#cyber-and-careers

1 messages · Page 74 of 1

trail granite
#

Is cybersecurity math heavy?

quick forum
#

Some parts. Mostly in crypto.

golden ore
#

and networking

cosmic ingot
#

those maths are far easier by comparison

south nest
#

Hey guys I just had an interview for a Security analyst and they asked me how can red teamers avoid IPS/Firewalls and I wasn't too sure. What would have been a valid answer?

cosmic ingot
#

that's a whole chapter. but here's a simple example as an answer. a company might have a firewall to only allow outgoing traffic through port 80. you can still get a session in one of those machines if you configure it to use port 80 while connecting back to you.

#

that's as far as the firewall's concerned of course, cause otherwise you would will have to exploit a system.

south nest
#

yeah i did not know that

#

i did like 70/30

#

i knew most of the stuff but some questions just i did not know

#

Thank you tryhackme btw taught me so much stuff

pseudo creek
#

and depends if they are considering physical security as well because if you can walk into a building into a network room...

south nest
#

ohhh i did not even consider haha

cosmic ingot
#

just ask them for their credentials

south nest
#

i think i said something along the lines of that

#

but i just said i wasn't too sure and id have to look into it

#

well wish me luck 24-48 hours I see if I can actually take my first step into security

pseudo creek
#

good luck

south nest
#

regardless gotta keep learning :p

pseudo creek
#

don't we all

cosmic ingot
#

wish you the best 😄

south nest
#

🙂

flat sedge
trail granite
#

Shady u got a degree in cybersec or did u built ur way up with certs?

languid hearth
south nest
#

@trail granite certs and self learning using tryhackme

#

@languid hearth is there a room where i can learn more about this? or just like some website or video that you recommend

languid hearth
#

not really, its just kinda stuff you learn over time

south nest
#

for sure yeah that one threw me off for sure also some port scanning questions but everything else i knew somewhat decently

trail granite
#

Nice Shady unfortunately most companys seek a uni diploma

#

In my country

south nest
#

oh yeah I have a bachelors for CIS

#

forgot to put

trail granite
#

Ohh nice

#

Then its kinda equal i suposse

remote mauve
#

If anyone in London is interested in a job:


I came across your profile whilst searching for suitable candidates for a permanent Vulnerability Management Specialist role I am currently recruiting for my Investment Management client based in London.
This is a brand new role in a growing global information security function. You will lead the global vulnerability management capability both technically and in process. The role is key in supporting the information security risk management in the identification and management of risk and will be key in providing support and remediation strategies to IT. Globally responsible for tracking security weaknesses and improvements and helping the organisation be protected.

Skills and knowledge required;
Experience in managing and configuring commercial vulnerability scanning technology.
Experienced in setting up scanning profiles, conducting routine scans of security environments, overseeing remediation efforts.
Experienced in agent and appliance based vulnerability assessments.
Background in security threat analysis ability to determine risk level of identified threats and necessary urgency in remediation.
Possess strong technical understanding of common network and system vulnerabilities. Understanding of networking principles (OSI Model, routing, TCP/IP).
Experience of network infrastructure.
Ability to present risks and propose countermeasures to senior technology executives (CISO, CTO).
Experience of regulatory compliance and policy enforcement.
Excellent communication and interpersonal skills.
Desirable certifications: CEH, CISM, CompTIA Security, CompTIA A+, and MCITP.

My client is offering a base salary of £60,000 - £70,000 + bonus + pension + excellent benefits

If you are interested please forward me a copy of your CV to andy.macewan@merakitalent.com or alternatively call me on 07383 436 721 for full job
noble stag
#

hello

#

normally how much time i will need if i practice 4 hours to 6 hours every day to get to OSCP

somber bramble
#

precisely 4.6 months

noble stag
#

on THM

quick forum
#

You will want more than just THM

languid hearth
#

not a day more than Blob said

#

if you're over it, then your not ready

quick forum
#

Don't limit yourself to just a single platform.

#

Do VHL and stuff too

languid hearth
#

the OSCP in reality is not a difficult certification. it seems big and scary, but its designed to be an intro course to pentesting

noble stag
somber bramble
#

especially if youre a complete beginner

#

if you were only somewhat a beginner I would've appended it to exactly 4.7 months

noble stag
#

i have done CEH thats it

somber bramble
#

its an inverse relationship unfortunately

languid hearth
#

if you have prior networking, IT, and Sys Admin knowledge, you're good to start the certification today

#

and when I say prior knowledge i mean like you actually know it. Not kinda know it

noble stag
#

how many people here have done oscp?

languid hearth
#

lots

noble stag
#

cool thanks a lot everyone for the help

#

do anyone here know OSCP dealer who sell it in less price?

somber bramble
#

well that doesn't sound too legal

noble stag
#

i meant there are some official venders i am talking about that

#

i am taking about official vendors who can give the PWK course and exam voucher in less price as i want to take 3 months

lofty apex
quick plover
lofty apex
#

Virtual Hacking Labs

quick forum
#

Another training provider

#

If you typed into google 'VHL hacking' you'd find it

quick plover
quick forum
#

Hacking is 99% research. Get good at google, and get good at refining it.

#

@quick plover VHL literally stands for Virtual Hacking Labs

#

They were answering your question.

languid hearth
quick forum
#

Unless you win it through THM etc

noble stag
regal pulsar
#

Hi

trail granite
#

Sup

trail granite
light wave
quick forum
#

Just remember there's loads of people doing it

visual herald
#

Approaching 20,000 someone was saying earlier.

cosmic ingot
empty anvil
#

[somewhat a career question] should I transfer to a university in order to form connections/network/more opportunities (skill/leadership workshops and whatnot) but will lose some time doing cybersec learning (ctfs, thm, etc) or should I stay in a college where I'm doing well and have a lot of time on my hands to improve and learn more about hacking but have none of the aforementioned benefits of transferring to a uni.

polar rock
#

if your current university is working well do not transfer

#

Im a high school student and have more connections and networking than a majority of adults, fully online. Its just about how you connect and communicate

flat sedge
empty anvil
#

Being able to have a better network/connections/opportunities is one of the reasons I consider transferring. The college I am currently enrolled at only has a small student body to begin with and my assessment of the students here are meh. The uni I plan to transfer to however not only has more students but have more of them activities, clubs, opportunities, more 'like-minded' people per se. They have a comsci society which promotes learning and growth of its students whereas ours does not.

The second being the subjects being taught. Currently at 2nd year (1st semester), the major subjects we have are c# programming and java data structures and algorithms. Java data structures - where they just teach us how to initialize Queue<>() objects etc instead of teaching us from creating simple node structures to making them into trees, etc. (I thought myself the latter in order to better understand how those data structures since I've gathered from reading online that most interview questions when applying to jobs focus on implementations of those data structures). Meanwhile the uni I plan to transfer to already teaches its 2nd year (1st semester) students data structures, digital design, and database systems. Speaking with the people I know there, they certainly have the better quality of education in comparison to ours.

flat sedge
#

i went to a 3rd tier school for CS - not the greatest, but it has a very strong alumni community. I actually found both my current job and my previous job as a result of networking at that school. FWIW.

empty anvil
#

yea my school doesn't have that luxury

final goblet
shut current
#

hey so i'll be attempting for my security+ cert in 4-5 months from now. Right now i am focusing on Professor Messer's playlist and GCGA. I was wondering if anyone has any other resources which they found useful?

meager hazel
#

Get a set of practice questions/exams. Jason Dion's set on Udemy is solid

#

Other than that I think you're already using the most popular resources

shut current
#

Thank you for the recommendation!

junior kelp
#

Hi. What do you think about COMPTIA PENTEST+ certificate? Is it hard? Worth to get?

golden ore
#

depends on the company on how it gets weighted, but certs are always worth obtaining in most cases

junior kelp
#

and what about difficulity?

