#cyber-and-careers

1 messages · Page 83 of 1

light urchin
#

yeah, we had the very expensive support plan

#

lots of zeros involved

pseudo creek
#

yup

light urchin
#

like multiple senior AWS people on site or on call for us all the time. Same for MS, probably way more $ their way actually, just lower quality of support

pseudo creek
#

yeah we have a ton of AWS people assigned to us, I've only been on a few calls with the Azure people

light urchin
#

how does the azure cert you're doing now compare to SA-A or D-A for aws?

#

(am I remembering right that those are the aws certs you did?)

pseudo creek
#

it is closer to SysOps

#

I studied a little of SysOps but then was like screw it, I don't need another AWS cert right now

#

but I think its hard, there is so much to remember, seems harder than the AWS content

light urchin
#

hm

#

What was your study/prep process for them?

#

A Cloud Guru? Books? Just playing around with the services?

pseudo creek
#

ACG/LinuxAcademy (when they were seperate)

#

and obviously using the services

#

I'm actually in an Az-104 class this week

light urchin
#

Yeah, I felt ACG did a decent job of prepping me

#

plus actual usage, obviously

#

and some practice exams from udemy or tutorialsdojo

pseudo creek
#

I really liked when they were seperate... I found ACG prepped you more for the exam, Linux Academy prepped you for usage

light urchin
#

hm. I hadn't used LA much. Had an acct there but didn't use it hardly

pseudo creek
#

LA is where I had my account, ACG, I bought from Udemy

#

I'm grandfathered in at the $150/year price so I just hold onto it

light urchin
#

I was studying for the aws security specialty, but decided not to get it, start of pandemic, things closed, exam repayment changed at my employer. But the content was underhwelming

pseudo creek
#

yeah I just had no interest, I do have an interest in the AWS networking

light urchin
#

oh nice, 150/yr is cheap. Now it's like 50/month. I don't pay for it anymore

pseudo creek
#

but I may do the AWS DevOps

light urchin
#

I kinda want that, and I kinda want to never ever get it

pseudo creek
#

after I get a few Azure certs

light urchin
#

I get so many recruiters contacting me for devops, but I don't want to do JUST that

pseudo creek
#

nah its just so I have a better understanding

#

oh got a recruiter notification in my target city today... was totally AWS DevOps with a side of security...

#

I was like hmm you haven't read my LinkedIn have you?

light urchin
#

do they ever?

pseudo creek
#

nah

light urchin
#

i get so much recruiter spam. Most of it is garbage/not interesting

pseudo creek
#

I just like reading the recruitment messages, AWS has been recruiting heavily, so has Salesforce

light urchin
#

In the last year, I've started to notice a transition from companies heavily looking for aws certs to looking for more azure and gcp experience

#

used to be aws was the only thing I got contacted for, but that's definitely changed

pseudo creek
#

because I live in the DC area, I tend to see a lot more Azure recruitment than AWS, now I'm getting more AWS recently

light urchin
#

well, that jedi program/lawsuit is still being worked through the courts

pseudo creek
#

yeah

light urchin
#

but there are plenty of other contracts/subcontracts that are not related to that, that can play with whichever cloud they want

pseudo creek
#

but the recruiters have been Azure heavy for a while and I only have a slight mention of Azure on my profile

light urchin
#

interesting

#

yeah, kinda similar for me

#

but I've also noticed a definite uptick in gcp recently

#

(which I know nothing about)

pseudo creek
#

I get none of that, but I don't have any interest in GCP

light urchin
#

neither do I really

pseudo creek
#

my aunt said her company (amusement park) uses GCP

light urchin
#

I've never used it. But people contact me for jobs that "we prefer gcp experience, but since we can't get it, you'll have to suffice" kinda

#

My tentative plan for now is to try for the pen+ in june, then maybe? do aws security, then either aws networking, or azure, or net+/sec+

pseudo creek
#

right now, I'm Az-104, then maybe Az-500, then swing back to AWS DevOps, then Azure Devops

rugged sable
light urchin
#

I've never even heard of CloudAcademy, I don't think

rugged sable
pseudo creek
#

I think our company had a trial of it a few years ago and I didn't like it as much

light urchin
pseudo creek
#

but like you said ACG is $$$ now

light urchin
#

yeah. At the time, my company paid for it, so... 🤷‍♂️

#

but before I left, I did download all the videos to like 20 classes 🙂

peak steeple
#

Thanks for your feedback! 👍 I am pulled towards Azure as already as my friend did the course as last year so I can borrow his material and he can give me pointers. Once done, I can return for Azure before going after the beast that is CCSP!

thorn pebble
#

guys does anyone know will knowing technical side of cybersecurity help me as a lawyer maybe to work in this industry? any thoughts or experience would be much of a help cheers

peak steeple
#

I would focus on knowing the technical side of the cyber laws would serve you best but am no lawyer ...

pseudo creek
pseudo creek
thorn pebble
# pseudo creek what is your goal overall? Obviously there is the IP side of law but is that yo...

ey yea well my mainly goal is to focus on data privacy and knowing more about laws that regulates data protection and cybersecurity like GDPR NIST Framework HIPAA and such. And i just saw a job post like IT risk associate i gues that one is the closest i would like to work, the requirements are knowing both technical side of infosec and laws? Any thoughts on this ? thanks for reply cheers

serene umbraBOT
#

Gave +1 Rep to @pseudo creek

thorn pebble
haughty leaf
pseudo creek
pseudo creek
stoic cave
#

Yeah I agree. You dont need to be a lawyer to work in policy. However, if you if you want to affect change in current computing law or defend people from overbearing entities a law degree would be needed

#

I had a Cyber Law course and business law course as degree requirements and they were pretty interesting

#

Cyber Law though mainly focused on the overreach of the government and the 4th amendment and how it applies to the cyber domain

pseudo creek
#

Cyber law can vary including international law where you are trying to ensure compliance with various laws, companies definitely need lawyers but there is also general compliance which is the aspect where a law degree isn’t required. I’d probably look at actual law degrees/law school info on what they mention.

haughty leaf
#

I basically just want to do everything...😑

#

I appreciate the responses!

pseudo creek
#

Don’t we all

stoic cave
#

LinkedIn: company x is looking for: Cyber Security

Me: "well isn't that specific"

thorn pebble
#

Hahah yea cybersecurity is pretty broad field

stoic cave
#

If you actually click into the posting it's extremely specific

thorn pebble
stoic cave
#

Looks like a 1099 for Cyber Security Threat Engineer

#

With "supplemental duties"

pseudo creek
#

I dug into that job in my target city (found the company and job listings). Job actually looked interesting but it was gcp and azure. It’s also a much smaller company that I’m in now which has pluses and minuses

stoic cave
#

You saw that listing? Company start with a C?

light urchin
#

Chuck's Chicken Shack?

stoic cave
#

close

pseudo creek
#

Nah it is called Dexcom

stoic cave
#

ahh different company then

#

if you're in the DMV though youve probably seen the listing

pseudo creek
#

Yeah this was one a recruiter messaged me about today

#

It was actually what I do... so kudos to recruiter

stoic cave
#

lol

pseudo creek
#

Usually they are so far off, it’s funny

stoic cave
#

I got a message for a Line cook position about a month ago

pseudo creek
#

Well not that far off

stoic cave
#

ehh it was semi close

#

within three jobs ago

light urchin
#

I recently got one looking for a mechanical engineer. Nowhere near my field.

