#cyber-and-careers

1 messages · Page 81 of 1

polar rock
#

How hard did you look because I’ve already found multiple manuals and articles on it

nocturne tide
#

wow

#

how much does it cost homie?

pseudo creek
#

Sounds like a weird homework question

stoic cave
#

If Steve buys 20 univac 9000s and Bob buys 10 univac 9000s, how many does Alice have?

light urchin
#

42

gaunt token
#

helloo i was wondering if anyone here holds the GCIH certification. if you do, i would appreciate if you'd PM me as i have some career related quetions

distant pier
#

GIAC Certified Incident Handler?

gaunt token
#

yes thats the one

distant pier
#

Which SANS FOR course relates to that one, I can't remember? 508?

gaunt token
#

it is offered by SANS but im not sure of the course name, i am only familiar with the certification name

#

i'm just wondering how respected they are in the field

#

and whether they have the potential for an entry level incident response role

distant pier
#

I don't have that certification, but I imagine any GIAC certification is well respected.

gaunt token
#

i see, thank you!

polar rock
gaunt token
quick iron
#

Has anyone taken the PenTest+ after utilizing the PenTest+ path on TryHackMe? I was wondering how well it prepared you and any other resources you might recommend...

distant pier
quick iron
distant pier
#

Probably most of the study guide style of information you would find in books, like: CompTIA PenTest+ Study Guide Exam PT0-001 by Mike Chapple and David Seidl. Supplement that with THM's hands-on Learning Path, you might be golden. 🙂

pseudo creek
gaunt token
pseudo creek
gaunt token
polar rock
#

there is a reason SANs is 7000

pastel pollen
#

Network Chuck

austere badge
#

This will help me learn hard way

mystic river
#

Hi. I'm a student in first year, so I was wondering when I should start worrying about getting certifications.

I'm still learning and I know that I'm still at the beginning, but I wanted to know for future.
Also, it's possible to get a decent job without any certs?

A few hundred/thousands dollars are a bit spicy for a student raported to my country's economy lol

#

And what certification should I get first? I like the offensive path more if it matters.

undone shore
#

@mystic river most folks wait until they have an employer paying for certs for them; however, they do definitely give you some talking points for interviews.
It is possible to get a decent job without certs, but it generally relies on having good contacts in the industry. In fairness, that applies even if you do have certs. I would suggest networking as much as you can. Hang around communities like this one -- make friends. You never know when someone might have an offer for you. Equally, conferences are obviously a lot harder with Covid, but if you get a chance to go to some, take it! Virtual isn't quite as good for networking but better than nothing.
The goal for entry-level offensive certs is usually OSCP. If you're in Britain then CRT (much cheaper) is a good bet instead. If you're in India, CEH (expensive bs though it is) will help you more.
For a first cert, a lot of people go for eJPT. It's a really nice introduction to offensive stuff, and the training materials are free. The cert itself is $200, but I would argue well worth it because it proves to potential employers that you're committed. Once you have a job, your employer will often give you funding for other certs.

mystic river
#

Oh. I didn't knew that employers actually give people fundings for other certs. That's great. Thanks for the info, helped me a lot.

undone shore
#

Np 🙂

covert cobalt
#

Hi guys,
There is a bitcoin company(startup) in my area hiring cyber security analyst.
I'm wondering whether I should apply to that job, because the word "startup" kinda remind me of "long working hours"? I looked up glassdoor for that company and there is only one review, the guy was a client service representative and he mentioned that there is no lunch hours if busy. Is this a bad sign? (But this is a cybersecurity role instead of client service representative roles, so hopefully things may be different?)
Is it usually longer hours than big corporations? Please advise, thanks

ancient prairie
#

eh missing lunches is a fairly regular occurrence for me so thats not really a huge deal but startups are kinda iffy to work for

#

on one hand they'll hire people with little experience just to get the ball rolling, and your pay will usually be commensurate with that fact

#

and also job security is a concern, you could be out on your ass in a couple months if the place fails

#

on the other hand it could be an amazing opportunity - my advice is if you are in a position to take on the risk the experience would be worth it

covert cobalt
#

My major concern is the working hours as it's pretty far away from where I live. Also, may also need the experience proof/sponsorship for my future security cert requirement

pseudo creek
#

Lunch hours exist? You kind of fit in food when you can

light urchin
#

@covert cobalt by any chance, does the company start with P and end with x ?

warm hinge
#

Question: If im rank 4000 on THM what percent am i in?
I was thinking of putting it in my linked in bio to show experience

undone shore
#

Top 1%

#

But bear in mind that rank doesn't mean a whole lot

warm hinge
#

yeah i know but its for the gatekeepers

#

I have never worked in cyber and anything helps to showcase experience

undone shore
#

Yesss, that it does

warm hinge
#

Damn gatekeepers need things easy to understand

distant pier
#

Probably useful to add the duration of having been on THM listed as Continuing Education for Ethical Hacking and Cyber Security, covering both Defensive- and Offensive Cyber Security hands-on skills and methodologies. 🙂

warm hinge
#

I have only worked hospitality and sales and i don't really want to put that in the job section im not sure if its relevant.

stoic cave
#

I put my jobs relevant or not on my resume

#

Shows work history

pseudo creek
#

yeah you need to put your jobs there

warm hinge
#

hmmm i see, so i guess i will put my sales and hospitality jobs.
I just dont seem to have relevant jobs to put.
I guess the soft skills and management experience is a good thing.

pseudo creek
#

honestly, showing the fact that you worked for someone/on a team is very valuable

stoic cave
#

By putting those jobs there it also allows you to show other skills that you may have developed or problems you may have solved

pseudo creek
#

you don't have to emphasize those jobs, but they should be listed, a few bullet points each is sufficient

warm hinge
#

Yes very true, i tend to suffer from impostor syndrome because i have never had an IT job but i know i have marketable skills

#

I just want to put my best foot forward

stoic cave
#

Everyone goes through that. Don't let it eat you and you'll be fine

#

Everybody had to start somewhere whether they like to admit it or not

warm hinge
#

Yes your right, i guess its a very common thing among people unfortunately.
Im going to get to it and put some of my good jobs i have done down.

stoic cave
#

Put them chronologically as well

warm hinge
#

Thanks for the advice people i really appreciate it.

pseudo creek
#

good luck 🙂

warm hinge
#

I want to get out of my current job so bad and its all i think about

#

I want to do something i love and not dread going to work

#

I need to be challenged every day or i get bored and depressed

#

How would u guys show tryhackme as continued education/learning on LinkedIn? Carrying on what cyber was asking prior?

stoic cave
#

Personally I have a projects section on my resume

#

In it currently are my senior practicum and my homelab but I also change it because each application I put out had a custom resume

#

For my job I have now it was my Homelab and Digital Forensics/Cyber Defense Practicum. Then I also had Network Security Practicum which was offensive

warm hinge
#

My god this is very strategic

stoic cave
#

Applying for jobs is in itself a full time job

warm hinge
#

Got ya. So lets say writeups someone post on the git or there own website. U would throw that under projects correct?

#

Like u post it but would I just leave it like that or would I create a section to emphasize my writeups?

warm hinge
light urchin
#

projects, or perhaps a "community engagement" or "continuing education"

stoic cave
#

So for me coming out of school it was Education, Certifications, skills, work experience, extracurricular activities, and projects

light urchin
#

you'll probably find that on linkedin, you will get a lot of recruiters contacting you each day, just from keyword searches on your profile

warm hinge
#

Im guessing that comes from the skills section correct? @light urchin

light urchin
#

probably everyone has a different format that they prefer

warm hinge
#

Ah okay, im just trying to learn the best way to professionally format my LinkedIn

light urchin
#

for me personally, I have a couple paragraph blurb at the top of my LI page. On my pdf resume, I have a qualifications section, which is just bullet points I want to emphasize at the top, and then a publications section, at the bottom, with work experience and education in the middle

#

honestly, I don't think many people read LI pages. Not for the initial contact

#

recruiters do a keyword search, and spam you with a form letter

stoic cave
#

Education was where I went with GPA and then a rotating list of courses that I would change depending on the job. Skills was certifications, software I've used, technical skills, and then programming languages I can write in or read. Experience was past jobs. Extracurricular activity is to specific a section for here but it included a club where I was a junior administrator for the university. And then projects as I mentioned were CDP and Homelab

warm hinge
#

This is some good stuff, thanks moose and empty

stoic cave
#

The entire skills section would change as well per job application

light urchin
#

it also depends on what stage of your career you are at. As a recent college grad, focus on skills/classes/side projects/community engagement, since you have no work experience to speak of

stoic cave
#

Yes

warm hinge
#

Yea thats me currently

light urchin
#

later on, you can focus more on what each job's duties and accomplishments are

warm hinge
#

Great advice same here

light urchin
#

and if you are still in school- try to get an internship, or a few

stoic cave
#

I'm 6 months in to my job now but I still don't think I would move away from my Uni stuff yet

light urchin
#

looks great on a resume, but also will help you figure out what you like and don't like

light urchin
#

unless we're talking graduate degrees

stoic cave
#

True. Or if you're trying to switch into the field your degree is in

light urchin
#

right

stoic cave
#

I'm kinda straddling right now

#

I also skipped junior somehow

light urchin
#

I've interviewed and hired a LOT of people over the years. I can say that the things I look for are enthusiasm/personality, and passion. I'd gladly take a college kid with few skills who spends his/her free time learning/tinkering for fun than someone with more experience but no enthusiasm, or a pain to work with

stoic cave
#

Lol

#

The last thing is a sticking point

light urchin
#

yep

stoic cave
#

I'm so glad I was forced to take public speaking courses as part of my degree

light urchin
#

someone hiring a fresh college grad/intern/etc. isn't expecting you to know everything. Just that you know the basics, and know how to learn. And showing that you're enthusiastic about it with side projects/THM/github repos/blog posts/youtube howto vids, that says something

warm hinge
stoic cave
#

People also thought I was weird for buying a Dell R710 to tinker with

light urchin
#

those were the wrong people 🙂

#

I have a few laptops, a separate network, raspberry pis, etc

stoic cave
light urchin
#

lol

stoic cave
#

Yeah ive got almost exclusively dell gear, R710, Inspiron 660s, Inspiron 620MT, and a pi for a camera time-lapse project. I'm prepping for a storage server right now