#

comparing with OSCP for example

quick forum
#

Cert stacking is frowned upon, and a lot of certs are not worth the money at all

lost token
#

Wait why?

junior kelp
#

including comptia pentest+ ? 😄

lost token
#

Isn't more == better?

golden ore
#

it depends on what sector you are in sometimes, I know DOD has different cert requirements based off job level

junior kelp
#

from offensive pentesting perspective

empty delta
#

What are the different kind of careers in cybersecurity?

quick forum
lost token
#

So is cert stacking like getting CEH, Pentest+, eJPT, and OSCP?

distant pier
distant pier
quick forum
#

Ejpt is a lot more entry level

lost token
#

Oh, so if you have lots of experience it's okay?

lost token
keen gate
#

Many places just use the title "Security Engineer" for anything from SOC, to pen testing, to policy, to code analysis, you'll see many companies use just "Security Engineer" for all their roles.

quick forum
#

The idea is certs for the sake of certs, rather than certs for the sake of learning

distant pier
lost token
#

Ah I see

#

So it's not the certs, it's the learning

#

Got it, thanks

keen gate
#

Also don't be that guy that lists all 196 Udemy courses he's taken.

distant pier
pseudo creek
#

yeah my job title for most of my career has been security engineer and my jobs were vastly different, although generally security engineer we consider people that work to develop secure solution for various projects, its a very visio focused job

loud marsh
#

Going to start my internship as threat intelligence

#

if yall have any good resource

#

lets me know

#

Don't see many source cover about this 😦

#

feels overwhelmed

quick forum
loud marsh
#

thanks

polar rock
#

@loud marsh if youre going to start an internship theyre going to groom you the way they want I almost 100% gurantee more than half of what you will learn will be thrown out of the windows because they have their own methodology and tools they use

#

I 100% suggest following tryhackme as we will be releasing a lot of blue team rooms all this year

loud marsh
#

But at least I will get some experience... for my next job. Better than nothing

#

I want to do malware analyst but they told me it not an entry level role. I need to start at bottom then escalate to malware analyst

#

💀

polar rock
#

lmao what threat intelligence isnt an entry level role either

#

what

#

bunch of crackheads

loud marsh
#

So he wants me to work with their API, then learn about IOC , write blog... reasearch. It sound pretty intense

polar rock
#

crack

#

I mean threat intel is a very interesting thing with not a lot of documentation

#

I would get familiar with things like redline, IOCe, YARA, any mandiant tools specifically advantage (requires email access), familiarity with ISACs (AlienVault OTX, ThreatConnect, USCERT, etc.)

#

there Ive given you some key words and tools that you can go and research now

loud marsh
#

yup those are the tool that they used daily. The company deal with maldoc mainly.

#

Thank for the info

#

My brain about to explodeeeeee

polar rock
#

If you really want to invest and learn you can drop some money on an INE pass and learn a bunch about threat hunting, intel, DFIR, malware analysis, etc.

loud marsh
#

I wonder if all internships are actually for noob anymore

#

I hope in the next few year they don't require 4 years experience on internship

polar rock
#

depends on the company and expectations

#

for cybersecurity internships it is assumed you have a genuine passion and pursue the topic a lot in your free time

#

for example an internship I have with a very large company is basically just a 6 week long project that you are guided by the other teams and then present at the end.

golden ore
#

I know several that want people who can code for the interships and that is how they measure them

final goblet
#

they did it for like a month

#

And then realized everybody wanted that and not to pay 2k a year

#

And so they took the monthly away

#

I understand it's a business but it felt scammy

quick forum
#

IIRC you can email and ask?

final goblet
polar rock
#

@final goblet you sure about that one? I dont even know if its been out for a month

#

its in the plans it just has yet to be implemented

final goblet
#

Do you mean the INE Cyber Pass?

polar rock
#

yes

final goblet
#

They released it October 20th and there was complaining on reddit

#

Everybody loved the Vera Labs

#

And felt this was pay to play now

#

I tried doing the trick to see the monthly option that somebody mentioned, and it was no longer available

#

This is what I'm on about

polar rock
#

so it never actually released

#

again its in the plans its just not out right now

final goblet
#

Hmm maybe I misunderstood what you meant

polar rock
#

CC: @exotic epoch any updates on when the monthly pass will be out?

flint pilot
#

@final goblet If u send them an email explaining you want to do a particular course and certification monthly, I believe they will allow it

final goblet
#

thanks for the info everybody

ancient prairie
#

yeah I got the $1200 for 2 years deal, which is a great value imo

#

i believe they offer the monthly if A) you ask nicely and B) have taken a course with them(i think, dont quote me on that)

#

but I was offered the monthly and have taken a course with them for reference

final goblet
#

Yeah the 1200 deal is good for sure

#

I agree

light wave
#

i'm using INE starter pass

#

the sql injection study guide seems like a much longer slide deck than the pts barebones sql injection slide deck

gleaming basin
flint pilot
#

^ i can second that

pliant sand
#

Hey I just wanted to ask "is it possible to change interest field after few years of work in MNC?

zealous forge
#

Are there certifications for INE ??

cosmic ingot
#

yes

pseudo creek
#

you pay for the certifications sepearetely

pseudo creek
pliant sand
#

Yeah

#

@pseudo creek

pseudo creek
#

but like I said, yes you can obviously change your field of interest, IT is very fluid, Cyber is very fluid

lofty apex
#

Is it true that there are more jobs in blue teaming than there are in red teaming ?

pseudo creek
#

yeah tons more

lofty apex
#

Oh

golden ore
#

but you can take red teaming knowledge and apply it to blue team principles though

pseudo creek
#

yeah lots of information is tranferable

#

I'm an architect but planning to do OSCP next year just because

warm hinge
#

im completing my Graduation next year
i want work in this cyber security industry
can anyone guide me from where i should get started ?

pseudo creek
#

whats your major? are you starting from 0? Do you have any certs?

warm hinge
#

i dont have any cert

#

im a student of BCA
Bachelor of Computer Applications

#

im not starting from 0

#

i have basic knowledge of Web Application pentesting

ebon estuary
#

where in the world are you located (what country)

warm hinge
#

India

quick forum
#

Certs then.

warm hinge
quick forum
#

You'll want to look at getting certs

polar rock
#

Get certs my dood

warm hinge
#

which certs?

quick forum
#

Look on LinkedIn at jobs you would want

#

Look what they are asking for.

polar rock
warm hinge
#

holy F

#

they are expensice

#

expensive*

polar rock
#

Yes certs are expensive

#

so is a degree

#

Think about the cost / benefit

warm hinge
#

any guidance where to get started without certs ?

#

maybe i'll do it in near future

#

i want to afford these certs myself

quick forum
#

Without certs? Get an unrelated IT job and pivot

meager hazel
#

There are pentest consulting services with offices in Inidia - FireEye, Synopsys, etc. – find job postings from them and see what they look for in a candidate.

languid hearth
warm hinge
deft path
warm hinge
warm hinge
pliant sand
#

Even if there are so many benefits of the certification , it very hard to convince parents. .

#

Because that 800USD sometimes is equal to yearly fees of the college.

polar rock
#

Make your own money, if you’re motivated enough you will figure it out

ebon estuary
#

I made things work for a long time with out getting certs. I am not sitting in a boot camp to get certs 🙂 luckily my work is paying for them but i still am here.

pliant sand
#

That's what most of the people do, get a job save money do security certification and change field.

meager hazel
#

Yes. Even with certs it would be hard to get into pentesting if you don't have a confirmed background in IT

mint viper
deft path
mint viper
deft path
# mint viper Any recommendations for someone considering making the same move?

well, I got lucky, the company I work on had a pentest team, and still took over a year the transition, if you are in a similar spot I'd recommend you to talk with your boss, if not then go get some CTF experience and start sending resumees, I'd put level of Portswigger/HackTheBox/Tryhackme on it as well on the extras part

mint viper
deft path
#

Where are you located? geographically speaking?

mint viper
#

As central US as possible, Kansas City

deft path
#

I see, well, I don't know much about the US market at all so wish I could help you a bit more

mint viper
#

Haha no worries, but if you have any leads on companies looking to bring over american devs, lmk!

deft path
#

for sure

#

But I would not recommend come to my country nowadays, violence is rampant hahahaha I live in Brazil

#

I actually am looking to relocate to Germany in a couple years

mint viper
#

That's fair. I've actually been there! Visited people in Araraquara and Ubatuba

loud marsh
#

Would getting a master comp science + teaching cyber security on free time, be better than a master of cyber security ? Happen to able to get bachelor+ master in 5 years

#

I mean it doesn't really matter that much

#

🤔

pseudo creek
#

I guess what is your goal?

loud marsh
#

Hardware/Software Reverse Engineer, Malware Analyst

#

Comp Engineer is also an option

#

i'm Comp Eng and Electrical Eng major

#

not sure if I should just go an extra mile to expand my Comp Eng knowledge

pseudo creek
#

I guess whats the purpose of getting a masters? I guess are you trying to get a masters either way and trying to figure if CS or Cyber is better?

loud marsh
#

@pseudo creek yeah for a long run

#

i heard there is shortage of people who know how to code in depth in cyber security

pseudo creek
#

not really

#

developers come into cyber security as a frequent path, it really depends

loud marsh
#

CS master would teach heavily in algorithm, Cyber Security degree would teach me all the Network/System/Web security

pseudo creek
#

honestly, in the US, I don't find cyber security masters to be much use unless you are already in a cyber role and trying to go towards a management role

loud marsh
#

That make sense

pseudo creek
#

and even CS masters is something you could wait on unless you really are burning to go that path

loud marsh
#

my friend did master cyber security but he also held OSCP cert

pseudo creek
#

certs are better investment than MS degree, at least in the beginning

loud marsh
#

so it hard to tell which one prepare him better

#

I looks up plenty of Malware and Reverse Eng position, didn't see cert mention

#

so I guess I will stick with the generalist degree

pseudo creek
#

yeah if malware/rev engineering, you can do a lot of self study, there are a few certs like GREM

#

and I think eLearn has 1

golden ore
#

there are some BS and MS that also help get certs or include them in course work

polar rock
#

Sans will probably be out of your price range but INE has some good stuff

loud marsh
#

How come nobody sell Reverse Eng/Malware on udemy. Didn't see any good course about it in the platform.
Ya'll would make good money from it

pseudo creek
#

there are RE courses on the platform

loud marsh
#

oh yeah there are some now. Last time I check, most of them are below 3.0 rating

pseudo creek
#

but RE seems partially to be a dying field unless you do vulnerability research at a company specifically looking for vulnerabilities

polar rock
loud marsh
hazy crypt
#

@pseudo creek how is it a dying field?

loud marsh
#

Pretty sure it's pretty good field to be in. Not many people want to do it so if a person get good at it. S/he can get job easily.

pearl carbon
#

RE is not a dying field.

