cyber-and-careers

[stoic cave]

That's right. I knew the last name was blanchard. For some reason I thought the first name was eric

[warped moon]

Wait, do you not need to be cleared to search on there?

I know USAjobs doesn't require clearance

but I thought the other two did

[stoic cave]

As far as I am aware I don't think you do for clearancejobs. Cleared jobs you may. Clearance jobs has jobs that don't require clearances or allow you to get one within a designated time period

[haughty leaf]

I thought clearance was required, too! Game changer.

[stoic cave]

I may be wrong so don't quote me. I was cleared when I signed up

[haughty leaf]

I've checked it out very briefly and you can filter "public trust" or "confidential", which don't require more than a background check, but then I don't know if the job postings will say otherwise.

I'm going to a career fair end of the month that is partially sponsored by ClearanceJobs, so I guess I could just ask then too.

[stoic cave]

Yeah don't lie about anything. Public trust while easy to get is still a form of clearance

[warped moon]

Is the only way to get a clearance through a job that requires one?

[pseudo creek]

Yup

[stoic cave]

Not always the rule but generally

I was put up by my internship just because

I'm also a numpty because the FSO was like "what are we putting you up for? A insert level" . And I said "no, x said insert lower level". And he responded with "are you sure?" and I absolutely r/whoosh

[pseudo creek]

I would consider an internship to be a job... Like my company likes people with clearances so they will sponsor people even if your specific job doesn't require it but you have to get it through an employer

[light urchin]

You could also join the military. Often times you won't actually NEED a clearance, but you'll generally get one (even just a low level one), just in case.

[light urchin]

Doh!

[warped moon]

Oh, I see. I guess I'll be looking for jobs with orgs that offer that

I'm a little hesitant to join the military since a lot of the listings look like they'd want me to enlist

and I don't think I could do enough push ups to get through basic

definitely a potential option though

[light urchin]

Yeah, it's definitely a bigger commitment, just throwing out that option :). It's one way of getting some "free" training and your foot in the door to some tightly controlled places/job networks

[warped moon]

That's a good point

[light urchin]

There are a lot of companies/jobs that can hire you for a job that requires a clearance, even if you don't have one. You can get an interim clearance while you wait for the full process to go through. Your access is a little bit limited at first, but it's a viable option

[warped moon]

Oh huh

Are those the ones that ask if you're "eligible" for a clearance?

As opposed to ones that just list a clearance requirement?

[light urchin]

Different companies/job postings probably word it differently, but yeah, that's probably what they are saying

[warped moon]

Ah okay. I've seen some that ask for "active clearances", which sounds like they want someone who has a clearance right now. I'm not too clear on if I should be applying to listings that just show a clearance for the position.

[light urchin]

you'd apply, interview, go through a basic background check, get hired, start working (either on an unclassified project, or a classified one with an interim clearance), and then wait a few years for the full background check

[tawdry frost]

most jobs in the military will get Secret clearance

Cyber space operations officers get TS (bachelors degree job) and then the CWO which is enlisted cyber warfare operator get TS as well if I'm not mistaken

[light urchin]

Worst case, you can apply and get rejected- worth a shot, but you could also irritate the recruiters potentially

[tawdry frost]

a lot don't care if you meet what they need, they just want to filter people

[light urchin]

You can do TS work with an interim clearance. Beyond that (SCI/etc.) requires completed clearance

[warped moon]

I see

Should I be worried about irritating recruiters and getting blacklisted from the company as an applicant? I'm not sure if that's a thing companies do

[tawdry frost]

I'm in the military and if you plan on working with the goverment, expect 0 to no job unless you get fully cleared, most if not all the work is done in SCIFS

[light urchin]

It's also easier to get a clearance if your background check is easy. If you lived in smalltown, middle of nowhere your whole life, that's a lot easier to check than if you travelled all over asia/iran/etc.

[tawdry frost]

nah, you should be fine, they would probably just toss you aside

[warped moon]

Ooh okay

[tawdry frost]

you can also do clearances by step

[light urchin]

You can get into TS SCIFS with an interim.

[tawdry frost]

secret clearance job, then look for a top secret clearance job

can you look through the information with the interim though? I haven't checked much on that tbh

[light urchin]

Yep

[tawdry frost]

interesting, I know there's some menial jobs people can do within a SCIF while waiting for their clearance to be done, wasn't sure if they could hear classified information though (haven't been in that long)

[light urchin]

things may have changed, but that's the information I had

[tawdry frost]

you can also just be escorted into the SCIF, but you can't really do anything within the SCIF

[light urchin]

true- so with an interim, you do require an escort

but otherwise, you're treated as being cleared at the level your interim is

of course, I have no idea what would happen if the full check got denied

[tawdry frost]

going back to the clearances by step, one of the easier ways to get higher clearances is by step, you get a secret clearance, go through all the paperwork and stuff for that and then find something (new job) for top secret and get upgraded, the next tier investigation they do isn't that much more once the secret is completed

[light urchin]

I've actually heard the opposite

[tawdry frost]

going TS instead of secret?

[light urchin]

that a TS and above basically starts from zero, even if you already had a secret

[tawdry frost]

I mean they look for more information, but I wouldn't say start from 0

[light urchin]

I thought they had to re-check everything too, even if the secret was still active

[tawdry frost]

you submit a whole new "package" which is essentially your old one, plus some new information, and they (to my understanding) verify all the new information

[light urchin]

so having a secret didn't make it any faster/easier

[tawdry frost]

every few years they conduct a new investigation regardless

[light urchin]

yeah

[tawdry frost]

I never said it was faster, just easier, it still takes a few months

[light urchin]

or years

[tawdry frost]

I think mine took around 6 months?

[light urchin]

for TS?

[tawdry frost]

yeah

[stoic cave]

I think you get secret just for being in

[tawdry frost]

I know most do, not sure if all that's why I said most

[light urchin]

wow. THey must've cleared the backlog, then

[tawdry frost]

it was required for my job so they bump you up

[light urchin]

or maybe it was because it was a .mil clearance as opposed to a civvy company sponsoring it

[stoic cave]

Yee. I know some FA guys and they all had to go through clearance training as well as some infantry and MP bros

[light urchin]

or maybe it was because it was a .mil clearance as opposed to a civvy company sponsoring it (for the quick turnaround)

[stoic cave]

Mil goes through a different process from my understanding

[tawdry frost]

they probably have specific people that work the military ones

I went through ROTC as well so we had 1 person do all of our college ones

[light urchin]

maybe. That I don't know. I'd always assumed it was the same investigators, but 🤷‍♂️

[tawdry frost]

he would do around 20-30 a semester if I'm not mistaken for us

[stoic cave]

Yeah you can get a clearance a lot faster in the military. I think my boss at my internship said he got a top level TS in 3 days

[tawdry frost]

TS has too many different sub designations 🤣

[stoic cave]

Which is wild

I know right

[tawdry frost]

I'm excited I have 2 job interviews coming up, one tomorrow and one Monday

[stoic cave]

Why can't they just name it super duper secret

[stoic cave]

Eyy congrats and good luck

[tawdry frost]

thanks, they are just to see if I can get a specific job within my career after tech school, they are interview locked jobs. 🤞
if not I get some pretty cool ones regardless

[light urchin]

the only 'interview' I've heard of within the mil is SFAS.

[tawdry frost]

special forces?

[light urchin]

yeah

[tawdry frost]

I got a friend that got picked up for a special forces squadron the other month

[light urchin]

everything else is pretty much contracted

[tawdry frost]

super exciting stuff, I got no idea what they do 🤣

a lot of exercise

some squadrons within the air force, more specific in technical jobs won't take anyone without an interview

[light urchin]

ah, that makes sense

Air Force

[tawdry frost]

to see if they are a good fit for you more than you for them

[light urchin]

well, that seems like a reasonable idea. Hope it works out 🙂

[tawdry frost]

thanks

[stoic cave]

When I was doing ROTC one of our alumni came back on block leave when he was in the pipe for PJ. Dude was absolutely tapped

[tawdry frost]

wait PJ's can be in ROTC? I thought that was enlisted only

I know a couple that went through CRO and they came back different after the training

[light urchin]

I've trained with PJ's. Tough SOBs

[stoic cave]

Worked a kid out so hard he pooed himself

[tawdry frost]

they take the motto "so that others may live" very seriously

[light urchin]

Anything in the special operations sphere is that way

[stoic cave]

I think he dropped ROTC and enlisted after graduation. Either that or he was in the CRO pipe

[tawdry frost]

he was probably in the CRO or STO pipe

[light urchin]

they don't look for people who are physically fit- they look for people who will never quit, no matter how bad it hurts

[tawdry frost]

you can be the most physically fit but not mentally fit

[stoic cave]

Yeah i cant remember if he was enlisted or not. I know he graduated from the uni but not sure about the ROTC

[tawdry frost]

can you go until your body breaks, then keep going or do you quit halfway through when you're body breaks

[light urchin]

hence the 'interview' part- acceptance AND selection. You can pass the quals, and still not get selected

[stoic cave]

Oh wait I remember now

[light urchin]

I ruptured my achilles tendon and broke a foot and kept going

[tawdry frost]

the Special operations group doesn't do regular type "interviews" though, they do training time type interviews where they go through specific trainings and have to pass them to continue at least from what I've seen

you were special operations?

[stoic cave]

He graduated from my SMC and then enlisted in. Someone in the Det knew him and asked him to come back and give a presentation to the Det

So yeah he was straight up PJ pipe

[tawdry frost]

nice, those guys are crazy too, I've heard some wild stories

nearly all special operation stories are wild

[stoic cave]

I think there are sub 500 PJs right now

But yeah my school has some wild alumni. For instance, one of the main dudes in Blackhawk down or one of the dudes involved in Operation Red Wings

[light urchin]

your school being a PJ school, or ?

[stoic cave]

No my school as in my Uni

[tawdry frost]

that's crazy

and here I am just trying to survive the Cyber space operations pipeline 🤣

[stoic cave]

Its one of the SMCs so I got to play military dress-up for 4 years

[light urchin]

ah, okay. But you said you went to a military academy, right?

yeah, that's not surprising then, tbh

[tawdry frost]

if you went to a military academy having people that have been or done pretty much everything is pretty normal

[stoic cave]

I was ROTC but had things going on and did not know if officership was for me. Now I'm graduated and seeing if I can get a warrant slot in the Army and if not I'll probably just enlist FA or go over to the Marines

[light urchin]

FA?

[stoic cave]

Field Artillery

[tawdry frost]

😮

[light urchin]

you 13 series?

[tawdry frost]

I had doubts about officership the whole way through ROTC, I can't lie about it, however, it's been great so far and I don't regret the choices I made

[light urchin]

you're an officer now, @tawdry frost ?