#

Honestly need to think about getting a rack because it's getting messy lol

light urchin
#

I used to have a server rack. Got rid of it to save space

stoic cave
#

Yeah ive been eyeing a 42u lol

#

I think its welded though so that's a no bueno

#

With that size rack though I would put literally every piece of electronic equipment I own in that

light urchin
stoic cave
#

Yeah we have some extra big bois where I work

#

I think one is 48u? Maybe bigger?

light urchin
#

ah, yeah, if you are getting them cheap as discards, then get what you can

stoic cave
#

Like im pretty tall and I stood next to it and I had to look up

light urchin
#

yeah, and also think of how hard it's gonna be to lift a heavy server that high

stoic cave
#

Oh yeah we can't take any of the extra gear

light urchin
#

I had 3 UPS that were 2u each, I think, and like 100+lbs. Just getting them into the bottom was tough

stoic cave
#

I don't think OPM would like $10000 racks disappearing

#

Or whoever handles overall procurement

light urchin
#

military?

stoic cave
#

No but gov

light urchin
#

sometimes you can find really good deals on discarded stuff from military and gov

#

universities too

trim vine
#

yah you right man

stoic cave
#

Yeah I'm in between like 5 mil bases so much stuff

light urchin
stoic cave
#

DC is an absolute goldmine

light urchin
#

yeah, call up the DRMO office and make some friends

lean dragon
#

govdeals is another one to look at

stoic cave
#

Yeah there was another that I'm thinking of but I think it was vehicles only

#

I was scrolling one day and there was a 270' PSV for sale lol

#

It was mad cheap too

#

Big RIP to all the sysads dealing with exchange right now

slim galleon
#

hey can ya'll give me advice on whether i should take up an internship that has nothing to do with my bachelors nor my field of specialization, which is security, is internship experience that important?

#

i need to log about 500 hours for an internship to graduate for my bachelors and quite frankly i've been struggling to even find remote IT/security internships online and those that i have applied in and interviewed with doesn't reply to my emails

rugged sable
#

sure go ahead any experience is better than no experience

#

in my job interview they made me redesign TryHackMe architecture even though my job at TryHackMe was not technical at all

#

they knew I was though

slim galleon
#

the job is an accounting associate and its unpaid too pepehands

#

i got interviewed for this infosec intern position at a financial company, they said i'd get a technical interview and praised me for my certs but my friend who also applied as infosec intern who didnt know a thing abt info sec got the offer, but he worked in mcdonalds for 2 years so i guess thats that

pseudo creek
#

yeah some experience is better than none

slim galleon
#

or i could turn it down and spend another 2-3weeks or so applying and waiting for available IT internships? i've sent a few emails but the process and response is very slow, in fact i earned a technical interview with trendmicro but havent got a reply yet

flat sedge
#

I would never take an unpaid internship - what you are doing is still valuable to the company - essentially it is on the job training. if you are a good intern and positions are open, there is a very easy path into full time employment; if nothing else, a good internship builds your network for post-graduation applications

#

infosec internships, really, any internship, shouldn't make any assumptions for qualifications or background. my advice, always, is that if you are applying for an internship that is going to put you on a path for any kind of engineering or development role, do not accept unpaid. if the company isn't paying you, they don't see you as a potential asset

warped moon
#

Hey, so it seems like a lot of people say that for someone entering infosec it's a good idea to find what specific area of they're interested in. I'm kinda looking at incident response and threat hunting. I was wondering if anyone who had any experience in this could weigh in on how the day-to-day is.

static tide
pseudo creek
static tide
pseudo creek
#

and I've done some limited IR many years ago but I worked side by side with people who did both threat hunting/IR

warped moon
warped moon
pseudo creek
#

I think on some level IR is similar to pentesting in you are trying to put things together... but you are also trying to put a story together... what happened? Can you trace what happened? what was the point of entry, how long were they there, what did they do while on the system/network

#

of course if your life is good... IR is a small portion of the job 🙂 or you work for a MSSP, which provides services to multiple companies

#

and I'll say my view is skewed as I only provided support once an incident was confirmed, so I didn't have as much purview of the various possible incidents that were investigated and turned out to be nothing

warped moon
#

I see! I've been kind of under the impression that IR can be stressful, but it also seems pretty exciting. I do like that "investigative" aspect of it.

warped moon
pseudo creek
#

I think its a mix of handling investigations to determine if there is an incident and doing stuff to increase ways to get indicators/information about incidents

#

and a full blown incident can be stressful as its a bad day for your company

warped moon
#

Oh okay, that makes sense. I was a little apprehensive of pursuing IR if it's dealing with full blown incidents all the time.

pseudo creek
#

hopefully not unless the company's security sucks

warped moon
#

lol fair!

#

Thanks for the insight!

static tide
#

@warped moon sorry i got caught up. depending on what size you company you work at, as an ir analyst you won't always have a potential breach that you'll be able to work on

#

so you might also get to do things like writing rules

warped moon
#

IR does sound like something I'd like. I'm not sure how many incidents I'd be able to handle, but since it'll vary anyway I don't think I'll mind at least trying it out.

stoic cave
#

I would like to add, having applied to to many IR and DFIR positions relatively recently, companies are looking for people with experience or some sort of previous IT experience

#

It was one of those "entry level position" that requires 5 years of previous experience deals a lot of the time

rugged delta
# stoic cave It was one of those "entry level position" that requires 5 years of previous exp...

A lot of orgs want to see a broad level of experience though they're not always concise with their needs. Even if you don't have 5 years, maybe list specific technologies you're familiar with and to what extent, or any qualifications you might have or courses/modules you've completed.
Look at the job spec and use exact words from it next to the names of particular related tools you know how to use in your resume/cv. You need to tailor your cv for the particular job so it should be an easily changeable template

stoic cave
#

Yes, I know. I wrote individual resumes for the 100ish jobs I applied to. I was specifically told by a majority of the positions hiring managers that they were looking for more experience

#

I'm employed now though so everything is good

rugged delta
# stoic cave I'm employed now though so everything is good

Yeah I guess it's really difficult to show work experience if you haven't done that kind of work previously and some employers can be really pedantic on actual dates and that kind of thing and they'll use any excuse. Glad you found a job and I hope it propels you forward

stoic cave
rugged sable
#

:))

stoic cave
#

Oh oof my bad

mystic river
#

One of my teachers told me about one open spot as a Information Security Monitoring Analyst. It's not offensive (i like it more) but as a first job it seems okay. I'm only 19, so I think it's a good way to get some experience.

So she's gonna talk with Team Leader and ask if they agree for me to work 6 hours a day instead of 8 'cause I have college as well, and if they do, i think i'll apply for the job.
So my question is : Any good/fast ways to learn about IR and writing reports at a beginner/intermediate level?

static tide
mystic river
warm hinge
#

Hello
I am passionate about pentest and cybersecurity in general
I would like to work for someone to have experience in the field but I am a minor I am only 15 years old (but ambitious x))
there are similarities?

and another question I am in high school and I do not really know where I should go if I have to do a general technological baccalaureate then a school DUT ...
ps: I live in France

polar rock
#

imo you’re not going to get anything at 15

static tide
#

set some goals, maybe certifications, that you want to achieve, or maybe do some but bounties to prove your knowledge in the real world

warm hinge
#

Okok thank u

warm hinge
#

Hey! I have 0 experience in cybersecurity or coding field. I am a High School Student highly interested in cybersecurity and have read books about some basics like what a trojan is...what's phishing. But I have never had practical experience. How do you reckon I start? Any resources to start learning?

golden ore
quick forum
warm hinge
#

Ok thanks a lot

stoic cave
#

Getting pursued by hiring managers is :lightsaberpepe-1:

#

I'm leaving that lol

ivory flower
#

CTFs and bug bounties should be fine for now

warm hinge
tropic girder
warm hinge
tropic girder
#

You don't need degree or cert
Its juste an "optimal" path

warm hinge
#

any alternative to the painful, expensive and long university path? 😄

#

Hello!

#

Am an CS student n need some cybersecurity project ideas can anyone help🙃

tropic girder
lilac escarp
warm hinge
#

Thnx

warm hinge
forest knoll
#

Thoughts on OSWE? Seems decent and quite in depth

lofty ibex
#

@split plank Completed OSWE recently so would likely be a great person to touch base with on it. Seems like a lot of code review and white box techniques

novel spindle
#

Hey guys...is this the right channel to ask about ap attacks?

split plank
# forest knoll Thoughts on OSWE? Seems decent and quite in depth

OSWE was a lot of fun and learned a ton! But I'd very much recommend getting some experience with the mentioned web technologies. Being able to quickly read and understand various programming languages (C# .NET, PHP, Python, Java, Node) will make the course so much easier.

