cyber-and-careers

[rigid marsh]

What's wrong with what I've written

or do I simply need to include some subway surfer footage next time

[sharp jacinth]

Hey everyone

[stable raptor]

Hi

[plush obsidian]

Hi ;3

[lapis iris]

low-key thinking of becoming an IT Project Manager. I got 4+ years experience in supporting the govt authorization to operate process but I dislike reading security requirements.

will keep security on the side as a hobby and participate in CTFs but what certifications should I aim for as a project manager? PMP, Scrum, ITIL?

[keen tundra]

It was too much political 🙂

[rigid marsh]

Hey, I know the DACH market to well to put him through the meatgrinder and tell him to buff it out, before he realizes that he gets softlocked into GRC, which happens way too often over here. He obviously doesnt like it

[wicked whale]

sup

[echo grove]

I would focus on ITIL & PMP first then for a third cert aim for an area you want to go down

[elfin girder]

But all the unemployed cybersecurity influencers say cert is a waste of time? 🥺

[echo grove]

All certs are handy just depends at what level and what job

[elfin girder]

Honest jw what ARE the actual interview ratios for ppl with zero certs, zero IT experience, and a bachelors degree?

I gotta feel like it’s really really low

[echo grove]

My belief is

Bachelors Degree = Baseline standard you can be held to and proven work ethic (Also handy for promotions)
Certs = Practical standard and knowledge you can be held to
Experience = Proven practical and theoretical experience whilst in an operational environment

Obviously over simplified

[elfin girder]

That’s a decent perspective, but it doesn’t answer my question - how many straight college students actually have opportunities awaiting them (cybersecurity) without having to spend a bunch of money on basic certifications and without luck landing a help desk role?

That number’s gotta be really low

Even for normal IT roles

[echo grove]

College student with a degree? probably not that high however possible in low level jobs

i.e. service desk or IT technician roles at schools etc

It would also be more competitive which is what certifications negate in that aspect

[elfin girder]

True, also HR is a black hole

I’ve read stories about HMs applying for their own roles and not getting passed on for review

[echo grove]

Yeah HR is a bit of a blackhole however there are ways around it and unfortunatley normally requires decent experience before hand

[elfin girder]

In my 191 class we were legitimately told to write keywords and then color them white so they’re invisible and don’t get filtered by ATS 💀

[echo grove]

Well yes you can however that can be found out, a degree luckily negates a lot of HR filters so long as you arent required to have specific certifications

@elfin girder you question emoji'd elaborate

[elfin girder]

Huh? That’s the thinking emoji

[echo grove]

Oh lol

[ashen rampart]

YOOOO what do yall think about the AZ-500 or cloud security in general 👀

[stable raptor]

it's big and lit

you should do it !!

[charred ravine]

Hi guys, I just came accross the train o track site that selleing comptia security+ exam voucher for 16k inr is this legit? (In India only)

[rugged delta]

You should only purchase exam vouchers from legitimate sources. CompTIA has an authorised partner reseller program, so you need to check any claims by sites about such things

[undone sapphire]

i was wondering, is BS a must in the cyber industry?

For future promotion and administrative role

[rugged delta]

It can certainly help you but isn't essential. A lot of people have other accreditations; certifications, CTFs, bug bounties, conference attendence/talks, teaching, maintaining a blog, doing writeups

[balmy dove]

My degree is in chemistry and physics… but I was also doing security in high school (MCSA+security for windows 2000 and 2003)

As a hiring manager I’d rather see your tooling and thought process.

I’ve worked with people with phds and those with no degree. Just show you can actually do the work and you’re hired.

[elfin girder]

You’re a hiring manager? Do you take any amount of training into account?

[half cargo]

it counts, just like other things on your resume. is it a deciding factor? it depends. sometimes. sometimes not. 🙂

[elfin girder]

Thank you 🙂

[serene umbra]

Gave +1 Rep to @half cargo (current: #1453 - 4)

[undone sapphire]

thank you

[serene umbra]

Gave +1 Rep to @rugged delta (current: #17 - 610)

[wooden tide]

Do you guys reccomend me to get a bachelor in cybersecurity? I got an offer from a school, but is there something else i should get instead?

[echo grove]

Wouldn't not advice it, however if you don't think cyber is going to be your be-all-end-all may be worth doing a Bachelor of Information Technology then major in Cyber Security

[wooden tide]

why not study cs right away?

[elfin girder]

Comp Sci most jobs, Cyber same jobs as Info Sys

[echo grove]

Well you may not necessarily like it and might want to be a DB admin or network admin etc

[wooden tide]

I dont have the grades for comp sci😅

[wooden tide]

Okey. What about the salary? Is it good, in cs compared to others?

[elfin girder]

Cyber degree local to where I am here is kinda treated like information systems. Computer science opens all doors, cyber opens most.

[wooden tide]

Okey, good to know. What about the job market on a global scale? And do you think the demand wil increase over the years?

[echo grove]

Well it depends go do some research

all of them have senior roles all of them pay heaps depending on how niche you go

[wooden tide]

Okey, will do some research too. Thanks for the help

[serene umbra]

Gave +1 Rep to @echo grove (current: #598 - 13)

[wooden tide]

Or could you also answear on this?

[echo grove]

No problem figure out what YOU want to do then look at the options from there, cyber security, computer science and information technology all open up options depending on what YOU want

[echo grove]

Yes, with growing technology involves growing jobs, especially with the move towards cloud in all areas of industry

[wooden tide]

Okeoke. Think i will accept the school offer i got

[echo grove]

Just remember to look at your majors and possibly your minors and dont take on too much of a load

Yes, C's get degrees however B's & A's get you recognition

[wooden tide]

Fax. I will do my best.

[elfin girder]

That only matters for internships 😇 grad school just wanted 3.2 GPA 🤣

And jobs don’t care about gpa lol

[echo grove]

To be fair it also looks better if they check your academic transcript is moreso the point if your trying for competitive positions

i.e. if someone with a GPA of 6 and someone with a GPA of 5 applied for the same spot the 6 would likely win unless they are a proper idiot

[elfin girder]

Jobs still probably wouldn’t do that, but I’ve heard internships can/do

[echo grove]

internships definitely or graduate programs in government or competitive organisations i.e. google etc

• doing less and getting higher marks its better overall for self development purposes

[flat sedge]

first job will care about GPA as part of interviews. Once someone is in industry and has proven they can do the job, it doesn't matter anymore.

[elfin girder]

My first job didn’t. Most ppl I’ve talked to - no.

My experience, other countries might be diff

We are only ever advised to take GPA off resume unless it’s for internship

[woven folio]

Hey guys, I'm a final year integrated masters student about to graduate in July. I'm interested in going into pen testing but I realise that I probably won't be able to get a job in that field right after I graduate so I was wondering what other jobs should I look in in the spare time to build up my skills. Ik everyone recommends IT for common sense reasons but is it a good idea for me to focus on Software dev or even DevOps jobs to build up my skills so that in the future I can pivot to what I actually want to do

[elfin girder]

DevOps is its own career path. Software dev is good for hands on coding and experience with pipeline tools like Git and Jira

[woven folio]

Aaaah okay, Because I was thinking about focusing my skills on java and getting really good at it to get a software Dev job, and then pivoting later down the line.

Is this a good plan?

Or should I focus on another language

[elfin girder]

Up to you. Java still used, heck PHP still used. JS might be the easiest and fastest paying job tho

Everybody hires JS devs

[woven folio]

Yeah true, The reason I chose Java is because I've got the most experience in it through university projects and what not, It's definitely my strongest language

[elfin girder]

If you enjoy it, get really good with it and explore opportunities.

App Sec is also a big industry fyi

[woven folio]

Oooo okay, I'll note that down

Thanks I'll focus on java for the spare time then

[stable raptor]

insane btw

Jr. Analyst - 5+ Years Req.
I've seen more than a few job postings like this lately that makes me wonder if this is normal. They go like this:

Bachelor's Degree Required, Master's preferred

5+ years Security Analyst, SOC 2 experience

5+ years IT experience

Industry Certification (CompTIA +, CEH, CISSP, CISA, etc.)

3 years with SIEM, triage, digital forensics

3 years pentesting, red team, or blue team

saw on a reddit post

[elfin girder]

Apply anyway

If it says Jr. that means apply

Don’t worry about the details

[flat sedge]

This would be a mid to senior level role. it sounds like the hiring manager gave a req to the recruiting team and between the recruiter and HR, they fucked it up

If it's truly a junior role, having 20% of that list is fine. I would not expect a junior analyst to have any real pentest job experience.

[slim charm]

It’s because there’s a major gap between people with degrees and certifications and the people who have actually done the job. There are people with a “Bachelors Degree” in cybersecurity who don’t know the OSI model or what a subnet is. It’s something you’ll come across if you stay in these circles long enough. I talked to one guy on Twitter who told me he was CEH certified but he didn’t know what a shell was. It’s something you’ll see in the wild too, especially on smaller sites. Sysadmins who may have brilliant SIEM skills, or who are great at setting up a WAF… but at the same time they won’t sanitize user inputs, will have gaping SQL injection holes, they’ll leave on a public facing VNC server with no password. Employers have absolutely no idea where the knowledge gaps are for their applicants, which is why they come up with psychotic laundry lists for junior/entry level positions.

[echo grove]

I feel like with any degree if you don't know the basic fundamentals you mentioned the university needs to be looked into or your work ethic as an individual needs to

[rigid marsh]

Counterpoint: Where do you draw the line between "spoonfeeding" and "meeting the minimal baseline requirements"?
If a student enters a compscience or cybersecurity class and doesn't know the fundamentals at all, while the course focuses on more isolated and advanced topics, is it really the fault of the uni to spearhead someone through their courses, whoever organ who designes the curriculum, or the student who tunnel visions on the course material without understanding the core concepts?

It's my personal belief that anything IT related is like a car. Just that plenty of people studying automotive engineering instead of working as a mechanic.
I can tell you who of those is able to refurbish a rear axle.

Unfortunately, workshops don't usually require a degree to pass a HR filter. Whole system is busted.

[echo grove]

Yes it is the universities fault, quite literally the first topic I did was internet fundamentals about how the internet works. A degree should teach you from the ground up. It is not a masters degree and is vastly different to what TAFE certificates are for. If OSI or TCP/IP models are not covered at any point that is pretty shit

Let alone not covering subnetting

[rigid marsh]

Maybe I'm a bit jaded, since I did my degree part time, which means the baseline for expectations was a bit higher - but I find it rather hard to teach all aspects of IT within 4 years, if it has go to beyond a fundamental level. Going in with the mindset that you're a top dog in more than 2-3 domains after 4 years by following a bachelor program is insanity, especially if you put in any/barely any work for projects on your own.
But I don't disagree, going through the degree path and not doing anything tangible about the 7 8 OSI layers is pretty ridiculous . But I'm sure even these shitty unis just follow a playbook by whatever organisation tailors the curriculum.

[echo grove]

I am doing a part time currently, a bachelors isnt meant to teach all aspects, it is meant to teach the fundamentals and then after that is where you have your masters and/or certifications to go deeper into specific areas

I like to view a bachelors as an HR gateway and a taster of all areas of IT

(Specifically if your doing a Bachelor of IT than cyber or comp sci)

[gleaming pebble]

Does anyone know how long it takes someone to study and pass CREST Practitioner Security Analyst (CPSA)?

[slim charm]

It’s called a “Bachelor’s Degree” because the education is supposed to be so intense that a man puts off marriage (becoming a bachelor) to pursue it. Learning the fundamentals is what an Associate’s Degree is for.

[echo grove]

An Associates Degree atleast in Australia has a higher educational rating than a bachelors IIRC. Also, we are talking about the 21st century here

[slim charm]

I’m not sure what being in the 21st century has to do with anything. College degree holders had better educations the further back in time you go. At the beginning of the 20th century it was still a basic expectation that a collegiate would be able to read and write Latin/Ancient Greek, be trained in both Platonic and Enlightenment philosophy, speak multiple languages. Have you read Thucydides or Pindar? To someone from the 1850s someone with a modern Bachelors degree would be completely uneducated

[echo grove]

1. Women can do degrees
2. My partner and I are both doing a degree and it has not had a major impact on our life
3. Reading those are not relevant for what I am getting a degree in

Hence my 21st century comment (Also we are talking about information technology degrees.) (Also I was thinking of graduate certificates not associates I was incorrect on that)

[rigid marsh]

Sorry, but a "Bachelor" isn't here to teach you the basics. It's the first part of advanced studies, and advanced here is the precursor that determines that you don't start from a clean slate, but are expected to have fundamental knowledge already that is then built upon.