[tawdry frost]

yeah

[stoic cave]

It would be 13 series but I'm not in and haven't signed anything yet

[light urchin]

We should talk, then

[tawdry frost]

you and moose or you and me?

[light urchin]

sure 🙂

but that was directed at Moose

[stoic cave]

There are so many MOS' lol

[tawdry frost]

they keep making more as well 🤣

now there are also the space force ones

[stoic cave]

My primary objective is to get a WOFT slot

[light urchin]

nice :). that always looked like fun

[tawdry frost]

don't you have to be enlisted to apply for warrant?

[stoic cave]

Not WOFT

[light urchin]

I'm not sure. I think you can get warrant straight off the street, but that might not be true anymore

[tawdry frost]

I don't know much about them since the AF doesn't have them

[stoic cave]

WOFT is the Army's "street to seat program" though it's mainly directed at high schoolers

It's their pipe to get more aviators

[light urchin]

There was a while they were taking people off the street into SF programs as well, but I think that might have been stopped. Not sure about the street to WOFT thing. It depends on their manpower quotas

[pastel solar]

Street to SF still alive and popular

[rain helm]

h

Hello,
I'm currently working in network security infrastructure and I plan to move to offsec field.
I plan to improve my skill doing some boxes but I don't have mental energy a day of work during the week to study offsec.
Any advice ?

[ebon mica]

First of all, don't overcommit. Try to reserve some time for practice during the weekends. But do not overdo that either.

[velvet spindle]

I personally find physical activity helpful. Go for a walk, run, bike ride or whatever. It's a good way to reset.

[stoic cave]

Take a 5 minute walk every hour if you work at a desk

If you have the option for a standing desk do that as well

[flat sedge]

Physical activity is a great way to wake yourself up. i keep a kettlebell and small medicine ball nearby just for that purpose

[stoic cave]

Also get enough sleep and make sure you are getting the appropriate nutrients in your diet

[flat sedge]

And water.

Tiredness can be a sign of dehydration as well

[stoic cave]

Most peoples diets are incredibly imbalanced

[flat sedge]

I usually drink 1-2 gallons of water at my desk during the day, more if i'm taking hourly walking breaks

[stoic cave]

Yes water as well and maybe reduce caffeine intake if you are consuming any

Personally I can't recommend going over 1 gallon a day. If you would like to do that consult your doctor

[ebon mica]

This sounds like something that makes you have those walking breaks 😄

[stoic cave]

It removes to many nutrients from the body and flushes the system. It can, in some cases, be doing more harm than good

[tawdry frost]

Water poisoning for over drinking water

[stoic cave]

Ive mentioned posting a redacted copy of my resume for a while now so here it is for anyone interested

There is stuff missing from this but its just to give a general picture

[quick forum]

Nice to meet you, First Last

[stoic cave]

I already leak enough PII on here lol

[light urchin]

I always pictured you more as a Frank than a First. Hm.

[ancient prairie]

i'd put your IDS/IPS and SIEM experience (specifically which ones too) under skills; e.g. Splunk and zeek/snort would be two big keyword identifiers for HR

also, you have experience with Active Directory, homelabbing, and campus wide networks so you should definitely have "Experience with TCP/IP stack, network configurations" somewhere in there too, otherwise pretty solid!
would definitely be enough to get you a decent job by me

[static tide]

i agree with this, put in some specific technologies you used

[stoic cave]

Yeah i currently have a job which is nice. I mainly just posted this for others but I will make those changes honestly. I like them

[pseudo creek]

Format looks good, the light text looks a bit too light.

Skills - Drop Microsoft Office, spell out FTK, Just put IDA and not IDA Freweware. Based on the rest of your resume, your skills is too light, look at what you have done otherwise and move that to skills even if it is something you did in a homelab.

I'm gonna disagree with Droogy slightly, I would add networking, but I don't think TCP/IP should be on a resume.

[ebon mica]

Unless you have deep experience on it.

[pseudo creek]

well true, like if you talk about generic networking stuff, wireshark, etc, I assume you have a base understanding of TCP/IP

[flat sedge]

I'd expect to see TCP/IP only if a candidate can start quoting from relevant RFCs

[ebon mica]

I've at times asked if I should get to PDU level when asked about networking with "tell in detail..." 🙂

[woven socket]

I started getting selected more often once I put "Network administrator" up at the top in bold letters. Probably because whatever script the company has running on the resume picks out a bunch of key words fist

[stoic cave]

Yeah like I said this is a redacted and edited old copy. It's missing some things completely but I think posting it here will give others a good reference point and also allow others to see how a critique is done

Once I go back on the market the skills section will probably be rebuilt and some other changes

[static tide]

on a cv, if i have for example, CCNA R&S and CCNP R&S, should i put both? or just CCNP R&S since CCNA R&S is implied

i know it's probably best to have both, but takes it onto two pages :/

[pseudo creek]

I think it’s fine just to have CCNP listed

[ancient meteor]

i'd put them both. Companies do value all ur certs 🙂

[bronze lodge]

Wondering if anyone has any info on this concept...and this isn't just US based as I am sure multiple nations have this...but is there an industry or company that provides like a security compliance rating for data that is not considered protected or if it is this could be supplementary that would provide more comprehensive auditing for companies to say they get a "A rating" on PCI-DSS+ or HIPAA+. I'm wondering from a consulting standpoint is there's a market for this

Essentially like the US Better Business Bureau where you could give more in depth auditing...as someone who works for a place with PCI-DSS and GLB, I'm often concerned with how light and not in depth th auditing is lol

[stoic cave]

With those two specifically, HIPPA and PCI, it's you're either compliant or you're not. If you're not you get levied huge fines against you

And both are taken seriously. PCI audits are pretty hardcore from my understanding

[bronze lodge]

Maybe since I'm only being ran through very specific items they seem to be more concerned about the "buzz words" of data governance and not the larger environment picture. Without disparaging my workplace too much we get asked about like patching compliance against specific threats or these one ticket items, but never about like possible lateral movements etc.

Some real threat intel would have to go into that but I guess I understand why it isn't...that's a ton of data to get from larger enterprise's

[stoic cave]

My only experience is through the eyes of others though so I may be wrong

One person I knew was a CISO of a large hospital network and they were terrified of HIPPA audits and took their stuff seriously

[bronze lodge]

Was wondering if it'd be worth offering up a supplemental service like I just added "+" to PCI to say you're compliant with these AND these noted supplemental items and give like a list of shit to check off

See, I deal with a lot of our threat stuff and patching and all that shit and we deal with PCI, GBL but I never feel concerned

They never press but yeah I've not dealt with HIPPA but even so...I know of a pharmacy here that doesn't use any VPN solution for their systems so it's all open on a network lmao

[stoic cave]

Yeah while I think the + designation would be good you have to be able to "sell it" to these orgs. Nothing will change without teeth and at that point why not update the requirements

[bronze lodge]

Yeah, it would have to be bought into pretty heavily but my intention has been for awhile to do like small/medium local business auditing/pen testing and see if like a local council would pick it up as an accreditation

[ancient prairie]

well I believe the Fed just proposed some sort of security rating based on risk

[bronze lodge]

Interesting if true!

[stoic cave]

For me I see another layer of possible waste and ways for it to be exploited which is why I'm apprehensive

[ancient prairie]

ah okay close, its actually a software security grade, not organizational grade
https://www.cyberscoop.com/biden-administration-cybersecurity-ratings-solarwinds-microsoft-update/

I have mixed feelings about it as the BBB is a joke and has a similar premise

[bronze lodge]

Understandably so. It would definitely be hard to scale but was really a concept I was messing with

[bronze lodge]

Agreed. It seems like it could just be "bought" essentially, and it could just be arbitrary too, if we don't know exactly what's measured and an improvement roadmap it's kind of pointless

[stoic cave]

Yeah security is already hard enough to sell to businesses as it costs a lot and doesn't have a return

[bronze lodge]

It's like selling insurance lol. Which is disappointing to say but it's unfortunately true

[stoic cave]

Because it basically is insurance

[ancient prairie]

good security will always be an organizational culture thing, need everyone to buy in

[stoic cave]

Yep

Not going to lie it's kind of weird being on the userland side

[bronze lodge]

Appreciate the input, knew we'd would have some good feedback here

[ancient prairie]

then you end up with my situation, where im basically the only security-minded person in the entire org and have to "sell" certain controls and pretty much restricted to open-source/free solutions, which is still very doable but harder

[stoic cave]

Personally while I like having free and open source things, "you get what you pay for" is an incredibly real statement lol

[bronze lodge]

It's not a good situation to be in @ancient prairie but it's the same in a lot of places.. I am in the same situation mostly lol

Idk if the Solarwinds shit just made more prevalent or more reported on but way more supply chain attacks have come across my feed too, speaking of open source

[ancient prairie]

yeah luckily I don't get much pushback (except for setting up 2FA lol) and my bosses kinda let me run wild

[stoic cave]

It's because people are actually looking now lol

[ancient prairie]

ideally I would like a MSP to set-up a SOC for off hours but thats a tough sell

[stoic cave]

The SolarWinds attack was kind of an eye opener and people started to look at their own stuff

[bronze lodge]

We are setting up a SOC now...gotta say it fucking sucks when your company is cheap as fuck and wants fresh college CS grads to handle security response lmao

[stoic cave]

I mean as long as you have some higher level talent as well to guide them is that an issue?

I've never been in a SOC so idk

[bronze lodge]

It's the same issue for us, too much work not enough resources

[ancient prairie]

yeah thats another thing, I have a bootleg ass "SOC" that I manage and set-up myself but I would love to have a senior person to shadow and learn from obviously

[stoic cave]

I literally work in a hole lol

[bronze lodge]

We underwent an internal audit for all our work and functionality and the auditor said we needed 50% more bodies to meet expectations lol

[stoic cave]

A hole that doubles as a storage space

Like bare min?