#

It's definitely getting harder now. but never a dying field.

#

I use RE every day to hunt bugs in android and iOS apps.

warm hinge
#

Thing is re can be used in alot of different fields

pearl carbon
#

Yea

warm hinge
#

Exploit development to more

#

It's just a good skill to have

pearl carbon
#

If you mean like a job where you ONLY do RE hard core, then yea I think those are pretty rare unless you work for companies like FireEye.

warm hinge
#

True

pseudo creek
#

I think due to automation and information sharing, RE has definitely lessened in the amount of people you need to do it, which is why I say it is a dying field. That isn't to say there will eventually be no people that do it, just the amount of jobs will be pretty rare. And honestly that is a good thing for security, not the best thing for finding a job. If you want to focus on finding a job, time learning RE may be better spent elsewhere unless you use it as a hobby like I do.

#

and should say that I would differentiate RE from things like application analysis, which generally don't need RE to perform. Application security is its own bucket I feel, but again there are a lot of really good tools and automation out there for that as well.

warm hinge
#

yeep

#

should I take the Google IT Professional Certificate with Comptia+ certification?

#

I think I should so i can fix my own computer like MacBook pro when i do my graphic design work and if my macbook pro goes haywire

pseudo creek
#

I would say if you are looking for entry level job, Comptia+ is best option

#

how much is the Google IT pro certificate course?

warm hinge
#

Google IT pro certificate course has where people can use their financial aid for it

#

@pseudo creek i've been thinking about taking Google and Comptia+ certs so i can fix my own pc while I am doing my graphic design work

ancient prairie
#

well basic troubleshooting for a PC is something you could easily learn online without having to take a certification specifically

#

it really depends on what your career aspirations are

#

if you want to do graphic design then this is the completely wrong community for you unfortunately

warm hinge
#

I love Information technology since when I took an IT class in HS

pseudo creek
#

also the IT pro cert seems to be a survey of IT topics without much depth

warm hinge
#

mhm

ancient prairie
#

thats good!
but IT is such a huge field you really need to narrow your interests a bit - which is often the hardest part

pseudo creek
#

but if you think you can get the course free, it wouldn't hurt to take it

ancient prairie
#

yeah Zojja it's essentially Google's take on A+ (minus the annoying printer stuff)

#

the labs in it are actually kinda cool

pseudo creek
#

also when I google the IT professional cert, they said they no longer offer financial aid?

#

unless they added again due to covid

warm hinge
#

Google IT Support Professional Certificate and Comptia+ certification is my backup career path if I have a hard time finding a job in graphic design.

pseudo creek
#

graphic design is a tough field, I know someone who works in it

warm hinge
#

I've been looking at certs in Cybersecurity too. really wow cool

ancient prairie
#

yeah its possible Zojja, I got mine back in July through my college - all paid for

pseudo creek
#

well know a few people but doesn't mean its impossible/out of reach

ancient prairie
#

also know a person who does Graphic Design - incredible artist but deals with a lot of crap

warm hinge
#

like what?

pseudo creek
#

it just may take a while to get a graphic design job, if that is your dream, you could just keep applying, keep doing skills and maybe do IT on the side

warm hinge
#

mhm

ancient prairie
#

not to discourage at all but graphic design is difficult and competitive - probably moreso than Cyber Security

#

but just build up a solid portfolio and take lots of art classes

warm hinge
#

I've been thinking about taking Google IT Support Professional Certificate and Comptia+ certification maybe a cybersecurity certificate too lol

#

so yeah

loud marsh
#

Yeah im planning to do RE free time and focus on malware analyst. :P

#

@warm hinge you dont need a certificate to fix macbook. I repair mine myself. There are some good youtuber know macbook in and out

warm hinge
#

ok

#

I just want to have the certification on the safe side

#

so yeah

loud marsh
#

@warm hinge if you want to do graphic design then i would skip both of those. Get a udemy course on design, start build your portfolio

warm hinge
#

I am pursuing a degree in graphic design at my technical college

loud marsh
#

School taught mostly basic and the foundation of the topic. They never get in depth anything. I would suggest you get a udemy course. You would surprise how much you learn from it.

warm hinge
#

ok

elfin rain
#

Can I ask you guys something
CEH or eCPPT for career
Which one you guys prefer?

fringe spade
iron temple
fringe spade
elfin rain
fringe spade
quick forum
fringe spade
quick forum
#

It's either

#

But PT+ is the better course

queen crown
#

I have some doubts

#

Regarding career in cyber security
Like is it promising?

loud marsh
queen crown
#

Oh okayyyyy

#

Thank you so much

#

So it’s more of a side income and passion than a job intensive field?

undone shore
#

Cyber security as a field is very promising for a career

queen crown
#

Oh okay

languid hearth
#

100%

#

security isn't going anywhere

pseudo creek
#

bug bounty though is more of a side hustle

zealous forge
#

I think it might all become automated in a few years

warm hinge
#

I think Google IT Support and Comptia+ professional certification won't help me find a job.

pseudo creek
#

getting an entry level job isn't easy, certifications are definitely the better way. Are you trying to get a job while going to college?

warm hinge
#

I have a part time job as a youth/high school sports official

pseudo creek
#

are you trying to get a full time job right now?

warm hinge
#

I am but with Covid-19 going on i don't want to take a chance to get hired and get let go because of covid-19 pandemic

pseudo creek
#

well if you want a full time job, I'd definitely look at the sec+ or net+, and then start applying

warm hinge
#

ok after I complete the Google IT Support Specialist Professional certificate then the Comptia sec+ or net+ certification which I know i have to be recertified every 2 years

pseudo creek
#

yeah sure or while you are doing it, whatever works

warm hinge
#

ok

#

why do I have to get recertified for comptia certification?

pseudo creek
#

honestly, I wouldn't worry about the recertification, don't stress about it

warm hinge
#

ok

pseudo creek
#

because things change and they keep the test up to date

warm hinge
#

ppl who complete the Compita sec+ cert gets $81K per year damn

pseudo creek
#

i would take marketing materials with a grain of salt but entry level IT with a college degree is usually around the $80k mark

warm hinge
#

geez

#

say I got the google IT Support Specialist Professional certificate and Comptia sec+ and net+ certification would it hurt me pursuing a degree in IT?

pseudo creek
#

no, why do you think it'd hurt you?

warm hinge
#

idk I think it would help do better if I worked at IT firm and get a lot experienced and knowledge I would get a degree in IT.

#

I know I love being on computers all the time lol

pseudo creek
#

I guess I'm confused at what you are trying to ask?

warm hinge
#

about what

pseudo creek
#

so why do you think getting certs would hurt you?

warm hinge
#

I think certs wouldn't let me get a degree in IT

pseudo creek
#

no that makes no sense, certs and a degree are complementary

warm hinge
#

ok

pseudo creek
#

if you were pursuing a degree, I'd tell you to get a cert as well

warm hinge
#

mhm I would get the certs first and work at a IT firm and get a feel of it until I am ready to get a degree in IT or cybersecurity.

pseudo creek
#

sure, but its not just a guarantee you'll get a job, it will still take a lot of work, self learning, etc

warm hinge
#

I thought professional certs in IT helps me to get a IT job?

pseudo creek
#

they do but not a guarantee

warm hinge
#

ok

pseudo creek
#

it could take many months, many applications, many interviews, etc

warm hinge
#

mhm some start their Computer repair shops with IT professional certs

loud marsh
#

@warm hinge yeah it could get you job as a technician support

warm hinge
#

IT help desk??

loud marsh
#

yea

warm hinge
#

I looked into the position before

pseudo creek
#

yes IT help desk is a good entry level position

warm hinge
#

Mhm like helping people with if they are in a DDoS(distrubuting denial of service) attack, troubleshooting their PC etc

pseudo creek
#

yes or things like password resets and what not

warm hinge
#

Okay

#

That sounds fuuuunnnnn Google IT Support Specialist cert program would get me a job in the lol 😁😁

loud marsh
#

@warm hinge if you are young, just use your free time and teach yourself ahead of time then attend college if you can afford it.