Als I fail to see how women being able to get degrees is in some whay influencing the scope and quality of them.

[echo grove]

I didn’t say the basics I said broad aspects across the field. Also I doing a bachelor of IT have 3 subjects that cover the OSI and TCP/IP model one of them in depth being ITC212 which is a core subject and explicitly teaches subnetting and the models

The women comment was towards Bushido rebuttal to my 21st century comment. Irrelevant to what me and you were discussing @rigid marsh

[rigid marsh]

I digged out the computer science curriculum of a local, full time uni.
and if I just dig up the details on the networking course:

The following aspects of telecommunications are covered in this lesson:
- Reference models (layered models)
- Coding theory and error detection
- Media access control
- Routing, distance measures, and shortest paths
- Flow and congestion control
- Connection-oriented communication
- Internet protocols
- Socket programming
- Network security```
I'm just note sure that 56 hours are enough to cover the topics that you're going to be able to work with this info in a very useful way.

So yes, certainly the guys you interviewed must have heard something of subnetting etc. But does it actually stick? Highly doubt so and as you could tell yourself, apparently did not.

[echo grove]

Don't know about you but a 8 credit point subject being ITC212 in Australia is expected ~8-10 hours per week

With an expected output of ~120-160 hours over a full session

Aswell as studying the full textbook ontop of practical/theoretical assessments with lectures

I would say to cover subnetting and OSI-TCP/IP for a single subject that is more than enough

https://handbook.csu.edu.au/subject/2026/ITC212

That subject is a core subject in bachelors comp sci and IT

[rigid marsh]

the course has 5 ETCS, which roughly translates into 125-150 hours. a third of that is contact hours.
If you want to grind out the list above in 150 hours, that won't be possible if you have to explain students what a network card is, or if you dedicate an entire day to explain a firewall ACL.

Pic above is from a renowed swiss uni, so I doubt it's one of these shitter degrees we talked about earlier

I just don't see it done in that timefrime without putting in the extra learning hours or some background knowledge. Sorry chief.

[echo grove]

Except that NIC's are actually taught in that subject hence the text book you read and as for ACL's those have an entirely separate subject under the network engineering major

[rigid marsh]

Of course they are. the question is in what detail

to get practical, there's a big difference between explaining what a subnet is, explaining how a subnet works, and being able to implement proper subnetting

[echo grove]

The point being a Bachelors is to make students have a baseline understanding and competency before you specialise and add depth via masters degrees or certifications

Correct, you are right. Hence why you wouldn't expect a fresh grad student with no certifications or experience to go into a mid-tier network engineer role straight off the cuff

[rigid marsh]

Correct. But it's also not realistic to say that people with a CompSci background got the bare minimum exposure and are now just one step above "useless" in the corporate world. If that's the case in Australia, I certainly woulnd't go an study IT over there lol.
There is a reason why science bachelors build upon previous knowledge. You very, very rarely start from scratch, but use that foundational knowledge for advanced concepts. If you go into a CompSci bachelor with 0 experience, 0 skills, 0 drive, and expect to be given a free handout of basic knowledge, you're in for a wild awakening.

Example from my past: Programming class. It was explicitly asked beforehand to install an IDE.
People didn't know what an IDE was, didn't do any research, and we spent time troubleshooting until everyone could launch code.
That's a failure in my book.

And an insult to people who at least put in the effort and pay money to spend time there

[echo grove]

With 0 drive your cooked anyway for a start. However your logic is coming from you must have a background, no. If the course is worth an ounce of the money you are paying I would expect baseline topics to be discussed and taught to you professionally not by self-education.

You are now also mixing student effort failures with curriculum design failures.

Further, most subjects will tell you if a prerequisite knowledge is required or not (Generally the prereq's is to of completed a different subject before moving on)

A bachelors in particular guarantees a baseline it does not guarantee mastery in a field. It is based on the learning outcomes achieved throughout the course.

[rigid marsh]

We just have to agree to disagree. What I see from newgrads and own experience doesnt match the fundamental knowledge boost you are talking about.
That said, you are completely right in theory. But with the hours scheduled per module, you will cut corners someewhere. And when that happens, what ends up being fundamental and what not can be open for interpretation.

But the examples mentioned in the earlier posts clearly are things not to be cut.

[echo grove]

Eh may be different and yeah I do see where your coming from and I have noted it a bit myself, noting I’m doing an IT degree not CompSci, however 56 hours or whatever per unit is nowhere near the Australian standard of ~160 hours so there may be a difference there

Also to be fair depends on the uni you go to some are more theoretical some are more applied

Anyway good chat imma go to sleep now haha

[rigid marsh]

Cheers lad

[opaque scroll]

how to start at the soc

[keen tundra]

https://tryhackme.com/path/outline/soclevel1

[lethal ruin]

Hi, I have a degree in conputer networks and Im recently SEC1 certified. I'm looking for my first role in cyber or anything IT at this point. 100% remote working is needed due to my current circumstances. Would anyone point me in the right direction or assist me in a referral please?

[rugged delta]

The best thing to do is to look for roles in your region on LinkedIn and other job sites. There may be a lot of competition for some roles so you might need to do more, such as having a home lab, a blog, discussing your projects, writeups, going to conferences/CTFs, having a Github/Gitlab profile, etc.

[lethal ruin]

I already have a selfhosted homelab as well as a portfolio to show it off. Git hub profile active and contributing to issues on my favourite repos. Attended my first Bsides.

Its hard to keep motivated with everything you have to do for a job.
I'm trying to be persistent but it just gets tiring applying through websites, registering to 100+ said sites and just get an automated message back with no human emotion to say that I have been unsuccessful. Please try our talent pool etc...

Sorry for the rant

[stable raptor]

Dude I feel the same but what can you do 😔

Try Helpdesk / apprenticeships / technician jobs

And fix your resume if you can’t get interviews and tailor your resume to the job title (not job desc)

There is this guy called head less hunter and he’s helpful

[lethal ruin]

Ive tried adjusting my CV a couple times, I was told by a recruiter I'm too over qualified for the job I applied for.

[stable raptor]

wth 😭

[lethal ruin]

I'll have a looksies thanks

[serene umbra]

Gave +1 Rep to @stable raptor (current: #1237 - 5)

[stable raptor]

Dude what role did you apply for

Are you international or US based

The dilemma: can’t be overqualified but can’t be under qualified 😭

[lethal ruin]

I really can't remember. It was a few years back. Just got it stuck in my head that the guy said that to me

[lethal ruin]

Europe

[stable raptor]

ohhhhh

Welp sir gl 🫡

[lethal ruin]

Thanks. You too ig 😅

[rugged delta]

When you're applying for a job, you need to tailor your cv/resume for the role. Use keywords and qualifications from the job description if you have them but don't load your cv with all the ones you have. You can discuss other qualifications at interview

[lethal ruin]

I have tried to tailor my CV to cyber and a separate one for administration. Maybe ATS systems aren't picking up keywords correctly idk. If i can get my hands on an ATS system to take home, maybe I could diagnose why.

[stable raptor]

ATS doesnt pick up ur keywords, its a first come first serve model

there is no AI or anything

you need to tailor your resume to the job TITLE not desc

you will waste time b/c every job desc is a bit different

i highly recommend watching headless hunter

[vale belfry]

I have been gone for a while but I've been working on building my cyber range lab 🙂 I can't wait to get it racked this weekend and start installing all the software. It's been a long, grueling, painful month of securing deals.

How would you reference a cyber range lab on your resumes?

Would it be a project or since it's part of my business would I put it under experience?

[lethal ruin]

Oh, I thought it scans and filters every single CV that comes in. My silly assumption

[stable raptor]

lots of people think this

again, watch headless hunter, he has videos on what ATS rlly is

what role are you targeting ?

think of it like a digital filing cabinet

[lethal ruin]

Junior SOC analyst and system/network admin

[stable raptor]

i think those two MIGHT have different resumes

i would join his discord

[lethal ruin]

Do you have a link please?

[stable raptor]

ye

[lethal ruin]

I have separate resumes

[stable raptor]

ok good

[covert roost]

I was planing to work as a soc1 analyst but I learned they are working with nightshift system so I am planning to push myself for Security enginner role and tryhackme path do u guys think that path is enough and decent for this role?

[torpid lantern]

What certs you got?

[vagrant cargo]

I'd still take that SOC analyst role anyday, any experience you get will be a benefit to further on move laterally to the security engineering position.

[torpid lantern]

Yeah experience always looks better than anything

Nightshift isnt that bad. A lot of SOCs have them

[covert roost]

I have no experiance guys I just had 3 months internship as a soc1 role but I dont wanna get any nightshift thats why I changed my roadmap

but I just want to know our tryhackme security enginner path is that enough

[torpid lantern]

Security engineering isnt an entry level role, especially if you dont have experience

I'd go for the SOC L1 role. Night shift is rough but it'll look good on your CV to have experience

[covert roost]

I mean yeah u are right but I dont wanna really work at nightshifts

I wasnt really know the disadvantage of nightshifts

[torpid lantern]

If you have no certs and no prior experience then it's extremely unlikely youll get a security engineer role

Is it an internal soc or internal?

[covert roost]

but which certs should I push u think

for a security enginner role

[covert roost]

and sir I really dont wanna for as a soc analyst

[torpid lantern]

Why not

It's a common starting role in cybersec

[torpid lantern]

Depends on what the roles in your area look for. If you do an internship then you can pivot and potentially move up the corporate ladder and get a full time role

[covert roost]

secutiy enginner

[torpid lantern]

That doesn't help

Security engineer roles in India have different requirements than a company in the USA

[covert roost]

I am living in Turkey

[torpid lantern]

Yeah so see what certs are required

[covert roost]

CompTIA Security+

[torpid lantern]

Go on LinkedIn and check what the certs all the job listings have

Security+ is like... Bare minimum for SOC in my experience

[covert roost]

what would you go for?

then

[torpid lantern]

The opportunity to have an L1 role internship without certs is crazy good

[torpid lantern]

Like I said - Look at the certs that are mentioned for roles in your local area. What certs I have and recommend might not be useful for you in your area

[covert roost]

I worked for a turksh bank but I had 3 months nightshift so end of the internship I decided to change my role

[covert roost]

ight

[torpid lantern]

What's your reasoning to saying no to nightshifts?

[covert roost]

I mean basically I dont wanna lose my face card

[torpid lantern]

Bro what

[covert roost]

It can be weird but thats why

I need sunlights and friends

[torpid lantern]

You can have good experience on your CV and money, or no money or work experience, but at least youll look pretty I guess

[covert roost]

ahh I mean I am just not sure

[torpid lantern]

If that's higher on your priorities then all the power to ya. Personally I would take the job experience and money so I can use that to get other jobs later. Without any experience or certs you're not likely to get a security engineering role

[covert roost]

try to look from my persfective pls

[torpid lantern]

I don't know you. I can only tell you what I would do.

[covert roost]

but still in the future I dont wanna work as a soc analyst

I mean role is superfunny

[torpid lantern]

If you want to be a security engineer youll need prior experience.

SOC Analyst might be something you dont want, but it's the start of a career in InfoSec

[covert roost]

so what is the other alternatives

if still I dont wanna for as a soc1

[torpid lantern]

Have a family member in the company

[covert roost]

my red team knowlage is awful

[torpid lantern]

Or enough certs to get a job

I'm bad at pentesting, but HR look at CVs before anyone else. If they're told "get people with X Y and Z certs" and you dont have those certs then youll be rejected

[covert roost]

what about if I work 6 months as a soc1

do u think can i swich the role

to

cloud security analyst

[torpid lantern]

Depends entirely on the company

[grim pendant]

I'd take that job anyday

[covert roost]

this is sounds great

[torpid lantern]

Yeah nepotism is a hell of a good way to get a job

[covert roost]

ahh I am so stuck

[grim pendant]

If i were you just take the job, not everyone is lucky to get that. Then in future you will have experience and can apply for what you want.