#

Only thing I didn't like about it was the focus on white box, it would've been so much better if it was a better balance of white and black box testing

forest knoll
split plank
#

Np! GLHF

warm hinge
#

Can I get a job with OSCP certification if I don't have cybersecurity degree?

undone shore
#

Potentially. I've seen job listings like that. Heck, look at #jobs-board.
That said, certs just give you a talking point -- they don't guarantee anything

#

Certainly in Britain it seems to be CRT/OSCP + a degree being the magic combination

#

And of those two, definitely do OSCP from a learning perspective. CRT is arguable more useful from a hiring standpoint, but (like CEH) it's apparently useless for anything other than checking a HR box

lofty ibex
warm hinge
mystic river
lofty ibex
#

I'd air on the side of caution with that tbh

mystic river
#

I mean, 4400$ to 69$? Just why?

lofty ibex
#

Assumption is it's just an udemy course, won't include any of the certs with it

mystic river
#

That's what I was thinking as well.

lofty ibex
#

Just the prep material, if you feel you'd need them it isn't a bad idea to reinforce what you likely already know

mystic river
#

I'm gonna stick with THM and some other courses that I have right now, I just wanted to see if they're legit or not.
Thanks for the info.

pseudo creek
#

people say that doctor messer is the person and its free

foggy dragon
#

We’re is a good place to start to get in to cyberSecurity

quick forum
warm hinge
#

Quick question

#

Can you go straight for the Pentest+ instead of the Security+ if you're mainly just looking to get into pentesting?

unreal arrow
#

If you want to yes you can, PT+ is not exactly recognised tho, unless you're in America and want to go for a DoD position

warm hinge
#

Ah okay, yeah I'm in the US currently

#

is there anymore certs I should be working towards as well?

unreal arrow
#

You're most likely better off going with sec+ because that has a lot of recognition and can open a lot of doors

warm hinge
#

Gotcha, alright I'll stop procrastinating it lol

#

thanks

rugged delta
# warm hinge Can you go straight for the Pentest+ instead of the Security+ if you're mainly j...

You can go for the pentest+ straight off but you really should have a good understanding of all the concepts in the sec+ or similar certs, even if you don't take that exam. Depends what job you're going for. Some certs, like @unreal arrow suggested are good for parcticular kinds of recruiters. Your curiosity and capability are the things they'll want on the job. You should just consider Pentest+ an intro to that career path, there's so much more you can learn, Would help to know some Linux, Windows, networking and scripting too 🙂 Have fun

stoic cave
#

I've said this before but do not try and pigeon hole yourself before you even start your career. Idk about where you are but around here pentesting/Red teaming is not an entry level position and those teams are looking for people with experience in other areas to make a more effective team

#

That being said if you do get in on the entry level make the absolute most of it and learn all you can. Good luck!

pallid cobalt
#

I need a hacker who can delete a server

polar rock
#

@quick forum

quick forum
#

-ban @pallid cobalt Joined to ask for a hacker who can "delete a server"

serene umbraBOT
#

🔨 Banned dexter#9661 indefinitely

distant pier
#

Instead he got a server that can delete a hacker.

hot fog
#

I wonder how long it'll take to go from no certs to CISSP lol

distant pier
pseudo creek
#

and the CISSP is just the basics... there is the associate CiSSP which means you don't have the work experience but anyone can take the test

hot fog
#

Oh that's cool

#

Im not sure which cert to start studying for after THM

#

Comp tia A+ or security+

pseudo creek
#

sec+ is a good starter cert

hot fog
#

Oh great, I'll start studying for it after THM :)

pseudo creek
#

what do you mean "after" THM? are you at a point where you want to start looking for work or already actively looking for work?

hot fog
#

Nope, I'm not looking for work

#

I'm in uni currently and I just want to have some certs before graduating

#

Rn I studying computer engineering and then I'm planning to do a masters on cybersec

#

But I want a lot of experience beforehand

pseudo creek
#

why are you going to do a masters in cybersec?

#

a sec+ would also be helpful to get you internships and what not, worst mistake people who want to work in industry make is not having a job while in college

#

if you want to go onto PhD and academia track... that is a whole other thing but then you would want to make sure you are doing research now

hot fog
#

thats why

#

if it wasnt i dont think id need it but yeah, its imp around here

pseudo creek
#

is that Europe?

hot fog
#

nope

#

far away from it a bit haha

pseudo creek
#

hmm ok never heard anyone say that before other than a few European countries

hot fog
#

in the states i heard its not rlly imp

#

but yeah, i want to get certs before going to masters

#

it would be helpful if anyone here can hit me up and give me some advice :)

static tide
#

sec+ is well regarded in lots of places as an entry level security cert

#

i recommend studying sec+ by whatever medium you find most hopeful (books, videos etc.) and use thm alongside your studies to help reinforce your knowledge in a practical manner

hot fog
#

Brilliant. I heard the sec+ expires in 3 years

#

Is that true?

static tide
#

i think so yeah, lots of certs have a 3 year span

#

you can still say you've achieved it on your cv or whatnot, it just won't be active

#

and if you do any other comptia certs, it automatically renews your sec+ (i'm pretty sure?)

pseudo creek
#

If you are in India, CEH seems to hold some weight

hot fog
#

Nope far from India too lool

#

Thank you guys for the advice btw

pseudo creek
#

well I'd look at job listings in your area to see what certs do hold weight

idle mist
#

How good is eJPT? I have no certs until now and I am planning to take up eJPT, Do you have any other recommendations?

flat sedge
stoic cave
#

Sec+ expires in 3 years without continuing education I believe

#

You can submit any credits you have accumulated and then it will reup

fringe spade
idle mist
#

I am almost done and completed about 80% of the course, and it's not that exciting for me as well but does the cert really help for the HR process? or would you recommend me to takeup something else?

quick forum
#

For eJPT?

#

It's very beginner level

#

Check what jobs are actually asking for, go for those certs.

idle mist
#

Okay will do some research, @quick forum do you have any recommendations?

quick forum
#

It 100% varies depending what country you're in

idle mist
#

I am from India but I am planning to takeup masters in cybersecurity in USA, so I am getting ready to keep my profile to appear for internships as soon as I got to masters, so now do you have any recommendations for certs which companies there prefer for the initial HR entry?

flat sedge
#

If you are going to do postgrad in the US, you need to make sure your visa allows you to work outside of academia. otherwise, your student visa could be revoked if you get a job while taking courses

idle mist
#

I am on an F1 VISA and my course is a STEM so I can take advantage of job opportunities with OPT.

flat sedge
#

Check your visa - F1 only allows you to work on campus.

idle mist
flat sedge
#

OPT only applies once you have graduated

idle mist
#

Yep thats true.

#

that's what I meant doing.

#

@flat sedge where are you from?

red palm
pseudo creek
#

I just go by what people have said

red palm
#

nvm bro

pseudo creek
#

Not a bro, I’m not in India, if you say employers are asking for OSCP and not CEH, I believe you

warm hinge
#

Hi

red palm
umbral field
#

Hi Guys, just a question about the OSCP, how do you find the pwk course? Is it comprehensive enough for the exam or is it best to do alot of med-hard difficulty boxes on THM and then follow this with the PWK course?

undone shore
#

@umbral field I would suggest doing PWK and all of the labs, then following it up with THM and VHL

#

The PWK gives you technical skills to the level you need. It does not give you methodology, so in that sense, no, I wouldn't recommend going in with only PWK. The extra experience of seeing a wider range of vulnerable machines is also really helpful.

umbral field
#

awesome many thanks for the help 🙂

undone shore
#

Np 👍

loud relic
#

hello guys

#

im doing computer science engineering, my goal is to work in the field of cyber security

#

as i just started i dont have more ideas on this

#

can anyone give a rough road map on this

sturdy harness
loud relic
sturdy harness
#

My pleasure

lusty snow
#

Any one from Australia? Doing masters in cyber security?

silver sierra
#

Anybody else get sick of getting rejected from Jobs and just go "f*ck it Ill do it a masters"

#

Because im vibing for that rn

pseudo creek
#

there are a couple things you can do, look at the various jobs you are applying for (do they ask for experience ranges well outside your experience?) and also have someone look at a sanitized version of your resume. Depending where you are, a MS can make it worse (in the US at least). Also the economy is in sort of a buble and some companies are hiring but others are holding off

silver sierra
#

Im in Scotland

#

Like, I like the idea of staying in Uni and getting a proper qualification and the unis I'm looking at have good links to employers

undone shore
#

Which uni did you do your undergrad in?

silver sierra
#

Strathclyde

#

Im still doing it

#

You Scottish as well?

undone shore
#

Ah, so it'll be a more generalised computing degree then?

#

Aye. Abertay for me though.

silver sierra
#

Yea, strathy does do a MSc in Security, but you can only do it if you are employed by a specific list of companies

#

Kind dumb but it is what it is

undone shore
#

Irksome.

silver sierra
#

Abertay is one of the ones im looking at, along with Cally and Edinburgh

undone shore
#

I remember being disappointed at their open day that it was only the one module on cyber. Way too offensively minded 😆

#

Yeah, can't speak for the Abertay MSc but the BSc is great, and the MSc is world renowned

silver sierra
#

Yea my dissertation supervisor was trying to get me on the MSc but he couldnt 😆

undone shore
#

They both are, tbf

silver sierra
#

Aye, I know somebody who went to Abertay to do the cyber course and she said it was good

undone shore
#

First of its kind, and apparently still the best. I can't really confirm that though, not having experienced the others 🤷‍♂️

silver sierra
#

Aye fair enough

#

I had a look at the Edinburgh one and its got good accreditation but the tuition is expensive lol

undone shore
#

That's Edinburgh for ya 😆
Do SAAS not cover masters?

#

Oh, of course not. 4 years of study isn't it

silver sierra
#

5 years of study, but it needs to be undergrad iirc

undone shore
#

Worth a shot

silver sierra
#

But if you do a teaching postgrad thats covered

#

Aye SAAS is weird cause they'll cover 5 years of UG but not 4 years of UG and one year of PG

undone shore
#

That's so strange

#

Guess it's to give people time to drop out and move courses

silver sierra
#

You can get a loan I think, but its not paid by the government like undergrad

undone shore
#

Shame. But yeah, a teaching pg should do it. It's a shame about the jobs though. The one thing I will say for Abertay is that the networking is awesome.

silver sierra
#

Yea I'm definitely considering it

dark anvil
#

check out the open uni

#

they got a new cyber security degre

#

not red brick though but still a high standard in the industry

lusty snow
olive forge
#

WHAT about teeside university Msc Cyber security?

rugged sable
dark anvil
full elbow
#

Does the certificates have any meaning outside US? For example in Europe?

quick forum
#

Yes

full elbow
#

Thanks.

dusky oracle
#

Im 21 years old and I am graduating with a Bachelor of IT degree. I am from Toronto, Canada. Anybody from there can provide me guidance on which certs people are looking for in that area.

quick forum
#

Have a look on linkedin at jobs you want to apply for. See what they're asking for.

ebon mica
full elbow
#

@ebon mica Kiitti.

ebon mica
warm hinge
#

Hello again, i kinda realised that i want to be a privacy consultant\technologist and do nnot know where to even start with that, any tips? (thanks whoever adviced extreme privacy book, i just can not buy physical books right now)

golden ore
#

Thycotic has a bunch of e-books and webinars on it

warm hinge
distant pier
warm hinge
sly pilot
#

How’s the marker in this field and is it difficult?