#

Lot brilliant hackers didnt even need their college degree and cert.

polar rock
#

thats a lie if I ever heard of one

solar mural
#

Guys need a bit help. Im still new to hacking & i really want to learn cyber forensics & cyber warrior any help is much appreciated

polar rock
#

name one well known hacker that ethically gained a career without a single cert or degree

loud marsh
#

George hotz

polar rock
#

he started his own company thats a bit different

#

he also didnt do things the most legal

loud marsh
#

He is the first person hack the iphone thou

polar rock
#

I dont care what he hacked first

#

its unsustainable to use him as an example

#

Id rather use @languid hearth as an example of someone who doesnt have a degree and worked their asses off to make 6 figures a year

loud marsh
#

naw he is well-known and gained a career without single cert and degree. He worked at google, tesla before founded his own

polar rock
#

can you give me more than one very specific example?

#

I think that model is asinine and unsustainable to be a role model for young people

loud marsh
#

those would be in jail 😂 before get a full time

polar rock
#

as I said

#

name one well known hacker that ethically gained a career without a single cert or degree

#

the key word being ethically

loud marsh
#

well, the iphone hack wasn't illegal back then

#

so

#

but lets me see

sick wave
polar rock
#

hes has multiple lawsuits the dude was doing some sketchy crap

sick wave
#

never read of those

polar rock
#

yall are giving very specific people which congrats to them, but it is going to be very hard to get anything stable with that path. I dont see why you would want to push a young person in that path

loud marsh
#

pretty sure he quits hack because hack law start to passing around. Most of his works are reverse engineer

#

there is malware tech as well

#

Marcus Hutchins

polar rock
#

he doesnt have a career lol he got hella lucky and I dont even know if he has a job now?

warm hinge
#

It would be fun hacking my own iPhone lol

loud marsh
#

After he stopped wanacry, he got arrest so

#

lol

polar rock
#

because he also did sketchy ass crap

warm hinge
#

Would I be arrested for hacking my own iPhone

polar rock
#

part of the reason he doesnt have anything sustainable

loud marsh
#

@warm hinge could be, a youtuber was sue by apple for fixing macbook

warm hinge
#

Geez

loud marsh
#

His name is Louis Rossmann on youtube

#

you can looks him up and learn how to fix your own macbook

warm hinge
#

Look Ma I hacked my MacBook pro lol

dense dome
cosmic ingot
#

While some good points were made here, IMHO when someone is wondering whether a uni education is worth it, this isn't the best way to go about it. I believe they should ask themselves how valuable that education will be, and if it's worth spending a few years of their time for this reason. From my experience the answer is a huge yes to both of those questions. Some people might be asking because they're in a tough financial situation, and I can understand that. But I would go so far as to say, if it's possible for you to even move to another country to get an education, do it. Universities and study programs aren't perfect, but they're a good way to get a solid background in a structured way in the field you want to pursue a career in. Also, a great chance to learn from people who know a ton more stuff than we do. Sometimes it's hard to appreciate that fact if you haven't gone to uni, but even if it's possible to make it without going, you will have gaps, and most likely huge ones. IMHO, uni is much preferable to diving immediately into doing what you like, and then coming back to fill your gaps as you go. It's useful to know that some people have made it without going, but not a great way to think and plan the rest of your life/career upon.

wet moon
#

on the the topic of training and certification, i was hoping to get some opinions from the certified people here on the training they used. I've been on this site about a month and love it, been on HTB, in a SANS course, been on INE for eLearnSecurity, CompTIA, and had a few specific pentesting courses elsewhere. I just wanted to know what people thought of the training they used and any recommendations.

#

There is a lot out there and I just wanted to get a more clear picture of some of the resources

#

i also have and read a lot of books from nostarchpress. i actually really like those.

cosmic ingot
#

What exactly are you asking, what's the best resource to study for each of those things, or what's the best among them? It's a very general question.

wet moon
#

it was a little open ended yeah. Im just looking for peoples opinions of the resources they used. im not sure there is a correct answer to whats best, or at least i doubt there is.

#

as in what resources you found most helpful/useful.

#

or which ones you tried and steered away from

cosmic ingot
#

#resources. A ton of useful stuff in there, as well as opinions on them 🙂

wet moon
#

ill check that out thank you.

#

I hadnt even looked in that room to be honest

#

so i appreciate the pointer

cosmic ingot
#

Np, it will quickly become one of your favourites 😄

wet moon
#

i love resource pages so i believe you. the number question i've asked instructors/trainers was what there common resources were. its hard to learn/catchup/keepup if you dont know where to go to learn it

cosmic ingot
#

It's also easy to get lost in tutorial hell though, so it's best to work through a few resources and then move on to others, than jumping from one to the next and back again

#

ask me how I know 😄

wet moon
#

lol im notorious for that. i cant NOT do the tutorial and starter stuff for some reason. fortunately THM has more or less had my attention of late so ive been in that situation since starting

#

well, until i got on INE. because i learned about it here

coarse agate
#

I want to learn about malware analysis and develop in this field, do you know any roadmaps on this subject? thanx

warm hinge
#

I wonder can I be a graphic designer and a web developer?

loud marsh
#

@warm hinge if you want to become graphic designer and web dev. Freecodecamp community would be a better place to ask

warm hinge
#

ok

warm hinge
warm hinge
#

@loud marsh what is Freecodecamp

loud marsh
warm hinge
#

ok what code can I learn?

loud marsh
#

MERN stack

warm hinge
#

ok

loud marsh
#

HTML CSS JAVACSRIPT, mongodb, react, nodejs

#

don't eremember what e stands for

warm hinge
#

ok

#

what code do web or software devs use?

quick forum
#

Front end, HTML+CSS+JS, maybe frameworks like electron or react

rugged sable
#

Vue is very good

#

I'd suggest Vue over react for someone new to the field

#

It's also the most popular GitHub repo of all time 😄

warm hinge
#

Free code camp will help me develop good coding skills?

#

Kaney

golden ore
#

it will give you the basics, you still have to practice

warm hinge
polar rock
#

Sounds like Wordpress or wix ngl

quick forum
#

I wanna say... Adobe Dreamweaver?

warm hinge
#

Mhm

#

I might want to try free code camp

#

Quickly create and publish web pages almost anywhere with web design software that supports HTML, CSS, JavaScript, and more.

#

Create, code, and manage dynamic websites easily with a smart, simplified coding engine. Access code hints to quickly learn and edit HTML, CSS, and other web standards. And use visual aids to reduce errors and speed up site development.

umbral hawk
#

This might be a bit far fetched, but is there anyone who is working in the cyber field who is working at senior level/as a recruiter who would find time to review my CV as part of my uni assignment? I've been let down by a few people and trying to find someone last minute

warm hinge
#

???

warm hinge
#

https://www.freecodecamp.org/ I made an account on here

freeCodeCamp.org

Learn to code. Build projects. Earn certifications.Since 2015, 40,000 graduates have gotten jobs at tech companies including Google, Apple, Amazon, and Microsoft.

#

I'll be using Adobe XD and Adobe Portfolio to create web sites.

#

Hi all, I was wondering what does it take to be a security analyst

golden ore
#

I have seen security analyst defined differently by many companies, most perform threat hunting of some sort, ticket management, SIEM watching, etc

warm hinge
#

Is threat hunting like pen testing @golden ore

#

I took two security courses in university but I didn’t learn anything

golden ore
#

not really, most threat hunting is understanding TTP's and then being able to identify them in logs

warm hinge
#

Ohhh

#

So I should study TTPs? @golden ore

golden ore
#

it's good to know TTP's no matter what field in cyber you are in

warm hinge
#

Ohh

#

How do I be prepared to be a security analyst?

golden ore
#

I would look at the job boards and see what companies are looking for in a security analyst, like I said companies define the role differently and it's hard to say what one company is looking for

warm hinge
#

thanks!

