]

Openings in cyber have generally grown year-over-year outside of FAANG and other tech-driven companies - for example if you look at different verticals like Automotive or Finance, hiring is pretty steady for cyber. There is a bit of confirmation bias at play when you hear the market is bad, unemployed folks struggling to find jobs are generally more vocal and somewhat distort the reality.

TL;DR don't let what people tell you about the "market" discourage you from applying to places, but also maybe think about applying to places other than CrowdStrike or Google and you may have some more luck

[flat sedge]

Agree with that

[wise harbor]

you're right, however, I must admit that college graduate unemployment rates have definitely increased and I think that is a valid concern for someone like me who is about to graduate. Openings can open in cyber but I still have to get at the very least a year or two of IT experience before I can enter or for it to really benefit me, unless I get lucky and find a place that doesn't require it, which is of course possible.

[stoic cave]

Hey, sorry for the late response, I've been really busy with work. If you have a redacted copy of your resume, post it as an image here.

[stoic cave]

Who says you need two years of IT experience with a degree? Did you do any form of internship? Your degree is what substitutes for the experience requirements in entry cyber (analyst, engineer, etc etc) roles, typically. Anecdotally, I graduated in 2020, into the pandemic, and was able to find a job within 3 months of graduating. You're going to have to put the work in to find a job. Job hunting is a full time job in itself.

[ocean birch]

No problem, can I DM it to you instead?

[stoic cave]

No, that's why I said to redact it. Doing it here benefits the community.

[ocean birch]

Alright, hold on.

[ocean birch]

Here:

[wise harbor]

internships have been dry, only one. My degree unfortunately does not substitute for entry, they require IT experience which I do not have.

[stoic cave]

One internship is fine. Is your degree a STEM degree? Also, let me just ask, are you in the US/western world?

[wise harbor]

In the US, it is compsci.

[stoic cave]

Off the top, bring skills to the top, separate education and certifications, call your experience section "Experience", and your clearance isn't something you did at your job so it shouldn't be under Experience.

Is your template a modified AwesomeCV? If not, it looks similar, so maybe take a look at moving it over to LaTeX

[stoic cave]

I don't see an issue then

[ocean birch]

I don't know. I had a resume expert make it for me a few years ago. I'll look at LaTex though. Thoughts on removing my education? I've been in the cybersec space for over 2 years now and I've never used it in my job.

[stoic cave]

I would work on your CG bullet as well. Relate what you did in your Rate to the jobs you're applying for

[ocean birch]

I did basic work. Painting, standing watch, keeping logs, did some QMOW work that helped with navigation, but that's it.

[stoic cave]

The formatting could use some work, if I'm being honest. There's room for improvement. Do not remove your education.

[stoic cave]

What was your rate though? Did you go to A-school? If so, what did you learn there.

[ocean birch]

I was a non-rate (E3). I was going to IT-A School but I had to get out for medical reasons. So I never got any actual experience.

My cybersec career is my current job

[stoic cave]

People are going to ask what you did, you need to work that into your resume

If all you did was scrub and paint, talk about how good of a job you did scrubbing and painting

I had lifeguard on my resume for a while, it's OK for it not to be cyber related

[ocean birch]

Noted, I'll look into editing it.

[wise harbor]

As much as I would like to generally agree, there is too much conflicting advice from others in this channel. I will still apply to said jobs and do projects focused on them, however, I am not going to focus on only them and still focus on entering IT if needed and doing certs for them.

[stoic cave]

You do you. Myself & Droogy (Juun too because he agreed with Droogy's take) are just trying to give an industry perspective to help cut through the noise

[wise harbor]

The same number of people have for the other aspect of it. I see no issue in me preparing for the worst.

[ancient prairie]

fresh graduates will generally have a tough time finding the first job in their chosen field, this is not unique to cyber/IT and merits its own discussion - as someone without a degree and was a late career changer (food service -> IT -> Cyber) I can definitely assure you that if you have a CompSci degree from a reputable school, can speak English reasonably well and have some decent soft skills then that is literally all you need for entry level work, you will be fine

[obsidian rose]

Wow the market in the US is definitely insanely different from the one we have here in France.

[shell jasper]

What is the market like in France?

[obsidian rose]

A master's degree is required for most CyberSec jobs. People got shocked when I said that in here but no longer than 3 weeks ago, someone from France was here complaining they couldn't find a job because all of them requires 5 years of higher education.

So far I've listed 4 people in here from France (2 of them having OSCP) that can't even get a Junior pentester job because they only have a BSc.

[shell jasper]

Brooooo... that's hardcore. I understand some of the why, but holy hell. I'm beginning to wonder if the whole fuss about, "tech companies don't care about degrees anymore" was really just a way to beat off some of the competition with a big stick.

[obsidian rose]

I think it's the case in the US.
But definitely not in the middle east and a few countries in Europe.

Qatar is a bit less strict about degrees when it comes to the ME.

The "Why" is because people in cybersecurity are expected to be engineers (Actual engineering degree) which lasts 4 to 5 years.
If you're not an engineer, you are required to have the same level of education as one. Which means a BSc and a MSc. (Equivalent to 5 years of education)

And if you want to go for a Cybersecurity consultant role? That's even more strict.

It's 5 years of education + at least 1 or 2 years of experience for a junior consultant role.

Which is definitely OK and normal in France since people work while studying. That's how colleges work here. 6 months end of studies internships are required to validate your degree.

[shell jasper]

So, in your opinion, would you say all of that is truly necessary, or would you even go so far as to say that it creates a stronger workforce? I've been hearing a lot about people with degrees ultimately still asking the same dumb questions as those without.

Here, we don't get that. You get a degree, even a PhD, and you still might just never find a job.