#

How’s the career market for this field and is it hard/difficult?

pseudo creek
#

'the marker'? and what field?

#

career markets depends a lot on location

young scarab
#

Hello everyone, this is somewhat offtopic question but can you all help me which university is good for cybersecurity for masters degree?(any country, preferably US, UK, Canada, Singapore) I'm hella confused about university
I eventually want to get a job in pentesting

undone shore
livid ember
#

Is ejpt a decent cert in Uk ?

young scarab
#

I want an on campus university

young scarab
undone shore
#

Most masters degrees are one year

#

If you're after the undergrad BSc then that's four years

young scarab
#

My degree is Btech Computer science and engineering

lilac plume
# young scarab Hello everyone, this is somewhat offtopic question but can you all help me which...

I'm doing my master degree in cybersecurity at University of Twente (Netherlands). I'm not writing this to either recommend this university nor deny it. It is definitely a program where you will NOT learn about "hacking" or pentesting. It has a lot of practical courses but it is mostly around Research (I hope I am not wrong). You will learn a looooot about cryptography and how things work under the hood. Why would you choose some algorithms over others, how can you store data securely, how to write secure code (I also learned Rust, pretty cool). There is a lot of programming and a lot of information but you will not do anything regarding the above mentioned, pentest or "hacking". DM me if you want to know more about courses from the program I am in or anything that you might be interested. Also, a big plus is that everyone here speaks English 😄 I'm not from NL and this was a huge plus for me. Cheers.

pseudo creek
#

a lot of MS degrees in Cyber in the US are really about Cyber management, there are a few technical courses but I had to try hard within my program to get the more technical courses

warm hinge
#

Doesn't really affect your interview..

static tide
#

i disagree

warm hinge
#

I mean, you can get it doesn't get a recruiter's attention.

static tide
#

it does for entry level positions 🤷

warm hinge
#

I wanted to go for it but I rather save money for OSCP, still an entry-level cert but it is better than eJPT.

static tide
#

oscp is better yeah, but it's also 4x the price

warm hinge
#

and probably 4x harder:))

#

eJPT has some easy tasks and you also have 72hrs to get it.

ancient prairie
#

eJPT helped me out with my job - it also always led to an interesting conversation as well

#

also the whole 24 hours test thing doesn't cater to people with learning disabilities and isn't terribly realistic/healthy

warm hinge
#

isn't it a 72hours exam ?

ancient prairie
#

as far as bang for your buck goes, its really hard to beat the eJPT imo

warm hinge
#

bruh

ancient prairie
#

im talking about OSCP

warm hinge
#

oh yeah

#

oscp is meh

#

not really easy but not the hardest exam

ancient prairie
#

have you taken it?

warm hinge
#

OSCP ?

ancient prairie
#

either

warm hinge
#

I didn't take it, because I am not 21+ to have a job as a pentester in US and if I take it now I would just waste my money in my opinion.

#

Because in the future, probably it will be more updated

pseudo creek
#

you didn't take OSCP but talking about its difficulty and its value to HR?

warm hinge
#

yes

languid hearth
#

do you see the problem here?

static tide
forest knoll
ancient prairie
#

pentesting is also not an entry level role for most places, you could have all the certs in the world but without any real-life experience a lot of places will discount you from security roles if you have no real-world experience
(coming from my chats with recruiters)

languid hearth
#

seeing I had the job for little under a year and a half and my teens are about to end

forest knoll
#

Aye but we're not all as 1337 as u

languid hearth
#

step 1. simply be the only one who's willing enough to go hand the ceo of a pentesting company a resume
step 2. he be impressed and send you an email inviting you into the office

livid ember
#

thx for the answers, i think im gonna take it as its not that expensive

forest knoll
#

All certs are an investment, if u get good u can pay them all with bug bounties 😉

livid ember
#

Well I`m not sure if bug bounty is for me , is not that easy looking for errors and vulns after already got a pen test 😄

young scarab
#

@lilac plume thank you for your detailed msg

languid hearth
#

a small initial $1,000 investment can turn into millions over a lifetime

sly pilot
warm hinge
#

what am i doing here

languid hearth
#

not investing in stocks and or not investing in yourself kekw

warm hinge
hasty geode
#

Stocks are eeeh

#

Not great if you only buy and never sell and are just worthless papers TBH

#

It's IMHO just gambling

stoic cave
#

Stocks are long term investments. Short term buying and selling of stocks is not advisable and shown not to work by Warren Buffet himself

hasty geode
#

TBH there's always a big risk of loss

#

That's why I compared it to gambling

stoic cave
#

On the short term. Long term you will always come out on top

hasty geode
#

| ||
| I | _

stoic cave
#

Long term is 25+ years

hasty geode
#

Something like that

#

Companies can go bankrupt long-term

#

Look at eg the bubbles

#

Dotcom and others

languid hearth
#

its also kind of important to clarify the difference between stocks and investments

stoic cave
#

Those were risky investments though. You have to look at the market and do your research. AT&T, Coca-Cola, and Index Funds are good choices

languid hearth
#

renting is probably one of the best investments you can make

stoic cave
#

Yeah real estate investing has a good ROI

languid hearth
#

as long as you've got a stable job with ample income and can afford two mortgages it something happens

stoic cave
#

Or you can use your first time buyer house loan to purchase a duplex

languid hearth
#

👀 👀 👀

#

someones done their research

stoic cave
#

Then you have the renter cover a majority of the costs

languid hearth
#

tl:dr work smart, not hard

#

but yeah, AT&T solid choice, .50c dividends quarterly is nice

#

i just need to drop all my nonsense yolo buys stock and put it back in AT&T

#

$30/purchase for $2 gain a year is great no matter how you look at it

stoic cave
#

3M is another good one

#

Right now I've got 3M, Tesla, AMC, Nokia, SolarWinds, VTI, SPGM, AGG, and Coca-Cola

#

Then I have a bunch on my watch list

#

Lockheed, CAT, some real estate funds, and some bank fund

hasty geode
#

Tesla is not really that great in the long run AFAIK

stoic cave
#

AMC and Nokia i bought for the meme and not anything more than that

hasty geode
#

It seems that it's linked to bitcoin apparently

#

And eeeehh

#

And in the long term it will crash

stoic cave
#

Tesla I have $6 invested into it

hasty geode
#

Tesla will not gain as much foothold as other tech companies did

#

Yes, I deem them a tech company

#

Not really car but also car

stoic cave
#

I agree that Tesla is a tech company

hasty geode
#

I don't really believe that they will keep foothold, they will potentially make way for other companies

stoic cave
#

My crypto even though it's only 5% of my overall portfolio has had a monster ROI

hasty geode
#

But they won't stay around

stoic cave
#

Doge to the moon 🚀 🚀

languid hearth
#

people think tesla and elon

#

as long as elon is associated with tesla, the stock prices will continue to rise

stoic cave
#

I agree with that too

#

Anything connected with elon will do well at least until he retires or passes on

#

Then it will fall to the merit of the company

languid hearth
#

is the company work $700+ a share? hell naw, GM is worth what, $50?

#

granted theres other things that account into the share price

#

ie supply and demand

stoic cave
#

I mean was Apple worth $400?

#

Debatable

languid hearth
#

I'll give them a maybe because they are one of the top companies on fortune 500

stoic cave
#

Also true

#

Ford is one of the largest auto manufacturers and they only have a $6 share

languid hearth
#

shorting is also another thing to take into account

stoic cave
#

Yep

languid hearth
#

tl:dr the economy is one giant game

stoic cave
#

The people who screw others over and get protection from TD Ameritrade

#

And politicians

red palm
#

im just curious and wanted to get a reality check, how hard is it to find a job for cybersec/ EH?

lusty umbra
pseudo creek
#

Finding an entry level job is generally tough for most sectors... Generally people get a job in some IT field then get a job in cyber security but not always.

lunar geode
#

I ended up in a job which says "Security Analyst"after being trained in Cybersecurity . Trust me it's basically endpoint antivirus support.. What I found out in last 6 months is offsec jobs needs skills .. try get a certificate from CompTia atleast

#

@red palm

fresh vapor
#

would I seem stupid for putting my write ups in an blog that i reference on my cv as my portfolio? For someone yet to have an cybersecurity job i think it can have some value or not?

lofty ibex
#

Having a blog shows you're passionate and spend time to demonstrate what skills you have. Usually stuff like that can turn into a great talking point in an interview so there's value in it for sure

tender sierra
pseudo creek
#

Blogs are great way to showcase your interest, knowledge and projects

lilac plume
#

What tools are you guys using to do this? To write down the steps you take and, as Zojja said, you show interest. Im currently taking notes in Sublime but I think it would be way better to have some online portfolio to share in your CV

static tide
stoic cave
#

Depends on what environment I'm in but I'll use notepad, notepad++, OneNote, Text files from the terminal, Word, etc

#

Notepad++ or OneNote probably get the most use from me though

fresh vapor
stoic cave
#

Whoops thought they meant note taking in general

#

I run/host my own site

timid swallow
#

if it comes to note taking in general i have to share my discovery of the week

#

notable app is great

#

it supports markdown and idk just works for me

sour rune
#

Guys I need your insight about getting certification sec+ combine it with CCNA ,or go to cyber boot camp for 6 months. I am on the job transition, which one has good chance to land on good cyber career ? Thanks

languid hearth
#

combine it w/ the CCNA

#

bootcamps are rarely worth it

#

plus you can learn it all yourself

sour rune
warm hinge
#

Would VHL be a good stand-in for the labs in sec+?

warm hinge
#

Really want to get certified in something just don’t know what

undone shore
#

@warm hinge no idea about sec+, but given they're a good extension of the labs for OSCP, I would imagine more than enough.