#

@golden ore I am gonna learn and practice coding on freecodecamp for web and software design

golden ore
#

it's a good place to start

warm hinge
#

mhm

#

freecodecamp has professional job certification to people to work at google etc

#

even for security?

pseudo creek
umbral hawk
pseudo creek
umbral hawk
pseudo creek
#

No prob!

warm hinge
#

does anyone use free code camp

pseudo creek
safe gate
warm hinge
#

I am learning to program with HTML code on FCC

safe gate
#

html is just a markup language. real programming will begin with JavaScript

warm hinge
#

mhm

#

I know I am gonna learn javascript and other coding language

safe gate
#

cool

#

keep doing those projects and you can earn those free certificates. you can put them on all your online portfolios/resume/etc

warm hinge
#

Its gonna take me a while to get used to programming on FCC

warm hinge
safe gate
warm hinge
#

because its been awhile since I taken a computer science class when i was in high school

safe gate
#

dont worry, you will get used to it

warm hinge
#

Mhm like learning a new video game u never played before.

light wave
#

all of tech is like that. i started playing modern warfare earlier this year. by now, i am really good at it, have unlocked almost all attachments, i know how to really make people mad, i've only been playing for close to a year. learn code for as long as i've been playing modern warfare, see where it can get you.

#

good lord i just dug up a dead body over here

quick forum
#

Eh only by 4 hours

#

I've seen people necro stuff from a couple days ago here, or even longer

hushed flint
undone shore
#

Definitely not CEH. eCPPT or OSCP. OSCP is better recognised in the industry. eCPPT apparently has better training material. I've not done the eCPPT training material though so I can't really compare

trail granite
undone shore
#

Because it's got virtually no learning value. A lot of it is out of date, a lot of it is completely irrelevant

#

It's good for checking boxes if you want to work for the American DoD (although CompTIA is gaining ground)

#

It's also apparently sought after in India

#

But that's all it's good for -- checking a box, getting past HR, or an automated scanner

trail granite
#

I see good to know thanks Muiri and congratz on ur oscp btw!

undone shore
#

Np, and thanks! ♥️

quick forum
#

So that's gonna be the better option for DoD IMO

undone shore
#

That's the one. Couldn't remember if it was Sec+ or Pentest+

#

But either way, CompTIA is now the better provider for DoD

quick forum
#

I mean that way you might actually learn something valuable, and have a better cert afterwards

jovial parrot
#

Hey I am just a beginner
Can some experienced pls provide me a path to become good in cyber security

fringe spade
dire rivetBOT
jovial parrot
#

@fringe spade thnx a lot

warm hinge
#

is anyone here a security analyst?

tacit bobcat
#

Probably

static tide
#

yes

warm hinge
#

@static tide are you a security analyst?

static tide
#

yes @warm hinge

spice yacht
#

no but seriously, are you? 😂 😂

static tide
#

yes

#

why are you doubting me

spice yacht
#

I was joking, I would've thought the first yes would've been enough 🙂

unkempt nova
#

@undone shore passed oscp?

undone shore
#

Mhm

unkempt nova
#

Congrats! Next course?

#

Pen-300?

somber bramble
static tide
#

fight me @somber bramble blobknife

somber bramble
#

Ok come to america

static tide
#

no you come to uk

somber bramble
#

Me + 0day vs you

cedar terrace
#

Guys, guys
Dont fight

Without a knife

cedar terrace
somber bramble
#

You can choose a legend to be on your side too

#

But I have 0day so I automatically win 😎

#

I hope (I haven’t asked)

undone shore
static tide
#

bring him with you blob

#

muir why ejpt after oscp?

somber bramble
#

Ok I’ll ask him if he wants to come

static tide
#

good you can come stay with me

somber bramble
#

Coming!

undone shore
#

Oh

#

Oops

#

Small Typo there

pseudo creek
#

we are fighting?

golden ore
#

with knives

unkempt nova
#

Not sure if eWPT contents are covered in pwk guide

#

I am targeting els 3 course. Wpt, wptx and ptx

#

oswe is white box though

austere heart
#

Is there anyone here who was in the Military in cybersecurity?

#

And can talk atleast about SOME parts of it?

distant pier
golden ore
#

I've been out for 8 years and there are many parts that I can't discuss still

deft walrus
#

What's this server about

distant pier
#

Learning Cyber Security and Ethical Hacking.

deft walrus
#

Ohhhhh so it's not what I thought

quick forum
flint pilot
#

@deft walrus u wont be finding any dark-web links 😀

polar rock
#

@flint pilot why not? nothing wrong with the dark web if used correctly and your country allows it

warm hinge
#

@static tide is it ok to ask you a couple of questions about security analyst?

static tide
#

ask them here, that way other people can also see the questions/answers

warm hinge
#

Do you mind describing your career path? How you became a security analyst? @static tide

deft walrus
#

Ah dang I was hoping this was a ip logging server lmfao

warm hinge
#

um hi is it worth doing an online course on like udemy or something im interning soon and i dont really have any certs

#

kinds concerned my chances for internship alone might go down

fringe spade
warm hinge
#

um easier like ?

fringe spade
warm hinge
#

ah interesting ok ill take a look into it ty

static tide
#

the 3 big things they liked about me were: networking skills (ccna), offensive mindset (htb, thm, ejpt) and that i created some ctf's on thm

somber bramble
#

they also loved that you were blobular

distant pier
#

He was known, amongst his peers, as the Valued Creator.

static tide
#

both very true

final goblet
#

Is anybody familiar with Amazon's Technical Interviews? This is for a Sr. Security Consultant position, and is a role with zero information about it online, nothing on glassdoor, etc. It's just really broad in terms of what they could ask about, and I know the one topic I'm not an expert in, they will drill into it, so trying to be prepared.

spice yacht
final goblet
#

wow didn't know about blind

spice yacht
#

ye, pretty useful and anonymous 🙂

stoic lotus
#

what is blind

cobalt escarp
#

?

rugged sable
#

A social network 🙂

#

It's quite good

final goblet
#

A good place to make yourself feel underpaid

#

😝

rugged sable
#

lmao

#

TC / YoE?

#

728k 1 YoE, FAANG. 41786 Leetcode questions done, AMA

#

I fricking love how everyone on Blind signs off with their TC / YoE

#

Some of my fave r/cscareerquestion posts too why not

#

If you ever step on a dog in an interview, killing the CEOs childhood pet in front of a panel interview at least you'll know what to do

open leaf
#

What job should someone go for after getting their OSCP? Have 4 years of experience working L3 support + server administration

#

I’m seeing a lot of pen tester jobs ask for 4+ years of experience. Not sure if that’s specifically with security or?

languid hearth
#

@open leaf if you feel comfortable with Security and can answer some of the interview questions here:
#cyber-and-careers message
you're ready to apply for a Pentesting position. Server Admin+High level support is stuff they like to see. The only other thing they might want is SOC experience, but honestly, your Sys Admin experiences should trump SOC.

earnest slate
#

Is anyone aware how a regular day as a Tier 1 SOC Analyst (Alert Analyst) looks like?
Do you just fk around during your shift until you get an alert(s) or what kind of other responsibilities they might have?

unkempt nova
fringe spade
fringe spade
static tide
#

average world, or even country pretty much means nothing though

fringe spade
#

It can vary from person to person, often luck is needed

unkempt nova
#

Thanks for the info. I got a contract offer for pentest website remotely for a few days. But the rate is too, actually really low.

fringe spade
unkempt nova
#

I can include that as experiece in my resume... Right?

fringe spade
unkempt nova
#

He says he want to prove my skills so that he can work with me for long term. And proved it well by pentesting in few hours. I did not really count the money. But he is coming with another project, and not sure what i should ask for.

fringe spade
unkempt nova
#

Hmm... I understand it is good to market myself and gain experiece.

#

I will try.

fringe spade
viscid yew
#

For those that started out as pen testers what are some skills that you brought along with you when changed to a SOC role, and vice versa?

#

i.e. what are skills that are transferable in the different areas?

polar rock
#

most go in a SOC role then a pen tester role

#

Some things you can bring are TTPs and attack techniques

#

pentesters can take away ways that the SOC detects to avoid detections

#

etc

viscid yew
#

ah ok cool thanks for that!
However, what are TTPs?

unreal arrow
#

Tactics, techniques and procedures

viscid yew
#

ah ok

#

thanks again for that

open leaf
#

I was able to answer most of them on my own. One that stopped me up a bit was “- Without nmap and other standard utilities how could you determine a port is open” my first thought was the Python sockets module, nc and then curl/wget

final goblet
dim snow
#

does comptia pentest+ have more active directory than linux or the other way around quick question

distant pier
#

Download the Pentest+ syllabus from the CompTIA website @dim snow

dim snow
#

tyty

ancient prairie
hollow socket
#

I am currently an SOC engineer supporting their day to day activities but also curious what they actually do in the SOC

wise grove
fringe spade
olive orbit
#

because everyone is constantly engaged in a game to inflate each others' self-importance.