[obsidian rose]

Degrees are total BS. I'd hire an OSCP certified person over someone with a MSc.

[shell jasper]

See, that's exactly the kind of attitude I'd HOPE to see in the field.

[muted bone]

Hi guys, I have an interview in the near future for an SOC L1 entry position any tips?
(my first interview by the way + its remote)

[ancient prairie]

Note the first interview may or may not be technical; otherwise expect questions that cover "miles wide, inch deep" type knowledge, you need some understanding of some fundamental pillars of IT, Networking 101, Windows/Linux internals - having knowledge of ticketing systems, popular SaaS offerings and typical cross-team workflows will also help guide "what would you do in XYZ scenario" questions (e.g. "I would reach out to the Threat Intel team to see if they had any information to help", "I would check the internal KB for any open tickets involving XYZ", etc..)

[wise harbor]

Tryhackme actually has interview tips iirc somewhere on the website!

[lucid current]

Hey chat - so what's the demographic breakdown here? any folks working in the CyberSec industry?

[obsidian rose]

Well, you'd need to read the start of the convo to know. Taking it out of context like that would definitely shock you like it did to many.

[lucid current]

Nope, you got me, i was totally just skimming.

[obsidian rose]

You got people in the US that have given their advice above as well.

[lucid current]

The industry here in the US is wide open. Experience seems to trump certs and certs trump college

[obsidian rose]

Follow this thread @lucid current
Seems like it's not the case in the entirety of the US.

[lucid current]

Seems in line with what I said imo. Most employeers of cyber folks want practical experience and ability over college education. You're more likely to find a job beating CTF's and going to CONs than you are on zip recruiter and posting a degree

[stoic cave]

No, certifications do not trump college

[bronze lodge]

The job, the organization, the hiring team, etc all have different expectations. College is absolutely an equal if not greater in terms of recognition, certs just have a lower ceiling to getting skills validation, hence their popularity, but if you're doing cyber security degree, so many schools are getting a lot of tangible, hands on experience

[muted bone]

@ancient prairie @wise harbor THX guys

[serene umbra]

Gave +1 Rep to @ancient prairie (current: #45 - 223)

[velvet mauve]

question for exomplyers!.. as someone like myself was to get intervied for an entry level cybersec lets say as a red teamer what are the questions do you ask us?

[ancient prairie]

There really isn't any entry level work as a red teamer, you should generally be a subject matter expert on internals for various OS's and architecture. malware development, evasion, C2 usage in addition to having deep knowledge across general IT/Cyber pillars

[velvet mauve]

ahhhh so what would be my best bet getting into a career as a cybersec?

[flat sedge]

SOC or GRC

Both of those will require either a technical or administrative background in some capacity

[velvet mauve]

and im assuming i need to get my certs for those first?

cause i been doing walkthroughs CTF videos on youtube training for the SOC

cert

[flat sedge]

Do you have any IT work experience, or certs?

[velvet mauve]

no not at all i did that bullshit google course to get an understanding of cybersec because i wanna make this my new profession thats why i just been tunnel visioned into learning and grabbing knowledge from everywhere.

[flat sedge]

I strongly recommend you gain work experience in another IT domain before making the jump to security. Entry level to info or cybersec usually makes the assumption that one has some technical background in other domains, like network engineers, sys admin, dev, etc

[velvet mauve]

ahh, what type of those domains to you recommend i should look into work experience wise and of course certs?

[dusk wedge]

IT helpdesk is good, maybe juun has some others

[velvet mauve]

would data analyst be a start as well?

[ancient prairie]

no not really, that job is usually more on the business side of things - no one says you can't apply to traditional entry level cyber roles like GRC or SOC as you may get lucky but don't be too suprised otherwise

desktop tech and any sysadmin work is great

[velvet mauve]

ill keep doing what im doing then and take juuns advice as well and look into the basic IT domains

im a 100% new with this tech stuff so sorry for all the questions and misunderstanding on my part

i come from an automotive background hahaha

[ancient prairie]

no worries, definitely just take a look around at job requirements so you can get a more concrete understanding of what knowledge you'll need - and if you come across a job you honestly feel like you are capable of fulfilling then go for it

[velvet mauve]

for sure thank you! for SOC positions. would i still need a cert? or some hire with just experience.

[ancient prairie]

it depends, having real-world work experience in any field helps it shows you are a reliable adult who is capable of working well with others. As for certs starting with the CompTIA trifecta is almost always recommended - some companies value certs more than others so your milage may vary

[lucid current]

I didn't google, but I've worked in Cybersecurity for the past 8 years

[stoic cave]

Degrees or professional experience have the ability to move the needle independently of each other and independently of certifications. Certifications are used to quantify professional experience/meet contract requirements, and don't have that level of independence.

[flat sedge]

Certs are also a business requirement, and to be honest, are not a fair judgement of knowledge or ability.

[lucid current]

Respectfully, I would put degrees and certs in the same category, very separate from experience. That said, many Certs require a certain level of experience to go with them, college does not. Moreover, I would choose an analyst that's passed several SANS courses where the focus is entirely Cyber centric, over a college student whose had to do alot of work, much of which has nothing to do with the field he'll be working in. Certs are not just used to meet contract reqs, they also show technical understanding - that said, not all certs are equal.

furthermore, there are MANY college courses out there whose entire purpose is to build a curriculum entirely around obtaining industry certs.... so again I'd say... Certs over College.

But better than both (IMO) is experience gained, on the job or through things like CTF's, volunteering/instructing, technical writing, etc.

Just my 2.5 cents.

[wise harbor]

Inflation so bad it's now half a cent up

[fickle crag]

What about sans courses without the cert

[lucid current]

That's more on par with watching youtube videos by someone working in the industry. Can be VERY informative, but doesn't really indicate ability at all.