Oof

[ancient prairie]

CEO: "50% more bodies? Okay we'll just make the people we have work 50% harder instead "

[bronze lodge]

Yep....but my team is like a Sys Admin/Security ops team so we are stretched but it is what it is...they're so hard in for automation so we can do other shit. Our org is fucking weird as hell lol

[bronze lodge]

It's upsetting how fucking true this is lmao

[stoic cave]

I feel like I have it good over in the Goob sector lol

[ancient prairie]

well cheers to the many hats club, I don't hate it entirely atm just bc im getting exposed to and experience with a lot of things

[stoic cave]

I clock in at 9 and leave at 5

[bronze lodge]

Makes your resume look good as hell

[ancient prairie]

same, thankfully im never on call or have irregular hours - i need that divide in my life between personal vs. professional

[bronze lodge]

I am on the worst schedule, in the fact that it's random dealing with global stuff...but I get to travel(non pandemic) so it's a good tradeoff

For now at least lol

[ancient prairie]

ah okay gotcha, yeah we're global too but thankfully i just manage the US stuff, more specifically our HQ

[stoic cave]

I'm global as well just a little different work than y'all

[bronze lodge]

You just gotta learn to fuck off...my boss is Australian and they are way more lax than in the US

[stoic cave]

Global presence whether people want it or not

[bronze lodge]

Pretty much just meet deliverables, respond as needed and you can do whatever lol. I may or may not take naps in the middle of the day where possible

[stoic cave]

Yeah the server closet i work in is a little loud for that

Some dev group decided to spin up the loudest servers/switches known to man last week

And didn't adjust the air system to compensate so it got incredibly hot with a few of us in there

[bronze lodge]

I remember seeing our Ops sitting area for our data center on the east coast. They had the best chairs, huge TVs for server monitoring in real time and for watching other shit

I was envious

[stoic cave]

Yeah i have a folding table

[bronze lodge]

In our first data center where I started was pretty much what you describe...had a crash cart and a folding chair and a permanent workstation at a table

The good ole days lol

I just got to install a new pressure and biometric based mantrap at our new DC though, that thing is badass lol

[stoic cave]

That's cool

[stoic cave]

Oh that reminds me of one man trap Ive been through. It's at the Reichstag and it is probably the coolest thing

At first glance you don't even realize it's a man trap until you're in it

[bronze lodge]

Not gonna lie a mantrap at the reichstag sounds pretty fucking metal and I'd love to check it out

Maybe they'll let me test their physical security there

[stoic cave]

Yeah ive been inside the Reichstag twice and each time I got to see something new

Wow thanks autocorrect lol

The second time I went we got to see a wall that they didn't renovate post WWII and it still has all of the graffiti from the soldiers that captured it

Which were the Red Army and I think specifically it was a tank brigade

Let's just say they weren't fans of the Germans

The worst part of the capture of the Reichstag was that the Germans faked intelligence and fooled the Red Army into thinking it was a target they couldn't lose. As such the Red Army threw a ton of men at it and a lot of them died

[flat sedge]

@bronze lodge Compliance is a hugely complicated issue, especially where mapping requirements across frameworks is concerned. Remember too, that the vast majority of frameworks are industry and not government. Even HIPAA isn't really a set of technical requirements, it is a set of regulations mandating protection of PHI and PII within healthcare systems.

HiTRUST CSF does provide a lot of common controls, but getting that accreditation is a very strict process that is time bound. If an organization doesn't come close passing criteria before that audit process begins, it's extremely unlikely to remediate in the allowed timeframe

[bronze lodge]

That's a great distinction, regulation vs technical controls/compliance. That was the distinction I needed

[jagged mango]

What jobs do you guys think are most likely to be remote in the future even after coronoa stuff is gone? The obvious ones I think are like web app pentesters/bug bounty but are there any others?

[opaque laurel]

well, anything that people worked remotely for prior to covid would still be remote possible, it's largely down to company policy and standards and level of position

[jagged mango]

yeah it seems like its largely up to the company but Im guessing there are some jobs which are inherently more "remote". like server guys need to be in the data centre at least occasionally while there are some other people that can be completely remote

[pseudo creek]

Server admins (which is a job filled by men and women) is a job that is changing due to cloud technologies, which means you aren't onsite.

Lots of security jobs can be remote, may be easier to ask which ones can't be such as SOC analyst and NOC analyst maybe not.

I've been fully remote for 6 years myself and work in security.

[jagged mango]

just wondering why a SOC analyst wouldnt be, Ive recently started a soc analyst role and its basically fully remote

they prefer you to go in once a week or so but I think thats to get you to see the team etc

[pseudo creek]

I guess it depends, I would think if you are in an envirionment where you are monitoring and have to quickly collaborate with other team members, some management types may not see remote as an option.

I'll also say as someone who has worked in various offices, worked remote or partly remote, etc, remote work hinders growth of junior team members. Its great for senior team members but not so great for junior

[jagged mango]

I can see how that may be the case

although not having to travel 2 hours per day is to good

[terse stone]

thoughts on https://www.white-hat-hacker.com/certified-whitehat-hacker-associate-cwa

[zealous forge]

Currently a soc analyst, done ccna, sec+ and GCIH.
Got 20 oscp like boxes from vulnhub to do over the next couple months then book 90 days pwk, does that sound reasonable? Done most the offensive pathway on thm too

[languid hearth]

it seems like you've got a solid background, I don't know if I'd go 90 days right off the bat, depending on how fast you work, you can get a good grip on most of the PWK boxes with 30-60 days

[charred glade]

what is the requirements to be a cyber security analyst?

[tawdry frost]

@stoic cave I got it

[pseudo creek]

search job listings in your area and see what they say?

[stoic cave]

The jerb?

[tawdry frost]

Yes sir

[pseudo creek]

I'm hoping for new jerb

[stoic cave]

Nice!

[opaque laurel]

time for a change? looking for new type of work?

[stoic cave]

Are you cleared? I forget

[pseudo creek]

a change is imminent, company is restructuring stuff, just trying to get ahead of it

[pseudo creek]

now now, that would be telling... I have 0 interest in non WFH jobs

[stoic cave]

Ok well im not sure if they are all in person but I was just reached out to about a myriad of positions that are becoming available

[pseudo creek]

just an opportunity popped up within my company and my job is likely going to change sooner or later so

[stoic cave]

Lockheed, Sierra Nevada Corp, etc

[pseudo creek]

yeah recruiters get in touch with me daily, AWS has been persistent lately about their AWSome opportunities

[stoic cave]

Say no

[pseudo creek]

I just ignore

[stoic cave]

Amazon is just as bad as Google

[pseudo creek]

I'm aware, lots of people from my company have been attracted by $$$ to go to AWS

the total workaholics seem happy, the ones that weren't, are miserable

[opaque laurel]

ah wow, good luck with the restructure

[pseudo creek]

I'd land in a good position, but maybe not the exact position I'd want

[opaque laurel]

i'm trying to bridge the massive divide from my team to the red team at my workplace but it might be another 6 months before i get anywhere

[pseudo creek]

lots of churn

hard to explain but I was in a security consulting type position for quite a few years, I watched for various opportunities and was passed by for a while but then finally made the bridge to more of a security engineering/design position

just applying, gaining skills, etc, etc

don't give up, it'll happen

[haughty leaf]

What state/region?

[stoic cave]

I think most were NOVA and DMV

[haughty leaf]

I'm getting tired of where I'm at. Thinking of making the move to D.C area in the coming year or so.

[stoic cave]

It's expensive AF

I'm an hour outside of DC ish and I'm paying $1400 for a 1 bedroom apartment

Almost as much as my parents mortgage

[pseudo creek]

Maryland is cheaper than Virginia and less crowded

[haughty leaf]

Well I'm out west, so I'm in an "affordable" $1400/month while my friends in other states are above $2000

[pseudo creek]

Come on down

What kind of position you looking for? How many years work experience do you have?

[haughty leaf]

I'm coming from a background in hospitality and just recently moved to a NOC technician. But I would rather do security. Studying all the things right now. THM, INE, PentesterLabs.

[stoic cave]

Unfortunately there weren't any places to rent in Maryland near where I work

[flat sedge]

@pseudo creek Do you have a current clearance? IIRC you said you had one.... I might be able to help you make a move, DM me please.

[pseudo creek]

I'm not interested in leaving my company at this time

[pseudo creek]

ahh ok, I'll keep on the lookout

[forest knoll]

@meager sandal I'd ask that question in here 🙂

[meager sandal]

ooh ok dude

Learning Cybersecurity
I am a newbie here can I know which course is the best if am just starting out (OSCP or OSWP)

[remote mauve]

I pasted my response in here @meager sandal sorry for the double ping:
an exam from eLearn, maybe if you're just starting out OSCP and OSWP may not be the right choice in your instance. I would advise to either start with eJPT - eLearn Junior Penetration Tester or wait for a bit longer before venturing into the likes of the certifications above as they require you to have more than just basic understanding of the subject 🙂 but that is my opinion. the rest is up to you

[undone shore]

OSWP is also very specific

[sterile coyote]

I see now for take the EcPPT by elearnsecurity elearn want 400 euros , plus, if you want to study on material or on the labs, you must pay the subscription to INE organizations....

When i took the eJPT i pay only 400 euros , with two retake , and unlimited labs...

[languid hearth]

-warn @tacit gate Asking for exam question dumps is against all exam vendors terms of service, including EC-Councils. Please refrain from asking for them.

[serene umbra]

⚠ Warned Dante#2384

[tacit gate]

Sorry

[shrewd briar]

I'm new here

[glad cipher]

Welcome

[shrewd briar]

Hello everyone... I'm glad to join

[shrewd briar]

Thanks man

[serene umbra]

Gave +1 Rep to @glad cipher

[glad cipher]

Have you tried any rooms yet?

[shrewd briar]

Yes

I rooted rootme yesterday... It was fun actually

I am trying overpass and I got stucked

At the login page

[glad cipher]

Awesome! If you have any questions there is tons of knowledge in here. This channel is specific to careers and certs but ask away if you need anything

[shrewd briar]

Thank @COLONEL

[warm hinge]

Noob question here. I'm transitioning away from a 20 year career in another technical industry. My initial plan was to get my Security+ and CySA+ certifications to prepare for a SOC analyst role. I spoke to someone the other day at a large cyber security firm and he recommended I get CEH to stand out from everyone else, but the research I've done says it's not well-regarded in the industry anymore apart from HR. Since my career goal is blue team, what would any of you recommend for certs beyond Security+ and CySA+ to help stand out when I start looking for job. All of this of course in addition to the practical skills I am developing here on THM. Any advice would be appreciated.

[golden ore]

Sec+ and CySA+ are great certs to start with to get a base understanding, CEH has been around for many years and is a recognized cert but you could also to CompTIA's Pentest+ and get similar knowledge

[flat sedge]

In my view, CEH basically certifies that the holder has a basic understanding of the ethical considerations of security

[warm hinge]

Cost is also a factor to me. Don’t get me wrong, I’m willing to invest in my education. But also trying to get maximal results. My contact at EC Council recommended a learning path that would be $3,000, and I just have to believe the other certs are worth looking at since the knowledge base seems similar and yet they are much, much more affordable

[static tide]

sec+ and cysa+ are both good certs, and if you're going for a junior soc analyst, they will most likely get you the interviews, then it's up to you to impress

networking certs are also highly valued in blue teaming, so maybe look at the ccna (200-301) too

tryhackme has lots of blue team content and a path dedicated to giving you the skills a soc analyst needs, and interviewers would love to hear you've been doing them

[warm hinge]

Thanks!