#

"you're a great fit!"

stoic cave
#

Oh yeah Ive gotten those

#

Or a machinist

flat sedge
#

I got a fun one for 'we think you'd be a great fit for our front end developer position' - my current LinkedIn skills are 90% CI/CD, don't know they managed to fit that into an angular.js jr position

light urchin
#

you gotta wonder how broad of a search they do to get those hits

light urchin
#

that and "full stack" (i.e. we don't really know what we want/need, can you just do it all?)

stoic cave
#

I actually messaged back and was like "bro, I can barely change the brakes off my car and have used industrial tools once"

flat sedge
#

'oh you know c++? and have done some embedded systems work? we think you'd be great at UI/UX'

stoic cave
#

yep I have C++ on linkedin and get those too

light urchin
#

Most recruiters are like one step up the educational ladder from fast food fry cook / barrista

#

and sadly, most of those people working those low paying jobs have expensive degrees that are relatively useless

pseudo creek
#

My favorite one recent one was a Linux admin... I was like well that’s interesting

stoic cave
#

I have a love hate with linux

pseudo creek
#

Not sure what part of my info would scream Linux admin

stoic cave
#

my Gnome decided it didnt want to be a Gnome anymore

pseudo creek
#

It paid well at $170k but no

flat sedge
#

Is this related to your earlier RHEL7 problems you were posting about here, Moose?

stoic cave
#

so now I can't use userlevel 5 anymore

#

same system yeah

light urchin
stoic cave
#

but the machine doesnt have a tmp device

pseudo creek
#

But like our Linux admins don’t get paid that much

flat sedge
light urchin
#

Yeah, that's a lot for just a linux admin, but that's also an expensive area to live, I've heard

stoic cave
#

like the security device

light urchin
#

Last time I switched jobs, I could've made about 70k more than the job I ended up taking- I'd rather have good people than more $

pseudo creek
#

It has some cheaper areas, NSA is commutable from some cheaper, more rural areas

stoic cave
#

I tried to have it sit over the weekend to see if it could pull itself together but 🤷‍♂️

#

it fails Certmonger in the boot

pseudo creek
#

I rather have flexibility that more pay but I can’t complain about my pay

stoic cave
#

$170k in DC?

pseudo creek
#

In MD

stoic cave
#

or Meade?

pseudo creek
#

Meade

stoic cave
#

thats a lot lol

#

I wish I made $170k

flat sedge
pseudo creek
#

You’ll get there

stoic cave
#

there is no source which I thought was odd

flat sedge
#

If it doesn't have any entropy, it's not generating any random numbers

stoic cave
#

right

flat sedge
#

more entropy == more randomness

stoic cave
#

and when I tried to set a source it just went "nah bro"

#

not enough entropy kekw

#

that and hwrandom didnt exist in whatever directory /random is in

light urchin
#

It's been interesting to me how salaries have changed in the last year, with more west coast companies hiring more remote workers

dry raft
#

Is anyone here living off of bug bounties? How realistic is something like that?

pseudo creek
light urchin
#

I'm not, I am not that skilled yet to even try doing them.

#

But yeah, what she said is what I've heard from a lot of people

pseudo creek
#

It’s extremely rare to make a decent living... so rare that it makes news when it happens

dry raft
#

I'd be happy with $50k a year

pseudo creek
#

That’s be difficult

dry raft
#

Sad

pseudo creek
#

It is a side hustle/learning experience for most people

light urchin
#

It's like actors in hollywood- a few people make big bucks. The rest wait tables and struggle to make rent

haughty sundial
#

Another reason is that if you have the skill set to earn a lot from bug bounties, there's a decent chance you probably also have the skill set to get a job at a tech company. And getting a guaranteed salary is more reliable as an adult

light urchin
#

(again- I can't speak from experience, just relaying what others have said)

pseudo creek
#

And what you don’t see is the years of work where people spent thousands of hours getting paid nothing or next to nothing

light urchin
#

there are also those with the skill who sell to gray market or black market :/

dry raft
haughty sundial
flat sedge
pseudo creek
#

But say you spent 40 hours to get a bounty that pays $500, company says thanks but someone already reported it

dry raft
#

Tough, but the contractor option sounds good once I get some bounties under my belt.

light urchin
#

some contractors/consulting companies can pay quite well

#

20-25k/month

pseudo creek
#

Yup

flat sedge
#

Being a contractor introduces a whole other set of problems. Being self employed really means you work all the hours you can get paid for - and you have manage your own retirement, healthcare and other benefits without the advantage of having paid HR to do it for you

light urchin
#

also true

flat sedge
#

I'm not saying people haven't been successful doing it - but understanding the business side of things is a necessity. I prefer not to have to care about doing all that business related stuff

#

give me a SOW and i'll generate my own tasklist and we can all be happier 🙂

stoic cave
#

Yeah i was told that 1099 you should ask for 3 times more than what you are looking for from a regular opportunity

flat sedge
#

Pretty much

pseudo creek
#

I saw a recent Reddit post where a guy was making $30k/year but doing bounties 80-100 hours per week and people were saying that was excellent pay and I was like uhh no

stoic cave
dry raft
flat sedge
#

Consulting may be the place for you then

#

I really like being a consultant - stress is very low compared to the firedrills I had to run weekly as an infosec engineer

pseudo creek
light urchin
light urchin
stoic cave
flat sedge
stoic cave
#

If i move on I should be looking for a 15-20% increase right?

flat sedge
#

I don't know what you're being paid now vs your skillset

stoic cave
#

I'll have certs and more experience at that point

light urchin
pseudo creek
#

Also depends on what another job may offer

stoic cave
#

Also true

obtuse cobalt
#

How much time will it take for first response after submitting bug in private program of Hackerone

stoic cave
#

I actually want vacation next time

flat sedge
#

when i made the jump from infosec fulltime to devops consulting, it was a 35% increase

pseudo creek
#

A position with growth would be preferable to more money

stoic cave
#

I didn't look into that lol and it kind of bit me

light urchin
#

You don't get vacation?

flat sedge
#

Another thing I saw on reddit that I thought was really great to keep in mind, is that your job should be paying you twice

stoic cave
flat sedge
#

It should pay you first for the tasks you do; and it should pay you a second time to give you room to grow into your next position

light urchin
#

that's not HORRIBLE, depending what "free" holidays you get

stoic cave
pseudo creek
#

2 weeks of vacation is pretty standard for early career

stoic cave
#

It's not so much the amount I get it's how I get it

#

I'd rather get it in bulk up front

light urchin
#

almost nobody does that

pseudo creek
#

Yeah nobody does that

stoic cave
#

They are all accrued?

light urchin
#

pretty much, yeah

stoic cave
#

My dad and my buddy from college both get theirs up front

light urchin
#

my current place has a "flexible time off" policy, so we can take as much as we want, whenever we want

haughty leaf
#

Unless you get "floating holidays". My PTO is accrued but I automatically start with 2 floating holidays that are just a day off whenever.

stoic cave
#

I thought that was normal

flat sedge
#

Last company I worked for required 6 months, then you started to accrue 2 weeks annually at a scaled amount for each partial hour worked

light urchin
#

but realistically, most people only take a few weeks a year

flat sedge
#

So if you turned in a timecard with 1 hour on, you got something like .15 minutes of PTO

pseudo creek
#

Yeah I get floaters and ‘sick’ time up front but then vacation time is accrued monthly

light urchin
#

yeah, depends on if you are salaried or hourly/have to track hours

stoic cave
#

I get PTO and standard fed but no sick leave

flat sedge
#

my current PTO accrual is based on the quarter; doesn't matter how many hours I bill, i get the same amount. But that also accounts for sick time as well.

light urchin
#

that kinda stinks

haughty leaf
#

That's the one I can't stand. You have to use PTO for sick leave.

pseudo creek
#

PTO being what? Your vacation hours?

flat sedge
#

Standard fed is a lot of holidays off isn't it?

#

Yeah - universal paid time off

stoic cave
pseudo creek
#

Hmm

light urchin
#

something else to look at it healthcare and 401 and stock options

#

different companies do that differently, but it can be a big $$ difference

flat sedge
#

I get essentially 20 days a year + holidays

#

stock options can be a big suckers game too

light urchin
#

potentially so can bonuses

stoic cave
#

So getting vacation up front isn't normal? It's mainly accrued? TIL

haughty sundial
#

A really really rough heuristic to try and figure out appropriate contractor pay: take whatever your annual salary would be at a salaried job. However many thousands it is, convert that to dollars per hour. So $120,000/yr would mean you want $120/hr as a contractor. Which sounds like a lot by comparison, but you pay more in taxes, don't get paid time off, have to pay for your own benefits, etc etc

flat sedge
#

IMO better off throwing that money into a 401k or IRA until you hit max, unless the stock options are ridiculous

pseudo creek
#

I get about 6 weeks of time off plus some holidays but I’m old

flat sedge
#

like 15 points under previous quarter minimum or something

stoic cave
#

I should probably look at my 401k

#

We just switched providers

light urchin
haughty leaf
#

My new job said I would get 401k then I got here and they told me it doesn't start until after a year. I don't plan to stay that long.