[lucid current]

https://tenor.com/view/paul-rudd-its-funny-its-actually-kind-of-sad-funny-but-sad-gif-17011210

[fickle crag]

Is there a ranking of how valued specific certs are over others? Like what certs would you expect an L3 SOC lead/Incident Commander to have

[ancient prairie]

GIAC certs are not really indicative of ability either unfortunately, it just tells me you have a few thousand bucks to spare - I have met an overwhelming amount of GIAC cert holders who are pretty clueless when it comes to actual day-to-day work

[fickle crag]

Sounds like certs are just for HR screening then? Lol

[ancient prairie]

yep, I don't even look at resumes when I interview (granted my boss does pre-screen applications)

[lucid current]

yep, pretty much each vendor has their own hierarchy map.
https://cyber-center.org/wp-content/uploads/2022/02/04687-it-certification-roadmap-nov2020-24x36-onepage-1.pdf

[lucid current]

yep, alot of them are just there to pass automated resume checkers. The interview with a technitian is what really gets you in.

[lucid current]

What do you do in the field? if you don't mind me asking

[fickle crag]

And how many YoE lol

Why is threat hunting a dedicated role now, shouldn't that just be something TI and SOC do together?

[hard verge]

Is there anyone who is currently doing job in cyber security?

[lucid current]

👋

[fickle crag]

Quite a few here id imagine

[hard verge]

I want some guidance

[lucid current]

I imagine that very much just depends on the place you work at. Where I've worked TH is part of the SOC/TI, but there are also agencies like Fireeye/Crowdrstrike that have folks that specialize in TH - especially as consultants to other firms/SOCs.

[lucid current]

I'm happy to answer questions. But my info would be specific to the region/state i live in.

[fickle crag]

Why so specific, GRC?

[lucid current]

Well if it's about getting into the field - culture, hiring, policies, etc are going to be a little different depending on where you're at.

pay, etc

[velvet mauve]

where are you guys from?

[lucid current]

US/Midwest

[velvet mauve]

ahh US/east coast

[lucid current]

Nowhere near the capital region?

[fickle crag]

If we are looking for a remote position does location matter as much?

Are there any remote positions left

[velvet mauve]

im in New york city

[fickle crag]

Reddit makes it sound like there are no jobs in cyber at all especially remote lol

[lucid current]

I've never worked with folks remotely. but I imagine alot of that lowers pay... especially since much of what you're talking about could likely be outsourced to foreign countries for SIGNIFICANTLY less pay.

China, India, etc have a massive surplus of folks in IT that work for really cheap

[fickle crag]

Some things can only be handled by US personnel tho, and there's a difference of quality I've noticed between regions

[ancient prairie]

I split my time between threat hunting and detection engineering

[lucid current]

And most of those things, especially if you're refering to gov work, will be limited to in person... especially with the administrations recent gutting of remote workers

[velvet mauve]

is threat hunting hard to get into? if you dont mind me asking

[lucid current]

contracting, vendor, or gov?

[fickle crag]

Do you hunt on one specific edr or how do you do your hunting usually, just whatever the customers got?

[lucid current]

I'd argue yes, requires deep technical knowledge - alot of folks go to it after working in IT for a bit.

[fickle crag]

How do you know what to threat hunt for

Check fw logs for evil bit?

[lucid current]

MITRE ATT&CK Framework is a good place to start.

https://attack.mitre.org/

[fickle crag]

Bit broad since that covers pretty much every attack vector lol

[lucid current]

exactly

that's what threat hunters do

They require broad and deep understanding of potential attack vectors based on a specific companies threat profile

[fickle crag]

Have to prioritize it some way, either by recent trends or something

[lucid current]

---> Threat Profile.

The diamond model is a good way to explain it

[ancient prairie]

neither, full time for a F500 company

[lucid current]

Nice

[ancient prairie]

I hunt across all our data sources depending on the hypothesis

[lucid current]

Diamond model - Adversary and their capes, vs a victim and their infrastructure. What type of adversary wants what your company has, what vulnerabilities exist within that infrastructure, trends.... all of this plays into building a threat profile for the org you're defending

[ancient prairie]

in a nutshell I typically start with assumed breach scenarios and work backwards, e.g. Scattered Spider has been in the news lately, they typically get initial access through the help desk and have a set of tactics and techniques they like to run after that, these represent signals and data sources that can be included to help hunt your hypothesis

[fickle crag]

Do you usually get those TTPs from a specific source or just wherever you can find them

We use recorded future for a lot of our TI stuff

What siem/edr are yall using to do your hunts?

[lucid current]

---> MITRE, Crowdstrike, Mandiant, certain federal agencies > they are persistently hunting for new threats, standing up honey pots, to observe and collect new TTP's and disseminate them to vulnerable orgs

[ancient prairie]

We have a dedicated TI team which helps out a lot, otherwise I know our threat profile and where the gaps are to hunt against

[ancient prairie]

I usually export the data I need from our SIEM and use Jupyter Notebooks to process it

[lucid current]

What SIEM do you use?

nvm

splunkinator

[ancient prairie]

we have Splunk and Elastic

[lucid current]

I prefer Elastic, my start was actually in securityonion

[ancient prairie]

I ran Security Onion for years in my homelab but recently overhauled because its just too resource-hungry for my needs at this point

[fickle crag]

I hated elastic and much prefer splunk

[fickle crag]

What's the reason to use both?

[velvet mauve]

whats splunk for isnt it like SQL

[lucid current]

They're both databases that collect, index, and analyze data.

[fickle crag]

Can't splunk do everything elastic can

[lucid current]

yep

I've been in a place where we ran both - it was actually just down to preference of the team.

both have their own special learning curve

[ancient prairie]

it's cheaper to have some data on-prem in Elastic in our case

[fickle crag]

@ancient prairie how long did it take to become a threat hunter, what was your pipeline?