#

@warm hinge what stage are you at career wise? I would imagine you're based in Scotland?

warm hinge
#

I am, I work as a cleaner at the moment but would love to learn a new skill to maybe move jobs

undone shore
#

So, I would start on something like TryHackMe and aim to go for something like eJPT for the time being. The materials for eJPT are free, and the exam voucher is £200, so it's not breaking the bank. That gives you a bit of a negotiating position / talking point. From there going for something like CRT would cast you in a favourable light for the UK market.

warm hinge
#

Thanks muiri

undone shore
#

The other thing is: network, network, network. Conferences are obviously a bit dead just now, but any chance you get to make contact (or dare I say: friends) with recruiters or people who might be able to spring you a job, go for it.

#

Np 🙂

warm hinge
#

I’m considering subscribing to tryhackme

undone shore
#

Well worth it, although that may be slightly biased 😄

warm hinge
#

Only £8 a month

winter girder
#

Hi everyone, new here and would like to interact with everyone.

#

I'm sure i will be welcome 😋

undone shore
#

Welcome @winter girder 🙂
I'd suggest dropping into #general for a more enthusiastic response 😄

winter girder
#

Thank you @undone shore

timid swallow
#

are there any good entry blue team certs?

#

and another question

#

certs like eJPT have any value if it comes to blue team position?

#

I wanted to take eJPT in like two months

#

but i figured it would be much easier to get entry job as SOC analyst or smth

languid hearth
#

eJPT? Nah, OSCP, yeah.

The theory is that by being an attacker, you know what movement/tools should look like

#

it's not always the case, though.

fringe spade
languid hearth
#

alls you need to do to pass the exam is glance at the pivoting content so you know what they expect

fringe spade
#

So if you'd like to do that for fun, don't stress yourself too much

golden ore
#

Comptia CYSA+ or EC-Councils Certified SOC Analyst are 2 good ones for entry level SOC, there aren't a ton of blue team certs outside of SANS or EC-Council

quick forum
#

Splunk fundamentals!

languid hearth
#

What I would take:

  • CCNA Cyber Ops
  • Splunk Certified Core User (Fund 1, Splunk does their own training on Fund 1 for free, use the PDF they provide like a bible)
  • CompTIA Security+
timid swallow
#

in this particular order?

languid hearth
#

nope

timid swallow
#

i was thinking about security+ just to expand my security knowledge in general

languid hearth
#

bottom up would probably be the best way imo

golden ore
#

Sec+ is a good all around beginner cert

timid swallow
#

alrighty

#

sec+ it is

golden ore
#

I saw a video on youtube that was recent on different certs, I just cant find it right now

languid hearth
#

there's the whole "Blue Team Level X" certs, but I have no knowledge of those

quick forum
#

Just ask the question

#

That doesn't sound really expert

#

it also doesn't sound related to cyber-and-careers

sour rune
#

Any recommends for sec+ courses ?

unreal arrow
#

Professor Messer, Dion I've heard is pretty good, i'm currently using his udemy practice exams

sour rune
ashen hatch
#

I wanna get into, Cyber Threat Intelligence

#

ain't able to fetch much helpful resources on that,
as well as , what are the career aspects of a Cyber Threat Intelligence Analyst ,
how can I become one?!

warm hinge
#

@everyone

polar rock
# ashen hatch ain't able to fetch much helpful resources on that, as well as , what are the c...

That’s a bit of a hard question to answer as it is a little bit of a more advanced role compared to others, it really stems from working in a SOC, dealing with CTI, Red teaming etc to get the experience as there aren’t a lot of courses on it besides SANs. In terms of getting into it with no proposal job experiences is minimal but I have seen a few internships for it pop up but you typically have to have connections or a stacked resume to even be considered.

unkempt nova
#

What is the average salary of a senior penetration tester? 116k?

sick cobalt
#

Interesting question, what about junior too?

sick crystal
unkempt nova
#

@sick crystal USD

pseudo creek
#

it depends a lot on a number of factors... there are regional salary differences and also someone who owns their own business can make $$ if they are able to market their services vs working for a company

#

I would expect that if you are a senior anything in cyber security, you would be making over $100k... perhaps well over $100k... if you are a junior in cyber secrity, you are most likely making under $100k but not by much

unkempt nova
#

Recently, i got a interview question that what is my salary expectation as a senior penetration tester.

pseudo creek
#

I'm a senior in cyber security but not in penetration testing... my 'guess' would be $130k to $150k

unkempt nova
#

They need skills of Exploit dev, Vulnerability Research, Knowledge of windows kernel-c/c+, python, web+host+network pentesting skills etc

pseudo creek
#

that range would still stand, if you have multiple years of experience in those areas or in a super $$$ area, then it could be above that range

unkempt nova
#

ah...

#

Not sure what kind of exploit dev skills they want... They are not so clear at it. Exploit dev is not a small thing. I think An experienced exploit developer alone can make more than 150k yearly.

pseudo creek
#

sure

#

ranges are all generic... but like you could be a senior exploit developer with 5-7 years of experience... or a senior with 10-15... like what do they consider senior, and what do they really want

unkempt nova
#

Job description, 5+ years info security experience, 3+ years in pentesting, exploit dev, vulnerability research, and fuzzing. Most of the requirement i see they are asking about low level skills windows such as kernel and debugging.

pseudo creek
#

that isn't a lot so I would be surprised if that is $150k or more

unkempt nova
#

@pseudo creek Do you think asking for 150k is fair?

pseudo creek
#

but if it is NYC or Silicon valley then that would be different

#

no reason not to ask if you think that is a fair salary

spring garnet
#

Ok

flat sedge
#

It's also fair to ask for whatever you want. Only caveat I'd put on that is be ready for either negotiation or to walk.

ebon mica
#

They often want to have you give a number. And if you give them one, they have the initiative.

hot fog
#

When do you guys think a person should start studying for Sec+?

#

I'm planning to do it later on, but I'm just not sure when lol

#

To put it in further detail, would studying for it after finishing both the beginner and offensive path be good enough foundation?

#

nvm im pretty sure i should do A+, Network+ then Sec+

quick forum
#

What is your goal?

#

Like end goal?

hot fog
#

End goal in terms of certs or what I'd like to do in the future?

quick forum
#

Job at the end of it

#

Because I'd recommend choosing certs based on what they ask for

hot fog
#

Well, from where I'm from it's always preferable to start a business, so I'm going with that

#

But if I can't do that due to some reason, I'd go with being a CISO as an end goal

#

Long road ahead of me, I know

golden ore
#

A+, NET+, and SEC+ are good foundational certs, but depending on your current skill level they may be easy, some companies do ask for them but there are other stronger certs that you can fill in for them

hot fog
#

I see, well tbh I don't mind taking the easy certs and doing foundational stuff. More knowledge in the end :)

#

But yeah, I think if I had to choose a job as an end goal I'd go with CISO

golden ore
#

you might want to make a career-map on how to get there and fill in different certs that would help get there as there a several that could fit and I think there are a few designed for cyber sec management

hot fog
#

Yeah, I found some that lead to senior management

#

I would need CISSP & CASP+, CISM

stoic cave
ebon mica
stoic cave
#

That was the step I forgot

#

That would come before the massive range

pseudo creek
#

I wouldn't ever give them something that you wouldn't take

opaque laurel
#

in Australia we have seek.com.au and when employers upload a new role they can specify salary ranges, if they hide it you can kind of change sliders of what "you" are looking for until the job stops showing up

pseudo creek
#

fascinating

opaque laurel
#

so you could get a good grasp of how much certain types of roles are paying

#

I don't know if other employment websites are similar and its not our only one but it's widely used

#

I'd personally go into an interview with a salary expectation and not worry too much about what the company has allocated for it I guess but I feel asking about that would be awkward

pseudo creek
#

honestly, you know your skills, you know what you get paid now (unless its your first IT job, which makes it tough but original question was about senior position) and you can use salary sites to kind of gauge

opaque laurel
#

indeed, I agree with that

pseudo creek
#

and there is always room for negotiation

ebon mica
#

If there isn't, then you probably don't want the position.

#

I've heard of negotiations going like "take it or leave it". And yes, in software.

opaque laurel
#

they will sometimes especially if they have other applicants

warm hinge
#

Okay last time I ask cert questions I swear lol

#

I have a friend who got the CySA+ instead of the Sec+ first, was curious if the CySA has more opportunities since it’s the more advanced one? Thanks

pseudo creek
#

I think Sec+ is more well known

rugged delta
#

Sec+ is more widely known but a lot of organisations that recognise/value CompTIA certs will be aware of the CySA+, Pentest+ etc

#

There are some recruiters whose application selection algorithm looks for specific wording or certifications though as part of their elimination process.

pseudo creek
#

It depends... if a job listing has Sec+ but not Cysa+, you may never get passed the HR recruiter

#

I was typing as you were 🙂

rugged delta
#

Yeah it really does depend. bu you also have to decide if you want to work for a company that overlooks a more detailed cert. If a company isn't doing its homework in the field you want to work in, they might not be worth pursuing

#

And of course it can be hard to get past the recruitment stage because of cert requirements but a lot of orgs only want to know what you know if you're looking to apply with an entry level or slightly higher cert.

#

A lot of places will ask if you have a particular CompTIA cert but if you have a better one that won't be overlooked by a company who pays attention.