haughty sundial
light urchin
#

401 matching can be a big thing too

stoic cave
#

Yeah i get matched

flat sedge
#

Yeah

stoic cave
#

I'm only putting in 6% a month right now

flat sedge
#

Try to time it so you hit your 19,500 max contribution in early december

light urchin
#

I once worked at a place that did better than matching- they paid something like 7% of salary into 401, no matter what I put in

pseudo creek
#

Definitely put a decent amount into 401k, I’d say at least 10%

stoic cave
#

Mainly because I have other expenses

flat sedge
#

put as much in as you can afford to - the longer you feel poor, the more money you'll have at retirement

light urchin
#

max out your 401 AND your roth

pseudo creek
light urchin
#

that's currently about 26k/yr

pseudo creek
#

That’d be ideal

stoic cave
#

Yeah i have a strategy I just need the capital to do it kekw

light urchin
#

the more you can do, the earlier, the more years it has to gain interest

#

sell your toys and eat beans and rice for a few years in your 20s if you have to

#

you'll thank me in your 40s

flat sedge
#

I would say for the 10-15 years of gainful employment, whatever those ages are

haughty leaf
#

I did eat beans and rice in my 20's and still can't contribute that much to 401k 😂

pseudo creek
#

Your 401k lowers how much you are taxes, do what you can to put at least 10%

flat sedge
#

I was a slacker and worked lowpaying job for years

#

so much wasted time

stoic cave
#

I'm building my emergency fund right now and I am putting little bits into dividend stocks

flat sedge
#

the stocks can wait

#

the 401k is very risk averse....

haughty sundial
pseudo creek
#

Yeah don’t do stocks if you aren’t putting into your 401k

light urchin
#

yep

flat sedge
light urchin
#

401 and roth first, THEN stocks

haughty sundial
#

(I feel obligated to mention that 401k is, under the hood, a bunch of stock investments. So bear in mind that you're still leaving your retirement savings up to the whims of capitalism)

flat sedge
#

Also remember that the Roth IRA has rules about the maximum amount you can make before you aren't allowed to contribute anymore

stoic cave
#

You can ladder with a Roth

flat sedge
#

That's true Scarlett. Big difference between experts managing your money that way, and playing at being a day trader

haughty sundial
#

Yeah certainly

pseudo creek
#

There is also some things you can do with ROTH

haughty leaf
light urchin
stoic cave
haughty sundial
#

And investing the $$ means you'll hopefully at least keep up with inflation, rather than the money being worth notably less in however many years you retire

stoic cave
# haughty leaf Ladder?

You can move money from a traditional to a roth penalty free and then hold it in the Roth for 6 years and then pull it

light urchin
stoic cave
#

Yes

#

I am not a financial advisor do not take my advice literally

#

I will be talking to a professional before I do anything

light urchin
#

401 and roth are easy - just dump everything you can into those

#

once you max those, then go talk to an advisor

flat sedge
#

Up to the annual cap

light urchin
#

right, which is about 26k/yr right now

flat sedge
#

Over-contribution can mean some pretty signficant penalties

stoic cave
#

That's 50% of my salary

#

50%ish

pseudo creek
#

Again, get 10% of your salary into 401k

stoic cave
#

I already spend 24k a year on housing

stoic cave
pseudo creek
#

Then work to increase it

light urchin
#

and every raise you get, put that immediately into investments

pseudo creek
#

Ok

light urchin
#

so your standard of living doesn't change but your savings does

haughty leaf
flat sedge
#

One of my friends still uses the same budget he came up with 1993 - only adjusted for cost of living

#

He just paid off his house 15 years early

stoic cave
#

Nice

light urchin
#

that's what I'm currently working on

stoic cave
#

Oh poo I should probably look at my student loans

light urchin
#

yeah, that's the other big one

flat sedge
#

don't worry about student loans as much

#

the interest from those tend to be much lower than other forms of debt

stoic cave
#

Fed has had them paused and I don't want to get penalized

flat sedge
#

if you have any credit cards, zeroing those should take priority

light urchin
#

my mortgage is actually a fair bit lower rrate than my student loans

stoic cave
flat sedge
#

Are they fixed rate or based on prime?

stoic cave
#

I pay my cards every month

pseudo creek
#

Again I’m old but yeah 15 yr mortgages are preferable to 30 yr

light urchin
#

I did a 30, but paying it like it's a <15

pseudo creek
#

Usually 15 will have lower interest

light urchin
#

gives me the flexibility to cut back the extra payments some months if I want

stoic cave
#

Nelnet

light urchin
#

well, my rate is about as low as they will ever get...

pseudo creek
#

But interest rates are amazing

flat sedge
light urchin
#

You can refinance now for < 3%

stoic cave
#

My highest is 5.6% interest

pseudo creek
#

We are paying our house off next year or else I would’ve done another refi

light urchin
#

ah, gotcha. yeah, it takes 2-4yr to make a refi worth it

stoic cave
#

My car is .5% less interest

light urchin
#

something else to consider- there's a lot of talk about student loan forgiveness.

flat sedge
#

Aren't 15 year mortgages usually pegged to prime rate? lower at first, but possibility of a rate blow-up if things go bad

stoic cave
light urchin
#

no, depends on the mortgage

stoic cave
#

It's all the blue checks

pseudo creek
flat sedge
#

I thought that was one of the tradeoffs of 15 vs 30 yr. 30 yr normally has a slightly higher rate for having guaranteed consistent payments

stoic cave
#

Wait a 30 year mortgage has a higher interest rate?

pseudo creek
#

Nah you can get 10 yr and 15 yr fixed rate loans

flat sedge
#

sidenote: i'm currently trying to save up for my first home

light urchin
#

nah, you are thinking of balloon morrtgages, I think, juun

flat sedge
#

ah

light urchin
#

you can get fixed rate for any term

pseudo creek
#

Yeah balloon mortgages hardly make sense

stoic cave
#

My rent is almost as much as my parents mortgage

light urchin
#

or a graduated rate, or a balloon payment

#

the whole balloon payment thing is what caused the 2008 crash

pseudo creek
#

Yup

flat sedge
#

the balloon mortgages make sense as an investment vehicle - buy, live there for 2 years during the low-rate time, then sell right before the balloon hits

stoic cave
#

Isn't that happening again?

#

Aren't we over another bubble

flat sedge
#

adjustable rate loans have a much higher amount of surrounding regulation - or at least they did 3 years ago

light urchin
#

the thing about bubbles is you can only see them when you're in them/past them

pseudo creek
#

There are issues with our current bubble

flat sedge
#

i think current housing market issues are over-valuation, not bad loans being made

#

at least in my area

stoic cave
#

I thought i saw an article where the same dum dums were caught doing the same stuff they did in 08

light urchin
#

people always say we're on the verge of another bubble, but we really won't know until it hits

pseudo creek
#

People are taking 50 yr mortgages

light urchin
#

well sure, the folks on wall st. will do whhatever they can to make a buck, no matter who it hurts

light urchin
flat sedge
#

well, in 06, a minimum wage worker making ~30k could get a loan for a half million dollar house based on some vague assurances from a CPA

stoic cave
#

That's a thing?

pseudo creek
#

Because they can’t afford 30 yr

light urchin
#

are these just low paid workers, or massive houses?

pseudo creek
#

Expensive areas

flat sedge
#

depends on the market

#

that's a really common thing, from what i hear about the LA and SF markets

pseudo creek
#

Yup

stoic cave
#

That's why I will never live in California

light urchin
#

jeez. I knew prices were high out there but that's kinda ridiculous

flat sedge
#

1800sq ft home in silicon valley goes for something like 3-4 million

stoic cave
#

That and their ridiculous exit tax

pseudo creek
#

Also the market has been artificially boosted to help soften Covid but we’ll have to pay eventually

flat sedge
#

i might have the numbers off, i'm basing that off a conversation i had with a family member who was working in SF for google

pseudo creek
#

I think that is why I see us in a bubble, I hope I’m wrong but

light urchin
#

maybe that area is, but not nation/worldwide, I think

flat sedge
#

I think inflation will hit relatively hard in the next couple years, but it won't be a hard crash like in 08

light urchin
#

especially since people are starting to move away from high cost areas, with remote work

stoic cave
#

Now places are going to suck though

flat sedge
#

i'd rather live in convenient driving distance of denver than move somewhere like idaho or fallon, nevada

stoic cave
#

All the good states are getting the whiney people

light urchin
pseudo creek
#

I’m hoping people evacuate California as it’ll make it cheaper for us to move

stoic cave
#

Or the people that ruined their states in the first place

light urchin
flat sedge
#

i could probably halve my living expenses to moving to middle of nowhere (assuming i can get good internet there), but i need a chiascurro within reasonable driving distance -.-'

pseudo creek
stoic cave
#

Yeah why would you do that?