[ancient prairie]

I would definitely recommend Elastic + their EDR offering for small businesses on a budget, the stack works really well if you can keep it alive

[ancient prairie]

It wasn't a role I directly applied for, it pretty much came through internal hirings and me bugging people about the need to formalize a threat hunting and detection engineering function separate from the SOC - it came after working around 2-3 years in SOC/CSIRT roles

[velvet mauve]

ahhh question. what would i have to focus on and get a decent understanding on to get my foot in the door as SOC as someone who just started back in april haha

[fickle crag]

Started as what

Like a L1 soc analyst?

[velvet mauve]

yes

[fickle crag]

Is it remote?

[fickle crag]

What are they having you do, just churn a ticket queue?

[velvet mauve]

im not working at all in this industry im a mechanic haha im trying to change professions so im learning all this on my own

[fickle crag]

Oooh join the military that's a sure way to get a soc role within 6 years lmao

[velvet mauve]

https://tenor.com/view/what-wtf-eyes-look-phone-gif-3927559383930151204

[fickle crag]

Traditionally I think cyber security roles have been roles that other technical positions transitioned into after getting experience like network engineering and IT, but I know people who got a cyber security bachelors and then interned and got into a soc that way

[lucid current]

6 years... PFC's are doing equivalent work as soon as they pass their pipeline.

[velvet mauve]

PFC? whats that mean

[lucid current]

Private First Class - A very junior enlisted rank in the Army

[fickle crag]

Yeah but they are PFCs for 6 years and get paid as such lol

Gotta get out to get normal soc pay

[lucid current]

That's True... but they're also going to spend those six years learning very high level tradecraft and going to technical training every day they go to work. There's something to be said about the trade off between money and experience/training.

Cybercommand is an absolute Certification Farm... That said promotion rates in Cyber, are significantly faster than most other job roles in the military. SSG in six years is very much viable

[velvet mauve]

so whats the lowest position to be in as cybersecurity i just need my foot in the door and have work experience

[fickle crag]

Not necessarily. Pipeline is like 6 months and then most of them just go to work and stay stupid, will maybe get sent to some sans courses. Depends on if they make it into a super technical role. I know plenty of army cyber guys that suck at the job. In the military enlisted don't usually get fired for incompetence so you can be a shitter and still get paid lol

[fickle crag]

Intern

Then L1

[lucid current]

What's your experience with military cyber? Because that wasn't at all my experience. The only people that stayed stupid where the seniors that VTIPed from other jobs. The ones that got after it... learned every day they were there, that's absolutely a choice. The opportunity for growth and training is always there... lazy folks just never used it.

[velvet mauve]

do i need experience as an intern or a background especially for someone like me whos being self taught

[fickle crag]

The shops I was in did not grant many opportunities for meaningful training. You either self taught or a chief liked you enough to put you through a sans course

[lucid current]

need is all relative to what you can get in on... but I would recommend going into general IT first, then switch to cybersecurity. The pivot will be easier because it will give you a solid IT foundation/experience, and there's a larger general IT base of jobs than secjobs.... that said, lots of people go straight to cybersec jobs... if you can get your foot in the door... and as discussed the military is a GREAT way to get your foot in... if you're willing to make that level of commitment. The access to training there really is top notch... if you're willing to do the work.

[lucid current]

That sucks man. I can't at all attest to what it's like in Navy Cyber. but I've worked other branches, and in my experience the Airforce and Army both do a great job developing folks in cyber ops.

[fickle crag]

So most people watched YT or did collaterals while like 3 of us actually developed the dmss kit or were sent tdy

The joint shops I was in was 95% YouTube watchers lol

[lucid current]

well you made ION, so you clearly put in the work. and I really do believe that's what always made for the best operators/analysts... the dudes who did the job, then went home and crushed it in CTF's and their own rickidy a$$ homelab/servers.

[fickle crag]

Yeah ion spaces were a lot different compared to the CPT spaces lol. People actually wanted to be there

Helps when mission feels more impactful

I think the CPT just had a negative feedback loop of no training > analysts cant find artifacts > demoralized and don't wanna do the job > not self training

Now that kind of work is popular tho so go figure

[lucid current]

yep, very easy to get disgruntled in a job like that if you don't have purpose... and good leaders always provided purpose through great training and hunting for good ops for their guys.

sorry that wasn't your experience

anyway, it was good talking to you, feel free to add me, i gotta hop off... heading to an incubus concert.

[fickle crag]

Have fun lol

[velvet mauve]

mmm random but as an IT intern what would they have you do?

[fast oxide]

maybe some helpdesk or computer fixing

[dusk wedge]

Depends on the position you apply

You have helpdesk interns

But you can also intern in a SOC etc

[lime quartz]

Hello, I'm new here. I need some tutoring help please anyone.

[round granite]

Guys I need help

[near yarrow]

Sup?

[rugged delta]

If you have specific questions you can ask. If you're new to the field, go to #start-here and follow the instructions

[olive bay]

is anyone freelancing in this cybersec field?

[tribal snow]

Hello. If anybody knows can I go university for ece (electrical and computer engineer I believe) and get a job at cyber? The curriculum has both math and stuff like networking, software and hardware if I specialise in the computers sector so if anybody knows it would be helpful

[near yarrow]

Read the testimonies by THM. As it already indicates that people such as teachers have reschooled them selves using THM, and got a job offer in cyber sec.

