cyber-and-careers

[flat sedge]

That said, the certs are still valuable; if my opinion means anything, I suggest getting a Blue team cert to go with it. IIRC the Splunk cert is pretty reachable for entry level

[warm hinge]

That was my thought. I’m working on Sec+ right now as a broad based introduction. Thinking of CySA+ next. Had someone recommend CEH but I’ve done enough research to know I don’t want to go that route (and had a really bad experience with an EC Council sales rep). The person who recommended it was basically saying to do something to make yourself stand out beyond the baseline certs required for the job. So I’m not looking at OSCP to learn the skills I’d need for the job per say (planning on CySA for that). But rather to set myself apart as someone who has an interest in the field beyond just what is the bare minimum required for the job.

[flat sedge]

Having a tool cert on your CV helps too; if you can set up a homelab to practice on, that's also a huge plus for interviewing with a security team

[golden ore]

having certs that don't apply to the job don't always make you stand out, it is more the knowledge around the certs you have that helps

[light urchin]

So you're telling me that the 10,000hrs I spent getting my underwater basket-weaving cert was wasted effort?

[golden ore]

well hopefully you can make some awesome baskets

[light urchin]

moderately useful ones

[wild moat]

Hi, I am a computer science major and would like to transition to cybersecurity which certification do you think I should start with? I'm considering starting with either eJPT or Security+

[pseudo creek]

Security+

[warm hinge]

Either one. Look over the syllabus(objectives) for each one, and pick one that grabs ur curiosity

[wild moat]

Im an academic, so from that perspective I was leaning towards Security+ more since the topics covered the basics that could help me go deeper in terms of research. eJPT syllabus looks more fun but correct me if I'm wrong, from my preliminary search I couldn't find research topics related to pentesting.

[light urchin]

when you say research topics, are you talking about writing academic papers for publication?

[wild moat]

yes

[light urchin]

well then there's plenty of that to go around. I'm not sure how well either cert would prepare you for that, though- it's more about getting ideas, that can come from anywhere

[warm hinge]

@wild moat Sec+ is giving u basic knowledge on a variety of security topics, but not enough to produce that initial “intro”. It can help u create topics to center ur paper around and than u can do further research from there. Best answer i got lol

[light urchin]

Another thing to do is just read papers, tbh

or just look at anything and think "how can I break this?", then go see if a paper exists on that. If so, take the next step. If not, research it and write it

[wild moat]

Yeah thats true, I was thinking that by reading and learning about the different areas I could find an area of interest and also be sufficiently aware of others.

[quick forum]

Honestly this led me to a great project idea so big +rep here

[serene umbra]

Gave +1 Rep to @light urchin

[light urchin]

ngl, kinda honored by that, James. 🙂

[quick forum]

I had the project idea already but that describes the process I followed to come up with it

[light urchin]

SOmething I've learned from academia is that most papers are the "minimum publishable unit", for a variety of reasons

so authors either have a second paper planned/in mind/in progress/etc., or they don't really care all that much, and their "next steps" is something they will never pursue

[quick forum]

I've just learnt that a lot of them are not properly proofread 😆

[light urchin]

yeah, that too. Depends on the journal

the publishing industry/system is pretty broken. I will spare you the rant/soapbox

[quick forum]

Yeah, it's a big scam

I have family and friends of the family at various levels of academia including a professor (and active researcher) and yeah, big scam

[stoic cave]

My professor told me that one of my papers could be published and then didn't help me publish the paper

[light urchin]

yeah. It's part of why I left academia. Also, way more $ in industry

[light urchin]

That's pretty standard. THeir job is to mentor and advise, not really help

[stoic cave]

I asked what the process was and how to get started and was told "figure it out"

[light urchin]

hah. So he/she is even lazier/busier than most

[stoic cave]

Like at least give me a starting point

[light urchin]

and you were an undergrad at the time, right?

[stoic cave]

I have no issues with doing the legwork

Yeah

[light urchin]

yeah, they need to help more then

[quick forum]

I'm a little annoyed that I can't keep my project as FOSS until I've handed in the assignment

[stoic cave]

And then i also hopped on another professors PhD project but I probably won't get recognition for that either

[light urchin]

Because of potential academic integrity/theft/cheating?

[quick forum]

Yeah, not allowed to publish work until after

Will have to sort out what extent I can demo it etc

[light urchin]

You should. Generally speaking, I've seen undergrads get at least a mention/thanks, if not a co-authorship, depending on contribution

[light urchin]

Yeah, different uni's have different policies. But once you're out, that is probably still your IP. Unless you signed patent rights/IP rights/etc away

[quick forum]

Yeah once I've handed it in etc then I'm good to release the code

[stoic cave]

It's a longer story but tldr looking back we basically did the "undergrad lead's" capstone for them and the PhD was still in the initial stages of development and execution

[light urchin]

doesn't matter. If you contributed substantially to the acquisition of knowledge that went into the publication of a paper, then it still counts

even if you are no longer a student and/or it's years later

I've personally seen numerous instances where an undergrad helps write a tool or process some data or something over a summer, but the paper doesn't get published for a year or 3. They still get credit

[stoic cave]

Yes i realize that but idk where the distinction between the two projects were

If that makes sense

We were told that we were working with the professor on the PhD project but looking back it seemed we were doing the undergrad's senior thesis for her

[light urchin]

ah. Well still, if a paper comes out of it, you should get credit. Whether or not you actually do is a diff story

[stoic cave]

Yeah i really don't care besides the fact that this project could be a multi million dollar company

[light urchin]

Yeah, I doubt you'd get anything, tbh, unless you really contributed a lot

you could always try a lawsuit, but I wouldn't be very helpful

[stoic cave]

Not really after any money, frankly, I wouldn't care about the money. Moreso having my name attached to the original launch

[velvet dust]

Im having a hard time finding some answers to this... CIO is second line of defense, director of internal audit is third line of defense, head of enterprise risk management is second line of defense, CRO is second line of defense, not sure what the Chief technology officer is and the chief technology officer is... Please Correct me if im wrong in anything!