#

It is important to have a lot of the skills and certs an organisation looks for but a lot of the time one can be exchanged for another and they won't only have a specific cert as a qualifying need, unless it's the US DoD or another one with documented certification requirements

#

Go and get the cert you want for the job you want and what the recruiters are asking for. But state what skills you have as well. That's what they really want you to demonstrate

pseudo creek
#

So I’m not familiar with either cert but looking at sec+, it says it covers the fundamentals and one thing I find from some entry level security people is they don’t understand the fundamentals so I can see why someone would make sec+ a requirement

#

But sure follow the cert you want but Sec+ is an easy HR checkbox

rugged delta
#

Yeah that's certainly true. A lot of jobs have it specified. And that alone might be a good enough reason to get it. The point of a cert is to give you a shot at getting on the interview list.

meager pecan
#

hello everyone

stoic cave
#

👋

warm hinge
#

Hey how hard is it to get into an entry level SOC with just an oscp?( I'm coming from medical science academic field.)

static tide
#

should be fairly easy with oscp

warm hinge
#

Thanks What's the starting salary typically for entry SOC? (In US)@static tide

static tide
warm hinge
#

Ahh kk

#

Wondering if 80k is doable with no work experienve

static tide
#

my comment was also based on the uk market but i assume anywhere will love an oscp joining as an entry level soc analyst

timid swallow
warm hinge
#

Thanks

warm hinge
#

Is it difficult to get into entry-level pentesting with OSCP?

quick forum
#

Depends where you are etc

warm hinge
#

Let's say I lived in a city that is considered a tech hub

quick forum
#

Ok, but country matters

#

In the UK, job listings tend to be OSCP && (Batchelors Degree || Experience)

undone shore
#

CRT (or CHECK status) is apparently more common UK wise. Not really looked yet -- got offered the job I'm currently in.

lofty ibex
languid hearth
#

It can be difficult to get into pentesting with the oscp

lofty ibex
#

If you have a blog to post individual research, write ups or any other tech related stuff it can do wonders

warm hinge
#

Hm, okay. I think I may know what to do

lofty ibex
#

It also comes down to country. As muirland said a lot of recruiters in the uk will ask for crt or equivalent. Though a lot of private companies don’t tend to look for it as much

pseudo creek
warm hinge
#

I wonder if its different than in seattle

lofty ibex
#

America is fairly different. Oscp is a solid start but depending on whether the job is government or private it can change quite a bit

pseudo creek
#

there was someone in the infosec prep discord that had OSCP and bachelors and had a heck of a time getting any job.. they ended up getting one through discord

#

so network, network, network

lofty ibex
#

Tbh certs and qualifications don’t land the job, the person does

#

So networking is massive

pseudo creek
#

have a profile on LinkedIn, stay in tune with cyber security discords

warm hinge
#

Okay

pseudo creek
#

also realize that like penetration testing jobs are like 1% of the possible cyber security jobs out there

warm hinge
#

Thank you

warm hinge
#

@pseudo creek thanks I have a PhD in immunology. So I have technical writing experience but no cyber work experience

warm hinge
pseudo creek
stoic cave
warm hinge
#

Was it recent? Could the reason be because covid drying up the job market temporarily?

#

@stoic cave I've been looking at those job reqs. All of them say that prior clearance is required. Is that just some clerical/administrative thing they put on the listing?

stoic cave
#

I was in the hunt last year from May to August and it was pretty rough. I had just graduated with a degree in Cyber Security and Information Assurance with a digital forensics specific certification and I had to open my scope wide. I also had to heavily network with fellow alumni

stoic cave
#

So typical government lol

#

Some jobs will allow you to get your clearance but others will not consider without it

warm hinge
#

Gotcha thanks

stoic cave
#

Yeah if you're not on Clearancejobs I would get on it. LinkedIn is also heavily used by gov and gov adjacent

#

I would also advise, as others have above, the cyber field is very wide and isnt just pentesting. Those companies that do pentesting are looking for people who come from all different sectors of the industry to make their teams balanced. I think in only two recruiters/hiring managers/alumni that I had conversations with were looking for people with no prior experience somewhere else in the industry. One was at INL and the other was with the DON

pseudo creek
#

also it helps to build your skill set in general, I got my first cyber job because I had networking experience along with shell scripting knowledge

#

I'm in security but right now, most of my studies are focused on cloud stuff

stoic cave
#

Yeah currently I've used everything from my degree including what I learned in English class lol

hot fog
#

Is it alright to skip A+ / Net+ and study for Sec+?

pseudo creek
#

sure, many orgs will want networking knowledge, so be sure to be knowledgeable in that area even without a cert

hot fog
#

True

#

Not rlly looking for a job though, just doing it for the cert lol

glad cipher
hot fog
#

@glad cipher Yeah im just trying to go solely towards Cyber. I'm thinking of going over past exams/concepts before actually studying for it in the future.

golden ore
#

A+ and NET+ provide network and systems fundamentals, iirc, if you are comfortable with those 2 areas no reason to take them unless they are requirement for a company (usually gov though)

pseudo creek
#

Basically, Networking is a key component for cybersecurity... when we are hiring security engineers, although we don't do network security (per se), networking is a key concept we look for in security engineers

#

I'm more focused on cloud security and networking is also a weakness I see in people trying to get into cloud security

flat sedge
#

Second that. Ingress/Egress into cloud environments is one of the most misunderstood concepts I see with VPC management

glad cipher
#

Cloud security is huge and growing at fast rate

pseudo creek
#

yes, its awesome

hot fog
#

Looks interesting, I'll definitely read into that. But yeah, I'm not looking to get hired or anything. Just want to get certs in the future lool

pseudo creek
#

for what purpose? just because?

hot fog
# pseudo creek for what purpose? just because?

Well, not exactly. For now I wouldn't want a job since im already in uni, but I definitely want to do something in the cyber field after I graduate. I just think it would be time efficient to start things before I graduate

ancient prairie
#

honestly I wouldn't recommend getting certs if you're just trying to learn, they kind of encourage a bad way of learning which is just cramming their often esoteric and non-practical objectives

pseudo creek
#

yeah that is true

hot fog
#

Ofc

pseudo creek
#

but I would recommend building a strong network foundation if you eventually want to go into cyber

flat sedge
#

There is also the risk of hte certs expiring before you enter the job market, depending on how far along your degree program you are

hot fog
#

Oh definitely.

ancient prairie
#

3 years for a renewal is laughable - goes so quick

hot fog
#

Its alright if I took my time, but I don't want to take my time too much if that makes any sense

flat sedge
#

IaC is also a huge area I'm seeing right now, with both network and system infra

hot fog
flat sedge
#

Learning Ansible or Terraform is a big resume boost from what I'm seeing with clients

ancient prairie
#

but def check out exam/course learning objectives - they are usually posted for free and are often drafted by professionals

pseudo creek
#

I'm loving Terraform

quick forum
#

Also eJPT's training material is nice and free for a foundation. You don't have to do the exam.

flat sedge
#

PI is so much easier to deal with in a lot of ways

hot fog
quick forum
#

Yeah, and the PTS content should be free

hot fog
flat sedge
hot fog
#

Sounds good

#

I'd for sure need better networking skills

flat sedge
#

Then went through a lot of CCNA study materials.

hot fog
#

But before all that, I need to level up a bit first haha

gusty cloak
#

uhm hi
I have a question
for a person with lets say average or below average programming knowledge(beginner basically)
how do you get into cyber security
cause im really confused and the things I read constantly contradict each other

unreal arrow
#

You don't need programming to get into a cyber sec job

#

It depends what role you're looking for in cyber sec

hot fog
#

Cybersecurity is a pretty diverse field, its not rlly about programming so don't worry about that. But I heard it would come in handy in the future

gusty cloak
#

uhm lets say the pentesting field

quick forum
#

Programming and hacking are loosely related, but not the same thing.

gusty cloak
#

ooh

quick forum
#

You'll probably do a little bit of scripting, but really not much programming.

hot fog
#

There is a path in THM called the Complete Beginner path, you should check it out :)

gusty cloak
#

thm ?

hot fog
#

TryHackMe

#

Paths are a great way to keep you on track of things. If you don't have a subscription though, there's a free path for beginners as well :)

gusty cloak
#

ooh okay

#

but do you have some tips on starting out

#

ooh

quick forum
#

That said, many don't.

#

There are entry level roles, things like junior SOC roles that people often go into out of uni.

sour rune
#

Subscribe with free THM and if it’s for you, pay $10/month is sooooo worth it

gusty cloak
#

hold on what path specialises in the "breaking into systems" aspect of cyber sec

quick forum
#

Offensive Pentesting

#

But you'll want to get a grounding in the basics first

gusty cloak
#

thanks

sour rune
gusty cloak
#

ayt

fair bolt
#

CompTIA will start beta-testing v2 of their Pentest+ (DoD Approved) certification exam in a few days!

For $50 you get a sneak preview at a brand new pen-testing exam, plus if you pass the exam you get a valid certification (which normally rings in at $350).

Sign-up starts April 13th, via PearsonVue. You can find all details here:

-> http://comptia.org/certifications/pentest

Default
PenTest+ (Plus) Certification | CompTIA IT Certifications

The PenTest+ certification validates skills in penetration testing and vulnerability management. Learn about the certification, available training and the exam.

light urchin
#

Interesting. For that cheap, I might try it just to see, although I doubt I could pass it. Can anyone comment on the difficulty of it or good study methods/materials?

loud marsh
#

Anybody here using both plural sight and ine before? If so can you give me your opinion which one is better prepare for job? 🙏

sour rune
#

For cyber sec, INE is better path

noble schooner
#

I really want to pursue a cybersecurity job for the government in the future. There is a uni course for cybersecurity that guarantees me a cybersecurity job after completing the course. But there is also a computer science course that is quite popular and I feel like computer science will teach me more, so I need a bit of insight.... Sorry if this is a dumb question

compact shore
#

i wanna know how to hack

#

then i will hack microsoft

quick forum
#

@compact shore Just a warning. We will not tolerate unethical and/or illegal hacking here.