pseudo creek
#

Because aging parents

flat sedge
#

that's a good reason

stoic cave
#

Ahh ok that's respectable

flat sedge
#

AZ is crazier than CA, believe it or not

stoic cave
#

AZ is a little weird

pseudo creek
#

The cost of living in California where my family is at is the same cost as living here

light urchin
pseudo creek
#

Although food is cheaper in California

stoic cave
#

🤔

flat sedge
#

Cheapest/best food I've had in a long time was LA food trucks

#

street tacos there are hands down the best i've ever had

pseudo creek
#

Groceries are so cheap in California that it makes me cry

light urchin
pseudo creek
#

I have no desire to live in a rural area

light urchin
#

yeah me neither

#

but I also hate the crowded cities

stoic cave
#

I pass this one place on the way to work every day... It's wow

pseudo creek
#

We are going to most likely move to a near rural area, it’s a city surrounded by wineries

#

But it’s a city and close to various places

#

California isn’t bad depending on where you live, Northern California is crazy but Southern still has some areas that aren’t too expensive

#

what I’ll miss are the amazing trees we have here on the east coast

#

What I won’t miss are ice storms

stoic cave
#

I found the place on Google maps

#

These people have to be old money

pseudo creek
#

What place?

stoic cave
#

A private residence on my way to work

#

You come around this hill and there is a giant white gate that leads up a perfectly manicured dirt driveway

haughty leaf
#

Chevy Chase?

stoic cave
#

And nestled into the top of the hill you can just make out a southern style plantation home

#

I found the place on Google and they have two full size tennis courts

#

And other rich people house things

pseudo creek
#

Lots of houses along the Potomac are like that

stoic cave
#

Yeah this is further inland

#

Not gonna say where though lol

pseudo creek
#

Ha

#

It’s not unusual in the DC area

#

Just lots of rich ass people

stoic cave
#

Yeah this also isn't DC

#

It's like the north of the true south area

pseudo creek
#

I mean the metro area

stoic cave
#

Oh yeah

#

I get to go to Richmond on Wednesday though

pseudo creek
#

I love it here but the selling of land to build more houses is gonna drive me crazy

light urchin
#

how so?

pseudo creek
#

I like my wooded areas

light urchin
#

ah

#

yeah, that's happening everywhere

pseudo creek
#

They are just making it more and more dense

stoic cave
#

Yeah it's kinda gross what they are doing in my area

#

All of the town houses

light urchin
#

unless you can get into a neighborhood that's like arbor foundation certified or whatever

#

there's some law about amount of woodland required for that

stoic cave
#

Like legit people are finding DC to expensive so they are coming to where I am

pseudo creek
#

I live on the edge of a protected area so I’m good but whenever we drive anywhere, trees are gone and houses are going up

stoic cave
#

And turning it into another garbage pit

light urchin
#

I know some people who are very seriously talking about moving to Mexico or other places where cost of living is much lower

pseudo creek
#

Like they literally built half million dollar homes on the edge of a junk yard

light urchin
#

Sell the house and half your stuff, go down to the yucatan and live like a king

pseudo creek
#

Which cracks me up

light urchin
#

well, may be a junk yard NOW, but not in a decade

pseudo creek
#

Maybe not but seems like whoever owns that junkyard isn’t selling

light urchin
#

maybe it's the same person who owns the house

#

nice easy commute 🙂

stoic cave
pseudo creek
#

No It’s a row of houses

#

Or townhomes I guess

light urchin
#

someday I want to get anoother house or two and make it a rental property. Get some passive income going

#

I can't afford that any time soon though

pseudo creek
#

I have a rental property, there are pluses and minuses

stoic cave
#

All I see now are signs for Ryan Townhouses

pseudo creek
#

But overall it’s been good

light urchin
#

enough to make a profit?

pseudo creek
#

Yes

light urchin
#

or even just break even while you build equity

pseudo creek
#

The tenant pays a bit more than it costs me and it’ll be paid off in the next year, the value has almost tripled but that’s always the risk

light urchin
#

nice. Then you sell it and there's your retirement

pseudo creek
#

Well have to figure out that dance.. but we’ll see

light urchin
#

well sure, the details are up to you. But it's nice having that option

#

I don't. Yet. Might not ever 🙂

pseudo creek
#

It was an accidental rental, I bought it to live in then started dating husband

light urchin
#

hey, still works

#

I'm kinda hoping for a similar situation.

stoic cave
#

I've thought about buying a duplex when the time comes but idk if I want to deal with that

light urchin
#

I've heard that's a really good option too actually

stoic cave
#

Yeah you get the first time home buyer loan, purchase the duplex with it, and the have your renter pay most of the overhead

tawdry frost
#

I'm working on a duplex or quadplex for my first purchase in the next months, got a real estate agent scoping to see what we can find right now

#

quadplex is the highest you can go before you need a commercial loan

#

and usually if the numbers are good, you live for free in a quadplex or have very minimal costs in a duplex

ebon mica
narrow oasis
#

hi

pseudo creek
# ebon mica deal with what? The renter living next to you? 🙂

not only that but if something breaks at 2am... you are responsible. If your tenant decides to stop paying, depending on state laws, they may be living next to you for months before you can evict them and get a new tenant in there. And also, Covid brought interesting times for people who do renting. People who do AirBnB were affected greatly but lots of others were as well.

ebon mica
#

But is that any different to any other kind of rental than one half of a duplex?

pseudo creek
#

depends, you don't necessarily share a wall with your tenant

#

and I actually pay a management company to take care of everything for me, its fairly cheap and still my rental income over my mortgage and hoa fees is enough to cover the management

stoic cave
#

And on top of that people in the US are sue happy

leaden yew
#

Is it wise to take the OSCP if I have no experience ?
I have a degree though

pseudo creek
#

what do you mean no experience? do you have experience on TryHackMe, HTB and others?

#

and lots of people highly recommend eJPT first

frosty dove
#

Yeah, I'm doing eJPT course atm

#

It's fun - I have nowhere near enough knowledge for OSCP and it's soooo expensive as I'm only a school student

topaz heart
#

I'm looking to pivot into CyberSec and looking to start at Utica College in their BS in CybSec with a concentration on Cyber Operations. I already have a BSN (Nursing) and have been working as an ICU nurse for the past four and a half years. I have a minimal computing knowledge (built my own PC, have played around with basic router settings). Does getting a formal education matter?

golden ore
#

It helps

polar rock
#

From your background specifically I would say yes

topaz heart
#

Thanks

pseudo creek
#

well I'd disagree a bit, a BSN is a BS, now its not a traditional BS but that doesn't really matter, if you did some certs, you could apply to various jobs, you might have to take a slight pay decrease initially

#

if Utica College has a 2nd masters, that isn't a bad option, but may not be entirely required

topaz heart
#

I'm in NYC and have a feeling if I started out in an entry level IT position I would take a significant pay cut. Nurses in NYC start at almost 100k+ in every hospital and I'm in the highest paying one.

#

They also have a masters program, but I don't think I'd feel very comfortable taking it.

pseudo creek
#

yeah but you'll eventually catch up

#

I wouldn't do a Masters

#

get a Sec+ and start applying for jobs, get a blog, add some writeups there

#

and for a foot in the door, may not hurt to look at medical based companies or any company that may be concerned with HIPAA, companies always need GRC type people and that is a good entry level position

topaz heart
#

This is the program, I'd need to complete 58 credits and if I wanted an additional 16 for a minor in CS

pseudo creek
#

its not really needed, education is usually a poor way to get an entry level position if you already have a BS

#

it is really a mix of education (BS is helpful, specific degree not necessarily), work experience (any work experience helps for entry level) and certs.

#

like the SANS undergraduate certificate is 6 classes, 5 certs

#

the SANS academy is similar and its completely free (difference is you need to be a woman)

haughty leaf
#

Ooooh, I like free!

pseudo creek
#

yes, its meant for career changers or first time career people

#

and its competitive

haughty leaf
#

I'm in grad school, so not qualified. That would've been cool to know about a couple years ago. Oh well.

pseudo creek
#

grad school for security?