[pseudo creek]

well yeah you are but I'd google "CIO vs CTO" and you can get an idea of what the difference is, they are peers to eachother normally

[lilac plume]

Hello,

My name is Iulian and I am here to get some help from this amazing community. I am a Cyber Security master student from Netherlands and I will soon take my degree (I have only 1 course left to pass, wish me luck) and I am looking for a final master theses. I intend to do this project within a company and they asked me to pick my research project but I don't even know where to start. Do you have any interesting ideas I could research or any idea on how I should look for a project? This is a really big field and I am still a beginner and I am not completely sure what this field is capable of. I would really appreciate your help.

Wish you the best,
Iulian

[quick forum]

EmptyBuffer gave some great advice for choosing research projects the other day

#cyber-and-careers message just here

[lilac plume]

yeah, thank for that. I've read that advice before posting my message and it is a pretty good one. Anyway, I still posted my message because I am open for any other advice/ideas. 😇

[light urchin]

If you have to specifically work with that company, I would go talk to whoever you can there that can either help mentor/guide you, or who can give you ideas or data. So, if it's a software company, I'd go talk to the people writing the software and maybe ask how they approach security. Or maybe go talk to the IT people and ask how they defend the network, or what kinds of malicious traffic they see, stuff like that. Maybe ask them what tools they use, or why one is better than another. Or maybe you can do a comparison/analysis of those tools or IDS, etc.

[restive eagle]

Dude just have a look at this you might get some ideas
https://cybercademy.org/project-ideas/

[gentle terrace]

https://www.cbsnews.com/news/cybersecurity-job-openings-united-states/

[flat sedge]

To follow up with what @light urchin said, don't be surprised if whoever you talk to is not very forthcoming about their security landscape. Instead of asking what they do, it might be a lot more productive to ask about what is ideal. That takes the burden of reality away, and could allow them to be more free with what they would like to see to properly secure an environment

[light urchin]

Good point, some people might not want to give you the whole story. But some people are perfectly happy to gripe about their complaints, so ya never know.

[limber idol]

Buddies, what do you avoid testing when you have a web app?

@quick forum Can you give me an advice? I think you have some experience related to this

[quick forum]

I do not.
Please do not ping me when you want help.
Ask, and see who answers.

[limber idol]

Okei, sure.
I just read the topics from this channel and i thought that you know very well this part.
And also because you answered me with the OWASP part

[quick forum]

You should read the scope very carefully. Do not test anything that's out of scope.

[limber idol]

I always lose a lot of time on rabbit holes and I'm trying to figure out what to avoid

[limber idol]

Thank you!

[serene umbra]

Gave +1 Rep to @quick forum

[grand swallow]

Hwy guys, not sure if this has been asked before. Is it worth it to show your THM badges and certificates in the resume when looking for a job in cybersecurity?

[shut granite]

it would be a good thing to show for sure

[molten minnow]

@grand swallow in the begining definetelly positive, whatever you can showcase that you have worked with, labs, ctfs is a plus. Later on as you fill your resume with more prestigious accolades and job experience you will probably take the bades out xD

[shadow trail]

Hi guys, I'm kinda new in cybersecurity, do you think that a data science background can be useful somehow in cybersecurity?

[pseudo creek]

no, I would put it as part of a quick blurb in a 'personal development' section but it really most likely means nothing to an employer

[pseudo creek]

Sure, a lot of cyber security is driven by data

[weak tusk]

Hi all, I'm getting really interested in the OSINT rooms and challenges, I'm starting to wonder what kinds of jobs might be out there that revolve around that aspect of cyber security? I know that's kind of a broad question

[golden ore]

investigation related jobs would use OSINT, you may use it a little if you are doing malware analysis when trying to identify possible threat actors

[weak tusk]

@golden ore I'm really interested in DFIR at the moment, and it seems like OSINT could go hand in hand with that in certain situations

[golden ore]

DFIR is a lot of investigation, so yes it is used depending on the case

[weak tusk]

Awesome to hear! Thank you

[lilac escarp]

you may be interested in this talk.

https://youtu.be/qkItelFGblw

[weak tusk]

@lilac escarp thank you I'll check it out

[serene umbra]

Gave +1 Rep to @lilac escarp

[blissful isle]

Had a really disappointing interview today for an Entry level cyber security analyst role. Basically the guy didn't even turn his camera on, had bad internet, kids yelling in the background. He asked 3 questions "Tell me about your experience", "Get a pen an paper 8,6,9,23,87 what number comes next?" then same question with 8,10,70,15,60. Then at the end he asked "How interested are you in being a developer?" I basically said not at all thats not even the position I applied for (but said in a professional way). I asked him what his role was and he said he's a Java developer. Then he ended the interview. I was like wtf that was so unprofessional and straight up just not correct. You'd think an international company that does over $9 B in sales would have better hiring process. But i guess someone goofed it up idk

[light urchin]

I would follow up with the recruiter or whoever else you spoke to. Sounds like there's a disconnect there somewhere. But also- take this as a good thing- you figured out very early on that you probably don't want to work with that team/person/company. Interviews go both ways.