#

Welp they left

forest knoll
#

Maybe they were a bug hunter kekw

quick forum
#

Smh my head.

pseudo creek
noble schooner
#

I guess maybe computer science will benefit me more then in the long run...

pseudo creek
noble schooner
#

ok, that's fair

#

I'm just scared that my ATAR won't be high enough for computer science smh

#

thank you for your advice

pseudo creek
light urchin
#

One semester of computer science won't teach you a whole lot. The internship would probably be more valuable. Really depends on what the courses are teaching and what the internship would be

pseudo creek
#

I figured they were talking about a course being a major... I might be wrong

light urchin
#

Ah. Yeah, if 'course' meant a 4-year major, then that's a different story entirely

noble schooner
#

ahh yeah, sorry, I meant 3-year major

warm hinge
#

What you guys recommend doing to get better at offensive pentesting?

What I am doing right now:
Doing boxes/labs on thm and hackthebox
trying to learn php/python3 (which is pain)

I would like a more reliable path, but there are so many options

gentle mist
#

hey guys

#

what you recommend to start in cybersecurity

warm hinge
# gentle mist hey guys

start off by doing the most difficult box you can find and realize that u have too much to learn

quick forum
#

I feel like that's not a good way

warm hinge
#

ctfs or certs? which will make you good at pentesting and ethical hacking?

quick forum
#

They're not mutually exclusive.

warm hinge
#

Ohh

grand gulch
#

Hello guys,
Could anyone tell me how could I learn Hacking by using Kali_Linux?

static tide
grand gulch
#

Ok thx

clever vigil
#

Hey guys can anybody tell me what path should i follow for an entry level job in cybersecurity in India. I am currently in the third year of my Engineering .

royal flame
#

can anyone please help me

#

i am so tired of this

#

my computers and phones have been hacked

#

anyone

timid swallow
forest knoll
royal flame
#

i already did that

#

i figured this would be useless. no one gives a fuck

forest knoll
undone shore
#

No, we just can't break the law 🤷‍♂️

warm hinge
#

hey

#

would a diploma of networking or software development be most helpful in cyber sec area?

clever vigil
digital cypress
#

I had an interview for an it security job for a bank yesterday and I have my 2nd interview on Friday.
I asked a few questions about the work environment like what’s the retention, is this role a new role or am I replacing anyone, is there travel, is it remote.

But they kept saying “do you have any more questions for us?” As if they’re hinting on me to ask something specific. Or maybe I’m just looking too deep into it.

What kind of questions would you ask if you had your first IT security job role so I can ask those in my second interview

pseudo creek
#

you are probably looking too deep into it

#

but also a good question is "what is a day in the life of someone in this position?"

polar rock
#

Yeah sounds like common courtesy

pseudo creek
ancient prairie
#

a good one that usually opens up some conversation is "what challenges have you faced because of covid and how were they handled?"

pseudo creek
#

but yeah for every interview we do, we make sure the candidate doesn't have any additional questions before we sign off

digital cypress
#

I haven’t had an interview for like 3 years so I felt rusty lol

ancient prairie
#

most of the advice i've heard is that you should try to ask the interviewer a meaningful question - but yeah probably not a big deal if you genuinely don't have a question it's just a conventional thing

light urchin
#

Similar to what Droogy suggested, I usually ask something like "what are some of the biggest challenges you've faced here", and mention that I don't just mean technical- could be management, political, people, whatever

#

the way they answer that usually says a lot

warm hinge
pseudo creek
#

or even something like "what challenges do you find with remote work?" if iti s a remote job

digital cypress
#

Ty yall

warm hinge
#

Alrighty I got signed up for a Network+ boot camp in May and a Security+ one in July vent thanks for the tips again guys

golden ore
#

good luck

warped moon
#

Good luck!

clever vigil
#

Hey guys can you suggest free/paid online courses for network+ a+ security+ certs as they will be beneficial for me to make my base strong in os and networking

static tide
#

if you have the money, cbtnuggets are my favourite for certification training and they have a course for each of those too

light urchin
#

For anyone who has done the pentest+, I'd love to hear your thoughts on the exam (format, what you did to prepare for it, difficulty, things to study/watch out for, etc.). I'm considering doing the new beta exam, since the cost is currently so low, but I'm not sure if I could adequately prepare in time.

tawdry frost
#

Have you done any other comp tia certs?

velvet spindle
#

how much is the beta?

#

might do it just for the sake of trying

quick forum
#

I heard $50 earlier

light urchin
#

For $50, I'll take a gamble on it, even if just to see what it's like. But I'd like to actually prepare for it. I've got about 60-70% of the THM pentest+ path done (lots of overlap with the beginner path), and I might have some udemy courses I bought a while back as well, but would like to hear thoughts from people who have taken it and/or know a bit about it

stoic cave
#

Is pentest+ the one you can do in a week or is that eJPT?

unreal arrow
#

eJPT is 3 days

#

PT+ is 165 minutes

stoic cave
#

Personally I just pushed my Sec+ exam back to the 8th of May. I was supposed to take it this weekend

unreal arrow
#

I believe it's eCPPT, that's 7 days

stoic cave
#

Because I was a dummy and forgot when I was taking it and didn't read GCGA

pseudo creek
#

I pushed out my OSCP indefinitely but thinking of scheduling as-104 for early May

stoic cave
#

Yeah im taking OSCP in December probably

#

I think 7 months of study is good right?

light urchin
#

Zojja (or anyone)- I'd also be interested in thoughts on the CEH

stoic cave
#

Allegedly a meme but gets you in the door in the US specifically

#

So 🤷‍♂️

#

It satisfies government requirements if that's of interest

light urchin
#

Say I don't care at all about getting in the door or career advancement, just knowledge

#

All my security focused learning is (for now and the foreseeable future) just to augment my "day job" and for fun, not for a career pivot to security. That may come in a few years, but I'm nowhere near ready for that now and won't be any time soon.

pseudo creek
#

Oh for knowledge, I wouldn’t do CEH

#

Honestly, I’d just stick with TryHackMe

light urchin
#

so waste of time other than as a resume padding/checking off the HR filter?

pseudo creek
#

Yeah

flat sedge
#

CEH is a waste of time if anyone with knowledge is reading your resume

pseudo creek
#

Well it depends on your goal

flat sedge
#

exception being DoD I think

#

IIRC there is a checkbox on the DoD stuff that CEH can tick off

pseudo creek
#

DoD is an understatement... any company that does work for the US government has certain certification requirements to meet

#

CEH helps meet those

#

But so do other certs

flat sedge
#

If an org needs it for a checkbox, fine. But doesn't it fill the same box as Sec+, PenTest+, and CISSP? Only reason to get it seems to be to schedule someone out of role

pseudo creek
#

But it won’t teach you hacking, even as a meme cert, my company has CEH classes to help people get the cert

light urchin
#

so what does it cover, if not anything practical?

pseudo creek
#

CISSP requires experience, Pentest+ is new to the list, Sec+ is a favorite in many circles especially direct contract roles

light urchin
#

yeah, my plan was to do net+ and sec+ first just as a foundation, along with CEH, and then build on those

#

but with pen+ being so cheap, I might just give that a shot

pseudo creek
flat sedge
#

Experience for CISSP is true, assc of ISC isn't counted at all?

pseudo creek
#

The associate is also newer, I’m not sure by how much

#

It wasn’t around when I took my CISSP

flat sedge
#

I was an associate for 2 years, the test is the same

#

To uplevel from associate to full CISSP just requires time + another CISSP to vouch for the candidate

pseudo creek
#

Yeah but again it’s a new offering... we have ton of CISSPs in my company but I heard about the associate in the last few months on discord

flat sedge
#

Ah. The CISSP exam also changed drastically I think 5 years ago? something like that. No more questions about expected lifetime of outdoor security lightbulbs in Alaska.

light urchin
#

42

pseudo creek
#

I didn’t get those... just TEMPEST

flat sedge
#

I don't remember TEMPEST

undone shore
#

@pseudo creek you happen to know what counts as experience for CISSP?

#

Like, does THM content dev count?

pseudo creek
#

And a lot of questions that really only applies to gov environments

flat sedge
#

work in IT, you can count off 1 year from requirements with an undergrad degree in some IT related field of study

pseudo creek
undone shore
#

Wonderful. Reckon my other work probably does, so it'll only be three years out of uni before it's an option 🤷‍♂️

pseudo creek
#

You could still take the test

flat sedge
#

You have to have something like 20+ hours per week for a full year for it to count towards time in industry

#

part time work may not count

undone shore
#

You, uh, know I'm famous for getting out of bed, working, going to sleep, right? I'm a workaholic 😆

#

That said, CISSP isn't one of the ones that hugely interests me just now. I just like having options.

flat sedge
#

For example, I couldn't count 1 of my years as a private CompSci tutor, because the hours just weren't there. 50+ hours per week for 5 weeks a year with <10hrs/week the remaining time wasn't enough

#

If you want to bridge between business needs and IT groups, CISSP is a good one to have

#

There is a huge difference in understanding of 'proper security'

undone shore
#

Reckon I have a few more years of "I just wanna break stuff" to go before hitting that point 😆

flat sedge
#

Honestly, CISSP helped me a lot to categorize what kind of broken stuff should be fixed, what can be fixed, and what is going to be impossible to get fixed

undone shore
#

Worth doing then?

flat sedge
#

If you want a holistic picture of the landscape, yeah

#

It's also a soft requirement to jump from jr analyst type roles to team leader or management

#

it's a 5" deep view of the 8 ISC categorized domains from 1km up. You won't be seeing the end of the mineshaft, but you can see all the silos

undone shore
#

Given I've so far been focussing on the nitty-gritty technical stuff, that could be useful

flat sedge
#

It's helpful to explain to business folks why you want $1m to spend on new firewalls... and to explain to the network team why they need to ditch the 20 year old cisco stuff

distant pier
#

I usually call CISSP the lead cert (lead engineer, lead analyst), a bridge to manager role, which could be typified with a cert like CISM. But also probably senior roles and architect roles, etc..