[torpid lantern]

You can still see friends when you do a nightshift. If its like 1900-0700 then you still wake up at like 1pm, go see your friends and hang out before work

[covert roost]

bro I swear I am about the lose my facecard

I will try to go for security enginner role

[torpid lantern]

Without any experience

[covert roost]

I mean I got 4 months

I can still learn and get certf

I know almost everything abt network'ng

and splunk

[torpid lantern]

I just checked a job posting, they need 4 years experience

You can slim that down a bit if your experience with homelab stuff is good. But no one will hire someone with 4 months experience imo

[grim pendant]

I got a question, are people here who got careers for Cybersec, they just learned from tryhackme? Or did actually go to some school?

[torpid lantern]

I got a degree in compsci and got certs. Used THM to learn tools and add it to my CV

[grim pendant]

Would I need degree as well? Or is enough to learn every single thing from THM and get the certs?

[torpid lantern]

When I get interviews I talk about THM, but I don't put it on my CV because HR dont know what it is

You dont need a degree. Certs can cover that depending on the company

[grim pendant]

Thank you

[covert roost]

ight

I will work for a mcdanls

[torpid lantern]

Or get the SOC job

[wary bear]

Hey, whats the go-to for remote jobs outside of the US? Or ones that at least dont require sponsorship?

As in, websites and such. Linkedin feels like its talking to a brick wall sometimes

[torpid lantern]

That's incredible broad lol

Do you have certs? What kind of experience do you have? What role are you looking for?

[wary bear]

My bad, yeah I have eJPT and AZ-900, looking for pentesting/red team opportunities. I have 3+ years in cybersec consulting so im looking for similar roles

problem is im from LATAM, most US job opportunities requiere sponsorship and stuff which makes it hard to even get considered without them

[torpid lantern]

Look somewhere else then. Remote jobs can vary from jurisdiction who they can hire. From personal experience if a company doesn't have a legal presence in your country then they're less likely to hire you

[wary bear]

Yeah thats why im also wondering what other platforms people use apart from linkedin to find remote jobs. At least what i´ve seen pop up, I can´t apply to most that pop up on my search

[torpid lantern]

Indeed and Linkedin are by far the most commonly used

[wary bear]

I´ll try Indeed, thanks 🙂

[torpid lantern]

Talking from my own experience here btw. I haven't worked in North/South America so take it all with a grain of salt

[wary bear]

I´m also open to work for europe, honestly anything that isn´t south america is a huge plus

Europe has more language barriers though from what i´m aware

[torpid lantern]

Mm. I'm fortunate enough where I've never had to deal with a language barrier, but I understand it can be tough

Could see if there's anyone in your network who has experience in working for a company in Europe

[still finch]

Heya everyone!
Does anyone here have attempted or passed the “Certified Blue Team Practitioner” by The SecOps Group (pentestingexams)?

Would appreciate the resources yall used during your preparation.

[rugged delta]

The main concern when hiring pentesters is that it is some of the most sensitive work a company needs done. Companies may have regulatory requirements about how they fulfill certain roles and complete certain tasks. You might need to migrate, going through the visa process of a country, and for penetetration testing likely further scrutiny. You'll also be highly unlikely to be hired into a pentesting role with AZ-900 and eJPT, these are two fundamental certifications. You might be expected to have OSCP+ or similar at the minimum, or be able to show other pentesting experience, such as through CTFs, Bug Bounties, etc. I'd recommend reading the Tribe of Hackers Red Team book as well for hints and tips

[toxic citrus]

Hello, how can I get my first job in anything related to IT/Cybersecurity? I believe any IT position I land will build knowledge that helps me in the future — regardless of the role. My goal is to get that first job for both the salary and the experience. Any suggestions? how about help desk/it support?

I have previously learned web development a few years back HTML, Python, CSS, JavaScript, and Django on a self-taught basis. I also studied cybersecurity but wasn't too focused on it. I understand the concepts theoretically but haven't practised much hands-on.

[exotic thistle]

What’s wrong with SOC?

[toxic citrus]

wdym?
bcs it is the lowest role in cybersecurity I guess, and I love it based on what i learned

[willow tundra]

do u think cybersecurity is worth self learning it will it get me a job? and how can i really get a job without experience really

[echo grove]

Without experience?

Certifications, formal education, blogs, projects

[oblique forum]

There is an issues with rooms I just put answer of one question and tryhackme automatically solved my room why

[warm hinge]

Hi, I want to learn cybersecurity to become a pentester. I already know the basics and have used Metasploit, Nmap, and Wireshark. Where should I start? I would love someone to guide me?

[keen tundra]

https://tryhackme.com/path/outline/cybersecurity101

[distant kernel]

start from attack-chain terminology. the best thing you should sharpen is your recon skills.

[stable raptor]

is it unrealistic to from helpdesk --> soc analyst ?
i am just lost
i've heard if u do helpdesk u need some speciality to go to and so like cloud, networking, security, etc.

[maiden mirage]

Hey guys, does tryhackme offer like labs for universities to use? Like, hackthebox has communities that unis can make to have collaborative labs

[rugged delta]

Yes, you can absolutely transission from helpdesk to soc analyst. You can follow the regular paths on THM that'll teach you everything you should know from the basics to advanced knowledge you'll need to be able to do the job

[rugged delta]

You should check out the classrooms feature to see what's available for students:

https://tryhackme.com/classrooms

[torn girder]

yo guys whats the best things to learn first in studying red team at home? i already surpassed Comptia A+ core 1

i also know how to code basic python including threading and libraries.

i have built a simple voice recorded browser search app when u press a specific key

and some other apps, i mean you can check my github

[rugged delta]

You need to learn Linux, Windows, networking, security principles, and then start learning hacking. There's lots of great stuff in the THM paths to take you from beginner onwards. Python will certainly be a benefit. You'll pick up some basic bash and powershell as well as you progress

[torn girder]

Oh actually I'm not a beginner forgot to mention. I have a Linux homelab

[torn girder]

And I built a Android root level underclocker before using python

[stable raptor]

nice

[rugged delta]

Excellent. You should look at cybersecurity roles that you're interested in and see what kinds of qualifications and projects you should be partaking in. Having a blog/github profile can be a great way to discuss your projects, achievements, writeups, certifications, etc. Taking part in CTFs and going to conferences and meetups can be a great way to meet others who might be able to connect you with potential roles. Also consider various job fairs. You might consider reading one or more of the Tribe of Hackers books, a series of interviews with experts in various cyber roles across the industry

[torn girder]

This is some good insight, I'll check tribe of hackers as well, thank you!

[serene umbra]

Gave +1 Rep to @rugged delta (current: #17 - 611)

[jolly hamlet]

hi ! Can you give your tryhackme username .

[uneven hull]

Hey👋👋 I recently started working as a junior network engineer and I’m still learning a lot of new things. Recently I came across products like honeypots or deception servers. From what I understand, they act like intentionally vulnerable servers that attract attackers. When a hacker tries to interact with them or exploit something, the system can detect the activity and gather information about the attack or where it’s coming from.

My question is how effective these systems actually are in real life. Can they really fool experienced hackers, or are they mostly effective only against less skilled attackers?

Also, how do attackers usually detect or avoid honeypots/deception systems? Are there known signs or weaknesses that make it obvious that a server is actually a honeypot and not a real vulnerable system?

Would be really interesting to hear from people who have experience with this in practice.

[torn quest]

Hi, honeypots (and honeytokens) are actually pretty effective, our red team has tripped our deceptions various times in the past, meaning that you can fool experienced hackers with them. Because honeypots are so noisy, it's hard to effectively avoid them. The simple act of pinging or scanning a port on the honeypot would create an alert, which happens often during recon. If they manage to get into the honeypot, they'll probably figure out it's a honeypot based on how it's setup compared to other devices in the network. It really all depends on the honeypot you're using and how it's configured.

Hi guys, has anyone here navigated the process of landing a cybersecurity position in Spain as a Non-EU foreigner? I'm a mid-senior level cybersecurity engineer in the US and am looking to relocate to Madrid.

[slender hearth]

Now I'm currently at my final of grad bsc cyber security but i dont have much technical knowledge deeper and spent so much time in cyber awareness session in different schhol,communities ,organisation. but now i have to learn and earn but not have enough knowledge to start i think but still i have to earn . I dont have money left with me much but i m eager to learn now i have to support some fam expenses but expect me to manage it from just from carrer of cybersec only ...
Is there anything from u all who share some insights or learning or internsip oppotunity can tell me

[rugged delta]

You need to get really comfortable with Linux and Windows admin, how networks function, learn how programming works, spend a little time learning about the cloud and AI. If you don't you'll miss out on learning opportunities and be in deep water when you go to pursue cybersec skills. I know academia throws a lot of theory at you, and a lot of written assignments, with quite a bit of practical experience, but nowhere near enough to perform at a high level in cybersec. You might be suited to a helpdesk/tech support/IT/QA/SOC role with ongoing training. Luckily you can learn a lot here in THM. If you're not a subscriber, check out the free beginner's path suggested below. Also pick up one or more of the Tribe of Hackers books, and get in the habit of reading and studying as you progress.
https://tryhackme.com/resources/blog/free_path

[lapis iris]

I would like to network with Risk Officers or Risk Managers, if any. Risk is a weakness of mine and I'd like to get good at risk management and assessments. I believe it is a field that is underrated and I could transition into as I currently work as a Systems Security Engineer managing ATO processes.

[echo grove]

Do you have any specific questions?

[lapis iris]

I'm just wondering without a finance degree. Only security background. Is it possible to be a risk manager?

[echo grove]

I would say it depends on where you want to go. Risk isn't just finance, you working as a security engineer dealing with ATO processes are exposed to risk and management of it.

There are all different areas of risk Cyber Sec, operational, financial, legal etc it depends on what you want to go down

[lapis iris]

Yes. Could one get in without any certifications?

[echo grove]

In theory if you promoted into a managerial role and gained the exposure however generally you would be looking at getting a bachelors or masters else certifications

For example an ITSO with a masters in cyber security would perform risk management and acceptance on cyber security matters, however generally youd need some sort of qualification

To be fair risk is at all levels its just who you defer and elevate risk to is when you hit the dedicated people

[elfin girder]

Some recruiter reached out to me yesterday about a PM role 🙁 this has to be a joke. (I've been looking for IT/Cyber/Networking)

[echo grove]

PM roles can do that dependent on where and what it is, I personally if I was doing PM would still want to be on the tools

[elfin girder]

He said that it was mainly being the front-face for the customer. So probably not tech and probably wouldn't help with a career in cyber lol

it's a SWE company btw

[lapis iris]

My team is front face for the customer. We support them. It is still cyber.

[echo grove]

Fair

[lapis iris]

So and ISSO could be handling risk decisions as well?

[echo grove]

100%, an ISSO focuses on security, compliance and monitoring. If A system technician came to them with something theyve implemented however there is some risk involved i.e. opening a port for a service that is where risk acceptance comes into play

oversimplified example obviously

[elfin girder]

what do you think? i would have to relocate and it's quite far away

i also had a Sr. Recruiter reach out for a position I'm currently doing elsewhere, probably for more pay, but I'm not willing to leave for that personally.

[echo grove]

I would ask questions then way up your options of what you currently have

[random parrot]

Any advice after passing sec+?

[elfin girder]

Get job

[stable raptor]

Get GCIH

[sterile vapor]

I just finished the fundamentals of cybersecurity and started the Google IT support on corsera. Can anyone help give advice on where and what I should look into or work on next to get started with an intern/ entry level?

[edgy orchid]

Probably depends on which aspect of security you're most interested in. Have you done the Cybersecurity 101 learning path on THM yet? It gives you some practical demonstrations of what the different paths of the industry look like, that might help your decision if you haven't already decided

[stable raptor]

i love socks

[dusk wedge]

i bloody love recruiters

[rugged delta]

If you're doing one of the Google courses on Coursera, try and finish it in the first, free week, then cancel your subscription. They're fairly basic courses and employers wouldn't consider them valuable, because they don't really train you or test you to a satisfactory level to actually do a job

[lean sand]

Hello guys

I'm new here

[analog raft]

Welcome

[lean sand]

I don't know where to start from

[analog raft]

Try persecurity learning path first and see if this suited you.