[queen cargo]

If there is someone here residing in Oulu area please drop a dm

[ebon mica]

Not exactly there, but used to, and I know quite a bit about the companies and uni there

[queen cargo]

Not home atm, but is it okay to dm you later Arhu?

[ebon mica]

That's fine, I'll answer when I can 🙂

[ancient prairie]

alright have the PenTest+ scheduled in 3 weeks, anyone have a favorite resource? I already have Dion's stuff, currently split between the Sybex and the McGraw Hill books

[lilac plume]

hello guys. do you have any awesome template for a CV? Or maybe some tips and tricks in order to get some "points" from the company?

[stark marlin]

i would recommend using canva

they have some sweet templates you can copy

then for each application you make , make sure the cv is sorta custom and oriented to the job

and have basics like acheivements, experience(if you dont add some projects you did), Skills try to keep it relevant to the job, education etc

if you have certs and stuff do make a seperate column to plop em and add some drtail about what they are all about

and maybe in achievements you can add your rank of THM/HTB if you want

[lilac plume]

oh damn, these are some great tips. I will check Canva and I will use all the tips. Thank you @stark marlin I really appreciate

[serene umbra]

Gave +1 Rep to @stark marlin

[stark marlin]

no problems at all , Best of luck hope you get a great job

[light urchin]

I'd love to know what you find also. I'm taking it in a few weeks too, totally not prepared for it

[ancient prairie]

Managed to find PTO-002 exam objectives and a blog post detailing the difference between the two exams, you might find this stuff helpful - still undecided on the book ill get tho
https://comptiacdn.azureedge.net/webcontent/docs/default-source/exam-objectives/comptia-pentest-pt0-002-exam-objectives-(4-0).pdf
https://www.comptia.org/blog/comptia-pentest-001-vs-002

for comptia stuff the first thing i usually do is annotate those exam objectives page and try to write 1 sentence below each objective, whatever I dont know anything about ill mark for follow up

[light urchin]

Thanks!

[serene umbra]

Gave +1 Rep to @ancient prairie

[shut granite]

https://youtu.be/ey5tjmuHbCQ

this is there as well if u want^

[mint falcon]

Hi

hi Odaly

[young yoke]

Does THM itself have a careers page ?

[unreal arrow]

There's a #jobs-board where most of the recruiters will post if they have anything to offer

[young yoke]

What about working for try hack me itself ?

[unreal arrow]

They mainly post jobs on Twitter there was one a week ago i'll find it

https://twitter.com/RealTryHackMe/status/1395061963823230982

TryHackMe (@RealTryHackMe)

TryHackMe is all about product-led growth. We're growing fast, love running experiments & are looking for a Growth Engineer.

Benefits: Competitive Salary, Health Insurance, FlexiTime, Remote & 10% Project.

https://t.co/Izn70OZl6f

Twitter · May 19, 2021, 5:01 PM

[young yoke]

Cool. I'll keep an eye on the twitter. Thanks @unreal arrow

[serene umbra]

Gave +1 Rep to @unreal arrow

[ripe current]

can any one help should we learn programming languages for ethical hacking or can be managed by the tools we have please any one help me

[upper mirage]

Yes you should learn programming. You'll understand how the tools/exploits work and you can write your own

[ripe current]

can you prefer which programming language is more relatable to cyber security and ethical hacking

[upper mirage]

Python is a good beginner language

[ripe current]

anything else can be good including python

[upper mirage]

Depends on what you wanna do but in general it's good to know python, bash, powershell. If you wanna do webhacking for example then you should know JS,PHP etc.

[ripe current]

it means a lot bro

thankyou

[haughty sundial]

Understanding the fundamentals is really valuable, but you also don’t necessarily need to be some incredible, super experienced programmer to be able to do security stuff. Being able to write some scripts in Python can be really helpful.

Programming knowledge certainly doesn’t hurt, of course 🙂 But you can learn as you go, it’s not a big prerequisite or anything.

[velvet lantern]

https://discord.gg/VxdQKBHTSg

[zenith island]

keeping on the theme of learning python.. i feel like learning python would aid me massively right now, i've tried to do a python course on udemy before but lost interest.. does anyone know of any courses that teach python while relating to pentest/security at the same time?

[lofty ibex]

When it comes to learning a language for hacking you first need to understand the fundamentals of it. So best thing is to tough through a normal course and then relate it to security after

[zenith island]

yea that's what i sort of gathered alright... wish i could just sit through it lol

could anyone recommend a python course? i tried automate the boring things on udemy but it really just didnt grab my attention

[lofty ibex]

You might find https://www.codecademy.com/ useful, it's interactive so has that benefit

[zenith island]

thank yaa

[serene umbra]

Gave +1 Rep to @lofty ibex

[pseudo creek]

You could look at FreeCode Camp https://www.freecodecamp.org/learn/information-security/#python-for-penetration-testing

[zenith island]

thank yaa

[rugged sable]

This book teaches you Python from the ground-up using cracking secret codes, lil secret but this is the book which inspired Ciphey. So much so that I even emailed the author to ask for help 😅 https://www.amazon.co.uk/Cracking-Codes-Python-Introduction-Building/dp/1593278225/ref=sr_1_1?dchild=1&keywords=cracking+secret+codes+with+python&qid=1622192628&sr=8-1

[zenith island]

tytyty

[north hill]

Hey I applied for the Content Engineer thing with TryHackMe. Are we doing referrals for this one ?