#

Brutal!

fringe spade
#

I like the way this company works

#

They ignore certs and have their own inside exam that will filter the best out of the best

olive orbit
#

Thats a silly way of doing it though.

#

We all want the Best of the Best. But the more you filter, then the less of a pool you have to choose from, and the more it's gonna cost you. In my mind, it's better to have one Amazing dude/dudette, then others that are good, but you can direct towards the skills you want/need in your business

fringe spade
olive orbit
#

Oh don't get me wrong, the in-house exam is ok. I've done it a few times myself. But personally, If I'm at that high a level (i.e 'best of the best'),companies should be approaching me. I ain't doing no exam to compete for a job.

#

If I'm mid level and they wanna see my skills, then... eh, I guess it's ok

#

I did it once before for an IT position. It was kinda cringy to tell the truth

fringe spade
fringe spade
olive orbit
#

Not even close to secret 😄

#

There was a written bit with a few IT related questions - most/all of it was straightforward.

#

Then he showed me a computer on the desk and said 'This doesn't turn on. How would you fix it?'

fringe spade
olive orbit
#

Turns out he was being tricksy and the plug just wasn't in the socket, but was under a cover so not totally obvious.

fringe spade
#

Oh god

#

The company must've been a funny place to work at

#

Many experienced top-level workers I suppose

olive orbit
#

Second task was that he had an old router that he wanted me to reset the password. I just move to the computer next to it and googled it. Turns out on that router you needed to hold the reset button for exaclty 8 seconds

fringe spade
olive orbit
#

Nah, It was a perfume/derma product company, and they'd expanded really quickly off the back of 1 line of products. Their 'IT guy' was just their web programmer who took on the role

fringe spade
olive orbit
#

Hence why they needed an IT person 😄

#

This was going back about 7 years

fringe spade
olive orbit
#

When I applied for Digital Forensics, there were like 8 positions, so there were loads of people there. we had to do a 10 min presentation on anything we wanted in front of all the other applicants, then a normal job interview

fringe spade
olive orbit
#

Hacking.

#

😄

fringe spade
olive orbit
#

So my degree is in Internet Technologies, so I have precisely 0 forensics experience and was in a room of people with degrees and Masters in Forensics.

#

And I said that.

#

'.... So I've decided to present a short talk on Hacking'

#

I was up there for about 30 mins answering questions from the other applicants and the company bosses 😄

#

Like all really basic stuff. I described a mitm attack, spoke about social engineering, how hollywood is different to the slog of real-life

fringe spade
olive orbit
#

Hahaha, Nah was even more basic.

fringe spade
fringe spade
olive orbit
#

Well, They gave me one of the jobs over some of the Masters graduates

#

Later on (Like a few months into the job), during a staff night out I drunkenly asked one of the managers why I got the job over those people.. Turns out, one of the skills they were looking for was the ability to be able to stand up in court

#

And the couple of Masters-students were like... tryhard hyper-nerds

fringe spade
#

Are you still working with them?

olive orbit
#

No, I got made redundant after a couple of years

fringe spade
olive orbit
#

Hehe, Yeah. I'm working for my familys Pizza company 😄

fringe spade
olive orbit
#

Zactly!

visual herald
#

Reading that article is fairly interesting, but boiling everything down it's one giant sales pitch: "You're hiring wrong, license our tools/hire us to vet applicants for you!"

livid idol
#

Evening lads, whats up?

vagrant pond
#

Hi, so I am still in school but after that I want to do something with hacking so should I go for a cert or is there something to study in a university for hacking if so which of the two should I choose?

undone shore
#

I'm on a BSc (Hons) Ethical Hacking course, for example

#

Ideally you want a degree and at least OSCP if you're in Britain

vagrant pond
#

Ideally you want a degree and at least OSCP if you're in Britain
I am in Germany

#

and I am in 11th grade now

undone shore
#

I have no idea what the grade system is I'm afraid. Look around at what jobs in your area are wanting, and see if you can get appropriate qualifications for those.

vagrant pond
#

Okay thanks

#

Just as a info its like 11th and 12th grade and after that I'll finish school

polar rock
#

Yep I agree with muiri focus on certs while in school and try looking for internships

#

It will be hard to get internships being so young but that doesn’t mean you can’t

vagrant pond
#

Aight, I am going to do that thanks

shrewd sparrow
#

Hey all!! just got myself an interview for a cyber security role!!!! 😮 its a junior role and I'm super excited, any of you got tips for the interview? what sort of questions would be asked and things? this would really help me out!!

spice yacht
#

questions will depend on what type of cyber security role

pseudo creek
#

but yup, cyber security is a wide field, depends on the role you are applying for

spice yacht
shrewd sparrow
#

it is more of like a pentesting role.

#

"We specialise in security testing, using a world-class anti-malware testing framework."

#

"We work with businesses, technology vendors and magazines to provide accurate and realistic test results that are useful to consumers and vendors' internal teams."

pseudo creek
#

what type of skills does the job ask for?

polar rock
#

so an MSP

shrewd sparrow
#

doesn't give a great deal more of detail than that
skills wise is quite low as they are providing training.
"What we are looking for:

Meticulous attention to detail
Strong interest in information cybersecurity
Self-motivated and enthusiastic
Excellent organisational and interpersonal skills
Basic Penetration testing concepts welcome
Computer Science Degree and knowledge of basic programming concepts would be beneficial"
pseudo creek
#

hmm that doesn't say a lot, I think the pinned topics could help you though

spice yacht
#

given the job description, it sounds like they are non technical people looking for a technical person

pseudo creek
#

or it could be a consultancy position

#

does it have a title?

shrewd sparrow
#

yeah the title is Cyber Security Analyst,
its for a testing company against products and services

#

but yeah thanks I will have a read through these thanks @pseudo creek

pseudo creek
#

yeah but just because thats what the company does, doesn't mean that is what you do, there are a lot of supportive roles within cyber security

#

but it is good to see, one question I'd ask is what you expect to be doing within the first year

raw maple
#

need some guidance on resources for security in Datacenter for IOT devices ?

#

like training, methodologies

polar rock
#

hacking IOT or securing IOT

raw maple
#

securing IOT

#

i am building a new datacenter

#

and my focus is on securing it

polar rock
#

Hmm I dont know of a lot of resources for securing other than applying your normal security and monitoring methodologies already in place.

raw maple
#

also it needs to be monitored

polar rock
#

also why are you building a datacenter yourself

raw maple
#

so also looking for got tools like solarwinds

polar rock
#

huh?

raw maple
#

my company is building it

#

i am in charge of security

polar rock
#

It might be best to understand how to hack IOT before you try to secure it

#

I would recommend picking up this book and identify where IOT can fall and that should give you a good base to understand what you need to implement

raw maple
#

thanks, will check it out

teal field
#

I think that book is offered in the humble bundle that is out till Jan 4th. looks like a good package on there right now can get a few good books at great prices

hardy brook
#

Hi all!

I just graduated recently with my bachelors in Cyber Security along with around 9 months time in the field between an internship and other IT job and I was wondering what the best way to try and get a security job is. I've been applying for the last couple of months for anything from entry to junior level and above sometimes but have had very poor luck. I've reached out to the HR departments via LinkedIn as well as written cover letters for some of them.

What advice would you have for someone who is just starting out in this field? I have no certs or anything like that yet. Any help is very appreciated!

quick forum
#

@hardy brook Go on linkedin, look at jobs you would want to get, see what they're asking for. Most likely certs to go with the batchelors.

hardy brook
#

Do you know of any certs that I should get first @quick forum? Are there any that sort of stand as an entry point or any in particular I should start studying for?

#

Thank you for the advice btw

quick forum
#

Depends where you are.

#

And depends what jobs are asking for

#

Here in the UK, generally OSCP and a BSc ticks all the boxes

hardy brook
#

I'm over in the US trying to most likely go for some entry level security analyst or engineer position

quick forum
#

Yeah I'd just look on linkedin at those adverts

#

See what they ask for.

hardy brook
#

Yea that's fair enough

undone shore
#

@quick forum I'm hearing a lot about CRT over OSCP in the UK. Wouldn't recommend it though, given the limitations from CREST. You can use OSCP to get CRT without actually doing anything, but you're ineligible for CHECK that way, and have to resit OSCP every three years.