[lean sand]

Where can I learn that

[analog raft]

In tryhackme

[keen tundra]

https://tryhackme.com/path/outline/presecurity

[stable raptor]

LEARN

[random parrot]

Either soc or pen test lol

[edgy orchid]

Opposite ends of the spectrum but if you don't have a preference, maybe dabble in both and see which you enjoy more? SOC has more entry-level positions open, which is unfortunate for me because I just don't enjoy blue team stuff for the most part But yeah, I'd say just try both in depth and see which clicks better

[spiral mulch]

I’d like to have some feedback on my resume to fine tune it for job applications.
Will anyone have a look at it?

[rugged delta]

If you post a PII redacted image of it here, someone will look at it

[rugged delta]

It looks quite good, clear and easy to read. Good descriptions of your skills and experience. These days when applying for jobs, most of the time you'll encounter Applicant Tracking Systems (ATSs); Ais built to filter fitting cv/resumes. You'll need to tune your cv using keywords from the job role you're applying to. Your cv looks easy enough to modify to add/remove words that match the job description that an ATS will be looking for

[spiral mulch]

noted
thank you very much!

[stable raptor]

I heard this is wrong

ATS doesnt use AI, its just a first come first thing

[spiral mulch]

i believe it was just a word finder before the AI boom but now i think AI does have some play in this sreening thingies cuz it does a bit of a better job than just plain word search

[elfin girder]

Mang I gotta find a way to get an internship like that. I work on MES but I don’t get to play around with OT/ICS

[spiral mulch]

it was an on-campus opportunity sooo
but hey, I'd say i wanna do something in MES too

[rugged delta]

Some companies have integrated AI tech. Not all AI is LLMs. At one stage, calculators were considered AI tech. Also, it's AI until it works. Then it's just a normal computer program

[stable raptor]

Interesting

I’ve heard to tailor to the job title not the desc

Void recommended headless hunter dude that’s what I’m going based off

[rugged delta]

They want you to have some of the words from the description. Also, a huge volume of job positions on LinkedIn and such are fake, cos they're trying to encourage their staff and investors that things are going well so money comes in and staff don't leave. There are also regulatory requirements in some places where the job has to be posted publicly even if someone is just getting a promotion

[stable raptor]

👍

[elfin girder]

I mean your resume looks a thousand times better with it. So I’d say it was a pretty good opportunity

Surprisingly, my uni didn’t have many opportunities like that.

And I never landed an internship

[spiral mulch]

thanks man
appreciate it

[serene umbra]

Gave +1 Rep to @elfin girder (current: #148 - 74)

[stable raptor]

anyone wanna review my resume 🥺

[hushed mason]

its great i wish i had one to

[stable raptor]

???

[hushed mason]

your resume its great i mean

wish i had one to 🙂

[stable raptor]

oh ok ty

[hushed mason]

hehehe its ok 🙂

[stable raptor]

do you offer any advice

any way i can make it better

[hushed mason]

bro i be honest with u ok i dont even have 1 month of experience in AI/ML that thing takes metal balls to learn and do it's way out of my league hhehe and any way if u want to enhance you resume more u can add some more experience or projects ig

[elfin girder]

with resumes like yours, it's no wonder i'm not getting any interviews 😛

[stable raptor]

...

WAHT

something was delted

🤔

[spiral mulch]

Dang its fire
But don’t you think the first and the last point in your first professional experience are a bit repetitive?

I feel like it’s putting forward the same point

[stable raptor]

I see

[dim ridge]

Wanna ask you
should someone have an College degree or University
To land a job ?

[hushed mason]

guess its important in some countries 🙂

[rugged delta]

It's not essential, but it can give you better visibility. Depending on your country, the cost of doing a degree might outweigh the value it'll give you. Many people going to cybersecurity prefer things like certifications, having a blog with discussion of projects, home lab, events, writeups, etc.Having a Github/Gitlab account is a great way to facilitate that. I'd suggest reading one of the Tribe of Hackers books on the topic

[minor dust]

Heyyy is anyone interested in learning cybersec w me using homelabs?

[elfin girder]

I literally just saw like 5 minutes ago a State Farm Talent Acquisition person asking for recent Computer Science graduates from my college in particular. So probably 🤷‍♂️

On LinkedIn but still

[mossy ivy]

Hi,
I have around 2 years of experience in SAP Finance domain BUT I want to switch to cyber. I tried asking internally if I could move to a GRC related cyber role but 😑 they said network with people and increase visibility and provided a free isc2 certificate link to learn more on cyber. And I talked to 3 leads 🫠 not much hope.

So at this point if I get an ISO 27001 certification will that get me a job in the grc field in this job market....(From India)

Or should I just persue masters in cyber from Europe?

Cause I have heard a lot that masters in cyber is not required....but 😭 how do people switch careers I am so confused.

I have a btech in computer science and MBA in finance. So I already know about cyber and I am doing a Google cybersecurity professional certificate to brush up my fundamentals.

Any advice 😭?

[devout lark]

I'm not in the field but recently someone told me a master's degree is good and shows an ability to understand systems deeply as many places have their own proprietary systems.

Personally I want to get a master's degree in Europe.

[sturdy brook]

can someone give me advice on my resume? mainly will use it to apply for internships

[buoyant patrol]

Anyone have any experience interviewing for network related roles? I’m interviewing for a network analyst internship and was looking for tips.

[winged scaffold]

had two for this last recruiting cycle (one was technically infra title but it was mostly networking), at least in my experience if you know the OSI and TCP/IP models well (ie the layers, devices, protocols, order, who serves who, maybe even some layer specific header info and stuff), you can answer pretty much everything with ease. the deeper you know the models and basics, the easier every generalist question is, which is all theyll ask for internship level. in one of mine the only real technical question w hm was to explain the osi model in as much detail as I could, and nothing else, purely behavioral.

other than that maybe just simple stuff like use cases for vlans. im no networking expert but i found mine relatively easy

[chrome nebula]

Do HR-s take certifications into consideration? I have PCEP and i will do PCAP soon.Will i be able to get a job with those or they favor university studies?

[echo grove]

I would say getting a degree would be more advisable than those two certs alone

[chrome nebula]

Im only 17 so im looking for internship at DMAC (junior data analyst/market analyst) Do you think i have any chance? Be honest.

[echo grove]

I am not really in the analyst space, your best bet is to research the job you want and target midish tier certs that align to that

or get a degree in that field as thats pretty much a catch all

[pliant flare]

we're in the same situation, I too need to find an internship

[chrome nebula]

they offer really good salary for a freelancer junior data analyst tbh

at least in my country its a good salary

but every company has "ongoing university studies" in requirements

[pliant flare]

I'm fine with not having a salary

I might as well apply to THM, but they don't have any internship positions, I'll work for free as well

[chrome nebula]

i think blackrock has some good offers for you

i think they offer internship like that

iirc

[covert roost]

guys where can i learn Vulnerability Management

there is only 2 path exist soc1 and pentester

[buoyant patrol]

Thank you!

[serene umbra]

Gave +1 Rep to @winged scaffold (current: #3677 - 1)

[torpid lantern]

You can learn tools like Nessus, OpenVAS, or Qualys

[wraith geyser]

guys help i am starting my career in offensive security but i don't have any degree so still i can get job?? i also have adhd

[rugged delta]

You don't need a degree necessarily to get a job in cybersecurity. There are lots of ways to gain the skills you need. As well as THM, you can learn more about Linux, Windows, networking, coding, cybersecurity and more through certification and training, practice, building a home lab and creating projects, doing writeups, going to conferences, attending CTFs and blogging about them online. Github or Gitlab can be a great help in these. You can read books on every topic in the field, including AI. You should check out the Tribe of Hackers books, which discuss such topics for various roles in the field

[wraith geyser]

thanks

[serene umbra]

Gave +1 Rep to @rugged delta (current: #17 - 612)

[elfin girder]

hey ive got a question for you. what are the reqs for an ISSO? i got instantly rejected by boeing when i applied, i thought i fit most criteria having the dod 8140.03 compliance (sec+ and cysa+) and a bs cybersecurity along with IT exp.

i get i don't have the full 100% requirements, but i wasn't interviewed either

[rugged delta]

Are you part of the continuous vetting program? 3+ years implementing the Risk Management Framework? Their process is fairly intense, because they're a government supplier. This is the job description I found:
https://jobs.boeing.com/en/job/pleasanton/cybersecurity-information-system-security-officer-isso/185/92478430928

[echo grove]

We just had a chat about this over in #general haha not quite the clearance aspect haha

[elfin girder]

i was looking at the position in missouri, which i think said 1+ year instead of 3+ but no i am not part of the continuous vetting program. not even sure what that is tbh

[rugged delta]

A lot of the people going for jobs in Boeing or Lockheed grew up in the towns where they build, or have a continuous government presence close by, etc....

[rugged delta]

Well I think it's a government program you can apply for. It's not the same as a government clearance program, but they do likely do things like interviewing friends/family, looking at your web history, what clubs you're in, what programs/projects you were a part of and your success, and other things

[elfin girder]

interesting. what's this though: government clearance program

[rugged delta]

If you want to work in the FBI or CIA or NSA, etc., they have their own programs to decide if you get a security clearance and what level... Kinda like this... https://www.youtube.com/watch?v=Wq0jct4QLcY

Well then best of luck pursuing it

[elfin girder]

thanks 🙂

[serene umbra]

Gave +1 Rep to @rugged delta (current: #17 - 613)

[elfin girder]

Continuous Vetting (CV) is a process that involves regularly reviewing a cleared individual’s background to ensure they continue to meet security clearance requirements and should continue to hold positions of trust.
https://www.dcsa.mil/Personnel-Vetting/Continuous-Vetting/
I looked it up, appears Continuous Vetting is just the process of continuously making sure cleared individuals aren't doing anything sketchy 😕 so doesn't look like a program to help get a job.

[rugged delta]

It is a requirement that Boeing has on their job description. Specifically, you need to have been subject to it for 5+ years

[elfin girder]

hmm

but i'm not sure what I'm allowed to say here to ask because clearances are very sensitive

[rugged delta]

Of course, I'm not part of the team interviewing you, so I don't know why they made their decision

[echo grove]

For a start I am not even American lol

[rugged delta]

Nor am I! It's just quite normal to hear about a lot of American processes and organisations in this field, since so much of it comes from them

[echo grove]

Yeah haha, I love commenting on stuff that seem reasonable here but then unreasonable elsewhere then your like right different country

[rugged delta]

I've worked for American companies and they need to comply with US laws and policies, and a lot of the same ideas are adapted for other places around the world

[echo grove]

Tracking haha more meant in the Discord setting like this haha

[elfin girder]

don't get it wrong, even American companies tend to C/W ISO 27001/002 and others. we all share policies and frameworks 🙂

i dont rm which one, but a fully American company just recently shared on LinkedIn about their official compliance with that framework

[rugged delta]

Yeah it's quite normal for companies to adopt that standard, especially when dealing with international clients

[short sigil]

hello

[toxic plinth]

Yo guys any tips or anything I should prepare for appling internships

[dusk wedge]

find a fun company

thats honestly the most important thing

or at least somewhere where you feel comfortable

[toxic plinth]

I can find company but will they accept me 😭

[dusk wedge]

Im sure you will, its an internship your there to learn

not too become ceo

[lethal dawn]

hey everyone just started on my journey in doing a full career switch to cybersecurity, ive been working as a product owner/scrum master for almost a year in may and planning to quit once i find a job in the field. any tips or expectations i should have in breaking into cybersec? i find it a bit intimidating and have this weirdfeeling im rushing my studies

[willow field]

Find something you want to learn really well, have fun learning it, get certs for it, then apply and expand. Being to generalized is not the way anymore unfortunately.

[ebon latch]

hello friends cyber security I'm new I need your helpers

[elfin girder]

is it true that go/rust are good for seceng or devops?

im good at c++ but i want to tear my hair out using these langs im using for a personal proj rn and honesly i just wanna hear it'll all be worth it 😭

[echo swan]

What helps me currently is not only doing theoretical stuff as it demotivates me heavily reading all the time

I'm on day 3, i try to break my learning up into 50% theory and 50% practical stuff

so right now im moving through bandit overthewire while using THM for theory

Planning on in around 2 months to pick up abook for CompTIA Security+

[lapis iris]

Where can a person find jobs that are NOT requiring a clearance?

I live in the Washington D.C. area so every other job requires a clearance and it's on my nerves as I cannot relocate until my property is sold.