[tribal snow]

Well ty for the reply but I'm not asking if thm can make me go to cyber and change my major. I haven't been to uni so I don't have to chose ece to begin with. I'm just asking if anybody is familiar with the uni major. Thank you for the reply

[serene umbra]

Gave +1 Rep to @near yarrow (current: #3003 - 1)

[near yarrow]

Oh, I apologize, that was not clear to me. In that case I do not have an answer for you 🙂

[tribal snow]

No worries. Tysm for replying. Have a good one!

[faint moth]

I sure have tried, but the market is not kind to entry levels

I have a Bachelor's degree and still don't get real work

[near yarrow]

What about bug bounty programs such as Bugcrowd? Have you tried that?

[round granite]

I have applied for a ethical hacking job and I got a technical test before getting the job so I need to do vulnerability assessment by I need to hack 2 sites by planting webshell into the site then send them the link as proof, can you please help me guys?

[balmy dove]

I have

[faint moth]

The few times that I've turned in bounties they set my finding to a P5, didn't pay me and patched the next day

That and I'm just not very good at them 💀

[near yarrow]

Ya, bet lowering the finding to a P5 might be demotivating

Ya can get rich, but it takes a special kind of person

(and possibly lots of "luck")

[faint moth]

Luck that I just don't have

I genuinely have no idea how you're supposed to get a job in IT at all these days

I got turned down for a help desk job because I didn't have 3-5 years experience

[near yarrow]

Depends a lot on the company tbh. The one I work at is very eager to hire people every single day..
An although they do not necessarily hire only IT pro's, they do expect you to have some kind of experience, affinity & knowledge about the field.

As in, you can be whatever you need to be from occupation, but if you have several certificates proving you can code, they'll gladly hire you as a coder and train you further to a full fletched employee.

[faint moth]

I have the Google Cybersecurity, Sec+ and CCNA plus a Bachelor's in cybersecurity. I'm hardly underqualified for an entry level role

[near yarrow]

That eh, sounds pretty solid tbh

[faint moth]

I genuinely have no clue what I'm not doing right

I apply for jobs all the time, not just in cybersecurity but almost any entry level IT

[near yarrow]

May I ask what country you live in?

[faint moth]

USA

[near yarrow]

Hmm ya, idk... USA for some reason sounds really ffing critical in all aspects in regards to IT. Sometimes I wonder about moving there because of wage.. but everytime I end up thinking.. hell naww

[faint moth]

Pleaase don't

The wage increase isn't worth it imo

[near yarrow]

Well.. I'm having kidney stones from time to time.. so the US healthcare wouldn't be suitable for my needs, hah

[faint moth]

Oh in that case absolutely don't

Healthcare is a nightmare here

No guaranteed PTO or vacation

No parental leave

[near yarrow]

Ya, that's weird.. my product owner got a baby today, won't see him for the next 4 weeks because of parental leave 😂

[faint moth]

Paternal leave????

I've never heard of a US company allowing paternal leave

only maternal

and even then it's like 2 weeks

[near yarrow]

Idk 🤐 Something with words

[faint moth]

Usually only moms get leave for their kids in America

[near yarrow]

Ya, even dads get 4 weeks in the netherlands

[glass kestrel]

Hello, my apprenticeship is almost over in governance, i'm a bit lost, hard to find a job, due to my experience 2 years only, is there a good certification to start my career for begineer ? 🙂 thank you all

[near yarrow]

It all depends on your aspirations I'd say?

https://tryhackme.com/room/careersincyber

[glass kestrel]

i was wondering about comptia A+ then Security+

i'll check ^^ huge thanks

[near yarrow]

I mean, by no means will it answer your question.. but you're also (imho) not giving enough information to get proper advise, since there are so many paths to choose from, all with their own certification within both THM, and other official ones.

[glass kestrel]

that's why i'm lost, i haven't see much instead of creating policies ... and improvements of splunk's KPI ..

[near yarrow]

Then page above MIGHT help you a little bit in that case, as it does give an explanation for each job, maybe you can cross a few through so you won't have to waste your time at them.

And it couldn't hurt browsing THM a bit, seeing if you can take a few introductionary courses for each.

[glass kestrel]

yep got it thank you 🙂

[near yarrow]

And based on that, I'm certain people can give you proper advise of steps / certifications to take.

[heavy valley]

I'm sure this has been asked a million times but is college necessary for Cyber Security or do you learn enough through TryHackMe? I assume it's very hard to find a job without a diploma and just through online courses.

[livid cargo]

should I go to uni and get a degree or am I setting myself up just as much by getting a comptia security+ cert

[silver edge]

Any openings for internship ( remote)

[stoic cave]

US perspective. If you have the opportunity to obtain a degree, ie it won't put you in insurmountable debt or other extenuating circumstances, do it. The Security+ certification is not comparable to a degree program.

[stoic cave]

#jobs-board

[obsidian rose]

This channel's for advice not really recruitment.

The original query:

[silver edge]

Oh oh yeah

Sorry my bad

Yeah so guys
I'm struggling getting an internship
Can someone suggest me a ethical way like

Tips or suggestions

How can I get it

[stoic cave]

US perspective. Yes and no with the latter part of your statement. No to your question regarding "is THM enough." WRT the yes and no, can you get a job in cybersecurity without a degree? Yes. You'll have to start somewhere else in the industry though and then then work your way into cyber. A common "ground zero" starting point is IT Helpdesk. If you're able, is it recommended to get a degree? Yes. A lot of roles require degrees due to contractual obligations on the work being done. ie the contract your company signed to do x work for another company mandates that y number of seats must be filled with degree holding individuals. Degree holders also make more than their non-degree counterparts. It also, if you desire, sets you up for management as well. Typically they'll have degree requirements and when that time comes you can negotiate to have them pay for your masters.