#

but anyway, I've been in security for a long time and I've worked with people with a variety of backgrounds and previous degrees including biology, psychology, criminal justice and those with no degree as well

haughty leaf
#

Yeah, I heard from plenty of people that I didn't really need it, but I love learning. Thinking about PhD one day.

pseudo creek
#

yeah I am thinking about PhD in Math

light urchin
jagged mango
#

what are the highest paying blue team jobs ?

primal tangle
idle wren
pseudo creek
ebon mica
#

Not everything is about money or career opportunities 🙂

cosmic ingot
#

also education in greece is free so here's something to think about

hot fog
#

Is a masters in cybersecurity worth it?

#

I think it is

hot fog
rugged sable
#

I legit was thinking of doing a master's in algos, it'd just be for fun tho

cosmic ingot
#

Literally every person I know that's doing a master's right now (or finished recently) is kinda disappointed about it

#

Unless you're trying to be an academic, you need to seriously consider whether it's worth it

pale dome
pseudo creek
rugged sable
pseudo creek
#

MS in Cyber in the US are not really academic pursuits, they are career advancing pursuits, if you want to be a technical lead or manager, only then is a MS in Cyber really worth it

cosmic ingot
#

I've considered it as well, just not right now

rugged sable
#

Would anyone rec the Juniper data centre free certs? Like, will I learn stuff that I wouldn't have from cloud certs?

light urchin
pseudo creek
light urchin
#

Very much so. And you probably won't get to work on stuff YOU want to work on

#

you're essentially an indentured servant, doing whatever your advisor wants you to do

pseudo creek
#

I remember a dental hygienist I had many years ago who told me she was about done with her PhD but she never ever wanted to see a dead dolphin again (she studied marine biology)

#

My idea is I’d retire at 60 as I transfer into a PhD program

#

Maybe earlier if the finances work out

light urchin
#

What's your goal? Just to say you did it? Or to do research on something you find intersting?

#

or to publish?

pseudo creek
#

Right now, it’s just to say I did it

light urchin
#

Well, you'll be paying 5k-10k+ per year out of pocket to work for someone with less experience, being treated like you know nothing.

ebon mica
light urchin
#

The point I was trying to make is that getting a PhD usually isn't actually enjoyable (fun). Your motivations for pursuing it might just be for fun/hobby, but the actual process is not fun.

ebon mica
#

I don't think anyone said the whole process would be fun. There's a difference between doing something for fun, and enjoying every single moment of it.

pseudo creek
#

yeah exactly

ebon mica
#

I've been floating around the thought of continuing with my PhD at some point. Perhaps one day.

stoic cave
#

Personally I think that's a lot of money just to say you did it but if you want it the only person stopping you is yourself. Personally, unless I were to go in to the academic world, I wouldn't do it.

#

I used personally twice dammit

pseudo creek
#

the point is I'd be retired, I'd have money saved up specifically for doing it

ebon mica
#

I don't think a degree that would cost me nothing out-of-pocket would be a lot of money. Naturally there'd be lost income and what else.

stoic cave
#

Yeah schooling isn't exactly free in the US

pseudo creek
#

I'd be going to a state school, which would be relatively cheap

stoic cave
#

You'd have lost income, expenses of being a student, and the school expenses

pseudo creek
#

thats why it'd be a retirement degree

stoic cave
#

I understand

pseudo creek
#

but we'll see where things go

ebon mica
#

Back in the days I signed up for a PhD program, but then slid into working in the corporate world.

hot fog
pseudo creek
cunning bough
#

Can I go into cyber as a computer info systems major? Or do I have to be computer science?

stoic cave
#

Degree doesn't always matter

#

Depends on the position and if any experience or certifications

lofty ibex
#

Location is also a pretty big factor in degree requirements as well

stoic cave
leaden yew
leaden yew
stoic cave
#

More than $300 I believe

ebon mica
#

https://elearnsecurity.com/?post_type=product&p=10890 The training material is free to access by getting an INE free Starter pass.

eLearnSecurity
eJPT Certification - eLearnSecurity

The eJPT designation stands for eLearnSecurity Junior Penetration Tester. eJPT is a 100% practical certification on penetration testing and information security essentials. By passing the challenging exam and obtaining the eJPT certificate, a penetration tester can prove their skills in the fastest growing area of information security

shut granite
#

mods are taking care 🙂

idle wren
hot fog
#

Here's a plan I have for myself (so far)

Complete Beginner path --> Web Fundamentals path --> Study for Network+ --> Cyber Defence path --> Study for Sec+

Any thoughts? I would appreciate any feedback :)

pseudo creek
#

sounds good

light urchin
#

A little while back, some people were asking about the use of a law degree in cybersecurity. Here's a quote from an article that jumped out at me related to this:

One of the first things companies tend to do after cyberattacks is hire lawyers, and they put them in charge of the investigation. They do this for a specific reason — it means everything they find is protected by attorney-client privilege and typically is not discoverable in court.

From: https://www.npr.org/2021/04/16/985439655/a-worst-nightmare-cyberattack-the-untold-story-of-the-solarwinds-hack

stoic cave
sly lance
#

Hey guys i graduated from college in December and started working as a systems engineer for a small company, i want to work towards cyber security after i get some experience here any tips that can help my career, i don’t have much experience in working in IT and I’m basically learning a lot of stuff right now

light urchin
thorn pebble
serene umbraBOT
#

Gave +1 Rep to @light urchin

light urchin
#

You're welcome. And yeah, I didn't know that either, but it makes sense.

stoic cave
#

Yeah if they don't have general council they will bring in lawyers

light urchin
#

My understanding is that they bring in outside lawyers specifically to take advantage of the client privacy laws

polar rock
#

.....

#

what have i done

light urchin
#

Invoked managed code?

polar rock
#

why did I post that in here the heck

warped moon
#

Does anyone know if joining an org like ISA or OWASP is a good idea? I've been told it's good to network and meet people, but I'm hesitant because it costs money.

flat sedge
#

Low cost alternative: look for a local meetup in your area; community colleges are a great place to start looking for user groups

warped moon
#

I see! I'll check those out

warm hinge
sharp cliff
#

I wanna just learn something for fun, not sure what(why I'm asking here).

What's something fun I could do? Examples I have in mind: Cryptography, cybersecurity etc..

What do you guys recommend?

alpine dawn
#

online training is not easy .. focus

old niche
alpine dawn
#

thank = u

rugged sable
blissful isle
#

Junior level cyber security specialist salary ranges. (East Coast of USA)

pseudo creek
#

thats a wide range... GA, NC, FL would pay less, Boston, DC, NYC would pay more

stoic cave
#

Are you offering a position or asking what the range is?

blissful isle
#

Philadelphia Area

#

@stoic cave Asking ranges for my own desired salary

pseudo creek
#

I'm not exactly sure philly but that seems like it'd be pretty standard, $70-$85k probably

stoic cave
#

Yeah i dont think there really is a standard range for all of the east coast. It's definitely regional and going to require some legwork on your part

#

I would set up a budget and come up with a desired salary, an acceptable salary, and then an absolute minimum

pseudo creek
#

true and I'm assuming college graduate, college graduates will generally land around $70k/year

#

entry level but could be more based on experience or in more expensive area

stoic cave
#

Yeah i personally wouldn't take $70k in or immediately around NYC/DC

#

Too expensive for that salary

pseudo creek
#

yeah generally I've seen people say $80k+ in DC area for right out of college. Its been a long time since I've been entry level so I can't really know personally

stoic cave
#

Yeah i got ghosted for asking for 80k. It was a sub 1% increase on the offered salary

pseudo creek
#

damn

#

no company should ghost you for asking for more

#

unless its like insane

stoic cave
#

Yeah. I was like "hey, I uhh need to buy a car so I'm going to counter with a 0.45% salary increase. Very Respectfully, Moose" and then nothing

pseudo creek
#

I will say I was dumb right out of college, I didn't even think to ask for more as the salary was already more than both my parents salary combined, but the funny thing is that due to them giving me the lowest salary possible, but then by the time I started the job, they had to bump the salary up as the entire salary range had moved up

stoic cave
#

Yeah i kind of got in a tiff with my parents when I said sub $70k wasn't an acceptable salary

pseudo creek
#

I never even told my parents, only reason I knew my parents salary was due to fafsa

stoic cave
#

For Northeast and DMV I should say

pseudo creek
#

and I was like wait a second...

stoic cave
#

Yeah i know I make more than my mom

#

Not my dad though

#

Mom isn't hard though. She's a school teacher

pseudo creek
#

well depends where

stoic cave
#

School teachers get shit pay no matter where they work

ebon mica
#

I find it hard to understand teachers are paid as little as they are.

pseudo creek
#

my mom was talking about my aunt who is a school teacher making $100k/yr and I was like I'm not saying anything

stoic cave
#

Where the fuck does she work?!?

pseudo creek
#

she is a kindergarten teacher in San Diego area

stoic cave
#

Damn

#

That's like the 1% of the 1% in teaching pay

#

Specifically primary education not secondary

pseudo creek
#

in San Diego county, the starting salary is something like $60k

#

I don't know about other areas

ebon mica
#

And I thought kindergarten teachers are the worst paid group of teachers.