[elfin girder]

i'd still apply unless it specifically states "must have an active ts/sci" because the company can just pay for you to get one

[lapis iris]

I've ran into scenarios before where i apply to clearance required and i say i have one, then they do the bg check and see i dont have one and ghost me.

[elfin girder]

don't lie

a clearance isn't like a certification 🤣

that's a huge liability and you may have just gotten yourself on some blacklists

[lapis iris]

i had a secret clearance given to me in 2021 but it only lasts 2 years so they i have to start all over again and companies wanna save their money these days

[elfin girder]

last i knew secret lasted 5 years

top secret was 2?

you should mention expired clearance still because usually that's easier to get than somebody who's never had one

[stable raptor]

ez exam

[stable raptor]

marry a us citizen atp

[echo swan]

^^

[lapis iris]

I'm a us citizen and I've held a secret clearance in the past lol.

[pulsar copper]

Hello
I have started my preparation for soc level-1 but as I heard that most of the soc entry level positions are almost automated with ai for the alerts and monitoring.
Can anyone suggest me what should I do ?

[stable raptor]

Baby steps my guy

Build a AD lab, SOC lab, etc

Homelab I mean and do one thing at a time and investigate work

You can learn basic scripting but can’t replace of human part of why something happens and the investigation part

[pulsar copper]

Okayy thankyou

[echo swan]

is SOC level 1 usually part time or should I be looking at other companies?

I found one soc level 1 job that requires CISSP certification here and that just seems crazy to me

and the other two i looked at were part time jobs for students to gain experience

[brave shuttle]

thats def not a SOC1 position lol. apply anyways. but no SOC positions can be part time but most times they are fulltime. I work in an MSSP and all the SOC positions here are full-time

CISSP is usually not required until atleaast SOC 3 from what I've seen

[echo swan]

The position title is SOC L1 Analyst

"relevant certifications (e.g. CISSP, CISM, GSEC) or courses related to endpoint security, IDS/IPS, SIEM and log analysis"

[brave shuttle]

Sounds like the typical wishlist of certifications HR likes to post

[stable raptor]

insane they are asking for CISSP

that is like 5+ YOE

[echo swan]

I'm just gonna keep making write-ups on linkedin while learning in my own homelab

and hopefully a recruiter will take notice at some point

[stable raptor]

samsies :3

[elfin girder]

SOC 1 jobs in U.S. have been wanting CISSPs

This is what happens when market is flooded with people who were previously laid off

I’ve been applying for every SOC and Jr SecEng position I’ve been able to find since June and I’ve never been interviewed. BS, Sec+, eJPT, CySA+, GitHub projects, CTFs, 4y IT mentorship exp, and 6mo IT work exp. I do more and get less and less

[rugged delta]

Have you been posting your achievements in a blog, and on your LinkedIn?

[elfin girder]

LinkedIn was kinda an after the fact thing, but yes I have linked in I use to post that stuff and a website portfolio

Both are linked on my resume too

Markets tough my man

[rugged delta]

Yeah it is a really rough environment out there at the moment. Have you gone to your local BSides or other conferences/meetups? You say you've been doing CTFs

[elfin girder]

I did a couple non team ones for THM. I haven’t had time for any more. Hopefully get to go to BSides in October 🙏🙏🙏

[rugged delta]

Keep up the pursuit, and don't limit yourself to just SOC/Jr Sec Eng jobs. Apply to all kinds of IT roles too

[brave shuttle]

Where are you located?

[elfin girder]

IL, US

[stable raptor]

what 😭

you should of have at least ONE interview, this makes me feel lowk worried 😭

[elfin girder]

best of luck. this industry has never appreciated me

[stable raptor]

ty 🥺

myan i dont understand arent u doing everything u can tho

sec projects, certs, IT experience, what else ??

[elfin girder]

dont worry about me, my luck has always been dogsh

[stable raptor]

oh

[elfin girder]

somebody i know recently got hired as a security consultant at an aviation firm

we graduated in the same class

truth be told, the biggest diff is he had an internship

[stable raptor]

ah

[fickle grove]

You just need to find that someone who'll take a chance on you, don't give up.

I'm looking to find a job myself, but sticking to my current one at the moment as it is sponsoring my visa and haven't met the local experience requirements to apply for a visa under my own name. 😅

[stable raptor]

visa is tuff

[fickle grove]

Yep, adds complexity to the already complex job market. 🤪

[elfin girder]

Good luck!!!

[dusk wedge]

Marietta in Georgia isnt close to that right? otherwise i might be able to inquire at my old emplyer

[elfin girder]

No unfortunately not. I am looking to relocate however

[dusk wedge]

I checked on their website, i dont think they have anything currently

[elfin girder]

Yeah I figured 😔 like I said cyber hiring has been really bad recently

I may just give up on it altogether and try and stick with IT if I get CCNA and still no interviews

I literally can’t afford to not get interviews

[dusk wedge]

Normally they have stuff but now the IT stuff they have is either in NL or india

[elfin girder]

I mean I have a job but I need a better one where the COL isn’t so high lol

[dusk wedge]

yeah market does not seem good rn

you can always try to stick with IT and then later move into cysec

[elfin girder]

Yeah ☹️

[still bridge]

Hello everyone

I am new here

[jagged gale]

Hi , nice to meet you

[lean oriole]

someone offers a job? 😅

[ripe turtle]

Hi everyone I am new here

[glass seal]

Hi

[stable raptor]

Hi

[glass seal]

hi

[trail lichen]

Hey everyone I m newbie can anyone help me or guide me to get bug bounty?

[brave shuttle]

You’re subscribed to #TryHackMe yeah? Perfect place to learn!

[raven viper]

Will SOC still be relevant after a decade

??

[stable raptor]

hopefully 🥺

[dense lynx]

yeah

ai cant automate everything

and you'll still need human intervention

[stable raptor]

^

[mental umbra]

Hello everyone

[stable raptor]

Wsg

[short crown]

i think ai is just 10% reyality 90 % Bubble

[near jungle]

Hello everyone! 😊 I hope you’re all doing well. I find myself at a bit of a crossroads, as I’m currently considering two exciting learning paths: penetration tester and security engineer. At the moment, I’m working as an assistant system administrator, and I’m trying to determine which direction to take.
While penetration testing truly resonates with my passion, I feel that the security engineer path aligns more closely with my current role. This path encompasses DevSecOps and AWS, which is particularly relevant since our company is actively expanding its network to AWS.
On the flip side, I would absolutely love to explore the penetration tester route. However, our company currently lacks a dedicated cybersecurity department, and if one were to be established, it would likely focus on blue team efforts to safeguard our organization. This leads me to ponder that if I choose the penetration tester path, I might eventually need to leave the company to pursue that dream, which is a tough decision since I genuinely enjoy working here.
I would greatly appreciate any suggestions or insights you might have! Thank you so much!

[kind pond]

Do what resonates with you!! you’re gonna be 50 years old one day no matter what, might as well be 50 and motivated than 50 and burnt out. I went to the military got discharged then school for HVAC, hated it but it was convenient, but my passion was video editing and computers and so I took the risk of not only changing roles but entire careers for my passion and I never regretted it 🙂 if I had never done so, I’d imagine I’d live with so much “what if”

[plain valley]

Preach! I spent 15 years nursing,felt like I was a fraud, too much stress coming up to 6 months since I first started my cyber journey and never felt more at peace and connected to a community!

The leap into the unknown from a stable income is terrifying but so glad I did it!

[kind pond]

especially if you have a good support base around you being friends, family, even just mutual dorks in a discord server lol whoever it is can be a positive impact on you during the transition which will help so much in reassuring any venture is possible, as cliche as this may come off haha

as a random mutual dork in a discord server i hope for a future update lol!!

[distant pier]

Try both paths, one module at a time for each. After each module completed, continue both or jump on one exclusively.

[heady scarab]

.

[fickle grove]

To add in what has been said, try both paths and see which one you'll enjoy or fit your goals. Better experiment early on than regret not even taking a look at the other path

[devout lark]

Hell yea

[stable raptor]

mad respect idk how people switch careers like this

[stable raptor]

???

mods???

[elfin girder]

Is it true that certs like Sec+, eJPT, and CCNA (which I’m currently working on) only look like filler on a cyber resume compared to certs like CySA+?

Also if I start my masters in Fall at what timeframe do yall think I should start trying to apply to internships? (Assuming all goes well, I’ve been accepted) should I start when school starts, should I start early, or should I wait a year?

[deft comet]

Good morning peeps I'm in an ambiguous situation rn i am a cyber security enthusiast and i have done google cyber security certificate and currently doing SAL1 certificate - security analyst level 1 from try hack me

And i just feel like entry level jobs in cyber security are quite crowded and i was thinking of improving my skills in cloud security hence i have taken up AWS certified cloud practitioner exam

So my question is , am i doing anything wrong? Should I stick to improving my skills in soc analyst entry level jobs or should I learn more about cloud

I'm really looking for guidance

[elfin girder]

Dude, I just got told the only cert I have that matters is CySA+ for entry level cyber…

[deft comet]

Wattttt

[elfin girder]

I don’t think you’re doing anything wrong

[stable raptor]

dawg what 💀

what are u aiming for

[elfin girder]

(Out of the ones I have)

Which are Sec+, eJPT, and CySA+ (also including CCNA which I am studying for)

[stable raptor]

homelab 😊

[deft comet]

I'm from India and entry level jobs are soooo crowded mannnn

[stable raptor]

so many certs 🤤

[stable raptor]

too much population, we need thanos

[deft comet]

I have done 3 home lab projects

[stable raptor]

WHAT

bro how havent u gotten anything yet

what abt like certs? or like do u w*rk rn

[deft comet]

I graduated in the bachelor's of Computer Application with cybersecurity as my specialization and I have finished Google cybersecurity certification and I'm currently doing SAL1 certificate from try hack me

Yet

[stable raptor]

:o

I am doing cs

i heard doing a bs in cyber is not good

idk i could be speaking outta my ass

[deft comet]

Idk

[elfin girder]

IMHO no it’s not

[stable raptor]

so its good or no

in ur opnion

[elfin girder]

Very very few job positions ask for cyber degrees

[stable raptor]

ah

[elfin girder]

Almost all cyber positions accept comp Sci

You do the math lol

[stable raptor]

true 🤔

[wooden ivy]

I am graduated from biology, is there any career in this field

[elfin girder]

Dude I am so burnt out hearing the other certs aren’t worth anything… Even the cert I’m studying for.

[stable raptor]

yea people have went from nursing to IT 💀

idk how

but they did

[deft comet]

Network ig

[stable raptor]

gotta keep collecting em like a pokemon

[deft comet]

Istg yeahhhhh

[wooden ivy]

Intrest vs job pressure 😆 lol

[stable raptor]

CISSP FOR ENTRY LEVEL POSITION

[elfin girder]

Dude I’m going to quit this industry. I am so sick and tired of this. 🥀

[stable raptor]

u work in it support right

how is it

[elfin girder]

Yeah

It’s good

[stable raptor]

:o

but why cant u go from IT support --> soc

[deft comet]

Are you wo*king professional?

[stable raptor]

or wtv u want

[elfin girder]

No SOCs want me

[stable raptor]

WHAT

[elfin girder]

Dude, why do you think I’m so burnt on Cyber

[stable raptor]

D:

man

that sucks

but i thought ppl say do homelabs, sec projects, certs, and post everywhere and obv networking D:

sorry ur feeling dis way, I am also 😔

[tiny solar]

Hi

I have a problem; someone stole my Free Fire account from within my account using the cache on my phone, and I have the IP address, I need to recover my account, how can I do this?

[fervent fox]

Message Free Fire's support - not us

[tiny solar]

No, my brother, I have ip address I can check using nmap He went inside and took the cookies he had and everything else I saw in front of me.

[fervent fox]

Then keep your cookies secured next time - you can always go to the police

[tiny solar]

He entered through port Open within my network and withdraw them

[tiny solar]

The police probably won't be able to solve the problem.

I think

[fervent fox]

Doubt, but secure your ports better next time then - no one will hack anyone for you here

[tiny solar]

But I must return what he took from me, even if it was something insured. I will take what is most precious to him and exchange it with him.

[tiny solar]

Can you help me ?

It seems you know a lot of things

[fervent fox]

No, I don’t hack people

[tiny solar]

No, you are defending the truth, and I can show you that he accessed my account and took something very valuable.