[livid cargo]

understood, thank you, if I can obtain the security+ cert before uni that would help with obtaining student internships during my enrolment right? I'm looking at taking a 2 year diploma course for informations systems security, then likely another 1-3 years to convert that into a cybersecurity degree

[serene umbra]

Gave +1 Rep to @stoic cave (current: #20 - 521)

[stoic cave]

Not sure what the offerings are around you, but cybersecurity degrees are hit or miss. By degree, I mean an accredited 4 year bachelors program. A safer option is Computer Science as the programs are fairly standardized across the education space, no matter where you go. As far as getting Security+ before you go, I wouldn't. You'd be wasting its eligibility sitting in class. I would wait until you're close to graduating to maximize how long it's valid for post graduation.

[wise harbor]

Depending on the college you could even get one with concentrations. For example, though I'm majoring in compsci, my concentration is in cybersecurity, so I get a few classes that benefit me in that concentration while getting a standardized compsci education.

[crystal lion]

maybe u dont have enough experience

[velvet mauve]

dont worry im self teaching myself this cybersec thing and im still applying and learning as i go just keep applying dont feel demotivated

[tidal thicket]

hi eveyone! im new here but i do have a question. im new to learning IT but i want to make sure I take the right path to get a job. is it true that you can only land a job by networking with people and knowing your stuff and that the comptia exam is unnecessary? i hear alot of different things on the internet and not sure what to believe

[stoic cave]

Are you a higher education student? You're obviously late for Summer 2025 internships, but Summer 2026 will be opening in a few months.

[stoic cave]

No, it's not. See my message above to Isolate for some information on the topic. As far as networking, yes it can absolutely make a difference. Is it the only way into cyber? No. If you have local BSides or cyber meetups, you should go and talk to people. As far as certifications, Security+ is the baseline cybersecurity certification and really the only one that I recommend people pay for themselves. It's often a contract requirement in certain sectors of the industry, meaning they cannot hire you without it. Outside of that, you should get your employer to pay for your certifications.

[tidal thicket]

im currently self learning. i wanted to avoid it help desk jobs but i might have to since the exam cost alot of money for me currently. and i will definitely look into cyber meetups. thank you! i didnt even know they had stuff like that

[serene umbra]

Gave +1 Rep to @stoic cave (current: #20 - 522)

[stoic cave]

Do you have a degree? If not, then I would go start applying to entry computer industry jobs, to start building your professional experience, one of the most common entry points being IT Helpdesk.

Self learning is great and all, but it's not the same as on the job experience

[tidal thicket]

no i don't have a degree

[tidal thicket]

i have been applying on linkedin though

[glossy viper]

anyways may I ask if it is possbile that I can be a Computer Forensics Investigator?

[glossy viper]

So Its possible for me who drop out of BSIT college and proceeds to self learn, can get a job for building an experience?

[velvet mauve]

cyber meetups!? where can i find those in NYC lol

[warm hinge]

Can someone help me to choose one, I am currently pursuing a degree and have an interest in both CCNA and RHCSA certifications, which one would you suggest would be the most suitable to pursue alongside your degree? Which one would you recommend that would not be overly burdensome?

[dense dagger]

That depends, CCNA is more on the enterprise network side and RHCSA is more on the enterprise sysadmin side

[warm hinge]

Can you tell me which is easier to crack while doing a degree

[dense dagger]

I can’t say, I haven’t done the RHCSA but I did do the CCNA curriculum as part of my degree and it was ok but it depends honestly on how you would be able to balance it

[rare salmon]

Hello guys I'm a fresher having eJPT cert. Active in doing labs and engaged in vdp programs. I literally applied more than 100 companies but didn't get any reply mail....😭. How can I get a job in cybersec as a fresher 😭

[dense dagger]

You can always get IT experience first, as a developer, IT support technician, network engineer, sysadmin, before jumping into cyber as a starter

[floral yarrow]

Hello I want to ask despite using LinkedIn, are there any other ways we can use for networking, please?

Because my network is pretty limited, they are either my previous lecturers, or classmates.

[fringe spade]

Conferences, local meet-ups

[floral yarrow]

By local meet-ups, will it be like events?

[fringe spade]

Yeah, usually in larger cities there are cybersecurity events organised by non profit organisations or even tech companies. Search for something like bsides, ISC^2 meetups etc

[floral yarrow]

Noted. Thank you very much, Vertey.

[serene umbra]

Gave +1 Rep to @fringe spade (current: #284 - 29)

[flat sedge]

Your degree will supercede either of those certifications as part of hiring. Certifications are used as a business measurement for compliance reasons, the only reason a business will require a cert is to either show time served in industry (ie, CISSP) or because they are too cheap to spend money on certs to meet their compliance requirements for frameworks like ISO 27k1

[dense dagger]

Agree with that and also there are certain businesses that needs certain credentials to win a potential client

[flat sedge]

if the client requires it, that business will pass the cost of the cert on to the client. If a business needs an employee to have a cert before hire for that reason, that business has much bigger problems

[warm hinge]

Heyy, thanks for pointing it out.

[serene umbra]

Gave +1 Rep to @flat sedge (current: #12 - 842)

[warm hinge]

Just out of curiosity, what you mean by problems

[flat sedge]

in 5 years of working, you'll look back on that statement and the lightbulb will turn on with blinding intensity

[warm hinge]

[stable storm]

Is studying one room daily is enough or not?

[neat dome]

you become mad bro . studying in a single room witout stepping out and probabily you feel clumsy

[stable storm]

What do you recommend?

[neat dome]

i recommed you study and also spend some time with your friends , chillout , try to do some new cool things and focus on onrall development. also try to learn new things everyday

[stable storm]

Thanks. I meant that study one subject is good.of course I don't forget the social life.

[serene umbra]

Gave +1 Rep to @neat dome (current: #3005 - 1)

[stable storm]

??

[neat dome]

it is a discord bot

where does this came from ??