#

The are at least in Finland.

pseudo creek
#

you'd think so when she only works 6 hours/day for 9 months/year

quick forum
#

San Diego tho

#

So 90% of that salary is an apartment

pseudo creek
#

San Diego isn't even the most expensive place to live

stoic cave
#

I don't think teaching salaries go above 50k in Mass

undone shore
stoic cave
#

Or a majority dont

pseudo creek
#

you can get a 1 bedroom apartment in my hometown, where my aunt lives, for around $900/month

ebon mica
pseudo creek
#

generally Los Angeles and San Francisco are the super expensive cities

undone shore
#

(Metaphorically tie up)

quick forum
#

Muir don't tie up the teenagers.

stoic cave
#

Teenagers will fight back verbally and physically. Kids are easy

undone shore
stoic cave
ebon mica
quick forum
#

Don't do that in a a school environment, smh

undone shore
#

Oh God, I just realised how that'll sound out of context 😆

quick forum
#

Yes

ebon mica
#

😄

undone shore
#

Yeaaaah, let's delete that one rather than explain that I am a teenager

quick forum
#

Not for long!

pseudo creek
#

ha

undone shore
#

Hush

#

Don't remind me of my impending old age

ebon mica
#

At that point you move to using hexadecimals for your age.

pseudo creek
#

I'm 2D

stoic cave
ebon mica
#

I'm in the wild 28s.

stoic cave
#

You still have teen in your age

undone shore
#

Hehehe 😁

quick forum
ebon mica
#

If one is 2D, one's go-to coffee must be a flat white.

pseudo creek
#

in a month, I'll be 2E

blissful isle
#

I just dont want to under or over shoot

pseudo creek
#

if you happen to undershoot, then you can correct later, if its a good position for growth, sometimes a little less pay can be worth it

ebon mica
#

Sometimes it can be hard to correct while staying with the same company, though.

pseudo creek
#

yup it can be

blissful isle
#

If they are asking me if "im familiar with" a list of frameworks should i just say yea then study them lol

stoic cave
quick forum
granite hornet
#

I'm trying to decide what study to do. Degrees are so expensive. Maybe I'd be better off just doing the A+ Next+ Sec+ trifecta to start with? Then look at pentesting once I've got a job? (I have employment now but in an unrelated field)

pseudo creek
#

getting certs is a great way to break into cyber security

rugged sable
#

Is there any cloud-based security certs?

ebon mica
#

at least AWS security ones, do they count?

pseudo creek
#

yeah CCSP is probably the big security cloud cert, AWS security speciality focuses too much on their services/products vs security knowledge, AZ-500 (Azure) has a bit of both, security knowledge and security services/products

#

there is also the one I got last year, ACSP, which is through the Cloud Security Alliance, and then its younger sister the CCSK

#

CCSP is all theory and dry as hell, reason I have 0 interest in it, its like the CISSP for Cloud

light urchin
#

aws security specialty is half IAM and half configuring firewalls and security groups

#

I was a bit disappointed by it, tbh

pseudo creek
#

I thought it was more about things like guard duty and what not

light urchin
#

yeah, there's some of that too

pseudo creek
#

I had a coworker who did it, she provided a breakdown and I was like nah I'll pass

light urchin
#

I didn't actually take the exam- I was studying for it right at the start of the pandemic, then the world went to sh*t, and I never took it

pseudo creek
#

she said it was a lot about their security services

#

but that was over a year ago

light urchin
#

but the content and practice exams I was seeing was a little underwhelming

#

yeah. their services, and iam, mostly

#

Would definitely like to hear about the ccsp though, I don't know anyone who knows anything about it really

pseudo creek
#

one of my coworkers took it, and she said it was very dry, very boring, very CISSP like

light urchin
#

but is it useful? either in the knowledge gained sense or the employment sense?

ebon mica
#

or specialties.

pseudo creek
#

I think CCSP being ISC2 could have some usefulness in employment sense and potentially knowledge gained sense, if you had zero knowledge about cloud, may be useful

#

but I also think that if people have been around security a while, has CISSP then they spend some time with one of the cloud vendors, they can infer a lot of the stuff that is part of the CCSP

peak steeple
haughty sundial
#

I haven't done any of the Google cloud cert stuff so I can't speak to the value/quality of it. I have done some stuff on Qwiklabs and felt like I learned a bunch though. (Disclaimer: I work at Google, and also I got free access to the Qwiklabs training stuff that I did)

pseudo creek
#

interested, didn't know they were bought by google, I've only used them (when they were free through work) for AWS

rugged sable
#

My friend is applying here, can anyone TL;DR what they actually do and why they need to exist? https://www.collibra.com/

Collibra
Trusted data for your entire organization | Collibra

Data can transform an entire enterprise — or change the world. But it also presents a challenge. It is difficult to find insightful information or even trust that it is accurate. Organizations need to become more data-driven, but they can’t do it alone.

stoic cave
#

I'm not exactly sure but it seems like they are a way to make sure that the data you are using is validated and verified

#

And then providing it in a cloud solution

#

It also mentions record keeping on another page

#

After doing a 5 second Google they are also being referred to as a Data Governance and Data Intelligence company

rugged sable
#

nvm it's a semantic web company that tries to use more exciting words than "semantic web" kekw

languid hearth
#

thought it would be neat to see if any job postings on LinkedIn mention THM

Screenshot_2021-05-03-03-42-00-371_com.linkedin.android.jpg
hexed magnet
pseudo creek
hexed magnet
#

I'm still trying to build up some skills and understanding on cyber as a whole to get a better understanding of what job I want. Seeing these kinds of job postings confuses me a bit as most senior trust and safety people I've worked with are more forensics and community management focused

pseudo creek
hexed magnet
#

that makes more sense

leaden yew
#

Is there any list of topics or tasks that you MUST KNOW before sitting the OSCP exam?

peak steeple
quick forum
frosty dove
#

Is it actually possible to do the OSCP without doing the PEN-200 course? 🙂

polar rock
#

Nope

#

You can’t get one without the other

static tide
#

well you don't have to do the course, but you have to buy it lol

wispy rock
#

Is it absolutely necessary to get a certification if your switching into one of the streams in cybersecurity from a different career field and if so which one you guys recommend for a complete beginner like me. Also I am on the complete beginner path on THM

pseudo creek
#

certifications are a great way to break into cyber security. A lot of it depends on where you live, you'd need to look at entry level job listings in cyber to see what they are asking for. Security+ is a common cert for entry level

wispy rock
flat sedge
#

IF you are new to IT, that is not a recommended path.