stoic cave
stoic cave
#

Got sidetracked but he apparently wrote the initial CISSP exam

rugged wolf
#

CISSP is managerial and strategic to be able to govern the overall information security posture for an organization. It touches basically everything within information security but nothing in depth. IMHO it has no real added value if your day to day consists of operational technical security tasks and responsibilities.

pseudo creek
#

sure it does, CISSP covers the basics of cybersecurity, which anyone in cybersecurity should know

#

I think one of the biggest skills you can have in security is trying to show other people why it matters. If you can talk about risks, vulnerabilities, threats then you can intelligently talk to people why something is 'bad' vs telling them they ned to do something due to corporate policy or just saying 'this is bad'. Too many people really don't have the foundational knowledge of cyber security and it can create an adversarial relationship with those that you are trying to protect. When you are starting out, sure you don't exactly need to know it but once you get to the part where you may be giving presentations, may be interfacing with people outside your team, its a good thing to have.

rugged wolf
#

Yes it does but more from a strategic and tactical perspective. I agree everybody certainly in the security field should have foundational basic information security knowledge but I think there are others beside CISSP that one could pursue to fill that void. Not everybody talks to the business 😉

light urchin
pseudo creek
glad cipher
tawdry frost
#

I'm buying it today after work

#

$50 for a stab at the test is pretty solid

#

Only bad part is we don't get Results until October

glad cipher
#

I would because there is a limited amount of registrations

tawdry frost
#

I don't really need it for my work at all, but it would be nice to just have

glad cipher
#

Oh for sure. I am studying for my OSCP but having another cert and especially for only $50 is fantastic

tawdry frost
#

Yep, or at least the experience of taking the cert, the timeframe is a bit rough for me because I take classes/work M-F 0630-1600 until June 29 but for $50 I'll study for it

#

It took me about 2-3 weeks to prepare for Sec +

clever vigil
sour rune
#

@glad cipher any recommendations where the best resources/ teacher/book for study OSCP ? Thanks

clever vigil
#

I'm thinking of completing A+ Network+ and sec+ from professor Messer and then move on towards Linux and then to pentesting and thm htb how does that sound? @static tide

#

And how much time do you think it will take approx?

static tide
light urchin
ancient prairie
#

Just booked Pentest+ for mid-June too, good luck to everyone! we might be able to get a study group together, i reckon you probably only need like a month or so of studying to prepare

light urchin
#

I'd definitely be up for a study group. Right now my plan is to finish the beginner and pentest+ THM paths, along with some udemy courses I picked up. beyond that, not sure yet.

stoic cave
#

Hmm I might join yall

vapid panther
#

Hey guys whats up, I am trying to get the OSCP cert. Relatively new to cyber, how relevant is the event advent of cyber 2. Will that help me align with OSCP per? is there anything I can take from that course.
any information regarding this will help me

stoic cave
#

I need to seriously study for sec+ though. I am procrastinating too much

vapid panther
#

hahah same issue. Take it as a challenge, throwing away my masters in cyber into trash unfortunately industry is more interested in certs.

stoic cave
#

If i go back for a masters it will probably be in a completely different field. Maybe ICS Engineering

warped moon
#

I've also scheduled a Pentest+ exam for mid-June and would definitely be open to joining y'all in a study group

clever vigil
fringe spade
tawdry frost
#

just bought my pentest+ for end of June. winning

gloomy briar
#

Anybody in here a security engineer/analyst? If so would you say pen testing and analysts share some skill sets? I’m having a hard time choosing between the two.

tawdry frost
#

I've noticed from my experience and I'm neither one of those, the security analyst usually has some "pentesting or hacking experience" at the minimal their mentality. If you know how you would break in you know how to stop it.

#

When I learned defensive measures I was first taught how to break in.

edgy tiger
#

You also need to understand the process to break it to make a plan to improve defence

#

If you only know “ they are root now “ and you dont understand the process you cant do sh*t

jovial rune
#

Hi guys i have good basics knowledge of networking, so where should it starting pentester carrear?

fringe spade
clever vigil
glad cipher
glad cipher
low jungle
#

Hey all. I have a question. So I'm a former police officer who got medically retired after being in a bad car accident. For the last 8 years I've just been a stay at home dad. I have a strong interest in cyber security and pen testing. I've started to study for taking the Comptia 3, been working through TryHackMe, and plan to do PWK and get the OSCP.

But my biggest question is... will I be at too big a disadvantage when applying for jobs? No work history in IT, no recent work history, no previous experience? All the job postings I see, even for entry level, all require Bachelors in computer science, 3-5 cybersecurity work experience, etc for an entry level position. Am I out of league here?

undone shore
flat sedge
# low jungle Hey all. I have a question. So I'm a former police officer who got medically r...

I know that your soft-skill set (notably Incident Response) is very well received from a blue-team perspective. You have a lot of life experience, don't overlook that. It's a good foot in the door. That said, if I were in your shoes I'd enroll in a community or vocational college that is accredited for some basic IT knowledge and to start building your local IT social network.

#

Also look into local IT meetups; don't worry if you think it's beyond you, just showing up and showing some interest is a big help.

low jungle
#

That's one aspect I was hoping would work in my favor. Incident response, detailed report writing, trained observer, etc. Just wasnt sure how much that would help. But you make a good point.

Will definitely look into the IT meetups , thank you

daring lodge
#

does anyone here have knowledge about digital forensics and good beginner jobs

stoic cave
daring lodge
stoic cave
#

As far as good beginner jobs, Id say any job in the tech space is a good beginner job as it allows you to get your foot in the door

daring lodge
#

only thing i can think of is going for a df cert for encase aand ftk

stoic cave
#

I had Cellebrite stuff and still nothing

haughty sundial
#

I know someone who worked as a deputy sheriff for a long time and then went back to school at almost 50 and is now a doctor. Career changes are totally possibly if you want them!

low jungle
#

I'm more than willing to put in the time to study. I guess I'm just worried about sinking time and money into training and certificates just to turned down due to lack of experience and still not be able to get a job. It's just disheartening to look at job postings and see entry level described as needing a bachelors and 5 years of experience. I just dont comprehend how that's entry level.

flat sedge
#

Part of it is HR not understanding actual needs; they get a list of job reqs that are something like 'ideal candidate has all this, but we'd take some subset of the list into consideration'

#

Another large part of it is that security is hugely complicated. The most common path into security is to spend 5-10 years, at least, in a network admin, sys admin or developer role then transition into a security team.

#

The most difficult part of security is remembering that it isn't technology that drives the security of the organization, it is the business needs that drive technology and the surrounding security landscape.

low jungle
#

So all these websites and bootcamps claiming you just do them, pass the Security+ or Pentest+ certs and get a job should just be ignored?

Seems like the majority of these training sites and such all promote being able to just take a bootcamp, get a cert, and you qualify.

#

Which I know sounds un realistic. But I wasnt expecting to have get a network admin job for 10 years first

flat sedge
#

You can definitely get into industry a lot sooner than that.

#

Many accredited community, junior, and vocational colleges offer professional cert courses. CCNA is a great place to start if you are interested in networking

forest knoll
#

Get as many certs as you can (look at job advertisements for your country), be active in places like THM and other ethical hacking discords, network network network (like linkedIn), advertise yourself. Practice practice practice and put yourself out there

flat sedge
#

The nice thing about taking a cert course like that, is that some colleges have agreements with Pearson or Wiley or whoever runs the exam to include a voucher for the exam as part of the course fees

#

it's definitely a thing to ask about when you are considering options

forest knoll
#

I've been offered higher than entry level jobs just because I've networked with people and have OSCP (really not that hard to get if you put ur mind to it)

#

A lot of the time it's who you know, not what you know. That applies to all jobs

low jungle
#

My original plan so far was working through the paths on tryhackme while working through and getting CompTIA A+, Network+, and Security+. Then taking the course and test for eJPT, and after all that doing OSCP and hoping to get an entry level Pentesting or SoC job.

forest knoll
#

I'd avoid A+ if you already have a base computer knowledge, it's really aimed at people with very little computer knowledge (someone correct me if I'm wrong). Sec+ and Net+ are good and eJPT is good and a good starting cert to get into the flow of doing certs.

low jungle
#

I figured A+ would be all basic overview, I'm just seen it suggested multiple places to get those 3, so figured it would be easy grab

flat sedge
#

A+ is basically a primer for an on-site IT support career track

#

Stuff like identifying and replacing hardware components in a workstation

daring lodge
ancient prairie
#

A+ helped me get past the HR filter - otherwise it is a soul-sucking cert, unless you enjoy reading 200+ pages on printer repair kekw

ancient prairie
#

so yeah on paper, saying i was underqualified is a HUGE understatement - also I recently found BanjoCrashland from Black Hills Information Security gives really good job-hunting streams that are specific to infosec, ton of helpful advice in his stream and I believe he's helped quite a few people get jobs off his advice
https://www.twitch.tv/banjocrashland

Twitch
BanjoCrashland - Twitch

Storyteller. Comedian. Christian. Husband (22 years). Dad (15 years). Community Builder. Content & Community Director of Black Hills Infosec. Former: Comic Shop Co-Owner (A Comic Shop) & Film Instructor (Full Sail University)

▶ Play video
stoic cave
glad cipher
# low jungle Hey all. I have a question. So I'm a former police officer who got medically r...

I have a very similar background as you. I decided after 20 years in police work to leave and start a new career in cyber. It took awhile but I finally got an entry level position on a TVM team. I learned as much as possible in a short time and started to move up in jobs. I didn't have any certs when I started and was way older than my team members but that did not discourage me. Now I did go back to school and obtained a bachelor's in Cyber Security which did help but I don't think it is necessary. Your law enforcement background will be very useful in IT security as well as your communication skills obtained while on the job/

stoic cave
#

I find that job portals like Clearancejobs, ClearedJobs, and USAJobs are often overlooked as well as people think you need to be cleared to apply on there

stoic cave
quick forum
#

Initials are JB, they added me on linkedin

#

Jason Blanchard

ancient prairie
light urchin