#

No thanks to that. I'll take the much easier CRT exam every three years instead

quasi stream
#

I've had a lot about CREST during interviews for jr pentesting roles

#

CPSA slings you right up in my experience coming out of uni and applying (for jr pentesting roles) before THM

undone shore
#

I'm just hoping my OSCP (and hopefully at least OSWE or eWPT) does the same thing. Abertay degrees tend to carry a fair bit of weight too, for some reason I can't fathom.

zealous forge
#

I've already got cyber experience and working towards OSCP - how valuable do you guys see degrees for staying in the industry? Debating doing one remotely but it is a lot of effort, and since im in the industry already not sure if its worth it

quick forum
#

It's gonna depend where you are

#

In the UK, for entry level positions, it tends to be BSc || 4 years exp

zealous forge
#

Yea fair enough. South E / London I am, SOC analyst currently but want to progress to Pen tester

static tide
#

i'd say don't bother personally since you're already in the industry

spice yacht
#

I know plenty of people who have done amazing without any of them

#

I didn't have a BSc starting out, still don't ... but working towards MSc right now

zealous forge
#

sounds good gents... What MSc are you doing @spice yacht

static tide
cobalt escarp
#

@inner pine Could you keep the content english please

inner pine
#

sorry

unborn anchor
#

Hey guys,

#

I'm a recent graduate in Master's Cybersecurity in the states, I have been applying for jobs since 2 months now and not a single call.
I'm starting to think it is my resume. Any tips on how a security resume should be drafted.
I'm looking for jobs as Security engineer/analyst, Network security and Penetration tester.

pseudo creek
unborn anchor
pseudo creek
unborn anchor
#

Sure, Thank you.

flat sedge
unborn anchor
flat sedge
#

if your home lab is set up to deploy and implement security tools, it can help substitute for experience - something is better than nothing

unborn anchor
flat sedge
#

Target it for the role you are going for

#

if you are looking to be a soc analyst, set up a couple of dummy machines, FreeIPA, and a Splunk instance

#

if you want to do networking, build a pfSense firewall or get a prosumer grade off the shelf (like ubiquity) and configure some firewall policy

#

just to show that you don't just have the theory of how it's done, but you're working on building the practical skillset

unborn anchor
flat sedge
#

What CEH brings to the table is that you've gone through a basic ethical course on the ethics of security. It shows that you at least understand some of the attitude and mentality needed to be a trusted security professional at an entry level

ancient prairie
#

Having a personal website/blog helps too, hell I had a blog with literally one post and my boss said I stood out at the time because literally no other applicant had a website

#

I am curious if someone experienced could tell me how you would work homelabbing into a resume? I have a hobbies section I seem to get decent feedback from but not enough room to describe my homelab

unborn anchor
unborn anchor
#

Even a referral has not helped me get a call and i am starting to think the ATS is filtering my resume out

flat sedge
#

ATS?

unborn anchor
# flat sedge ATS?

Applicant tracking System which filters out resume's based on keywords and etc.

flat sedge
#

Talk to a resume service and see what they say

#

one of my old co-workers found a really great job by paying the service to help rewrite the resume

unborn anchor
flat sedge
#

the other thing i'd suggest is talk to professors you are on good terms with, and college study buddies

#

ALL of my IT related jobs have come to me through that kind of networking

unborn anchor
unborn anchor
flat sedge
#

i don't remember; it's been more than a decade

#

i just know that those services exist and have been helpful to people i know

unborn anchor
#

oh , no problem

flat sedge
#

another thing to try is to talk to a recruiter for IT and cyber specifically

unborn anchor
flat sedge
#

a lot of recruiters don't get paid until they place someone, so helping you is in their best interest

unborn anchor
flat sedge
#

talk to someone at a place like TekSystems directly - the recruiters i've talked to off linkedin and cybercoders have been less than useful

unborn anchor
pseudo creek
#

and in term of projects, a github account with projects where you can point people can be useful

pseudo creek
#

Personally my 'home lab' is vms on my computer so...

ancient prairie
#

haha well its better than nothing

#

good idea though I was leaning towards that approach

#

Im slowly but surely building up my hardware, just trying to find a cheap micro tower to run pfsense on and Ill be happy

pseudo creek
#

yeah it depends what you have, honestly I saw his resume and its not bad, the certs are good, yeah CEH but whatever. I think it is really a formatting question because (no offence RootBot) but first glance, I didn't even want to read the resume. And also looking for those foothold positions, Network analyst, network security analyst, soc analyst is where I'd focus

ancient prairie
#

yeah formatting can definitely affect you way more than your actual qualifications sometimes, its frustrating but recruiters/hiring managers probably spend less than a minute or two on your resume

#

I personally use canva, I have a student account which gives me free Pro and their resume designs are quite nice

#

2-column resume gang

pseudo creek
#

i'm qasi anti-2 columns but depends, I've seen way worse 2 column resumes than single pagers

#

like if you word wrap on your small column that is a no

#

Penetratio
N testing

#

no

unborn anchor
unborn anchor
ancient prairie
#

hahaha tbh that was something annoying I had to work around with word wrapping, I feel like people are 50/50 on the two columns but personally I have received pretty good feedback on how my resume looks despite the lackluster qualifications

flat sedge
#

one trick that has helped me, is that i write my resume in latex and provide source

#

i'm working on an adoc template as well, as that seems to be the most common markdown style documentation generator right now

unborn anchor
unborn anchor
flat sedge
#

One of my biggest 'selling point' items is that I am a documentation guy

#

LaTex and asciidoc are programming languages to specify typesetting

unborn anchor
#

ohh gotcha

ancient prairie
#

switching to latex has been on my to-do list for a while, tired of fiddling with formatting

flat sedge
#

if a tool like javadoc or doxygen is being used, a team can store their documentation on a CVS and generate appropriately formatted docs as needed - abstracting content from layout

#

latex is a tough row to hoe, but IMO worth it

#

because if you can wrap your head around LaTex, MD and adoc are child's play

ancient prairie
#

if I learned latex years ago I would have saved an insane amount of time writing papers and stuff

flat sedge
#

yeah

#

i knew a student who did all her note taking in VIM and latex

#

her workflow was insane, and she's one of the most talented software engineers i've ever met

ancient prairie
#

I believe it that's probably the most efficient way to type most documents

pseudo creek
#

I should do that just to confuse all my coworkers...

flat sedge
#

happy to offer any thoughts and whatnot on getting up to speed on LaTex 🙂

pseudo creek
#

it wouldn't do me good at work though, all our docs are created on specific websites

flat sedge
#

Latex is also super useful because you NEVER have to specify any kind of layout nonsense past the initial template

#

you can render Latex as an HTML template too

#

IIRC

pseudo creek
#

nah its not html, its something else, its kind of markdown but kind of not

flat sedge
#

oh, one of those horrifying language of the week template systems

#

a lot of those make me feel ill

#

the saddest part of many of those, is that they are XML based without actually adding anything new to require a new standard

pseudo creek
#

oh and I should say for anyone, I'm pretty willing to review resumes, maybe not same day review depending. And I won't say I'm a savant at it but I've reviewed a lot of resumes through work and know what seems to help and what hurts

spice yacht
spice yacht
ancient prairie
#

Also, as someone who is working their first job in IT, is there a golden rule for how long I should stick around before looking for something? I like my job but I dont really foresee upwards mobility in terms of security roles, its possible I could pitch something eventually but I dont see the budget for it coming to fruition and I wouldn't have anyone senior to mentor me

pseudo creek
#

being a constant jumper can hurt you over the length of your career but I'd stay at any job for at least a year unless a really great opportunity comes up and you can explain why

spice yacht
#

if you're jumping laterally a lot and not moving up it would raise concerns I'd imagine.

ancient prairie
#

Fair, I think a year is a good moratorium on job hunting. Im still learning IT in general so I definitely don't even want to hop into a security role just yet but definitely don't want to slip into the career path trajectory I'm on, which would primarily be involved in something non-infosec related

#

Appreciate the solid advice as always!

pseudo creek
#

yeah but its more like you get to year 7 and you've had 7 employers? the next employer would have a great pause at hiring you

ancient prairie
#

oh yeah for sure, the 1 year thing isnt a hard and fast rule, Im definitely willing to grow into roles as well, which Im hoping I can do here

spice yacht
#

I left 2 NOC jobs back to back within 12 months... both were shift work and having started a family, they really didn't suit. First was day/night shift, second was 12 hour day shifts. I explained this at the time of leaving the 2nd one and it was np at all. Job after that was 3+ years and current job is almost 2 years

flat sedge
storm aspen
#

So I have no certs yet no (Job) experience in tech either. Been looking for something to do cyber sec related and found a place near where I live. How should I approach them?

golden ore
#

Look at the skills you have and the job you want and try to chart a path there, you may not start in the industry where you want but getting experience helps you get there

storm aspen
#

I thought maybe I could go in and try to start with sales, marketing or help desk or something and then move laterally to pen-testing once I save up for the oscp, oswe, osee, etc.. Just nervous because where I live there's very few cyber-sec firms and I don't want to make a bad impression.