[static tide]

you're welcome :)

[haughty leaf]

Speaking of blue team, anyone with experience in BlueTeamLabs? I was thinking of checking them out, but with it being a British company (I think, price was in pounds), I'm wondering if it's even well-known in America.

[ancient prairie]

from my understanding its a really good and technical course, but yeah it gets no love unfortunately but still could be a foot in the door thing

I've done a bunch of labs on their new platform if you want to check it out, supposedly the labs align somewhat with what the course teaches

[edgy tiger]

The certificate isnt really known yet, a lot of potential when level 2 and 3 comes out. Probally worthit to get they cover like main enterprise software (not 100% sure) so a nice way to get some knowledge on it!

[haughty leaf]

Thanks!

[warm hinge]

Hi! For someone such as myself looking to get certified is the security+ certificate a good start or should I look at the OSCP ? Or maybe another ?

[quick forum]

Sec+ is a good general security cert. OSCP is a pentest cert, much much less general

[warm hinge]

Thank you, I guess then that getting an all-round grasp on cyber security is better so I can decide what exactly I want to do like pentedting or security researcher for example ?

Well, the responses to my post above were encouraging. I had already bought books for a few certs just to give myself some reading material. And just now the new Security+ book arrived in the mail. So between this, some Udemy courses I bought, and THM, I've got a lot to keep me busy. Thanks again!

[earnest helm]

I can highly recommend sec+ as an entry point!

[quick forum]

That sounds like a good plan. I'd definitely say Sec+ would be a good cert for that goal.

[warm hinge]

Thanks guys!!

[ashen hatch]

recently, codecademy has launched Intro to cybersecurity and they're aiming for more on web app pentesting...
here anyone eligible can apply for it , hope it helps

https://www.codecademy.com/about/jobs?gh_jid=5167365002

[blissful isle]

What are some entry level Information Security job titles?

[quick forum]

Junior SOC Analyst is a big one

[stoic cave]

I somehow skipped the junior titling but in all honesty look at the requirements and see what you match

[blissful isle]

@quick forum What does SOC stand for?

[golden ore]

Security Operation Center

[blissful isle]

Does Junior imply entry level? I feel like i've seen a lot of those that want 2-5 years experience

[golden ore]

Usually, but it will vary on company. You can also try to relate other experience to overcome a time requirement sometimes

[blissful isle]

What other job board sites would people recommend?

[haughty leaf]

I went through ziprecruiter and searched by the title I want in a few years as I gain more experience, then went directly to those company's websites and looked for entry-level positions. I can't say that it actually worked as I ended up getting a job somewhere else, and I'm still wondering if I should have held out for something more security-related, but here we are. I did get a technical interview with FireEye that way but then failed for not having enough Linux experience.

[golden ore]

I think the job board depends on country, I think LinkedIn has global, but not sure if others do as well

[stoic cave]

LinkedIn is great for OSINT style job hunting

[light urchin]

The other thing to keep in mind is that usually job descriptions are written by some HR person with a degree in art history or music appreciation or something, who has no idea what the job even is. And they are all looking for ALL the skills, and 100 years of experience in each. So don't be afraid to apply for something you're a little underqualified for on paper.

[stoic cave]

My job had no description

Lol

[golden ore]

not always

[light urchin]

True, there are exceptions to every rule

[golden ore]

but I have seen many a year or two later and the information in it is the same

[stoic cave]

"be knowledgeable in current Cybersecurity practices" and "familiarity DOD manuals x. X. X" that was it

[light urchin]

well, often cleared jobs won't go into detail because you're not cleared to know what the job is yet :). But that's kinda different

[golden ore]

I have seen a few with minimal details, but most will say has or able to get clearance

[stoic cave]

Yeah i know. Jokes on me though because I have done nothing that has required said cleared level

[light urchin]

I was more just responding to the "junior role requires 2-5yrs experience" comment from above

well, technically, neither does the janitor sweeping the floor. But to get into the space, you gotta be trustworthy, so a clearance ye shall have/require

[golden ore]

I was listening to some talk and the person had created a program that was only about a year old and they were seeing job posts asking for 5 - 10 yrs experience in the program

[stoic cave]

I've been cleared for 2 years now and I've never actually used it

[stoic cave]

I saw some postings like that

[golden ore]

clearance is sometimes more about possible access vs real access

[light urchin]

Yeah, there's a post along those lines that went viral, where the creator was turned down for a job because he didn't have 12yrs exp with the tool he'd only created 8-10 years ago or something like that

[stoic cave]

Actually I have used it once. Only to check if I had access to certain systems and that was it

[blissful isle]

Speaking of clearance what is everyone's thoughts about military intelligence analyst positions (USA).

And using that to get a clearanbce

[stoic cave]

Like enlisting into MI?

[golden ore]

if you enlist and can't pass clearance requirements, you get re-assigned

[blissful isle]

Specifically was looking at this https://jobs.nationalguard.com/job/198029/35f-intelligence-analyst/?utm_campaign=2020mosprogram&utm_source=5&utm_medium=indeed7663849intelligence&utm_content=web

Was wondering if it was not an optimal path to take if you have a college degree

[stoic cave]

Yes so you realize that this requires an oath of enlistment

[blissful isle]

yes

[stoic cave]

And once you sign the dotted line there is no backing out

[light urchin]

you are literally government property

[blissful isle]

Yeah.

[stoic cave]

Empty can talk more to this than I can

[golden ore]

wasn't in the Army so I can't comment

at least on the job post

[light urchin]

National guard is not a bad way to go, IMO. Your commitment is generally 1 weekend a month and 2 weeks a year. Plus a few months (or so) of initial training

[stoic cave]

Natty has a different culture than big army but it's still the military

And i would be 100% sure it's what you want before you commit

[light urchin]

here's the kicker, though- you can and WILL get called to active duty at the worst times, and you have zero choice in the matter

[golden ore]

until deployed for short period of time

[stoic cave]

This

Half my school is getting deployed at the end of this year

[light urchin]

I saw a lot of folks who were called away from good jobs to go 'play in the sandbox' overseas

it can be incredibly disruptive to your life, your job, your family, your finances, if you are not prepared for it

[stoic cave]

I'm not trying to talk you out of it as I am preparing for the same thing but you need to be certain

[blissful isle]

You would get deployed doing tasks that relate to your position though right? Sorry I'm just not seeing the part that is bad.

[light urchin]

yes and no

[stoic cave]

It depends as with everything in the military

[blissful isle]

Most contracts are 4 years right?

[light urchin]

yes, you would get activated because there is a need for your job. But there's also the distinct possibility you'd spend half your time painting rocks or sitting on a live grenade or something equally stupid

[light urchin]

Used to be that all are 8, but not all 8 have to be active

[stoic cave]

Again depends but 6 is generally the norm for the recruiting station at my Uni

[golden ore]

variable on the job, but usually 4 -5 yrs

[stoic cave]

For reference, it was the VT national guard and they are under 10th Mountain

So they have a higher operational temp than most guard units

[golden ore]

part of that time is active duty or ready reserve, the rest would be inactive ready reserve; but it is only the initial contract

[light urchin]

correct

but IRR can also be called to active duty at any time. So just keep that in mind

[blissful isle]

I am more so just wondering if you think it is worth it from a money point of view / or being able to attain a clearance. As apposed to working as a civilian where it seems you will have a hard time getting into government.

[light urchin]

you're "out", but you can be back in tomorrow

[light urchin]

Really depends. If you have skills, you can get hired at a civvy defense contractor and they will get you the clearance.

[golden ore]

I had to do one muster on IRR, mostly for here are some great job offers or are you sure you don't want back in

[stoic cave]

Basically be ready for a contract negotiation where you have zero leverage

Are you graduated?

Did you mention that?

[blissful isle]

Graduate in a month

[light urchin]

Going in with a degree, you might be better off shooting for officer. But in some ways, that's even less flexible than enlisted

[flat sedge]

Easiest path to attain clearance is active service. It's a hugely expensive process to get tickets from industry; most companies do not want to invest in that sponsorship from scratch.

[stoic cave]

Yeah army decides your MOS as officer

[light urchin]

Actually, I don't think that's true. I think you can get a guaranteed MOS, if you can pass it

could be wrong though

[stoic cave]

Hmm really? Maybe that's only ROTC then

We would have a branching ceremony every year for the Army kids

[light urchin]

I've seen several that will happily do it for lots of people, so kinda depends on the time/company/contract I guess

[stoic cave]

And they would get told what BOLC they were going to

[stoic cave]

Yeah i got lucky and got put up during my internship

[blissful isle]

I'm sensing the consensus is that it is very possible to attain a clearance without active service and based on the pay i saw for army seems like not that worth it.

[stoic cave]

I think with army officership coming from ROTC school pecking order plays a role in getting your preferred MOS as well

[light urchin]

It depends on a lot of factors. Can you get a clearance without a .mil background? Sure. As long as you have skills that a company needs, and is willing to sponsor you for the clearance.

Is .mil worth it? Again, depends on what your goals are and what you want out of life

Personally, I'd say don't put on the uniform unless you're willing to die for it. Because some day you might have to.

[blissful isle]

Yeah I have friends in but the money just doesn't seem to be in the right spot.

[light urchin]

Generally speaking, most people don't join the military for the money

[stoic cave]

Nope

[light urchin]

you can make a good paycheck as an officer, or senior enlisted, but by then, you've also spent a lot of time doing sh*t jobs probably

What's your degree in?

[blissful isle]

Information Systems

[light urchin]

I'd be willing to bet you can make a lot more money as a civilian than you ever could in the military. Will that look good on a resume? Sure. Will it open doors? Yeah, probably. Will a clearance help get you some "cool" jobs later? Yeah, potentially. But even as just some guy in a server closet at some random tech company, you're going to have more career options.

Right now, tech jobs are a hot commodity. The demand FAR outstrips the supply, pretty much across the board.

[blissful isle]

Forgive me if this is an inappropriate question on this server, but is it safe to say people in information security in America are generally pro-military, or pro-America i guess?

[light urchin]

I can't answer that, really. I would say it's too broad to generalize.

Even within the military, in combat and special operations units, you see a range of people

[blissful isle]

My job search is just accelerating right now as I look to graduate in a month and these job board postings are all looking similar to me lol. they either want people with 1-5 years experience or 5-10 years. I still apply to the former but nothing is sticking yet.

[light urchin]

don't get discouraged, and get used to it

[lofty ibex]

There's a lot of tech jobs, due to a major lack of skilled people to do them. (A lot of people seem to think that because of the massive amount of jobs, it's easy to land them)

[light urchin]

I have a set of skills that are in very high demand, and I get contacted by recruiters every day. On average, 5-20 per day, day in, day out. And most of those are junk or don't interest me.