#

The CompTIA beginner certs are sequential; net+ assumes the material from A+ is known; sec+ assumes net+ is known. It is possible to skip, but I would not recommend it to anyone unless I was confident that the earlier material is already known

wispy rock
undone shore
frosty dove
clear hatch
#

Hey, is anyone here an info sec analyst?

golden ore
#

we have a few, you might just want to ask your question as we have many people at different levels that could provide some feedback on it

clear hatch
#

Well, I have an interview tomorrow for an info sec analyst position, and I want to prepare for it as much as I can. What exactly do you guys do on a daily basis?

golden ore
#

most analysts work with a SIEM in one fashion or the other, but it will always depend on the job

#

and I do have to say when you get to the point where you get to asks questions do ask that one so you can feel for what kind of things you will encounter

clear hatch
#

Gotcha, I know for a fact we have Crowdstrike Falcon, I believe that's a SIEM, and I've worked with that a little in the past.

quick forum
#

IIRC analyst is a really really really wide job title

#

It can include a lot of things

golden ore
#

Crowdstrike Falcon is a more of an EDR

clear hatch
#

What about Nagios?

static tide
#

ayy crowdstrike sent me a tshirt for passing one of their certs

golden ore
#

Nagios is an older SIEM platform that has been around, most SIEM's will involve multiple logging sources

clear hatch
#

Ah. I know the engineers are more of the quick response team. So in that sense, wouldn't the analysts be the people who look and see like "So this virus did this, got into this system" or "this unauthorized user made his way to X server, how can we fix it? Which application allowed him to execute what he did, can we update it?"

golden ore
#

that would be more IR team, but most of the time the analyst would be frontline person that sees and alert first or does a large amount of threat hunting

distant pier
quick forum
#

Job description is the most valuable thing here IMO

clear hatch
distant pier
zinc epoch
#

Do you need a degree to get into IT security?

golden ore
#

not a requirement but many companies like them

#

they can be used to supplement experience sometimes too

zinc epoch
#

@golden ore Because when I look up jobs for IT security it says that I need a Bachelors Degree in Computer science, Information Technology, or engineering.

golden ore
#

most companies will request them, I have seen many ask for them or list them as perfered

#

you can sometimes supplement certs for a degree, it all depends on the company

zinc epoch
#

@golden ore Would getting an internship be a great start before getting an entry-level job?

stoic cave
#

Yes

#

If you're in school yes, it can't hurt if you're not and still living with your parents

#

At the same time if you get a start in IT most Jobs will forgo the degree requirements in lieu of experience

warm hinge
#

Any good sites to find foreign country interships, or is it country specific?

peak steeple
#

Is there a differeence between security analyst and Penetration tester?

quick forum
#

Yes.

peak steeple
#

Please elaborate for me - thanks

quick forum
#

Have a look at some job descriptions

old niche
peak steeple
#

@old niche Thanks! I tried but my google dorking failed to spot that.

serene umbraBOT
#

Gave +1 Rep to @old niche

warm hinge
#

@peak steeple Check out a couple of these books: A Tribe of Hackers, A Tribe of Hackers Red Team, and a Tribe of Hackers Blue Team. They're all a great way to get to know the industry as a whole.

peak steeple
#

@warm hinge Thanks very much! I want to go Red but keep getting Blue Teeam roles soo I might try and see if it grows on me more. Thanks for the reommendation.

serene umbraBOT
#

Gave +1 Rep to @stark steppe

warm hinge
#

@peak steeple From my understanding, the Red Team jobs are just a small portion of the CySec industry so it may take sometime for you to land something in the RT field. Get to know the BT side so you can learn how the BT defends the RT -- they'll call that the metaphorical Purple Team. It will make you a much better "hacker", too. The key to a good offense is knowing how to play against the defense.

peak steeple
#

@warm hinge Thanks once again! Great insight.

serene umbraBOT
#

Gave +1 Rep to @stark steppe

worldly kestrel
#

can i benefit if i am a system administrator and i want to work as red team after getting certs?

acoustic jewel
#

Of course. You'll have an understanding of the systems you'll be attacking, common shortcuts people take etc

lofty ibex
#

If anything having that experience will massively benefit you as you'll have a deeper understanding than most going into the field

static tide
#

i heard someone once say a good sysadmin is an undercover redteamer

undone shore
#

Blue and red team are two sides of the same coin

#

The better you are at one, the better you can be at the other.

flat sedge
static tide
flat sedge
# static tide shadow it?

Shadow IT is infrastructure that isn't being governed within the policies and procedures of an organization.

#

Like, a sysadmin that sets up a game server in violation of company policy

#

or a network admin that builds a 'secret' VPN in or out that doesn't conform to company requirements

static tide
#

ohhhhh i see

stoic cave
#

Hey that's on security plus lol

#

I think they call it sprawl though

ancient prairie
#

what if the shadow IT is the only security you got 😂

bronze lodge
#

Just had to deal with a shadow IT audit meeting today.... Too coincidental 👀

cosmic fulcrum
bronze lodge
#

I'm like the shadow IT to our shadow IT, I set up shadow infra to stop them from setting up shadow infra. Genius, I know

hexed magnet
#

praise be

pseudo creek
#

wrangling Shadow IT is part of my job

clear hatch
#

Had my interview yesterday for the info sec analyst job. I thought it went pretty well, waiting to hear back.

opaque laurel
clear hatch
serene umbraBOT
#

Gave +1 Rep to @opaque laurel

pseudo creek
#

good luck

static tide
#

anyone here “work from home” abroad? what are the tax shenanigans or other things to think about?

#

my friends company have just announced they are allowed to work from abroad now 🥺 lucky 🥺

opaque laurel
static tide
#

yeah so him and the company are both in the uk

#

and he’d like to work obviously somewhere exotic lol

opaque laurel
#

export regulations and tax are the main factors, as well as relevant visa's I think

#

yeah

#

also if he's thinking out of EU, GDPR regulations and data handling

static tide
#

okay awesome thanks!

#

regarding visas, is a work visa needed?

opaque laurel
#

Yes, I believe so in most countries

static tide
serene umbraBOT
#

Gave +1 Rep to @opaque laurel

stoic cave
#

I'm not sure about the UK but in the US if you work abroad you still have to pay taxes back to the US as well as where you are

#

There are tax credits though for that I believe but I am not certain. Talk to a CPA

static tide
#

cpa? certified public accountant?

quick forum
#

The US is weird with taxes though. Dual nationals with US passports are expected to pay US tax as well

stoic cave
stoic cave
static tide
#

he works for a large company so i guess he'd be able to speak to people in it

stoic cave
#

Yeah he can probably set up meetings

opaque laurel
#

yeah for my company they can make arrangements on my behalf to do similar things but I haven't looked too much into it

pseudo creek
#

My company is a whole hell no on work from home from abroad

stoic cave
#

Yeah the WFH abroad is definitely something I would consider later in my career

#

Specifically I want circumnavigate the globe by boat so yeah

static tide
#

hacking from the middle of the pacific

stoic cave
#

Dude it's going to be possible soon

#

You have Iridium Go and now Starlink

#

If they made a marine grade Starlink it would be a game changer

pseudo creek
#

My company basically considers you a foreign National if you live and work in another country

stoic cave
#

Yeah i would definitely be out of government work if I were to do it

light urchin
#

I used to work with somebody who had a small consulting company registered in the US, but lived in France

pseudo creek
#

I’m not even in gov work but I couldn’t do my job if I lived in another country

stoic cave
pseudo creek
#

They would not let you on the US network if you live in another country

static tide
#

beocme the network engineer and then you decide who gets on the network

stoic cave
#

Lol

pseudo creek
#

?

stoic cave
#

On all the VPN ads its always access content from different countries and make it seem like you're in another

light urchin
opaque laurel
#

my company has locations all over so its a bit different for me, some of my team are not in Australia even

pseudo creek
#

My company is in Australia so you could be hired there but you’d be supporting our Australia projects and get Australia pay

#

And you’d be on our Australia network

opaque laurel
#

yeah that makes sense

#

the pay disparity is a big deal when changing countries

pseudo creek
#

But you can’t just change countries due to visa requirements, you’d have to apply for a job

stoic cave
#

Yep

#

This convo also just reminded me of a video I saw about why this government contractor always wore a Rolex when they were in a foreign country

opaque laurel
#

yeah exactly

#

o.o

stoic cave
#

It was something along the lines of "everyone knows what a Rolex is and if you don't have cash or pew pews it can be traded for goods"

light urchin
#

or you could get mugged and killed for it 😉

stoic cave
#

In his line of work, probably

#

Guy was also a SEAL and accidentally swam in to the dolphin cages

light urchin
#

"accidentally"

stoic cave
#

If you didn't know, the US Military trains dolphins as harbor protection assets and anti-swimmer

stoic cave
light urchin
stoic cave
#

I know you know lol

#

On my phone I sent that before your "accidentally" message

light urchin
#

ah 🙂

pseudo creek
#

I don't know watches

stoic cave
pseudo creek
#

but you can also get a fake rolex I'm guessing pretty easily

haughty leaf
stoic cave
#

Yeah you can get one for like $50 but people will usually try and sell them for higher

stoic cave
warm hinge
#

How to find the ip address of the google meeting in which we are connected

lofty ibex
#

You don't

cyan laurel
#

ethical and legal hacking chief

warm hinge
#

"ethical"

cyan laurel
#

ethical.