[peak steeple]

Are network engineers supposed to have Cisco and Juniper certs?

[polar rock]

Typically, Cisco > Juniper though

CCNA is a fairly common requirement

[peak steeple]

@polar rock Thanks I will tell me friend who lost his job due to lockdown. Allready has CCNA but no interviews yet sooo this might open new opprunitss for him. Thanks

[serene umbra]

Gave +1 Rep to @polar rock

[austere drum]

I suppose that someone else also asked this question guys, but I would like a hand of help if is possible

What entry level jobs are there in cyber sec and what should someone need to know to start a career in the field?

[misty saffron]

interested in this answer aswell

[pseudo creek]

this is a good article that talks about things to know for cyber security https://github.com/ED-209-MK7/5pillars/blob/master/5-Pillars.md

Generally Soc Analyst is jr position although sometimes you may need experience in IT in general such as IT help desk, jr sys admin or jr network admin.

Sec+ is a great entry level cert for Cyber

[austere drum]

What knowledge you need about soc analyst. I am currently a university student and we have learned basic stuff about sec and every time I read a job offer I understand what they ask for, but I think that I cant make it. Probably because I dont have any experience from work in the field

[pseudo creek]

Honestly, junior level jobs are meant for you to know the basics, so like basics of networking, security, operating systems, etc. If you see job listings, those are a good guide

[austere drum]

So you think that is a good chance to start, at least to earn some experience?

[pseudo creek]

yes but like I said, it may be difficult as entry level security jobs are highly competitive, so you might want to keep an open mind and look at other entry level jobs in IT

[austere drum]

Thanks a lot, I'll have my eyes open then

[oak basin]

I have a question for those who work remotely for different reasons than covid. I would greatly appreciate it if you can help me!
What kind of webcam do you recommend?
I'm going to start looking for a job in fully remote companies. I don't have a laptop. I'm thinking of buying the Logitech C930e or the Logitech Brio. I think the Brio is too expensive but it may help make the interview a bit more pleasant.

[lofty ibex]

C920 is a pretty solid choice. The webcam doesn’t have to be expensive. The capability to display a HD image is the main thing

[oak basin]

Thanks!

[serene umbra]

Gave +1 Rep to @lofty ibex

[north hill]

Hey anybody's company got an opening for Internships ? For Summer/Fall ?

[stark marlin]

prob better to mention which country you are looking in

i know that cisco is hiring interns

for their incubator program

you can see if its they have that program near you and apy

apply* you just need basic knowledge more and less and if you are enthusiastic enough i am sure they will pick you up

[north hill]

I'm from India, so if anything here or remote opens up, please do lemme know. I have been told that SoCs hire interns to validate test cases and stuff. That would be really really helpful.

Summer breaks are coming up and I still don't have an internship

Also any recommendations for the THM job ?

[flat sedge]

It's a little late to apply for either - summer internships usually recruit around november-january. Finding anything past february is really tough.

[north hill]

Yes, that's why I am hoping for some heads up on Fall 2021

[sullen ridge]

@north hill from where in india?

[north hill]

Kolkata !

[static jay]

\

[leaden yew]

Are there certifications which you can take even if you do not have a company?

[opaque laurel]

most certs aren't tied to a specific company

[undone shore]

I mean, I got my OSCP as a student 🤷‍♂️

You can do virtually any cert by yourself

CISSP you may struggle with

[leaden yew]

Doesn't CISSP require explicitly 5 years of experience?

[opaque laurel]

well, Muiri did say you may struggle with that so perhaps don't focus on that first

[leaden yew]

I followed a course which was much harder than the CISSP, but from what I heard, the issue is registering if you do not have the experience

[opaque laurel]

well, their website doesn't say they won't let you

https://www.isc2.org/Certifications/CISSP

[pseudo creek]

you can take the CISSP but you would have to indicate you have an 'associate of ISC2' vs CISSP on your resume as you don't have the experience.

SSCP, although not as recognized, may be a better cert to take if you don't have the experience required by CISSP

[summer reef]

I wonder if it's a good idea to put my THM profile on my CV 😄

what do you guys think?

[opaque laurel]

if you are after a cybersecurity role and don't have anything better it's probably a good start

[summer reef]

I'm fresh out of uni atm, I don't really know if I can get a cybersecurity role since I am still learning

I'm more of a software developer with a security interest rn

It was just a thought tbh

[opaque laurel]

well, it would depend what job you were applying for then I guess

but if you apply for a cybersec one i'd include it if you don't have other stuff it does demonstrate learning and interest

[summer reef]

yeah

thanks for the replies

[wispy rock]

Seeking help! I am a mechanical engineer and was a design engineer for 2 years ! Due to covid situation lost the job and I developed an interest towards cybersecurity and started to learn from HTB and THM . But many people have been advising me that I need to complete full courses on networking and A+ and almost all job description in my region are asking for too many certs. I am halfway through my complete beginner path and I put in some stuff I did on THM on my resume and started applying for intern roles . I am not getting any calls and one of my best friend told me to do JavaScript now ! I don’t know where I am going wrong ?