[fervent fox]

Sorry for being an asshole, but respectfully, don't bs me - I've heard those stories countless of times
Message support, secure your network, go to the police. That's all you can do

[tiny solar]

I can show you the login messages or give you the account details so you can check for yourself.

[fervent fox]

No

[tiny solar]

Let's agree so we can find a solution. What do you need to prove my point?

[fervent fox]

Nothing, I don't hack people nor I recover random ppl's accounts

[obsidian rose]

Hey, we don't offer such services here sorry.

[wraith geyser]

@tiny solar u can report this on cyber security

[midnight pelican]

yo guys after a full year of learning and tryharding, working on countless projects Ive finally landed my first junior job in IT cybersecurity. Dont give up! I felt stuck and doubted myself. But consistency really does pay off

good luck for everyone

[trail lichen]

Hey there!

[misty geode]

Hello guys! new here! I want to pursue a career in cybersecurity but I don't know where to start and what certifications I need to take. Thank you in advance for your answers!

[opal raptor]

did you complete the cyber security 101

[misty geode]

Thank you for responding. Not yet I've been trying to find some info on where to start. So this is the first one I need to take to know which path in cybersecurity I would like to focus on?

[serene umbra]

Gave +1 Rep to @opal raptor (current: #2392 - 2)

[opal raptor]

you can start with the pre security path and the cyber 101 path in thm and you can choose the area of your interest

[misty geode]

Thank you! I'll be doing what you have suggested. Thank you so much!

[opal raptor]

do ask if you need any help

[misty geode]

Will do thank you!

[serene umbra]

Gave +1 Rep to @opal raptor (current: #1813 - 3)

[kind pond]

Sitting on a bunch of financial aid and I have tons of free time so I switched my major from criminal justice to pursing an Associate in Science Degree in Computer Information Technology. Hopefully am not cooked 💔

[stable raptor]

People have switched from nursing to cyber they can do it so can you

[kind pond]

Ty twin 🙇‍♂️

[serene umbra]

Gave +1 Rep to @stable raptor (current: #978 - 7)

[fresh surge]

Awesome! Congratulations 🥳 can I ask what path you took? I’m just starting out and am trying not to feel intimidated by all of it. Did you learn online and by “doing” or did you go to school, or both?
Again, congratulations!

[umbral pine]

Question asked I am sure a lot but how can someone with a software engineering degree break into cyber. I plan on doing my masters in cyber and getting basic cert but in regards to work experience and approaching it

[rugged delta]

The best thing to do is to just start with the simple things. Learn a bit of Linux, Networking, Windows, Python and ease your way in a little bit every day

[rugged delta]

You need to have a good understanding of Windows/Linux/Networks, etc., and build on your skills as you go. Most people will aim for the Net+/Sec+ certifications as a good baseline. The most important things you can do are to post about your progress and achievements on your LinkedIn and having a blog/github/gitlab to post about projects, do writeups, projects and experiences learning new things. Also consider going to conferences, CTFs, meetups in your area

[marsh wasp]

hello my name is ben ive been using tryhackme for about a month now and also am taking some online courses on cs just wanted to introduce myself

[umbral pine]

Thanks a lot but just a quick question what entry level position should I look at or build my way up to.

[serene umbra]

Gave +1 Rep to @rugged delta (current: #17 - 614)

[rugged delta]

Most people will have their first cyber role in a SOC, but really you should keep your eye on the kind of role you want, and train for that as your priority. There's lots of different roles in the field. Just look at job sites and see what's available. You should check out the Tribe of Hackers books. They're a series of interviews with professionals in different roles in the field. A lot of people will start out in tech support or QA or another IT/programming role.

[midnight pelican]

Thank you bro. Sure ! Private Message me Ill respond to everything tomorrow

[serene umbra]

Gave +1 Rep to @fresh surge (current: #3688 - 1)

[stable raptor]

i got an rpa internship, was wondering how far off that is from cyber and like if it was a good decision to take
obv i will have to work on the side to learn which im already doing but at least its IT experience idk and i got rejected from everywhere else and i alr accepted the offer so there is that :3
anybody have any opinions

[rugged delta]

An internship is a good start, you can build in the direction you want to as you progress. You should have a home lab, could be as simple as using VMs or spare computers or the cloud and to do projects, make a blog/github/gitlab profile, do writeups, post about your achievements to LinkedIn, so you're active in various ways

[amber onyx]

Hi I had started my cybersecurity fundamentals lesson and am stranded on where to proceed next

[late sail]

https://roadmap.sh/cyber-security
You can use this roadmap.

[amber onyx]

Thank you

[serene umbra]

Gave +1 Rep to @late sail (current: #3690 - 1)

[stable raptor]

alr thank you 😊

[serene umbra]

Gave +1 Rep to @rugged delta (current: #17 - 615)

[vivid pond]

Hi, I need some help to start my career in cybersecurity. I am passionate about cybersecurity. I am a student doing a BS in Computer Science with cybersecurity in my second year of university. Can anyone help me with a proper roadmap, step by step? What's the next step? with resources like from where I can learn and develop skills, hands-on experience etc

[exotic citrus]

Hi guys, i'm new in pentesting world and i'm looking for an internship in France for my engineer school
But i've got a question abt my CV : in my school, i don't do any cyber project so, for u, the best idea for the project part on my cv it's to explain some non-cyber project i did in class or to explain some cyber project but quite low level like *configure and secure a network composed by some switches and routers *or solving some box ...

What do u think ?
thx <3_ _

[covert steppe]

Do you want to get a job in cyber?

[exotic citrus]

yep i do..

[covert steppe]

Then I advise to do a cyber project so that you can add it to your cv!

[exotic citrus]

okay thx u !!

[stable raptor]

lol

[ancient prairie]

If you are in the US I would advise putting off your master's until you land that first job, it can hurt your chances for several reasons mostly because of perceived implications, especially for entry-level work (will they think this entry-level job is beneath them? will they ask for too much money? etc..) - for your first job I would look into putting that degree to work, DevOps is fantastic field that provides a great base to pivot into Cyber later on

[umbral pine]

Unfortunately putting off masters is out of the question now as I already applied and got acceptance. Devops is what I am looking at but I heard it’s not usually an entry level job. Is that true?

[supple marsh]

Hi, may I be banned from the PT1 exam if I use my own OpenVPN to access restricted websites in my country during the exam? In other words, won't I be banned for changing my IP address during the exam?

[rugged delta]

I wouldn't worry too much about having a Masters and going for a first role in cybersec. If you haven't worked in the field, you're going to be in a starter role with a starter salary for the first year, and then if you show your value you'll likely get a better offer. I know a lot of people who moved into cybersec after doing a masters/postgrad who had degrees in everything from IT to Nursing to Art History to Civil Engineering

[covert steppe]

THM doesn’t care if you use open vpn to access rooms.

However, no one here is going to advise you to access state restricted sites. You should understand the risks and consequences of that decision and make your own decision.

[polar sinew]

Guys may I ask you if there is any kind of internship programs going or in future going to be where they would teach me routine work and introduce me to the work culture pay me internship as well , this is not often but some of my friends got an internship of such kind and I am left behind SO just aking or rather looking of any kind internship programs that i could join

[north acorn]

.

[stable raptor]

..

[solar bough]

Hi everyone, I’ve recently completed my MSc in Cybersecurity and have hands-on experience with SOC operations and penetration testing tools. If you’re aware of any openings or can share relevant leads, I’d appreciate it.

[limber idol]

I'm confused between soc analysts or pentester?

[stable raptor]

soc analyst --> for monitoring, detecting, and responding to security threats in real-time use SIEMs, etc.

pentester --> simulates cyberattacks on computer systems, networks, and applications to identify security vulnerabilities

SOC is blue team and pentest is more RED team

[fickle grove]

Might be helpful if you point out which locations you are looking at.

[solar bough]

I am based in London right now.

But I am ready to relocate in any part of EU.

[rugged delta]

Dublin, Manchester, Norway/Sweden, Belgium, Netherlands, Lithuania, Estonia, France, Germany. Should be lots of opportunities

[solar bough]

You’re absolutely right, they have. But being a fresher in SOC or Penetration testing it’s hard to get one.

In the UK, the main barrier is security vetting. Most roles require SC or DV clearance, which typically means at least five years of UK residency. It’s generally more straightforward for EU citizens, but that doesn’t apply in my case.

[rugged delta]

Yes if you're going for government roles. Most commercial roles won't require vetting unless you're working on government contracts. But yes, if you want to work in a government/military role in cyber in most countries you'll require formal vetting/clearance

[covert roost]

guys do you think I can start working as VM

for blue teaming

[dusk wedge]

whats a vm?

[covert roost]

Vulnerability Management

This role for blue teaming

I was planning to work as a SOC1 analyst in the future but nowadays I changed my idea and look for other roles beginner friendly should be

for blue team

I dont wanna explain why I am not looking4 a SOC role anymore

living in turkey/cyprus btw

[rugged delta]

SOC is probably the most beginner-friendly role in cybersecurity, but vulnerability management could mean you're working with operating systems, SOC tools, threat intelligence tools, coordinating with Windows/Linux/Networks/Cloud teams. You'd need a broad understanding of technology in any cybersec role really. But if you put your mind to it you can aim for any role you would like that becomes available

[covert roost]

VM role is not even hard

just learn 3 tool and scan analys

[torn plume]

Vulnerability management requires understanding multiple technologies, attack paths, and real-world exploitability to perform meaningful risk analysis.

For example, a database server with several CVSS 9 vulnerabilities, but no active exploits, is isolated in a VNet with tightly controlled ingress/egress, limited to a private link to a restricted k8s cluster, which is used only for document processing from a storage account, is probably considered a lower priority. However, a web server with a single CVSS 7 vulnerability that is actively being exploited and provides a potential foothold into the internal network, should take precedence.

[covert roost]

dont you think beginner friendly

I though Its around beginner and mid friendly

[torn plume]

There are junior Vuln Mgt positions available. However, it's more than learning a tool and scan analysis.

[covert roost]

which certifation should I look for?

Security+?

[torn plume]

Network+, Security+ to start

[covert roost]

ehh network plus idk

[torn plume]

there are vuln mgt tool certifications as well. Not sure if they have options for the general public. Check Qualys and Tenable.
I have certs but i work for a cybersecurity company, so I get training through our partnership with various vendors.

[torn plume]

I'm not sure what that means

[covert roost]

as a pentester?

[torn plume]

Do you mean - do I work as a pentester or are there certs for a pentest?

[covert roost]

u work as a pentester 😄

sry that was my question mb

[torn plume]

I'm a security engineer that works primarily on exposure management (cloud security, vuln mgt, and attack surface mgt) and AppSec. I do some "passive" verifications of exploits but not active pentesting.

[covert roost]

Its a good role I mean better then SOC role surely

[dense dagger]

how do u say its better

[covert roost]

no night shift

sounds better

[dense dagger]

hah

[covert roost]

thank you sir

[serene umbra]

Gave +1 Rep to @torn plume (current: #425 - 20)

[dense dagger]

not quite true. there are "on-call" security engineers

esp. if they handle infrastructure

[torn plume]

This is correct. I don't have night shifts or on-call because I've been doing it for almost 30 years. However, my first 5+ years included lots of after hours calls. You have to earn your spot.

[covert roost]

how old are u

(sir)

[torn plume]

Started in the late 90s, so I'm a grey beard by this point.

[covert roost]

hard mogger

[torn plume]

I started as a sys admin on Linux and HPUX servers and writing Perl scripts.

[covert roost]

one more question why u dont swtich up to cloud security roles

as I know the salary will be so much better

[torn plume]

I do cloud security

[covert roost]

AWS AZURE

[torn plume]

exposure management includes cloud security. It covers tools like CNAPP, Vuln Mgt, and ASM.

Primarily Azure, but also AWS & GCP.

[still bridge]

When you guys are running automation, do you find it better to feed the agent the root domain (xxxxx.com) for broad infrastructure discovery, or do you get better hits by pointing it at specific program paths (like ://xxxxx.com) for deeper, targeted analysis?
Curious to hear how you balance broad recon vs. deep scanning in your workflows!

[torn plume]

Depends on the tool. Most enterprise tools (ASM, CTEM, continuous red teaming) crawl DNS records based on a combination of IP addresses and root domains, so you don't need to configured a specific path.

If you have a specific tool / scenario in mind, I can try to provide more details.