[light urchin]

Very true. But I also see many jobs wanting the perfect candidate who can do all things and has tons of experience in all of them, which is basically nonexistent

[lofty ibex]

Job specs will always put the ideal qualifications/experience and are always open to the idea of taking less than the asked skills

[light urchin]

@blissful isle job hunts are always a numbers game- it may take you a lot of applications to get an interview, and a lot of interviews to find one you actually like, and that they like you

[light urchin]

I would replace "always open" with "hopefully open", but yeah, I agree 🙂

[lofty ibex]

Just gotta show a passion and an employer tends to open up to the idea especially if it's a junior role

[light urchin]

yeah. As someone who has done a lot of interviewing and hiring over the years, if I'm hiring for a junior, fresh college grad, I'm not looking for skillsets much, tbh. I'm looking for attitude and enthusiasm. Can I work with this person? Are they a team player? Are they eager to learn? I would gladly take a lesser skilled person that's teachable and easy to work with than a hotshot/rockstar who is arrogant or something

[pseudo creek]

also if you are an aspiring junior, in college, please, please get some job experience, it will only benefit you. Graduating without any work experience will make things so so much harder

[flat sedge]

Paid internships are really easy to come by if you are in a technical field of study. Start looking in november for summer jobs though. it's too late right now to find an internship for June unless you get very very lucky.

[light urchin]

I think he/she said he graduates in a month

But yes, what Zojja and juun said are both 100% correct/I agree

[pseudo creek]

I'm not sure what this means? I have a wide diverse array of friends and coworkers, and they have varied beliefs. In my job (which is very... gov centric), security or not, there are even a wide array of beliefs. I don't know anyone (even people who would love to abolish the military completey) who is anti-military persons. Some people think military spending should be reduced, some people think xyz, I also don't know anyone 'anti-america'. I'm not sure what pro-America means in terms of someone who lives/works in the United States

[pseudo creek]

yeah it is a generic, but I've seen it a lot here. My company hires a ton of entry level people but the common theme is they have some form of work experience, internship, job at college, something

[light urchin]

Yeah, an internship as a college kid is a HUGE thing, for both parties. As an employer, I know the kid has some tangible skills. As a student, you can start to learn what you like or dislike

[ancient prairie]

I think there is a bit of Military glorification within certain sectors of infosec, specifically red team operations - just look at Lockheed Martin creating the whole cyber "kill-chain" thing

or certain infosec people prefacing anything they say "well what we did in the Army..." in order to sell their product/pitch

[pseudo creek]

I think the influence is different that glorification

[rugged sable]

@ancient prairie The cyber killchain isn't as bad as CYBOK imo

[pseudo creek]

(and cyber kill chain was not developed by a red team but a blue one)

[ancient prairie]

fair, but it does put a rather combative spin on hacking by calling it a kill-chain which is military terminology afaik

[pseudo creek]

but like I said, overall in cyber security, you'll find a variety of beliefs/ideals/etc

[ancient prairie]

for sure, and you're most likely to run into people that have well formed opinions on either side, tend to be an analytical bunch :p

[light urchin]

Well, a lot of that is being done for defense contractors/military contracts, so it kinda fits

[pseudo creek]

again thats the influence, rather than glorification

[light urchin]

agreed

[pseudo creek]

honestly, I've found more people in cyber security to be on the liberal side of the political spectrum than not even in the gov contractor space

[undone shore]

Tech tends to attract progressive people

[pseudo creek]

yeah, where you see it not is the people who came from the military and go more into the ISSO type roles for classified programs

but even in the military, you have politically liberal people, my family is full of military veterans, all are super liberal on the political spectrum

[opaque laurel]

that being said, finding pro-America people (whatever that means) in America isn't surprising, kind of expected I think

[pseudo creek]

one of the questions for a security clearance is... do you belong to any organization that wants to overthrow the US government... I'm jusre after Jan 6th, lots of people were like 'well kinda'

[rugged sable]

Jan 6th?

[pseudo creek]

storming of the US capitol

[rugged sable]

hahahah okay

[pseudo creek]

its all the Q-anon stuff which I never quite understood but that seemed like their goal

[rugged sable]

@pseudo creek One popular question for SC is "What do you think of Edward Snowden, or Wikileaks?"

[light urchin]

I saw a recent story saying something like 20% of that traffic was coming from overseas.

[ancient prairie]

the scary thing is there's some q-anon people in the military as well

[pseudo creek]

I never heard of that

[pseudo creek]

yeah but what happens when they get to the security clearance questions about overthrowing the US government "I was but not anymore"

[light urchin]

Snowden is a good example, actually. Self proclaimed patriot, did something that some people would consider treasonous, others would consider very patriotic and honorable. So like many have said, broad range of opinions/people/attitudes/mindsets/etc.

[pseudo creek]

I'm like Switzerland when it comes to Snowden...

[ancient prairie]

"I plead the 5th"

[light urchin]

polygraph usually catches those 🤷‍♂️

[rugged sable]

Polygraphs are bad tech

[ancient prairie]

yeah when it comes to that type of interview, he breach protocol plain and clear, when it comes to a security role thats a nope

[pseudo creek]

they really are

[ancient prairie]

oh those are ez pz

[rugged sable]

https://www.youtube.com/watch?v=nyDMoGjKvNk

[ancient prairie]

the guy who helped create them I think taught how to bypass them for years?

[rugged sable]

Way better to train someone to read body language than to invest in one of those machines haha

[light urchin]

Oh I agree, poly's aren't an end-all-be-all. But they can be useful

[opaque laurel]

when they give you the results you want

lmao

[pseudo creek]

its kind of horrible though... like when asked a quesiton, you dig into your mind for the littlest thing... "have you ever stolen anything?" "Well one time, I took a pen from the bank but it was an accident"

[opaque laurel]

BANK ROBBER?

[pseudo creek]

crap, caught me

[light urchin]

See, it's people like YOU why all my good pens keep disappearing

[pseudo creek]

all mine do to, so I have to replenish them somehow

[light urchin]

:smh:

[golden ore]

that is what conferences was good for

I seem to have a large stash of pens now

[light urchin]

unless your company has a policy that says you can't accept them, because that counts as a gift

😢

[pseudo creek]

under $25...

[opaque laurel]

they are usually advertising for a product/company so it shouldn't count as a gift typically anyway

but maybe

[rugged sable]

mine is $10 😢

[pseudo creek]

"SANS - Free ipad with course" cries in gov contractor employee

[golden ore]

I have a drawer with a bunch of shirts too

[rugged sable]

i can accept gifts but i have to go through like a board of gift giving lol

[pseudo creek]

yeah I stopped taking shirts as I don't like wearing logo shirts

but the socks... I got some nice socks

[golden ore]

all the socks I got were too small for me

[pseudo creek]

snort, slack, various other companies

[light urchin]

Mine was $0 for a while

[pseudo creek]

funny they are usually big on me but I take them

[golden ore]

I have size 14 feet, so most socks aren't built for me

[pseudo creek]

and hoodies... I gladly accept any and all hoodies

[light urchin]

I gotta say, AWS gives out some pretty nice hoodies

[golden ore]

swag bags are always good

[pseudo creek]

yes, I got quite a collection of AWS hoodies at this point

[light urchin]

correction: sells for $2500 with your re:Invent ticket

[golden ore]

no hoodies, but I do have the notepad

[pseudo creek]

I don't pay for it

oh yeah... moleskine notebooks too

[ancient prairie]

I just applied to their work-study so fingers crossed

[pseudo creek]

I got a ton of moleskine notebooks from various vendors

[light urchin]

I don't have any moleskin notebooks. 🙁

[pseudo creek]

boo

[golden ore]

usb plugs or cords are becoming common now

[pseudo creek]

one conference, I had so many, I had to leave a few at the hotel room

[light urchin]

or screw that. Like I'm trusting anything that plugs into my hardware?

[pseudo creek]

just say no to usb plugs

[ancient prairie]

i used to buy moleskines in high school, i've strongly hinted to my SO that I want a reMarkable tablet

[golden ore]

not thumbdrives

[pseudo creek]

it doesn't have to be a thumbdrive

[golden ore]

wall plug

[light urchin]

have you not seen the charging cables that are rubber duckies or sniffers?

[pseudo creek]

yes even wall plugs are no good, wouldn't trust them

[light urchin]

Side note: we've all just spent like that last 10 minutes reveling in the 'glory days' of past conference swag. 🤦‍♂️

[pseudo creek]

ha

I have no conferences planned this year but re:invent is late enough in the year that it might be on the table for me

[golden ore]

most are still running virtual

[light urchin]

that was a fun one. I wouldn't pay for it myself, but if the boss wants to send me, sure

[pseudo creek]

they always have it at the end of november

[light urchin]

yeah, into first week of december

Right before the rodeo comes to town

[pseudo creek]

my husband may be able to go with me this year, we could do some hiking

although one year, the flight was like $1400 or something... I dunno why, maybe my company decided too late in the year who was going

[light urchin]

are you a fan of the Cirque shows?

[pseudo creek]

probably not... I had free tickets to one through a ServiceNow conference and skipped it

[light urchin]

hah, don't get me started on SN. But you should've gone- they are pretty cool (just my $0.02)

I went to a few last time I was down there

[pseudo creek]

I think I was just tired

I'm not much of a shows person anyway

[light urchin]

fair enough. Plenty of other things to do in LV or the area depending on your interests

normally I hate shows too, but I make an exception for cirque. I wanna maybe see some of the big magic acts too if/when I go back

[pseudo creek]

watching the prostitutes work their magic against conference attendees was pretty fun

[light urchin]

lol

I didn't see much of that

Maybe we go to different conferences

[pseudo creek]

a group of my coworkers were sitting at one of the bars in a casino and making commentary...

that was AWS

it was like 'she is trying hard... is he going to do it? is he? guess not'

[light urchin]

hah. Yeah, I can see why that would be a fun spectator sport

[pseudo creek]

normally when I go to vegas, a lot of people from my company go so they do group events and stuff

but like I said, if my husband comes, we'll go do some hiking if the weather is good, check out some vegan restaurants, etc

I also usually put $100 toward gambling

[light urchin]

If you're outdoorsy, there are sight-seeing tours that might interest you also

[pseudo creek]

I don't do helicopters 🙂

[light urchin]

no, I meant like hiking or 4x4 tours

but yeah, heli tours too

[pseudo creek]

yeah there are some decent hiking, not sure we'd do a 4x4 tour

[light urchin]

And that giant ferris wheel of dome thingy

[pseudo creek]

when I was younger, my parents and I would hike in/around Vegas every few years

[undone shore]

Have you been lucky enough to marry a vegan?