[flat sedge]

One of the biggest obstacles you are going to face is skill transference. You have a lot of ME on your resume, what skills are cross applicable to cyber? What kind of IT background do you have? Do you know any programming languages? Cyber does rely very heavily on networking knowledge, especially for entry level. What kind of cyber role are you aiming for?

[wispy rock]

I was thinking of getting into junior pentester actually but yeah I don’t really have a strong hold on networking, programming or any Relevant IT fields . And as I was going through my beginner path I felt the need to dive deep into concepts , but following that approach I am losing time so I am kinda stuck . Again my friend advised me to get into web development and know the IT field and then jump into cyber with previous experience gained from THM . Do you think I should take his advice?

[flat sedge]

jr pentester is not usually an entry level position. That should be your 5 year goal

web dev is ok, but honestly, networking is much more accessible. I don't know you, so I can't really comment on what I think is best for your personally. Advice I have given other friends who want to jump into security is, work a 'regular' IT job for a year or two. Get a feel and a knowledge base for a specific domain with an eye towards security. Then make the jump into a SOC.

In the SOC, you will be exposed to a lot of different aspects of IT. From there, it'll be easier to pick a domain you like and grow your knowledge.

[wispy rock]

Oh I didn’t know that thanks a lot !

[serene umbra]

Gave +1 Rep to @flat sedge

[flat sedge]

I'm a programmer and software engineer at heart; code is my first love in IT. Web dev involves multiple technologies, some of which cause problems for other parts. As an engineer, you are likely going to want to understand the full technology stack right away. That isn't feasible.

[wispy rock]

I have had exposure to programming language C++ and C during my high school and first year engineering so I am comfortable with coding !

[flat sedge]

When was the last time you touched it?

[wispy rock]

Yes my friend advised me to focus on front end development for now and then slowly take it further learning frameworks and back end

[wispy rock]

Way long back I retain the concept s but definitely don’t have developer level knowledge!

[flat sedge]

C++ has changed pretty significantly in the past 5 years. Regardless, take some time and poke around the different security domains to figure out what is most appealing.

[wispy rock]

Yes yes but I also felt entering into help desk and working my way up into networking and then security as the best way . But following advice from YouTube created all the confusion 😩

Also @flat sedge do u think if I focus on learning JavaScript from Udemy, practice coding from codewars and then learning react or node.js would land me a job ?

[flat sedge]

I think JS is pretty garbage in general. I would rather wade through SIEM tuning than touch front end dev

[wispy rock]

Also some people advised me to do CCNA or NET+ but currently I have issues at home so don’t have money to take the certs ? Can I get a job as junior network engineer without those certs but by taking courses ?

[flat sedge]

Hating JS is a personal opinion though; there are many people who disagree with me that it should be taken to the desert, shot, set on fire, then buried in a shallow grave.

Most vocational courses will guide you towards CCNA or Net+ as part of the program; it's likely that a vocational college or junior college in your area will have a voucher program to either include or reduce the cost of the cert exam by taking their classes.

[wispy rock]

I didn’t know about SIEM till now. Thanks again for informing me about many things. I was an idiot thinking I can get a job after finishing complete beginner path 😅

[serene umbra]

Gave +1 Rep to @flat sedge

[flat sedge]

The SIEM is one of the primary ways that an organization monitors the entire IT landscape - it's a really important tool to get into a SOC role

[wispy rock]

So if I learn that tool without prior IT experience will I be hired ?

If somehow I can afford NET+ do u recommend it ?

[flat sedge]

Probably not. Net+ and CCNA are both valuable to getting an entry level networking job.

Your ME experience and workhistory probably isn't going to apply to IT, and you will more than likely have to start at entry level and work your way up again

[wispy rock]

Oh yeah I guess you’re right about that, maybe that’s why my resumes getting filtered 😅

Thanks again @flat sedge I feel light now and THM is awesome for learning cybersecurity. I will work on getting an entry level role and keep gaining knowledge from THM . You cleared all my confusion I can’t thank you enough @flat sedge 👍👍 🙂🙂

[serene umbra]

Gave +1 Rep to @flat sedge

[light urchin]

I actually wouldn't take the time to bury it in a shallow grave. Leave it in the open for scavengers to pick at.

[terse kite]

@summer reef I added my THM to my CV and they told me they looked it over. Not saying it got me there, but it was noticed.

[tranquil viper]

I applied to 37 positions and every application says denied 🤣🤣.

[opaque laurel]

try to get some feedback about your applications and what you could do to make yourself a more suitable candidate

[languid hearth]

just wait until you hit the triple digits

welcome to getting a job in security

i applied for around 300 positions, got 2 interviews at fortune 500s, led to one offer

this wasn't being picky either, anything from security analyst position across the country to red team down in the city :|

[tranquil viper]

I'm sorry to hear that. I'm happy you received an offer tho. I'm just trying to get out of my current job. I'm babysitting developers. I spend my working hours hacking in labs because I'd rather be doing that. I hope we all have a good year. Good luck everyone

[tranquil viper]

I would love too but they don't even respond

[terse kite]

Anyone have advice on how to receive/be sponsored for clearances? Seeing a lot of jobs requiring them going in but everything I read says you usually have to be sponsored or pay a bunch out of pocket.