[worthy kindle]

Hello I have doubt, right now I am in the graduation year but before should I get job in security analyst???

[torn plume]

What is the workload for your graduation year? Could you work time and still graduate on time?

[worthy kindle]

One more year ,
Yes

[torn plume]

If you can graduate with good grades and on time, I don't see any issue looking for a job.
Are you in India?

[worthy kindle]

Yes From India,but Will I get a job before completing my graduation?

[torn plume]

Not sure if it is possible in universities in India, but in the US, a lot of universities have help desk jobs that students can apply for. That gives them job experience while being a student.

[worthy kindle]

And after graduation

[torn plume]

Any experience you can get will help with a job after graduation.

[snow current]

Hey everyone. Im looking for a part time GRC position. Im happy to accept an internship of some sort as well. Just something to start getting hands on learning with. A little about me professionally. I have about 8 - 9 years in cyber. Started in a SOC for a couple years. Transitioned to vulnerability management at the same company. I then went to work for the DoD. I worked at the Army's Cyber Protection Brigade in various capacities. Including being a host analyst on a cyber protection team and working with the IC as well. I have a TS/SCI w Poly through that. Recently I accepted a position with a penetration testing company as a Senior Technical Account Manager for public sector. I have a BS in Cyber Security from WGU and handful of industry certs from that. Please dont hesitate to reach out if anything comes to mind for me.

[torn plume]

Why only part time?

[worthy kindle]

Thanks for your advice

[serene umbra]

Gave +1 Rep to @torn plume (current: #410 - 21)

[snow current]

I have a full time job that I wont be leaving yet.

[torn plume]

I'm not aware of any job that is as specialized as GRC that would hire part time. Those types of positions are usually full time.

[snow current]

Thats interesting.

[torn plume]

Unless you get an internship (as you mentioned), most places are going to be full time only. There are a lot of people competing for security jobs, especially entry level jobs, and it costs a lot of money to hire and train people. So a company isn't going to invest in that type of job for it to only be part time

[snow current]

Possibly could be the case.

[random furnace]

yoyoyo

[tight helm]

hello

[stable raptor]

h

[slate sail]

@torn plume hey, I see that you’re experienced in cloud security. Right now I have one more year left to graduate from Uni (osu) but want to learn about cloud security whether it’s azure, aws or google. What do you recommend for me to start both lecture wise/project to do as beginner? Who do you recommend for me to watch to help guide me?

[covert roost]

dude sry but ofc azure or AWS but I would go w Azure because it has more potential

[slate sail]

Any beginner projects you recommend or someone you recommend me watching. I’m new to the whole major and just started THM last September

[covert roost]

For beginner projects, I’d probably go with the Azure AZ-900 certification. If you want another one, you can choose something similar. These certifications are effective and quite cheap.

AWS also cool

and azure 500 for security

[slate sail]

Are these certs good with hands on labs and do you recommend me doing it after Sec+?

I’m like a noob noob rn barely know anything

[covert roost]

honestly idk

[slate sail]

No worries. Thanks for the help. Really appreciate it

[torn plume]

Unfortunately, unlike other security technologies, cloud can cost a lot of money. So it makes it a little harder to learn without already working for a company that is eating the cost of the cloud environment. That being said

Azure: Microsoft provides free credits and free software to most university students. I say most because occasionally I've seen students run into issues trying to activate their free Azure credits. Not sure why - it's something between the Uni and Microsoft. But it's worth checking.
https://azure.microsoft.com/en-us/free/students
I believe those credits also allow you to play around with Defender for Cloud (Micrsoft's CNAPP).

AWS: AWS also provides some free credits, but I believe it's just the general public. I highly recommend checking out SLAW by Rich Mogull. It's a weekly AWS security lab walkthrough. When you sign up for the mailing list, it will start you at the beginning. I did a lot of the labs for maybe spent a few cents. But follow closely. He will walk you through setting up the environment so you don't spend any money. And make sure you setup the spending limits that he talks about in the early videos. I think some of the logs is what set off my alert to let me know that I was starting to get charged.

https://slaw.securosis.com/

GCP: I don't know much about Google. They might also offer a free student or cheap credit to work in their environment.

Tools: Like I mentioned earlier, Microsoft Defender for Cloud is a way to start testing CNAPPs. Most other cloud tools are enterprise.

Skills: Networking networking network. I can't emphasize this enough. Any troubleshooting you do in the cloud will only be simplified if you understand computer networks - tcp/ip, packets, routing, firewalls, dns, etc.

[torn plume]

Network+

[slate sail]

Just to confirm, should I start with net+ or sec+?

[torn plume]

In the past (like 25 years ago) it was recommended you go A+, Network+, Sec+ because they built on one-another. I'm not sure if that is still the case - I got certified in 2002-ish.

[stable raptor]

No you don’t have to

I did sec + then net +

A+ was useless asf

but ig u can read over it

[ornate hare]

is anyone here making good money from cyber security because i was doing finance but i dont have a uni degree and might switch

and yes im very interested in cyver security

[dusk wedge]

Depends on what you define as "Good Money"

[ornate hare]

100k and over honestly

[dusk wedge]

This also depends on location, but ive been working as soc for close to 2 years now

and i dont make anywhere close to that

[ornate hare]

well i am in australia

and the job listings on seek and indeed all say over 100k but again just words at the end of the day

[dusk wedge]

Thats just words yes, 100k is probably based on your experience, background bla bla bla

[ornate hare]

i understand that good money is not isntant and would take me years to reach 6 figures but thank you for helping

[dusk wedge]

no worries

do you have a background in IT?

like a degree, work experience, certs

[ornate hare]

currently am still in grade 12 and just finished a cert II in IT and working towards fisishing the google coursa cybersecurity professional certificate

and then going to keep doing tryhackme and SEC+

cert

[dusk wedge]

yeah okay good, cybersecurity is definetly not entry level

[ornate hare]

definitely

[spiral bobcat]

i want to start cybersecurity but my tutor is charging 58k which i cannot afford can anyone hele me to learn it with free resourses

[ornate hare]

i have barley any knowledge in cyber security but 58K is insane personally i use the tryhackme website and then do certs and do your own studying

[lean oriole]

bro don't take that deal 😂

most of knowledge comes from open source try to make friends in here and they will help you out

if you pay something take the THM premium or other plattforms nothing else

[torn plume]

If you get into cybersecurity to make good money, you will burn out and not make good money. People that make good money in cybersecurity do so because they love this stuff. They live and breath it. In their free time they volunteer at hacker conferences, they listen to hacker podcasts, they read cybersecurity books.

You need to understand, in a lot of careers, you learn a bunch of things at Uni and then do your daily work based on what you've learned. In cybersecurity, you have to spend everyday learning. If you are not constantly learning, you will be left behind. So for people who love it, cybersecurity is awesome - we are constantly learning. But those who don't love it, get burned out.

[vagrant perch]

Hello, Whats your opinion, I was just wondering, learning from THM will help me to get a job in cybersecurity?

[dusk wedge]

yep, at least for me it did

[trim remnant]

Yes, for me as well.

[visual ingot]

Can you give me a roadmap? Like what courses in thm and what certs you got to get into soc ?

[dusk wedge]

i didnt get any paid certs

or at least none that were proctored

only completion certs

[torn plume]

THM is a great for getting hands on experience that you can speak to in interviews.
However, for your resume, I also recommend contributing to some opensource security projects in Github, building a lab at home using old hardware, virtual machines, docker, etc and writing about it. Your blog posts can be on any number of platforms - github, medium, substack. You can also write room walkthroughs on your blog. Then provide a link to your code & blog in your resume.

Another way to get out there is start writing talks and submit them to local conferences & meetup groups.

I have meet a lot of smart people in my career, but the ones that can write well and speak well really stood out and were usually the people that continued to grow their careers. You are a security product and you need to market yourself as such.

[rugged delta]

You can check out any of the certs, click the link on their channel, the Get Started button and look at the Recommended Learning for each one and it'll tell you all the things you need to complete for success in each cert.

Or else you can look at the paths, networks and other resources throughout the platform

[visual ingot]

Thank you guys

[rough turret]

anyone got any advice on landing a soc role, i’m in 3rd year uni about to graduate studying ethical hacking and cyber security

[covert roost]

btl1

Its not even hard to fınd job as soc1 but ofc depends on where do u live ofc

[rough turret]

you think ?

i live in a town of from Liverpool in the UK

[rough turret]

would u say that it’s worth it, concidering my degree

[covert roost]

SOC1 role might be the most friendly role for beginners. I don’t really think you need a very rare certification or anything else

[covert roost]

good country for cybersecurity

[rough turret]

nice

what do u do if u don’t mind me asking

[covert roost]

I worked as a soc1 for a start up

but now I am looking4 other roles like VM

[rough turret]

fairs, are you from UK or else where ?

[covert roost]

Cyprus/Turkey

ur country 100% better then mine for cybersecuity opuritnys

[rough turret]

i hope so, so you think it’s worth paying for the BTL1 cert, £400 is a lot

[covert roost]

It depends on what you want to do in the future, but if you want to become L2, certifications as a SOC analyst can be useful, though they are not strictly necessary. BTL1, however, would be extremely good to have because it is a really strong certification. Still, the rooms you complete on TryHackMe will probably be sufficient

[covert roost]

do yk how to use SIEM tools and suricata or snort?

[rough turret]

nope not really, my dissertation project is to set up a lab using the git repo DetectionLab so this is really my first time getting hands on experience with a lab

i’m hoping to expand my knowledge when i finish uni as my course mainly just focused on penetration testing, networking and compliance

[covert roost]

There is a blueteam path on tryhackme

It can be helpfull

[vagrant perch]

Thank you for motivation❤️

[covert roost]

me?

[vagrant perch]

All of you.

[thorn obsidian]

Guyss need assistance here what online jobs are you doing to survive in this economy?

[hexed yacht]

what would be a roadmap for bug bounty?

[fickle grove]

Do check the web application learning paths in THM. And you can build on it from there. There's also Nahamsec.

[hexed yacht]

by web application learning path do you mean web application pentesting path? you could say starting from jr pentester path

[ancient prairie]

Network as much as possible. Think seriously about starting off in IT and transitioning to Cyber later. **Most importantly, **try applying to as many US-based companies as possible (ideal if they are a transnational company) because folks in UK timezone are especially important for teams that are 24/7. The overnight shift is extremely hard to keep filled in a SOC and your daylight hours would naturally map to US 3rd shift hours.

[rough turret]

💯❤️

[fickle grove]

You can check both paths.

[hexed yacht]

i'm not sure what are the other web paths relevant to bug bounty

[hollow dagger]

Hey guys, good night. I hope everyone is well.
I have a question regarding the THM roadmap that was changed, I will give you a basic context and thank all in advance for your attention.
I'm currently in the data analysis area, I've worked for Accenture for a little over 5 and a half years and I'm transitioning to cybersecurity. I finished the Pre Security path (Legacy) a few months ago and today I finished Cyber ​​Security 101. However, I noticed that Pre Security was updated with some more content.
My question is: Should I go back and finish the Pre Securitu path with the additional content, get the SEC0 certification and then continue to SEC1 or is it not necessary? I question this because the project I am working on is about to be completed and I will be short on funds, so carrying out the SEC0 and SEC1 certification would be a bit expensive, but if it is essential, I will have no choice but to carry out both certifications.
Otherwise, I will buy SEC1 and continue learning on the path to Security Analyst.

[stable raptor]

Idk if SEC0 and SEC1 are useful

I would just do the Sec+ and Net+

[hollow dagger]

Ah, great, thanks for the help.
I'll study a little more and save up for the Sec+ and Net+.

[long coyote]

Do the learning path for SEC0 and SEC1 to get the practical experience but do not get the certifications. They have 0 weight. Get Security+, it's the bare minimum for many security analyst jobs in the U.S.

[hollow dagger]

What materials are recommended for the Sec+ exam? Currently, in addition to THM i'm involved in ISC2 CC (because it's free and I'm looking to do anything that's free)

[stable raptor]

PROFESSOR MESSR

I CAN SEND notes

[warm hinge]

I know i didn't. You need cable, connection and relationship nowadays

[ancient thorn]

I recommend reading this, it's long but it's good. You can just study at your own pace.

[forest finch]

@tawny wraith dm

[lavish rain]

hello everyone, is there a soc analyst or cybersecurity operation analyst here ? i would like to prep for an interview, any advice or interviews exemples?