[pseudo creek]

its not that easy, I went vegan a year after we got married, he went vegan a month later

[undone shore]

Heh, good enough. You're really lucky there

[pseudo creek]

so I 'turned' him

[undone shore]

I can't imagine even trying to date someone who wasn't vegan

Disadvantage of already being there

[pseudo creek]

yeah I know, he used to love fish too and I'm bleh about fish

just find a lazy partner and then cook for them, if they are too lazy to cook, they'll probably be like 'ok I'll be vegan'

[undone shore]

But then I have to deal with a lazy partner

[pseudo creek]

or find one that hates to cook

[undone shore]

Also true. I do love cooking 🤷‍♂️

[pseudo creek]

I cook, he matches socks

(I hate matching socks with a passion)

[undone shore]

Too busy to do it often just now unfortunately. I tend to just make stuff in bulk and freeze it

[undone shore]

As good an arrangement as any 😁

My grandparents do that. She cooks, he does the washing up. Works a charm

[pseudo creek]

yeah its good to share chores

[undone shore]

Heh, I've got friends who are the most incredible team I think I've ever seen. Husband and wife outdoor instructors in their late 50s, been married since before they turned 20. I swear they can read each other's minds

Should see them cooking though -- same arrangement. She cooks, he washes up, but they manage to do it simultaneously with massive batches of food in a really small kitchen. Him predicting which stuff she'll need washed up first for whatever is next on the list, her making the food and passing the stuff back to be washed. Absolutely incredible

[light urchin]

I have a few friends who are a married cave diving couple. Similar thing.

[undone shore]

Relationship goals 😁

[pseudo creek]

we've 'only' been married 14 years, but its weird how things just become symbiotic

[light urchin]

14 years is a long time. Good for the both of you 🙂

[undone shore]

Yeah, it's always so nice to see.
I'm still at the stage of being absolutely done with dating 😆

[pseudo creek]

I was done with dating when we started dating... which made for an interesting courtship

[undone shore]

Aha, I'll bet

[light urchin]

That's how it always works- you find it when you stop looking

[pseudo creek]

I totally didn't get that he was interested because in my mind that wasn't in the cards

[undone shore]

Unless there's a pandemic

[pseudo creek]

ha ha

[light urchin]

Oh, I'm sure somebody is secretly discord-stalking you, Muiri.

[undone shore]

I very much doubt that 😆

[pseudo creek]

c'mon, young, smart, hot vegan... you got it going on

[light urchin]

Well then, get back to work making more rooms, then. I have needs.

[undone shore]

You say that...
You don't want to see the next one

YotJF was made to procrastinate from my Hummingbird because it's a nightmare to implement

[light urchin]

Nah, I do. I'm just sad cuz I know it'll be beyond my abilities (for now...)

[undone shore]

YotHB will be... something

[pseudo creek]

they are all far beyond my abilities

[undone shore]

I'll be interested to see how people get on with it. It's the first one that I'm actively ranking as hard without prompting

Will be interested to see if YotJF gets force-upgraded from medium to hard though

The last few have been

[velvet spindle]

Imagine if 0day had a vegan wife and had to give up chicken fries

[undone shore]

Should see the abuse 0day gives me for being vegan 😆
I doubt he would ever date one

[velvet spindle]

the good thing about vegans is that it's not possible to date a secret vegan, they'll tell you instantly

[light urchin]

Is that an automatic ranking thing, or just outvoted by management?

[undone shore]

That so? 👀

[light urchin]

same with crossfitters

[pseudo creek]

people don't understand how good it is...

[undone shore]

The latter 😆

[pseudo creek]

most people I work with don't know I'm vegan, even people I've eaten out with

[light urchin]

I tried to do vegan and vegetarian. I can't 😦

[pseudo creek]

its not that I hide it, its just... like I don't bring it up unless I need to

[velvet spindle]

vegans, crossfitters, law students

[undone shore]

This ^^

If people are interested I'll happily talk about it, but no point in shoving it in people's faces

[pseudo creek]

I was a crossfitter for a while too... vegan crossfitter

[light urchin]

I see the value in it, I'm just too picky of an eater

[light urchin]

One of those people 😉

[pseudo creek]

only people who are trying to feed me are people I'd tell... like umm yah

[undone shore]

^^

[light urchin]

Yeah, I used to do a lot of marathons and ultramarathons and ironmans and such. I see the value from a health and fitness perspective, I just don't like most of the food. And I'm way too lazy to cook/prep it.

[pseudo creek]

even at work, you can direct group meals to restaurants with vegan options pretty easily

[undone shore]

Yeah, that's the difficulty. People really struggle to do veganism if they can't/don't like to cook

Not without a vegan helping them

[pseudo creek]

see I'm Mexican (american), I grew up eating beans and lots of veggies so... beans, rice, veggies, bread, tortillas, guacamole, thats all my jam

[light urchin]

sadly, I dislike most veggies

[pseudo creek]

and I love making various Asian food dishes (Vietnamese, Thai, Chinese, Indian) whih are either already vegan or easy to do so

[light urchin]

stupid, I know, but it is what it is. I've tried

[pseudo creek]

like ... omit fish oil? sure I can do that

[light urchin]

I'm actually pretty optimistic about the new trend towards meat substitute type stuff

impossible burgers/etc.

I've heard good things

[pseudo creek]

I make my own seitan too... and its super easy but if you don't cook, its harder, because people don't have confidence in cooking if they fail once

[undone shore]

Tofu is absolutely amazing too

[pseudo creek]

yes... baked tofu is the stuff of my dreams

[undone shore]

Virtually nothing you can't do with it

Agreed!

Literally, if I have spare tofu I will pan-crisp it with a little salt, some nutritional yeast, and cumin (or make a satay sauce and miss out the yeast), then just have it as a snack

Sooooooo good

[pseudo creek]

I marinate it and throw it in the toaster oven

slice it up, marinate it for a couple hours, bake in toaster oven, its so good

[undone shore]

Nice 😁
What kind of marinade?

[light urchin]

... and that's how you get your clearance and get a job in cybersec

[undone shore]

Aha, fair point. Should probably shift to #quiet-conversation 😆

[pseudo creek]

usually soy sauce, olive oil, garlic

ha ha

[light urchin]

🤷‍♂️

[undone shore]

That sounds nice actually. Garlic'd olive oil is so good

[light urchin]

Lemme know when you want a job as a personal chef

[pseudo creek]

thats too much work

[light moss]

yo

[warm hinge]

Hey everyone, can one become a privacy consultant for vulnerable people specifically or is that done only through volonteering work? Trying to figure that out

I feel like getting some kinda privacy cert is the first step anyway

[flat sedge]

You could. That's going to rough and lonely consulting career. Are you trying to get on with an accredited auditor first?

[warm hinge]

Not really, please tell me more, i am trying to figure out what i actually want and is there any way to do that realistically :D

[warm hinge]

accredited auditor as in the cert i have to get? Having a hard time understanding that line

Thanks very much for answering anyway!

[flat sedge]

usually it's a firm. Deloitte and Coalfire are two firms I know of that perform 3rd party audits and are accredited by a security standards body

honestly, being a personal privacy consultant is going to be really really hard to pay the bills. Unless you happen to be on Oprah and manage to be the privacy expert to the stars

[warm hinge]

Oh, lol, ok, will think about that

[light urchin]

Juun makes a good point. But I also think it's an admirable goal. I don't have suggestions, sadly, but I do wish you luck :).

[warm hinge]

Thank you very much!

[serene umbra]

Gave +1 Rep to @light urchin

[light urchin]

You're welcome 🙂

May I ask what your goals/needs/interests are?

[warm hinge]

I am not sure, but I am interested in privacy and want to help people

[warm hinge]

Also drawing

Programming also, lots of stuff actually

[light urchin]

And in terms of career goals/aspirations?

[sturdy frigate]

i am really not that familiar with career in cyber security yet can someone help me understand how a person living in india can get a job in usa or canada

after having OSCP cert

[warm hinge]

I am not sure actually, but privacy stuff and independence would be great

[light urchin]

Is this a mid-career career shift, or fresh out of school type thing? I'm thinking you could maybe start a consulting company focused on that, but it'll be an uphill battle at first.

[sturdy frigate]

i had a lit bit experience in this field i worked at local place where i learned quiet a lot about Network pentesting. web pentesting and many more and now i feel ready to take OSCP lab and certification

I am bit of confusing after that

how to chose or pursue with companies

[light urchin]

Getting a work visa in the US can be challenging. I can't speak to canada

[ancient prairie]

Work for the EFF! Having a background as a Private Investigator or maybe some sort of OSINT Analyst would probably give you some credibility needed to do some privacy-consultation work

[sturdy frigate]

@light urchin @ancient prairie thanks for replaying

[serene umbra]

Gave +1 Rep to @light urchin

[ancient prairie]

but there's also some great organizations or even teams within orgs out there that do a lot for privacy which you could always support in a different capacity - they always need idealists and people that believe in their mission

[light urchin]

The question I keep coming back to is how to make it a viable financial/career path. And the options there are either few big customers (corporate) or lots of little customers (selling to 'average joes').

either way, it would change the approach I would take

[stoic cave]

I'm pretty sure for canada you need someone to sponsor you financially for 10 years

[sturdy frigate]

Like github and things right

[ancient prairie]

Microsoft does a ton of great work for open source, i.e. Github, but ehhh not so much for privacy lol

[sturdy frigate]

haha

[ancient prairie]

it's not easy, I know the US can be lax on immigration if you have a Phd or some other technical qualifications, either way I'd try and focus on your local job market instead of international if you're new

[sturdy frigate]

hmm

anyway thanks guys for replaying i look forward for more quires

🙂

[solar roost]

So I’m curious about how folk who are currently working in cybersecurity got their start?

[warm hinge]

thanks, that would be a dream!

[serene umbra]

Gave +1 Rep to @ancient prairie

[warm hinge]

thanks for answering everyone, i think volonteering there then trying to get a job seems like an okay plan? working on open source stuff too

[stoic cave]

I took the college route. While there I joined and assisted the Advanced computing center and also took additional technical classes as electives instead of art and such. Junior year I got an internship over the summer as an IT intern. It was hell on earth and really wasn't a great fit, all parties involved were guilty in how it went. Then I went back for my senior year and graduated with a BS in Computer Security and Information Assurance concentrating in Digital Forensics and Information Assurance Management. Then I spent the summer applying for jobs this past year and ended getting a job as a Cyber Security Engineer

I also have a Homelab where I teach myself new technologies and techniques. I'm always reading and watching things as well

[light urchin]

Feel free to DM me if you want. Volunteering is something good to put on a resume, but the utility can be hit or miss depending on where you are and what you're doing.