[stoic cave]

You cant get a clearance out of pocket. You have to have a sponsor

There is no standard wording for what to look for but many jobs will require secret but allow you to wait while the process is being conducted

Things that will do you in are debt, foreign contacts, foreign, holdings, and lying

[flat sedge]

Lying is the biggest one on the list of bad things. Probably the 'easiest' way to get a clearance is to join the armed services, but there is still a large amount of risk. If you have close-ish family members who are citizens of other countries, it can make the process a lot harder.

[stoic cave]

And also remember that federally, Marijuana is still a schedule 1 drug. It does not matter if it's legal in your state

This includes all cbd products

On top of that be prepared to have POC at every job you have held since you were 18

Or the past 7? Years

[polar rock]

I know a good amount of people who use quite heavily and still hold high clearances

[stoic cave]

That's great until you get tested

I wouldn't bank on the if, it's when you get tested

[polar rock]

True

[stoic cave]

Oh also foreign travel

Pre-clearance it doesn't matter unless you are still in contact with people from places you visit but during the investigation or post investigation you need to keep records of where you go

[terse kite]

Good to know thanks! @stoic cave

[serene umbra]

Gave +1 Rep to @stoic cave

[pseudo creek]

Also if you see a job asking for a clearance, just apply as long as you are a US citizen.

[light urchin]

Debt and even past alcoholism and criminal records are not disqualifiers. I've known people with TS with all that

[stoic cave]

Depends on the kind of debt. Student loans? Nah. 30k to a loan shark? Probably.

[light urchin]

Yeah, illegal debt would be bad. But really the reason they ask that is because it's a potential vulnerability. If you owe half a mill on that house and student loans and credit cards and somebody offers to pay all that off if you'll just steal a few measly little state secrets, then....

That being said, I know people with 6+ figure debt and clearances

[stoic cave]

Yep. If they took student loans into account nobody would have clearances

[light urchin]

Sad but probably true

[long blade]

Hello carbon-based lifeform , i have an interview for a junior pen tester role soon an i'm hyped as hell , its gonna be from what i understood half tech half behaviour, do you have some tips guys to share ? like what they will likely ask me in the tech side , i'm kinda confident on the behaviour part but some tips there will be good too.

[ebon mica]

My behavioural tip is to not assume people being "boyz".

[long blade]

Hope its better now

[ebon mica]

not by a large margin, actually.

[flat sedge]

'Folks' is a very acceptable gender neutral term

[quick forum]

I like y'all personally

[ebon mica]

Or even "Hello, " would work.

[quick forum]

You lot also a good call

[queen cargo]

I'd go with scallywags

[flat sedge]

You lot is more regional for the UK, I think. I've never heard that in the US in a semi-professional setting

[long blade]

What about carbon-based lifeform?

[stark marlin]

Hey, so try learning about OWASP-Top 10, TCP/IP netwokring,

[light urchin]

But what about bots and silicone-based life? 🤖

[stark marlin]

DNS , how websites work

[flat sedge]

Sounds kind of derogative, I wouldn't use it

[queen cargo]

"Hello mammals"

[stark marlin]

and also learn basic stuff about i guess how you would detect some of these attacks,what is consdiered as sensitive data

[ebon mica]

This discussion is somewhat relevant, actually, I know someone that had her choice of job influenced by the other companies' interviewers asking what her husband does for a living.

[stark marlin]

what is CVE, MITRE, ATTACK, should also help i am not sure they will go into very specifics but i am sure it will help you to know these

[light urchin]

I don't think that's legal. Not in the US at least

[ebon mica]

It's not in Finland either. That doesn't mean it doesn't happen.

[light urchin]

true

[flat sedge]

Sounds like a lawsuit waiting to happen

Pocket recorder and that recruiter is busted

[warm hinge]

MITRE and ATTACK?? Doesn't these both focuses more on the defensive side...like the past approaches and groups

[stark marlin]

you would have to do reporting as welll

so you need to know basics atleast

on how to patch stuff and some defensive techniques

[warm hinge]

Thanks

[serene umbra]

Gave +1 Rep to @stark marlin

[long blade]

Thanks a lot , sound like a good start

[serene umbra]

Gave +1 Rep to @stark marlin

[stark marlin]

no problems

and Best of luck Space ghost you got this

[queen cargo]

I know a few cases where the recruiter was basically like "so any chance you're going to be pregnant soon"

[warm hinge]

Best of luck sexyplumbs

[long blade]

thanks folks i'll do my best and a bit more , and if i get this job some will be thanks to this community and the material on THM

[ebon mica]

...and this is explicitly forbidden in law. Then again, people rarely take pocket recorders with them to an interview.

[flat sedge]

That's definitely illegal to ask in the US

[queen cargo]

Haven

Haven't heard anyone carrying a recorder to an interview

[flat sedge]

Only caveat to that is be sure you are interviewing in an area where 1-party consent is the legal requirement

[ebon mica]

Finnish law pretty explicitly states that a person can record their conversations with other people. Publishing them is another matter.

[light urchin]

In the US, it varies state to state I think

[flat sedge]

Yes. CO and NY are one party consent, IIRC Alabama is not

[ebon mica]

mmh, I wouldn't know anything about other European countries and their laws about this.