[stable storm]

I don't know

[neat dome]

wt it trying say dude

[stable storm]

I don't know 😅

[neat dome]

[stable storm]

[neat dome]

bot couldn't stop its feeling to engagment in chat😀

[dusk wedge]

It happens when you thank someone

[serene umbra]

Gave +1 Rep to @neat dome (current: #1966 - 2)

[dusk wedge]

Its pretty much internet points

Doesnt mean anything

[velvet mauve]

what questions do you guys ask interviewers for the position of the SOC tier 1

[unreal ember]

Hey so I have a question regarding my future so I have two pathways that I can take any needing advice from USA folks, so pathway one is attending a university AKA radford university where Ill study cybersecurity at the atis college of technology and science if I attend the university I’ll be going for completely free including living in campus I’ll also join a cyber defense club where I’ll try and get into soc analysis or I can go into red team work they have many paths where I can choose far as I know it’s a good program. My other choose is enlisting and going to the army for cyber operations or the navy for some type of cybersecurity. I’m stuck on which one and I have a week to decide I’ve toured the university I love it and everything about it but I just want to make the best decision for my future. Any advice helps please and thanks ❤️

If I do attend the university I’m getting my bachelor degree and I would most likely then go into the military to continue my education, my end goal is to work for the government hopefully home land security or somewhere important

[stoic cave]

College and do ROTC if you want to serve. You should join the military if you want to serve, not for cyber, imo. You'll be miserable if you don't truly want to be there.

[unreal ember]

Okay thanks so much I’ll take that in mind and look into rotc

[vapid sandal]

.

[stoic cave]

That's not what I was suggesting. If you're already in a degree program you should stick with it.

[toxic plinth]

what should i do huh!

[mortal oyster]

hey guys first time here, context currently been working in tech industy around ~ 14 years and now interested in cyber security careers, and tips for me where should i start and what kind of certification that might help?

[toxic plinth]

#start-here that'll show you where to go and what to do

[mortal oyster]

thank you!

[serene umbra]

Gave +1 Rep to @toxic plinth (current: #3009 - 1)

[toxic plinth]

welcome

[lethal moon]

Hy

[lethal moon]

Can I get job as jr soc analyst compared with the penetrations tester

[dense dagger]

I’d say its doable, it really depends on the current job market where you live. From where I’m from, big companies hire multiple juniors for SOC roles out of university and there are multiple accelerated programs that companies have to bring new graduates up to enterprise IT speed

[lethal moon]

Ok

[stoic island]

Hello I want to start cyber security but i don't know how to start ... And is there way to maintain cybersecurity and other random part time jobs

[dense dagger]

Hey, TryHackMe has a dedicated learning path that walks you through from zero to hero. Just need to keep grinding.

[stoic island]

Well it's about part time jobs .. I need to carry both at same time

So better part time that suits for this career.?

[dense dagger]

I’m not sure what you mean, can you elaborate?

[rotund gale]

he is saying which part time work will be good to gain more hands on this field so that he can manage both at the same time

[dense dagger]

If that’s the case, see if you can get a part time job related to IT, maybe as a helpdesk support

[stoic island]

Desk supports are hard working type

I searched a lot but no use

[dense dagger]

Yep, but it helps you gain valuable experience imo as you get hands on with how IT works

[stoic island]

What are the qualifications ?

[dense dagger]

It depends where you live honestly, check your local job market, put yourself out there and talk to local companies if they would be willing to hire part time

[stoic island]

Thanks... For the suggestion I will try it

[loud marsh]

I went first option, so my other friends

Most of us are now Sr Security Engineer and Director of Technology

Get a computer science degree

and do the other part

You earn more if you know how to code

CPTC and CCDC are the best resource for you to earn experience early. Also companies scouting for talent in those cyber competition as well. You might get job even before you graduate.

Do Computer Science but all of your elective should be in Cyber 😉

[velvet mauve]

for CTF and KOTH if theyre scouting for people to recruit and hire, and do they go about that? look at the leader boards etc etc??

[dense dagger]

It depends on the hiring team actually but its more of something you say if they ask you about it during interview, not really something you tell them or put on your resume

[velvet mauve]

i understand that but im talking about people from THM the message above says theres companys that scout for individuals like us to hire

[loud marsh]

those are the sponsors

and the competition is not part of CTF or KOTH

Picoctf also a pretty popular one, but I fee like KOTH is more like a community host than actual tourney

if you want scouting, go to CTF where they listed out sponsor.

[hearty patio]

I’m almost done with my IS bachelor 🙏

[dawn snow]

I'm Joel from Ghana and currently on the path to becoming a Junior Cybersecurity Analyst. I'm taking a Cisco CyberOps course and building my skills in Blue Team, digital forensics, and incident response.
I have a bit of coding experience and id love to learn and gain the skills to acquire to my goal. My goal is to land a cybersecurity role (local or remote) in the next 6–9 months, and I'm here to learn, grow, and connect with like-minded people.
Always open to accountability partners, project buddies, or any advice, or help from those ahead in the field. 🙏

[dusk wedge]

Please dont spam your message accros channels @stable matrix

[cobalt escarp]

Please don't enforce community rules, ping a moderator

[noble dawn]

Yo, does something like this help? https://cyber-career-launch-yasens.replit.app/

[elfin jetty]

Are there any way to forensic process when it from the past. I have case need to forensic Linux action with my process (victim) when at that time, there is another process (hogger) make my server high load. But idk what happened with hogger and victim processes at that time and why my victim process affected

[dire thunder]

these are my uni courses,so from this what all roles can i expect?