[solar roost]

Interesting, so you basically went straight from college to a cybersecurity role? I’ve been working in IT for a little over 4 years now, I’m currently in a network admin role but I’m thinking of transitioning over to cybersecurity.

[warm hinge]

thanks, will do

[serene umbra]

Gave +1 Rep to @light urchin

[stoic cave]

Yep. However, I have mentioned before that even though I am titled as a Cyber Security Engineer, I dont think I have really done that yet if that makes sense? Ive done Technical Writing, Code Review, Scripting, Acceptance Testing, hardware testing, Linux System Administration, and many more small things and things that im not sure what they are called

[light urchin]

I could tell you, but then I'd have to have somebody kill you.

[stoic cave]

Yeah I also cant go more in depth than what I just gave you lol

[flat sedge]

those are all pretty normal cybersec activities, i think.

[stoic cave]

They are? Cool

I honestly dont know what I expected because my current tasking isnt very security like?

considering we dont patch anything because reasons

[light urchin]

hey, winxp is just FINE, quit worrying

[pseudo creek]

I've been in security "for a while"... but I started as a network admin, then moved into network security, then moved into more of a consulting role, then engineer then architect

[stoic cave]

"for a while" means you're old but put nicely 😛

[pseudo creek]

Right now, my focus is on design secure architectures mostly related to cloud environments (cloud is a great area to look into)

[stoic cave]

All of those jobs sound fun though

[pseudo creek]

well yeah, when I start to say I've been in security for 18 years, people kind of freak

[stoic cave]

Ive been in security for 8 months

Im an expert now

[solar roost]

Probably the type of progression I’ll take. What were some of the basic requirements for the network security role if you can remember?

[pseudo creek]

knowledge of firewalls, proxies and various network security services, I'd definitely look at job listings searching for "network security" and see what pops up

but honestly networking is a great foundation for any security position

[light urchin]

Hey now, be nice to old folks! Never underestimate old age and treachery. Beats youth and vigor more often than not 😉

Zojja- I'd be interested in hearing your thoughts about cloud security. I was pretty underwhelmed with the aws security specialty

[stoic cave]

One of my favorite quotes (that I am going to misremember) is "beware of the old man in the young mans profession"

[pseudo creek]

I had 0 interest in getting the AWS security speciality since it focuses on AWS security services vs security as a concept

are you saying cyber security is a young persons profession?

[light urchin]

Ooh I like that one.

[pseudo creek]

I work with a ton of people who are in their 40s, 50s, 60s who are in cyber

[light urchin]

One way to look at it- when you're hiring someone, you're hiring them for the mistakes they made in the past. Let them learn the expensive lessons working for someone else, so they can save your team from making them again.

[stoic cave]

It wasnt used in the terms of the cyber world

[pseudo creek]

it is funny, so many people have stories of huge mistakes they made early in their career

I brought an entire facilities network down on accident

[light urchin]

ditto

[stoic cave]

I believe the actual quote is "beware of the old man in a profession where men usually die young"

Specifically referencing older soldiers

[light urchin]

kinda related to "there are old <X> and bold <X>, but no old, bold <X>

but I like yours. Gonna hafta remember that 🙂

[stoic cave]

Because A the guy is going to be a pipe hitter and a stone cold killer or B will be a Blue Falcon

[light urchin]

"oops" ¯_(ツ)_/¯

[solar roost]

Done that a time or two 😅

Are you really a network admin if you haven’t brought down your network once?

[pseudo creek]

it was amusing.. my lead at the time was like 'hey did you do anything' and then a lightbulb went off as I ran to the network room

[light urchin]

It's actually a common interview question I ask- something on the order of 'tell me about the most expensive (or worst) mistake you've ever made'

[stoic cave]

I Imaged 100 Laptops and then realized that I made a mistake in the bios and you have to go back and reimage 100 laptops

[light urchin]

If I'm hiring for a senior person and they can't tell me a story of the time they crashed a server, wiped a prod database, turned off the lights in the northeastern seaboard for a few days, etc., then I kinda wonder.

[solar roost]

I think my favorite mistake was when I had turned off a phone server thinking it was a different box 😅

[stoic cave]

Idk why I said you

[pseudo creek]

which reminds me... I don't know if anyone remembers/had this but a few years ago, Verizon FIOS was having a tough time of it, I called the support line, told must be me... they scheduled a tech for the next day, tech told me that all Verizon's traffic was routing through 1 pipe

and there was some news article shortly after that about it... probably someone who made a routing change

[stoic cave]

Sounds like an ISP

Or how recently Pakistan rerouted YouTube to a blank page

[pseudo creek]

nice

[stoic cave]

Yeah they modified their DNS and rerouted most of the globe apparently because a Chinese ISP didn't have error checking on

[light urchin]

I read a post-mortem a while back of a "simple" regex change that ended up taking down an entire company's prod everything, and they were like a big internet backbone company or something. I can't recall details now.

[solar roost]

When services go down I often wonder if someone’s about to lose their jobs

Or if it’s primarily a “haha woops” and some scolding from higher ups.

[light urchin]

unless it was gross malfeasance, I wouldn't fire the person. You can be dang sure they just learned a valuable lesson they will NEVER repeat

[pseudo creek]

our company had a major whoops not too long ago, was a junior level person who did it, I just laughed, they were not fired

can't remember specific details, was something like applied a change mid day to the proxy servers or something

[light urchin]

Was really trying to find a snippet of it on youtube, this will have to do: https://www.imdb.com/title/tt0453467/characters/nm0000243 search for "my bad"

Eureka! https://youtu.be/JstTw_ZU-BQ?t=2591

"I still say we blame Canada" 🤣

[granite hornet]

I deleted a whole live site with the click of a button once; had to get vendor involved in restoration. Tech support were kind about it. Realised that I'd have to shelve my 'try it and see' approach to problem solving if I want to get into IT.

[light urchin]

Well, 'try it and see' is fine. Just not in prod 🙂

[inland basin]

:d

We've all done something stupid once or twice 😄

[light urchin]

per day

[static tide]

anyone know of any free systems recruiters use to parse cv's?

wanna run mine through one to ensure it's picking out the right things

[light urchin]

good question, actually. I don't know of any though, sorry.

[blissful isle]

@static tide I've used this one a bit https://www.jobscan.co/

[rugged sable]

I've used jobscan too but it costs money :-(

[lucid dragon]

Anyone have any tips on obtaining an entry level position, or even an internship for someone who is self taught, but has a development background?

Finding it hard to even get through to first round of interviews, or am dissuaded from even applying, seeing as most roles I see want a degree + 3-5 years practical application.

Any input would be greatly appreciated. Thank you!

[ancient prairie]

Don't be dissuaded from applying regardless of your qualifications, worst they can do is say no or not call back, which many that you are qualified for will do to you anyways

its a really stupid dance you need to do with HR where they overshoot the qualifications in the description, but in reality they'd be more than happy to take you, idk if its a way to weed out people somehow but I was insanely underqualified for my job on paper, managed to get an interview and did a good job there

[lucid dragon]

@ancient prairie Thanks for the input. Yeah thats how it was for me in the Software Dev field as well, because I am self taught in that regard as well. I got kind of lucky with that one though and landed a paid internship which led to a contract role, and build up my resume.

I have been applying to quite a few job posts in the security realm(and even a couple internships) and just keep getting shut down. Just have to keep going at it then I suppose.

Appreciate the feedback though, truly.

[serene umbra]

Gave +1 Rep to @ancient prairie

[ancient prairie]

It's tough for sure but hang in there, if you're actively on the hunt I can't recommend BanjoCrashland and his job-hunting streams enough, he's helped a bunch of people and has his own discord I believe, check him out https://www.blackhillsinfosec.com/webcast-how-to-hunt-for-jobs-like-a-hacker/

[lucid dragon]

Seriously awesome resource, thanks again!

[stoic cave]

Yeah Jason blanchard is a good dude and puts on great job hunting streams

He helped me with my job search and now I'm employed so yeah

[lucid dragon]

That is awesome to hear, I joined the discord, and am taking a look at the resources on the website. Pretty cool.

[stoic cave]

Yeah don't get discouraged. I think I put out 100ish applications each tailored to the position I was applying for

It was also the height of the pandemic though

[lucid dragon]

Okay that’s good to hear, I was worried it was just me haha

[stoic cave]

Yeah it was a lot of work. I had first sent out a couple of applications here and there between January and March of last year and then really started pushing them out in May. I was offered a job in August so it takes some work and time

[lucid dragon]

For sure, that’s basically where I’m at now, have put out maybe a couple dozen. Going to start pushing harder for it here in the coming weeks. Any tips for good job board platforms for these types of jobs? Or just the typical LinkedIn/indeed/etc?

[stoic cave]

I like LinkedIn more than indeed as it allows me to see if I have any connections or alumni at the companies I'm applying to. I then network with said people

But I used all of them honestly

LinkedIn, Indeed, USAJobs, ClearedJobs, Clearancejobs, etc

[lucid dragon]

Awesome, thanks for all the input. Truly appreciate it

[serene umbra]

Gave +1 Rep to @stoic cave

[tawdry frost]

If you knew how underqualified on paper I am for the job I got you'd be amazed but in the end performance trumps paper qualifications if you get in the door

[lucid dragon]

Definitely makes sense, that’s how it was getting into a development job as well. It’s just the getting in the door that can be tricky :p

[tawdry frost]

the hardest part is getting in, once you're in if you can perform, what the paper states is worthless

just don't give up and keep pushing forward @lucid dragon

[dim mesa]

Hello, I just created my first resume and was wondering if I could get some insight into how to improve it. Thanks!

[lime lion]

honestly - for a resume - find a professional resume massager and pay them the 50-100$ to have them polish your resume and load it with the correct HR keywords to get your through the door. Think of it like SEO - you can learn it yourself, but you could also spend a few dollars and let someone who's mastered it do it for you while you focus on stuff that matters to you.

[dim mesa]

For sure. Do you have any recommendations? I really just want to find that qualified professional to help polish out the rough edges. I want to out shine my competitors, haha.

[lime lion]

Sorry mate, I do not. I've been independent running my own gig for a decade now.

[dim mesa]

haha, for sure. I appreciate the insight, I'll do my due diligence and try to find someone.

[lime lion]

You could probably find someone on fiver that's really skilled tho

[dim mesa]

I'll check it out, glooks. :)

[lime lion]

Also if you find and ask on the right reddit sub - you'd likely have good luck

[dim mesa]

For sure.