[broken idol]

What do you want to know?

Or ask?

[hollow dagger]

ty guys! i am truly grateful

[lavish rain]

can i DM you ?

[broken idol]

No, you can ask in here, then others can chime in.

[rugged delta]

Have you used a search engine? There's loads of articles about interview questions for every role in cyber, such as:
https://www.linkedin.com/pulse/top-50-soc-analyst-interview-questions-answers-2026-manisha-chaudhary-25ypc/

[lavish rain]

thanks, and also yes but didnt find this

[serene umbra]

Gave +1 Rep to @rugged delta (current: #17 - 624)

[lavish rain]

well i have recently graduated so i never had a soc interviex, i wanted to know what to expect from a "technical interview" with live execise, maybe you had to do the same ? also ive been studying all of the concepts, frameworks but they said the exercise dosent need prior study, any advice would be great thanks

[serene umbra]

Gave +1 Rep to @broken idol (current: #2 - 3997)

[broken idol]

I didn't get a "live excercise" but I got some scenario based questions, and networking questions.

For example I was given questions such as

"What's a firewall?"

"Can you describe how a web server works"

"Can you describe the CIA traid"

"Can you explain why a user would scan ports"

"Can you explain which is a true positive, and a false negative, and give an example"

[lavish rain]

okay perfect thanks a lot!

[visual ingot]

Hey guys can someone send me professor messers notes please ?

[stable raptor]

sure

[burnt fulcrum]

Hey everyone 👋
I’m currently learning cybersecurity (just started building my portfolio) and working through labs on TryHackMe.

I’ve completed a basic internal security audit project using the NIST Cybersecurity Framework, and I’m trying to structure my portfolio in a way that aligns with industry expectations.

I wanted to ask:

• What kind of projects do employers actually look for in entry-level cybersecurity portfolios?
• Is it better to focus more on hands-on labs (like TryHackMe) or structured reports (like audits and risk assessments)?
• Are platforms like GitHub or Notion preferred when presenting a portfolio?

Any advice or examples would really help 🙏

[vivid pond]

Hi, I need some help to start my career in cybersecurity. I am passionate about cybersecurity. I am a student doing a BS in Computer Science with cybersecurity in my second year of university. Can anyone help me with a proper roadmap, step by step? What's the next step? with resources like from where I can learn and develop skills, hands-on experience etc

[torn plume]

• What kind of projects do employers actually look for in entry-level cybersecurity portfolios?

Contributions to open source security tools are great. Even if you are just submitting bug reports. If you provide your Github account, i’m going to stop and take a look through it - which means I’m spending more time remembering your name and resume than I am most resumes.

If you do write-ups for THM or other CTF platform rooms, that’s a major plus because I get the opportunity to review your writing and communication skills.

if you build your own cyber security (home) lab and do a write up about that, even better.

Give a talk at a local hacker/security conference or college cybersecurity group - major bonus points.

• Is it better to focus more on hands-on labs (like TryHackMe) or structured reports (like audits and risk assessments)?

Both. I’m looking for somebody that is technical and can communicate well.

• Are platforms like GitHub or Notion preferred when presenting a portfolio? read through the reports.

Github for project contributions and write-ups. Also, any write ups on something like medium is fine too.
but I don’t want is for you to send me example reports as part of your resume submission. I already have enough documentation to read through. Submit it as a link within your resume - Github, Medium, blog platform, etc

[rugged delta]

You can learn a lot about cybersecurity from THM by checking #start-here and then following the paths in the Learn section of the website, and if you're not a subscriber you can look here here:
https://tryhackme.com/resources/blog/free_path

[rigid marsh]

The choice of staying at my cushy Engineering job, or become a SOC Manager at the gov for 30% more pay (and a +30m commute and a lot more stress)
Is it really that bad as people say if it's an internal SOC?

[ancient thorn]

guys, can anyone help me to get a cybersecurity internship

[stable raptor]

what year are you

[ancient thorn]

3rd

[full nebula]

A quick question for those who have a job as a penetration tester. I am interested in doing web app penetration testing as a career. How much do you actually get to choose what you do? Do you get to choose what you do, or do you just kind of do everything?

[dull lance]

Someone basically told me ill never get a job in IT because I have no network of people. Is that true?

[fervent fox]

Psss. || You can always start building it ||

[full nebula]

It seems like you are building it now.

[dull lance]

Another problem i have is that im stuck with remote jobs due to a mental health issue

Which im currently trying to seek help with

[fervent fox]

Nice that you're working on it. Sort out your health first and then you can worry about networking

[rugged delta]

The point of pentesting is to fulfill the client's needs. The client has regulatory obligations to test their systems. They have regular audits and need your reports to show your findings. You'll have a role on a team, and depending on the size of your team/org, your workload could vary

[loud plinth]

https://youtu.be/naqV7Ic9x5o?si=uy9PdZSNkk-GNO1R

‘WTF is happening to Entry-Level Jobs’, Damon Cassidy

[dapper sky]

hello guy s

[lethal locust]

I’ve been IT support for many places, mainly Tier1 and one job was T2. I’m working on getting A+, Net+, and Sec+ certs. I’m just not 100% sure on what direction I want to go. I also want to learn Pentesting.. lol but I’m older and idk if I’ll get hired bc of my age.

[near bough]

I am about to hit the job market. Finished CCNA and have Sec+, A+. My portfolio and github are finally looking legit. Fingers crossed for 2026 finally making this goal happen and switch careers!

[stable raptor]

gl!!

[dapper sky]

Hi

[near bough]

Thanks!

[lapis iris]

Are there any office desk job careers that aren't so difficult to get into?

[rigid marsh]

Anything grc

This also includes general sysadmin and patchin gigs

[warm hinge]

yeah. just regular help desk. it's the lowest position in IT. it's still very competitive due to the market right now. but that's where people new to industry should probably start. that's where i started.

just dial in your resume and keep sending out applications. also, network here and on any discord servers or real life events you can attend.

networking is the best way to get it, but you can still probably get in with a "cold" application at that level.

[lapis iris]

I work in GRC. I've applied to many and don't hear back.

[lapis iris]

Yeah, that would be a downgrade for me as I work in GRC.

[warm hinge]

oh, i see. sorry. i should have read your question more carefully. i didn't really gather enough info. i thought i read "help desk". apparently my eyes don't work.

how many applications have you sent out so far?

[lapis iris]

All good. I should have been more clear as in "white collar"

[warm hinge]

also, what type of work. are you talking only about GRC? or just anything cyber or IT?

[lapis iris]

I haven't been applying as of lately since the Advent of Cyber. I've just been grinding on rooms. But last year. I apply to like 5 a day.

[lapis iris]

Anything Cyber or IT related. I was thinking of looking into ITGC as I've heard the phrase around and it seems adjacent to what I do now.

I'm also looking at security control assessors, vulnerability assessors and management

[warm hinge]

that might be a good idea if there are openings. but, regarding regular IT jobs, from what i'm guessing, it will be tough to pivot from GRC to IT unless it's for a role where you have enough technical IT experience to show you can do the job, since people see GRC, and they just think paper/policies.

[upper zinc]

hey is there anyone who can help me out in erasing all the data from someone else's phone?

it's really urgent

[covert steppe]

Sure. Drop the phone in a bucket of water. Then use a drill and make about 10 x 4mm holes.

[rigid marsh]

ISC2 recommends pulverization

[rough turret]

as a uni student studying cyber security and ethical hacking, do you think i am cooked if i didnt get an internship

[stable raptor]

no

[marsh bloom]

I have Sec+, and work is covering one cyber class from SANS. What should I take? I'm into pen testing, and offensive cyber ops

[cunning lily]

eat ants?

[marsh bloom]

wat

[cunning lily]

nothing ❌

😅

[chrome nebula]

What projects should i do to fill up my portfolio as an intern/junior data analyst? I've already made a price tracker that scrapes down values from the web.

[lilac tulip]

Hey, I have my first job in cybersecurity in OT/ICS. I would like to do rooms to help me learn from it to not be a total scrub but I can't find any (other than the two attacking ics plants and the modbus room from AOC). Are there some rooms i can do?

Ok on the academy or ctfs?

Ok thanks

[dense eagle]

@marsh bloom

[rotund lily]

Anyone got any ideas on how I can build my portfolio for cyber?

[rugged delta]

Be active, learn as much as you can. There's lots of articles about cybersecurity projects you can do. Do them and write a blog post about them. Same with any certifications you do (obviously no spoilers/content/solutions), do writeups about rooms you're doing and paths you complete on THM, take part in CTFs, go to conferences, and write small blog posts about each of them. Post links to your blog posts in your LinkedIn

[full nebula]

I mean, I am not at all a professional, but I am trying to find github projects that I can contribute to. I do not have a job yet, but I assume that it would be good for employers to see what you have done, and see how you have handled responsible disclosure. And if you can get a few CVEs pocketed under your belt that should help too.

[fickle grove]

Hey, any concern in particular? Also, I've removed your other message as it has your mobile number on it.

[rotund lily]

@rugged delta @full nebula Thank you both and would making stuff with python be a good project to do?

[serene umbra]

Gave +1 Rep to @full nebula (current: #3702 - 1)

Gave +1 Rep to @rugged delta (current: #17 - 626)

[frigid lion]

How to get contractor type jobs? (in fields like AppSec, Pentesting, GRC, Vuln management, Sec Engineering)

[nocturne turret]

Security analysts play a significant role in an organisation’s _____?

[fervent fox]

defence?

[nocturne turret]

I answer and it says the answer is incorrect.

[short ibex]

Where would you upload your blogs? Do you recommend purchasing a website domain or GitHub. Or maybe something else you recommend.

[rugged delta]

Python can be useful for projects, of course. You can look on a search engine to find several project suggestions

[rugged delta]

Lots of people go with Github/Gitlab. And yes, quite a few people have their own domain and a simple webpage

[short ibex]

I got a hint from someone who used hugo framework and render to host a website. I think I’ll try that and also build my GitHub at the same time. Having both won’t hurt

[marsh umbra]

Vercel can do it all for free

With next js

If u know react js shouldn’t be too difficult

Or even GitHub pages if it’s just a blog

[broken idol]

Defense.

[short ibex]

I did use it before yes, I’ll check it out as well then. Thanks

[serene umbra]

Gave +1 Rep to @marsh umbra (current: #3702 - 1)

[marsh umbra]

Np - albeit, it is a bunch of setup 😅, you need node and you gotta prompt Claude code a couple times to tell it to build you a nice site then do vercel deploy

Actually “vercel prod” I think the command is now to push it to prod

But they give u a free domain

[short ibex]

That’s fine, I’ll give it a go and see how it goes. Better than paying for a domain lol

[short ibex]

That’s what I need

[chilly pagoda]

This is not how it works, buddy.

[short ibex]

How does it work then, buddy

[chilly pagoda]

it wasnt for you

[fervent fox]

When I used to run my little "blog" I coded an HTML website and hooked Jekyll to it, so then I only uploaded articles in markdown format - Then I put it on gh pages and worked just fine

I think it even still is somewhere on my github

Damm, I should re-write it's UI in style of my portfolio page

[ancient prairie]

This is likely your problem. Spray and praying your resume for multiple applications is almost guaranteed to not get you many callbacks unless you have a great resume - you need to learn how to tailor your resume for each specific job application, which is tedious and slower but gets much higher engagement.

[ancient prairie]

purchase a domain and utilize a static site generator (like Hugo) to create and publish your blog. Having your own domain also gives you the benefit of hooking up a mail provider like Zoho to your domain - then youll have a mail account on your own domain which will help you stand out a bit in a good way

[lapis iris]

I don't spray and pray on apps.

[ancient prairie]

When you say you were applying to around 5 a day - were you using the same resume for each of those applications?

[lapis iris]

No.

I tailor them.

I've had 2 call backs out of 10 apps.

[ancient prairie]

2 opportunities to convert into a job is pretty good - I wouldn't be discouraged about your chances of getting an office job career as per your original message

Just keep doing what you are doing and you will find something, not getting callbacks at all would be a sign to change your job-seeking strategy a bit

[short ibex]

I’ll look into that thanks

[serene umbra]

Gave +1 Rep to @fervent fox (current: #54 - 221)

[short ibex]

That definitely seems like the best option tbh