Which might get interesting if you're interviewing to a position in another country

[queen cargo]

Trying to find an internship this time of the year when summer vacations are coming is hard...10 applications in, 1 no, and the rest is pretty much 50/50 we'll get back to you or havent heard anything yet

Guess there's some phone calls to be made this week

[warm hinge]

Kalma which country?

[flat sedge]

You are looking super late in the year for a summer internship. June internships are usually filled by mid January

Any company filling summer internships this late is probably a hot mess

[pseudo creek]

yeah our interns started last week

[warm hinge]

Can I apply for the winter? If yes, where can I find the notification that the portals have opened up

Thankyou

[stoic cave]

Yeah when I interned I interviewed in March/April and started in May

[pseudo creek]

I would look, I know my company only does summer internships or round year internships for those that have previously been summer interns

and our applications for summer interns start in November

[queen cargo]

Yeh but the thing is that the training I

I'm doing started a few weeks ago

So the whole schedule is pretty fast track 😄

[stoic cave]

It depends on the company size and how many people are applying honestly

[flat sedge]

Maybe your training has a work-study position?

A lot of vocational tracks will offer work-study to supplement their office work at near minimum wage

[warm hinge]

Thanks

[serene umbra]

Gave +1 Rep to @pseudo creek

[queen cargo]

Finland

[idle tiger]

anyone here pursuing career in cybersecurity?

[neat sequoia]

working towards atm

[idle tiger]

atm?

[neat sequoia]

atm = at the moment

[wispy rock]

Can someone tell me what exactly a junior security consultant do ?

I had applied to a company for that position based on my THM knowledge and got a mail today saying I am screened ! I am not feeling confident about going for it actually because I feel I lack the basic IT skills required? Any advices from experienced peeps ?

[pseudo creek]

honestly, it really depends on the company. What did the job listing have in it?

[static tide]

i just got a job as a junior security consultant hehe

but yeah if you share what the job desc says we can help more

[wispy rock]

Congratulations

Well the attached pic describes what they are expecting!

[static tide]

thanks :D

[serene umbra]

Gave +1 Rep to @wispy rock

[static tide]

okay so that’s a very broad job description tbh

it’s literally “be familiar with everything in IT” lol

[wispy rock]

Well to be frank I am quite shocked how was I even screened because I was discussing with @flat sedge the other day about how I am finding it difficult with my ME experience and my learning curve 😅😅

[static tide]

but make sure you know the osi model, common ports, owasp top 10, lateral movement techniques

[wispy rock]

I am confident about the osi model and ports . Will have to go through owasp 10 and lateral movement techniques 😅 regardless of whether I get the job or not I’ll consider a good experience and quite honestly if i do somehow crack the interview, I feel like I am cheating people who are far more deserving than me and have the networking, sysadmin exp

[static tide]

there’s always going to be someone better in one aspect

but as long as you have foundational skills in all areas you’ll do great

[wispy rock]

That’s there as always!

[static tide]

for owasp top 10, there’s a huge thm room with really good content!

i recommend going through that

[wispy rock]

Yeah in that case THM has the best content to make even a career switcher feel confident

[wispy rock]

Yep currently on that only.

[peak steeple]

Congrats My friend

[static tide]

thanks!

[serene umbra]

Gave +1 Rep to @peak steeple

[gentle storm]

Hi guys

[stoic cave]

Hello

[stoic cave]

!docs verify

[dire rivet]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[gentle storm]

I want to start my career at cybet security

[stoic cave]

Alright, Cyber Security is a pretty large field. Do you have any specific interests?

[gentle storm]

My networking is good

Dont know much rathar than that😅

[stoic cave]

Right but you aren't going to want to do that as a career if you don't enjoy it

[gentle storm]

I mean networking concepts

[stoic cave]

Maybe do a little googling into the different corners of the cyber landscape and see if anything interesting pops at you?

[gentle storm]

I want to i m intrested

[gentle storm]

Ohk

[stoic cave]

Are you signed up for THM?

[gentle storm]

Yes

Intrested in bug bounty

[stoic cave]

This is my personal opinion and I know some others share it, but bounties should not be relied upon as a stable means of income

[gentle storm]

Thats true

[stoic cave]

If you're already signed up for THM, I suggest also going to #start-here. There are a multitude of free rooms that are excellent and expose you to more cyber security concepts

[gentle storm]

Sure

[north hill]

Hey anyone working who's company is opening up Fall applications for Internships ? Too late for summer.

[tall hemlock]

one question, Comptia or ceh ?

[light urchin]

CEH seems to only have real value in India, and in the US for DoD positions

[quick forum]

Except the value in the US is a little less, as there are equivalent certs that are actually good now

[stoic cave]

Summer internships have already started. You're best bet is to find a part time job or start applying for fall internships that allow you to take your classes

[north hill]

Yeah, that's why I want to be early on those fall applications.

[vivid heath]

Aside CEH which other certifications will broadens ones knowledge

[golden ore]

Comptia's Net+ Sec+ Pentest+ and CYSA+

good base certs

[quick forum]

CEH is not that good

[vivid heath]

What are the various fields or specialization in HACKING

[vivid heath]

But good for basics right . I’m a pure starter even though I have knowledge on Linux and other basic IT. Want to start with CEH

[quick forum]

No

[golden ore]

usually you would want to go do a red team or pentester path

[quick forum]

CEH is only valuable in India really

The knowledge is frequently outdated etc

[vivid heath]

You mean CEH?