[light urchin]

if you're a college student, often the college will have a jobs counseling/help person(s) who can give you resume advice as well

[dusky oracle]

I just graduated with a bachelor of IT and I am looking for a job. I was thinking between some certs I should get. Comptia Security or OSCP

[stoic cave]

Security+

[dusky oracle]

That would be a good choice

[stoic cave]

Thats what I would go for personally and what I am currently studying for. Once you get in to a new position see if you can get the company to pay for whatever cert you want next

[dusky oracle]

Yeah looking for a job after college is tough

[stoic cave]

I currently have a job but purchased a Sec+ voucher before I graduated last year

procrastinated and now Im finally taking sec+

Work is paying for OSCP at the end of the year

Then after a little bit Ill start looking again and probably move on to get a nice pay bump

[dusky oracle]

What is your job rn

Are you a security analyst?

[stoic cave]

Cyber Security Engineer

Its a role of many hats

[quick forum]

OSCP if you're aiming for a pentest job, Sec+ if you want a security job but not necessarily pentest

[dusky oracle]

Yeah I’m not what kind of jobs I should be applying for as a fresh graduate

[forest knoll]

What country credirs?

[dusky oracle]

I don’t know*

Canada

Specifically Toronto

[stoic cave]

While I agree with that in the US specifically pentesting isnt an entry role most of the time

[forest knoll]

Ahhh OK, make sure to look at listings for jobs ur interested in and see what they require, always helps.

[stoic cave]

again thats just my experience

I only found two positions that were looking for fresh college grads to train up themselves for a red team

both government positions

[dusky oracle]

I’m pretty sure that is US

[stoic cave]

yeah

[dusky oracle]

What job did you get when you graduated

Anybody from Toronto have any guidance on jobs?

[stoic cave]

Me? My current position, Cyber Security Engineer

[haughty leaf]

What agency?

[stoic cave]

DOD and DOE

Unfortunately for me, the DOE position was just starting to spin up and looking for applicants when I got an offer for my current position. I wasnt going to wait for the "what if"

[haughty leaf]

I think DoE could be cool, depending on where you end up. The national labs seem to be in pretty nice locations.

[stoic cave]

It was INL

I actually tried to get on a Cyber Security Think tank/panel for recent graduates at Oak Ridge but when I went to apply it said they werent accepting Computer degrees for the panel

[haughty leaf]

I have a friend who works there! Nuclear engineer PhD candidate.

[stoic cave]

Yeah seems like a great place to work

[pseudo creek]

I know someone who works at INL

and know a bunch of people at Sandia

Sandia would be my choice for location, but I love New Mexico

[dusty wraith]

im also graduating but really dont know if i should get a security job when i have very little skill

i mean i have to get a job, im just not sure if i fit anywhere

[stoic cave]

Dont let that slow you down

Im blanking on the name but the feeling that you arent good enough is common

[dusty wraith]

i always feel like im not good enough

[stoic cave]

Coming out of college companies are arent looking for perfection and understand that there is going to be a learning period

well use that to your advantage then. let it drive you forward by being hungry to learn more instead of holding you back with the "what ifs"

[dusty wraith]

i guess im just a little sad because i still dont know where to go

[stoic cave]

Cyber is a big field you have plenty of options

[light urchin]

imposter syndrome

[stoic cave]

there it is

[pseudo creek]

20 years in and I still have it

I wouldn’t worry about not being good enough, no one is an expert out of college

[light urchin]

I'm pretty dang good at what I do and I still feel like I barely know anything half the time

just keep learning, you'll be fine 🙂

[dusty wraith]

i guess i'll get there but who knows how long thats gonna take

[light urchin]

the rest of your life

[dusty wraith]

yeah i guess

[light urchin]

in this field, things change all the time. And it's such a massive area, there's no way anyone can know it all. Just keep learning, keep adapting to industry trends, and you'll be fine

have a growth mindset- find areas you are weak, and learn more about them. The whole point of hiring people is that everyone has a different skillset and background. Working as a team, you can accomplish more than you can alone

[dusty wraith]

and well i also picked it because i wanted something that changes because if things stay the same im worried my brain will drop it in a month therefore be useless in a job

[stoic cave]

Are you coming out of the US school system? If so this feeling is normal

[dusty wraith]

and no, im in ireland

[light urchin]

I think it's just human nature, tbh. Regardless of education

[stoic cave]

True

I meant it more in the fact that the system in the US makes students good little robots and its only about the memorization and the next test

[dusty wraith]

oh yeah that too

that sucks

so many people only care about grades and have absolutely breakdowns if their grade off by 1 point

and im like why are you putting yourself in such stress

[stoic cave]

Yeah I would suggest trying to figure out how to learn better if that makes sense. Not that you dont, improving how you take on knowledge is always good

[light urchin]

DOn't worry about not feeling good enough. I know people with phd's, certs, and literally decades of experience, who are probably smarter and more capable than I am, who still feel like they don't know enough

[stoic cave]

Honestly, I think its a good feeling because you wont become complacent

and complacency in Cyber leads to bad accidents

[light urchin]

complacency in anything

[stoic cave]

true

[warm hinge]

Im transferring to dsu to finish off my degree there. Why? First: 4+1 program, there cyber team, and well hopefully grab a few connections and connect my way to a gov job to the dc, maryland, Virginia area @stoic cave will one of the top 12 schools designated as nsa cyber of excellence give me a better shot at getting a job got a gov agency, idk tbh but I will try my best

[stoic cave]

I'd say the most important thing is connections honestly. That's part of the reason why I went to the school I did. At the time I was touring we were in a head to head battle with UTSA for the number one school on the NSA's cyber excellence program

Once you start looking do they care where you went? Sometimes, but it's more what do you know and how willing are you to learn and be constantly learning

People skills are also really important unless you are a NSA number cruncher

I'm a contractor so my path is a little different than direct government and the pay is better

But even though I'm a contractor I still work on the same projects as my government counterparts and I have the added flexibility of moving contracts if I get bored

[warm hinge]

@stoic cave yea for the “what youre willing to do” part, id say my best option is there cyber team and build my reputation up and connect with external parties from there as well. If u dont mind me asking, how does a contractor become a contractor for the gov (in the cyber space specifically). Like was it by choice u became a contractor?

[stoic cave]

Yeah i applied for the position

You apply like you would for any regular job. It has its wants and needs as well as clearance requirements or any special qualifications that you need to meet like DOD 8570

[warm hinge]

Im guessing u had the sec+. And u were able to obtain ur clearance as a civilian correct? They tend to be expensive to sponsor vs someone in the military who already has top secret

[light urchin]

I know of companies that have a habit of hiring people without a clearance and putting them through top secret and beyond

just depends on what they need and what you have

[stoic cave]

Nope im studying for security+ now. I had a clearance because my internship put me up for one as a nicety. I was hired with the degree, one internship, and some personal projects for experience

[haughty leaf]

Did you put projects on your resume? I had applied to some software engineer jobs before realizing that's not what I wanted to do, but then I took projects off my resume because they didn't seem relevant.

[warm hinge]

What are some must have "beginner" certs?

[stoic cave]

Yep. I have personal projects and final practicum projects on there

So my personal projects would be my homelab and the practicum projects were culminating assignments of my degree

One was a straight up pentest and the other was an Attack/Defense exercise against other student teams

[warm hinge]

@stoic cave what college did u attend?

Those two school projects already are far better than half of the other cyber programs out there. Thats dope

[stoic cave]

Yeah as far as I am aware we didn't have anyone breach us

I wasn't on the offensive on that exercise so I can't speak to whether we breached anyone. Knowing the student conducting the offensive measures.... Probably not unfortunately.

[pseudo creek]

So honestly, I would not do a 4+1 program for Cyber (the +1 being Masters) unless you already have experience in some way... military, even any work experience not in IT. Generally what you will want to do is apply to as many internships as possible. If you know anyone who works for a Gov contractor/NSA/etc, you'll want to ask them about internships as sometimes there is an internal way to apply for internships.

[stoic cave]

Yeah to add onto that almost all of the internship for the alphabet soup are TWO summers not one and you have to apply as a freshman early sophomore

I think september is usually the cutoff for the following summer

[pseudo creek]

yeah my company generally has a November cut off for internships for the next summer although we had some late internship postings for some erason

[raven cloud]

how did you all get started? I want to learn but am clueless

[polar rock]

I would suggest checking out #start-here

[raven cloud]

sweet, thanks. sad that im about to grad and no idea what im doing with myself

[cosmic ingot]

join the club 😄

my only advice for that would be to not wait until you feel that you have everything figured out to make a move. usually you can't take a step without taking some risk, so don't be afraid (and even if you are, just roll with it). if you fail, try try again.

[silver sierra]

I got a job last week doing pentesting

🎊

THM definitely helped because it was all I did before the interview

[haughty sundial]

Congratulations, BitFlip! That’s awesome

[solar roost]

Has anyone used the skills they learned from THM for their current jobs?

[rugged sable]

congrats!!

[rugged sable]

yes, working for thm taught me a lot about team work and communication, as well as to trust your superiors

[peak steeple]

Hi there, Do you recommend getting Azure or AWS 1st?🤔

[rugged sable]

aws because if you search on LinkedIn for aws or azure jobs aws is more popular

[peak steeple]

👀

[golden ore]

AWS has been around longer than Azure, but AWS is the more complicated of the 2

[peak steeple]

👀 I didn't know that! Thanks

[pseudo creek]

AWS has a bigger market share

[golden ore]

first in a space usually has a bit bigger market space, but the principles of cloud are pretty much the same it really comes down to managing access and user privileges

[pseudo creek]

at the beginner cert levels, I don't think AWS is more complicated, I actually find Azure pretty complicated compared to AWS after using both and doing certs in both

[golden ore]

AWS' original complication comes in IAM vs the actual use

[light urchin]

The complexity/problem with AWS is that they have so many services. Well over 200 now.

but you can get the solution architect and developer certs with only knowing about 20ish of them

[pseudo creek]

well Azure does as well but as a beginner, you really don't need to know that many of the services

like with Azure, every service has a license level and every license level has a different level of features, so you have to learn not only the services but the various license/feature levels

it makes my head spin

[light urchin]

oh that's just stupid

but makes sense from a 'typical MS' point of view

[pseudo creek]

well it makes sense for enterprises but learning it is very confusing

[light urchin]

yeah

[pseudo creek]

makes for more granular pricing

[light urchin]

I don't have a ton of respect for MS, tbh. Used to work for a place that was a MAJOR client of both aws and azure. AWS support and account reps were super helpful and smart. Azure was literally "did you try rebooting the cloud?"

[golden ore]

reboot the cloud, sounds like trying to reboot the internet

[pseudo creek]

honestly, I've had good and bad experiences with AWS support

like since we get 'free' account support, one of our programs went to AWS to assist with possible solutions, one of them was the stupidest thing I've ever heard and would've cost the program a ton of money... I said no, we aren't doing that