[errant anchor]

🚀 Just Landed Your First Cybersecurity Job (or Getting Close)? Share Your Story!
Hey everyone! We’re running a quick survey for people with less than 2 years of experience in cybersecurity who have recently landed a job. If that sounds like you, we’d love to hear about your journey!
Your feedback will help us understand what really works (and what doesn’t) for early-career professionals—and could help make things easier for others starting out.
⏱️ It only takes 5 minutes!
👉 https://forms.gle/hzZYBBUJUXywtnEz7
Thank you so much for your time! If you’re open to chatting more, you’ll have the chance to opt in for a short follow-up interview. Your input genuinely makes a difference. 💙

[velvet mauve]

for the SAL1 cert on HTM. does that cert hold any meaning or should i just shoot for the real one with comp

[rugged delta]

The SAL1 certification is a professional certification built in collaboration with various leading organisations based on their needs for Junior SOC engineers. You can go to #sal1 and read the official site which shows the organisations connected to the cert's development

[grizzled arch]

Anyone know of cyber security jobs but with IOT or robotics?

[worn birch]

That could cover a lot of different roles. Are you interested in code security when being developed, or security controls once these devices are on a network?

[grizzled arch]

Security controls is more my interest. Mainly network security is what I’m looking for

[livid needle]

How much does it cost

[velvet mauve]

okay thank you so ill probably end up doing that at the end of august see how i do then go for the comptia

[serene umbra]

Gave +1 Rep to @rugged delta (current: #21 - 521)

[fair radish]

Hey! I would like to know if anyones been able to clear OSCP solely with TryHackMe?

[hearty plank]

If you work REALLY HARD you probably can

[dawn ravine]

(https://www.reddit.com/r/oscp/comments/vw5wbn/is_tryhackme_and_hack_the_box_good_enough_to_get/)

[hearty plank]

but I suggest you to first get at least a couple entry level certs

[dawn ravine]

i was gonna type out a para and then i figured i'd just attach this instead

[hearty plank]

since OSCP only lets you use metasploit on one single machine of choice, has a lot of restrictions

there is hardly any automation when doing OSCP, they FORCE you to do almost all of the work manually

manual port scanning, manual exploitation, manual enumeration, manual post-exploitation everything

[fair radish]

I am short on time, and i have way too many responsibilities on me, im studying and working, plus everything i earn goes to either uni fee or home, rent etc, and i cannot waste much time on low level certs, but where im from, oscp is the key to a job, so hence why i need to prepare for it but while keeping in with budget for either thm or htb

My argument is, htb is preparing you for cpts, which is known to be tougher than OSCP, and THM all the reviews we see are old, i wanna know what is the review as of this moment? Can it prepare for OSCP/CPTS or something similar if one worked really hard?

please tag me if you answer it! Anyone

[obsidian rose]

Do the OSCP training.
The OSCP bozes like A, B and C will give you huge insight on how the exam is formatted and the infamous "OffSec format"
Or else, get ready for a surprise.

[ancient flame]

Hey everyone, I'm looking for some honest feedback on my plan to break into cybersecurity and eventually become financially independent I'm 29, currently living abroad, but planning to return to France soon

[fair radish]

It is a bit out of budget at the moment

[ancient flame]

My plan is : Get a regular temp/warehouse job (around 1600-1700 EUR/month), live very frugally and save around 80% of my income. --> In parallel, tunnel vision on cybersecurity, studying 15-20 hours per week (TryHackMe, HackTheBox, building labs, doing writeups, small projects, Python, etc.)

[obsidian rose]

Are you of french Nationality or in need of a VISA?

[ancient flame]

--> Start with certifications like eJPT, then move on to PNPT, and finally OSCP to prove real skills --> Once I feel technically solid and have enough savings (12-18 months), I'll move to a country with a stronger IT market (like the UK, Netherlands, Germany, or Canada) where practical skills & certs matter more than degrees

The goal is to either land a pentesting/security job there or eventually start my own thing (freelance pentest, bug bounty, consulting)

[hearty plank]

wait OSCP has training exams?

[obsidian rose]

Oh it doesn't matter if you're not planning on working in France.

[ancient flame]

I'm skipping university entirely and focusing purely on practical skills, certifications, projects, and saving aggressively to buy my freedom

Do you guys think this is a realistic plan?

[obsidian rose]

Not if you're planning to work in France, it's not going to work.

[ancient flame]

sorry for the long text but I want realistic feedback

[ancient flame]

I don't want to work in France

cause I know it's bad

[obsidian rose]

Target region?

[fair radish]

@obsidian rose what do you think of THM being enough for oscp?

[obsidian rose]

Depends what you mean by bad. I work in France, I'm 23, and I'll be able to afford my own home in around 1.5 years.

[obsidian rose]

Big no.

[ancient flame]

In my head : Germany, Netherland, UK, Scandinavia

[fair radish]

how come? Just out of curiosity only

[ancient flame]

Maybe Canada/China

[obsidian rose]

Even HTB is a complementary training. OSCP has a no tools allowed policy. What can train you for that besides the OSCP training?

[ancient flame]

not having a degree in cybersecurity

[obsidian rose]

Automated attacks are not allowed.

[ancient flame]

and surely the salary

[obsidian rose]

Correct, they requires a MSc.

[obsidian rose]

#cyber-and-careers message
What do you think the salary range is?

[fair radish]

I can train for anything, i have no prior pentesting knowledge, oscp is a major job requirement, ill do anything, ANYTHING to reach that goal

[obsidian rose]

Oh well good luck. You'll need at least 6 months to a year of training.

[fair radish]

what learning pathway do you recommend?

[obsidian rose]

The OSCP training and when you're done, there's TJNUll's list, the IPPSec list as well.

[fair radish]

is oscp training alone enough to equip me with the required pen testing skills?

[obsidian rose]

A lot will say yes, and a lot will say no. It's a subjective experience.