#

Thanks for the advice blackdragon. Maybe I'll get lucky and win the AOC2 OSCP raffle. Then I can try to do a real applicationdarksanta

ancient prairie
#

Sales and marketing will not help you with a pentesting career, its also not a lateral move, pentesting roles requires a lot of general IT experience and tends to favor people from sysadmin/networking/programming backgrounds

#

also do not worry about location, plenty of remote jobs, and the right employer will fly you out wherever

willow island
#

Hello everyone. Sorry in advance if this is not the right place, but I'm looking for a mentor in AppSec area. My idea is to have someone experienced to share some ideas, ask for appsec-related advice, career, training. I've been working in the industry for a bit over a year now. Anyone interested? I've asked the people I know and are my references, and got turned down. I thought maybe I could be lucky here

spice yacht
remote mauve
#

however i know people that were luckier and got it as an entry level

austere drum
#

Hey guys. I am currently studying computer science and I am really intersted in security. I would like to know what skills and knowledge is needed for somoene to do his first steps at this field and what is better for a beginer like me to learn first?

pseudo creek
fast portal
#

what are good certificates to get

#

for someone looking to get into cyber security

languid hearth
#

Security+ is the standard entry level cert.

golden ore
#

a+ and net+ are good base knowledge certs

fast portal
#

got those 2

#

but security not so much

pseudo creek
#

security+, OSCP and if you are going into other areas of security SSCP

golden ore
#

CYSA+ is a good analyst certs

fast portal
#

OSCP seems hella hard

#

I'm not really a high level hacker

#

as yet

#

I'm trying be like yall lol

#

thanks for the info though

#

what is the best software

#

to learn?

#

and tools to know?

quick forum
#

For OSCP?

#

Learn as much as you possibly can

fast portal
#

in general, to get a job in cyber

quick forum
#

There's no one tool or software to learn

fast portal
#

I currently work as an IT Specialist so i'm curious if it's different

quick forum
#

You have to learn the techniques

#

The theory

fast portal
#

i see

raven wasp
#

Are online Certificates good for proof of education of a field?

wise grove
jagged mango
#

does anyone know when applying for jobs if a PhD is looked at differently to a Dr.Eng or DSc

pseudo creek
pseudo creek
pseudo creek
# jagged mango does anyone know when applying for jobs if a PhD is looked at differently to a D...

This might help some https://en.wikipedia.org/wiki/Doctor_of_Engineering#:~:text=The Doctor of Engineering degree,a business or technical environment.&text=Research toward the EngD is,the EngD emphasizes applied research

Doctor of Engineering

The Doctor of Engineering, or Engineering Doctorate, (abbreviated Eng.D., D.Eng., D.Engr., Dr.Eng., or Dr.-Ing.) is a doctoral degree awarded on the basis of advanced study and research in engineering and applied sciences. In most countries, it is a terminal research doctorate. In the United Kingdom and Germany it is a higher doctorate. An EngD ...

jagged mango
#

Im aware of the difference but im asking about perception of both when applying for jobs and not what they entail. I think most employers know the difference and are just aware that PhD is "the best" (even if thats not the case)

#

dont know the difference*

pseudo creek
#

what type of jobs are you looking for?

#

I guess like we don't see a lot of PhDs in normal industry jobs, we see them in various research positions. I've never seen anyone with a DrEng so I can't speak for that

jagged mango
#

I haven't decided whether ill be going for research positions or industry jobs yet, and i have the option of choosing either degree type. Because of the lack of visibility of doctoral degrees like DrEng I have the suspision people think there somehow lower than a Ph.D or else they would have heard of them. But I dont have anything concrete to base this on. Although, I think there are actual professor positions which spcificly require a Ph.D which shows the benefit of them for research positions, but was more curious about their public perception.

pseudo creek
#

personally, without looking at it, I would've thought they were a degree that schools churn out to grab money from professionals who went and got their MS and are willing to spend more money to be called Doctor. Like I said, I've never seen anyone with one/claim to have one so...

#

but it sounds like if you want more flexibility, go for PhD, or maybe even talk to one of the professors who is a DrEng and ask them

jagged mango
#

I haven't met a professor who isn't a Ph.D. Professional doctorates are more applied than research but don't think the quality is necessary less as long as the school is good. I already know which I'm going to choose, as I said was just wondering about general perception 🙂

pseudo creek
#

so the school you are going to offers a DrEng but doesn't have any DrEng profs?

jagged mango
#

I havent met any but there could be. Also most professors are middle-aged or over so I don't think applied doctorates would have been considered at the time if applying for research. Eitherway you wouldnt specificly need a DrEng to teach the course to get a DrEng.

pseudo creek
#

I would just expect if a school is offering that degree, they might have professors with it, I would expect all their bios to be online

jagged mango
#

There may be but its not necessary to teach the course or for the advisor to have one if your going for a DrEng. I taught by any DrEng and am able to get it

#

wasnt taught*

pseudo creek
#

I'm just offering you a suggestion, if you could talk to someone who has that degree it may help, if you don't want to seek them out then you don't have to

jagged mango
#

Oh yeah thanks for the suggestion, I might look into it

fast portal
#

will certificates compensate well for not having a CS degree?

humble bobcat
#

Is there any certificate you can get being under 18?

remote mauve
fast portal
#

I'm in the US

remote mauve
#

can't speak about US but can say than in UK both are fine, depending on the organisation and their views of it

fast portal
#

makes sense

#

I guess a lot of people are in the realm of studying something completely different in college

pseudo creek
#

lots of companies still want to see some type of degree in the US, even if its not CS

#

easiest way to get in without a degree is start help desk work

#

but certifications will go a long way

fast portal
#

cool cool

#

asking because I have a degree in Communications and Marketing

#

and currently work as an IT specialist

golden ore
#

a non-CS degree is not looked poorly upon, some companies prefer certain CS degrees for roles but will sometimes supplement certs in place, it all depends on the company

fast portal
#

gotchu

#

Hopefully, its not too much of an issue

#

I'm not trying to be a programmer anyway lol

#

I just know some python

summer furnace
#

Hey, i'm doing advent of cyber 2 this year and it reignited my passion for cybersec, so i wanted to ask for some guidance. I am aiming for the oscp as my first cert, and i think the equivalent of my studies in the us is software engineering undergrad ? My question is, what is the wisest path to master all the needed skills in the domain ? Like what topics should i cover first ?

golden ore
#

There are a lot of resources out there that detail the OSCP exam and how to approach it, the Offensive Pentesting path covers many of the principles on OSCP

summer furnace
#

Yeah i know, i read TjNull's guide, i carefully read the pwk syllabus, i even read various reddit posts that talk about someone's journey to oscp, but that just made me really overwhelmed by the diversity of topics, so i wanted a little help as to how to organise my learning process, my main goal is to become a well informed pentester, oscp is just a first step.

pseudo creek
#

basically good foundation is first step, a software engineering degree would be useful for some aspects but perhaps not all

visual herald
#

My process won't work for everyone, but what I intend to do is start out with one of the less technical, more documented(probably wrong term) pentest certs, either CEH or Pentest+ and use that as a map for all of the basics I need to cover. While studying each section or area for instance web pentesting, I'll supplement with outside reading like OWASP, and appropriate rooms on THM like juiceshop or OWASP top 10, or whatever for technical practice and hands on with the tools as I go. Additionally, while I'm going through a section, I plan on scripting out simple python versions of the tools to get some hands on experience coding/toolbuilding. Once I'm comfortable with a section, I'll move on to the next and continue until I pass the cert test. After I have the basics down and the cert, it's pretty much straight into PWK/OSCP and doing a ton of research to figure out anything I'm still missing.

summer furnace
#

@pseudo creek THANK YOU SO MUCH, this is the type of ressource i was searching for.

#

@visual herald the problem is that i can't afford to pass many certs, that's why i am aiming at oscp, because it is the most respected one in the decent price range ( and even with that, it'll take me some time to afford its cost).

flint pilot
#

@visual herald u can map out the basics with some free guides out on the internet, or one of the hacking platforms. The eJPT free course could even be ur “basics” course. Thats just how i see it

elder grove
#

And don’t buy in to the notion that you have to have OSCP to work in this field. Plenty of people with no OSCP pentesting because they networked well.

#

One of the admins on this discord is proof of that.

summer furnace
#

I'm well aware of that, i chose to have it just to consolidate my acquired knowledge and skills throughout my learning process since i'm not a cybersec major.

elder grove
#

Far cheaper ways to consolidate knowledge without spending a grand to do it. I ended up paying $1,300 for an exam attempt because I wasn’t able to benefit from their one size fits all educational model.

#

VHL would be a cheaper and better way in my opinion. But to each their own.

summer furnace
#

thank you, i'll think about this

spice yacht
#

can your current (or future) employer pay for it?

summer furnace
#

Considering where i live, no

spice yacht
#

👍

#

it's not always an option for people

#

it is always a question I ask in interviews