naive torrent
#

I am a Security Engineer with CEH. I am wondering what cert I should take up next. My long term dream is to be a Security Researcher and I'm inclined to Web Security but not fixating on it. Suggestions?

cosmic ingot
#

of course before you go for a cert, there's a ton of free content you can look at, most notably portswigger academy (since web security is your main interest)

naive torrent
naive torrent
cosmic ingot
#

you can browse to the rest of the certs from those pages. the entry level certs of those 2 orgs are OSCP and eJPT, respectively

naive torrent
serene umbraBOT
#

Gave +1 Rep to @cosmic ingot

rancid rover
#

Is there anyone here who's currently or has worked for Taos as a Technical Support Specialist and willing to give me some insight on the company?

molten minnow
#

yo one question for anyone who has passsed eJPT recently

#

are the exams harder or easier compared to the 3 black box test labs they have ath the end of the course

cosmic ingot
molten minnow
#

ok thanks

zenith island
#

most people say they're harder than they exam but if you manage them ok then you should be good for the exam

icy kestrel
#

hey I was wondering if any of you guys happened to like work like a job in cyber security? cause I have a question about like college.

quick forum
#

@icy kestrel Please don't ask the same question over several channels like that, it's very spammy

icy kestrel
#

OK sorry I didn't know. I don't really use discord that often

pseudo creek
#

just ask your question that you have

remote mauve
#

some of us do work in cyber, you can just ask your question here

icy kestrel
#

A little bit of background: OK, well I'm 18 and a senior getting ready to go to college . I want to seek a career Cyber Security and the college I'm going, to allows you to choose Cyber Security as a major but, some people I know are telling me I shouldn't choose that as my degree and I should get a degree in computer science. Question: So what should I do ? What degrees do you recommend and would those be beneficial to me at all?

#

sorry its so long ^

pseudo creek
#

either will work, Comp Sci is the traditional standard as Cyber security degrees are fairly new but it doesn't matter. Choose whichever one looks more interesting to you

#

and regardless of which one you choose, in your junior/senior years, look at getting some certifications such as security+

icy kestrel
#

yeah I plan to try and as many important certs as I can but I find both of those interesting so it kind of hard to choose. Also my neighbor told me that I should try to get into cloud security is that the same as Cyber Security?

stoic cave
#

sub section

pseudo creek
#

and way to get into cloud security... get a cloud cert or 2

stoic cave
#

Cyber security is really broad and then you have places you can specialize in

#

Yeah from what I heard the first few AWS ones arent hard

pseudo creek
#

cloud security is what I do, but I was in cyber security for 15 years or so before I went into cloud security

stoic cave
#

just memorization

#

but that could be BS

#

Im not in that sector

pseudo creek
#

it helps to know how to use the service, I think the cloud practitioner (which I didn't take as it didn't exist) probably doesn't require you to touch the console

stoic cave
#

Is that the first one?

pseudo creek
#

it can be, its not required, its the most basic

stoic cave
#

if so I think its basically memorizing their pricing structure and offerings

pseudo creek
#

I have no idea

stoic cave
#

and knowing the difference between things like Glacier and EC2

pseudo creek
#

don't confuse the kid 🙂

stoic cave
#

lol

icy kestrel
#

I know that having a lot of certs is good but do people even use them on a day to day?

pseudo creek
#

but basically, it doesn't matter, CompSci or CyberSec, choose what looks good

#

yeah people use the knowledge from the certs every day

#

and you don't need a lot of certs, I think over my 22 year career, I've gotten maybe 10 certs total?

stoic cave
pseudo creek
#

you'll only need 2 maybe 3 certs when you graduate college

stoic cave
#

and I was able to find a job mid pandemic if thats something you're worried about

stoic cave
pseudo creek
#

I'd recommend it, but you don't need like 10 certs

stoic cave
#

Actually I had the Cellebrite one but nobody knew what that was

pseudo creek
#

and my company has hired a bunch of new hires, many in cyber security fresh out of college and most of them had CompSci degrees

stoic cave
#

Yeah comp sci is still the predominant degree

#

many straight cyber sec programs are hit or miss so you have to do your research

#

NSA publishes a list of schools it likes as well

pseudo creek
#

the NSA list is primarily for MS degrees, its basically universities its worked with to basically come up with a baseline

stoic cave
#

🤷‍♂️ I used it to decide where I wanted to go

pseudo creek
#

and not to shit on my MS program but my MS program was on that list and I would say it was 'ok', it is more about getting out of it what you put in

stoic cave
icy kestrel
#

so your saying the list doesn't mean much?

stoic cave
#

Its a good reference if anything

#

With it you'll know you're getting a baseline of Cyber Security education that the NSA approves of but its also on you to further that learning

golden ore
#

schools and certs are there to provide the basics, it is on you to expand further

stoic cave
#

yep

#

I have a homelab for that reason

pseudo creek
# icy kestrel so your saying the list doesn't mean much?

I know it may be hard to explain but the most important thing about a BS isn't necessarily the specific degree, it is more that companies want to see a BS and many don't care what you major in. You will want to do learning on the side, a couple certs, etc

stoic cave
#

spend $350 now to make $100k later

golden ore
#

but I need the $350

stoic cave
pseudo creek
#

I've never had a homelab unless you consider VMS to be my home lab

stoic cave
#

it was a figure of speech

#

a homelab can be any price

pseudo creek
#

but also when I started work, they didn't care about putting old equipment on their network so they were like 'sure, here is an old router and some switches, go play'

stoic cave
#

now they would send in the swat team lol

opaque laurel
#

my team had a whole mini datacenter when I started, we'd use it to mainly set up client problems to try replicate or for education but

#

gone now though

pseudo creek
#

my company has those at certain sites

opaque laurel
#

I would laugh if we worked for the same company

pseudo creek
#

prob not

#

although 100k+ people are in my company so possible

opaque laurel
#

according to google mine is 300k+ so doesn't rule it out

#

probably similar industry except you actually work in cybersec lol

pseudo creek
#

I think the 300k+ ones are like the consulting firms, I'm not in a consulting firm

icy kestrel
#

I had to do some research for my dumb senior project and it said that most places are understaffed and some people have to the job of two people is this true?

cosmic ingot
# stoic cave I have a homelab for that reason

I've been toying around with ideas recently for a lab (although currently my "lab" consists of a single trusty pi0 😄 ). May I ask what's your use for it? (and what hardware you have, if you're not bored to say)

pseudo creek
icy kestrel
#

google

golden ore
#

depends on the company

pseudo creek
cosmic ingot
stoic cave
golden ore
#

but it's also very hard when companies are searching for 50 years of experience

opaque laurel
#

it's very hard to categorise, like, you should never have nothing to do, and you should never have to let really urgent things take longer than they should, but aside from that, unless you are literally doing 16hr days every day to just keep the company working its hard to say

stoic cave
#

the R710 has 96GB of RAM and 6TB of raw storage but I have it in RAID so its more like 4.2ish

icy kestrel
golden ore
# icy kestrel 😮

many companies put odd requirements for time in some times, it makes its hard for people getting into the industry

pseudo creek
#

I wish I could show you the job I just applied for that I'm 99% sure I will get, I certainly don't have everything in the list but you bet your booty I'm going to be able to at least talk about the areas I don't

cosmic ingot
stoic cave
#

It came out of a datacenter somewhere

cosmic ingot
#

the memes were true 😄

golden ore
#

you should have seen the box

stoic cave
#

hang on

opaque laurel
#

I applied for one in my company earlier in the year but I'm way under qualiied, they have another one up now but I'm still a bit out of the league so I"m wary about applying again till I get oscp

pseudo creek
serene umbraBOT
#

Gave +1 Rep to @opaque laurel

cosmic ingot
#

zojja didn't you change positions just recently?

opaque laurel
#

I did get to speak to the hiring manager and have a talk about it in future and it was positive though

stoic cave