[stoic cave]

Yes

[quick forum]

I mean I said CEH so yes, I mean CEH

[vivid heath]

Which is the red team

[golden ore]

CEH updates the test yearly, but it is usually updates from the previous year

[stoic cave]

THM has an offensive cyber path to learn and practice on

[vivid heath]

Noted , so what’s the current program in the market now for someone who want to starts a career in cyber security and hacking

[stoic cave]

James gave some good examples previously

[vivid heath]

Will go through

[stoic cave]

It's heavily depends on your current skill level and knowledge base

[golden ore]

Comptia's certs are some of the best to start with and then progress from there

[vivid heath]

Seen

[stoic cave]

Comptia is widely recognized

And are thorough in their approach to the material you need to know

[vivid heath]

Which computer language is best for aspired hackers who wants to be successful in their crafts

[golden ore]

most start with python

[wraith panther]

Does anybody know how are comptia pentest+ performance based questions like?

[rotund hawk]

A quick question for people in the know: Is there any advantages in getting a CCNA certificate over a Comptia Net+ one? From my googling they seem like they cover largely the same areas, besides the focus on Cisco products and IOS in the CCNA

[opaque laurel]

CCNA is a lot more cisco specific but the basic networking models are covered in both

[cosmic ingot]

that doesn't answer their question though and I think it's a good one. I'd like to know as well especially since I'm currently enrolled in a ccna course

[flat sedge]

I think a network engineer should get CCNA for preference, due to the prevalence and dominance of cisco hardware. But Net+ covers the same info, minus the cisco IOS specific configuration commands

[languid hearth]

Net+ is trash, no cap

[opaque laurel]

yeah if you are interested in practical networking CCNA will be more useful

[flat sedge]

deadass

[languid hearth]

worst certification I've ever taken

[cosmic ingot]

not the feedback this channel deserves but the feedback it needs 😛

[flat sedge]

Both are entry level networking certs, most reasonable employers recognize their interchangeability

[languid hearth]

I think there's definitely more value to security researchers with the new CCNA

they cover APIs and stuff like that, which I'm actually pretty weak on and having exposure to backend technologies is fairly nice

super far left for a networking certification tho

https://learningnetwork.cisco.com/s/ccna-exam-topics

[flat sedge]

Is this a different than the 200-301 series?

[languid hearth]

nah, peep the 200-301 objectives

[flat sedge]

I'm about 80% through vol1

haven't really seen security or automation topics yet

[languid hearth]

it'll be towards the end

it even shares overlap with OSEP material (Ansible)

[flat sedge]

Worst thing about ansible: people keep callling YAML files 'code', and keep adding a ton of loop and when conditions. If there is that much variability, write a py module. It's not that hard.

[pseudo creek]

HTML would like a word

[flat sedge]

Please yes. Config files are specifications, not programming

[pseudo creek]

keep up the good fight

[nimble cosmos]

Hello, I need some help👀

I just completed my degree and I want to get a job into security field.
So I checked some websites and saw I need to learn about networking stuff, OS working, firewalls.

Is there anything else that I need to learn?

[opaque laurel]

well "security field" is pretty broad, can you narrow it down a bit?

[nimble cosmos]

I'm new in this area😅
So I don't know exactly about it.

I did pico ctf once and it was fun👀

[opaque laurel]

well, maybe start with the beginner path on tryhackme or the "advent of cyber 2020" room to get familiar with some of the topics

[nimble cosmos]

Okk,let me check👀

[opaque laurel]

networking and how to use an operating system would be bare minimum, what degree did you get

[nimble cosmos]

B Computer science

[opaque laurel]

they don't have that stuff?

interesting

[hexed magnet]

And if you're really great at networking you don't even need to know anything at all!

[nimble cosmos]

They have ,but I didn't payed much attention to it😅. I do know about them little bit

[hexed magnet]

If you apply to "Fresh graduates welcome" postings they usually give some leeway. you don't have to be a master at what they're looking for. as long as you're not completely clueless and you can show that you have the mindset to learn stuff

[opaque laurel]

I think first yeah get some understanding of the topics involved - https://tryhackme.com/room/adventofcyber2

this is kind of not as long as the beginner learning path on the site or as in depth but it does help you get your hands a bit dirty and see what kind of stuff it involves

[nimble cosmos]

Ok , I'll give it a try once I know about this field little more👀

[nimble cosmos]

Thanks, I'll give it a try

[serene umbra]

Gave +1 Rep to @opaque laurel

[north hill]

To the people who hire for Cyber Security Roles : What do you find more important in a resume ?

• Personal Projects/Forum Ranking, or
• Internships/Prior Work Experience ?

Aka, should I quit my internship to focus on personal projects, more rooms and learning over the summer ?

[zenith island]

experience > everything else

definitely don't quit your internship

[north hill]

It's not even actively on security, rather content curation on some CISSP stuff

[polar rock]

experience is experience

[north hill]

If it was an active security role, I would have loved it

[north hill]

Okay, then 3 months of almost unpaid work it is :))

[polar rock]

personal projects are really just extras tbh

Some might not even give af about your projects if you dont have experience

[flat sedge]

There are things to learn in any job and in any role. Re-focus on what you can get out of it, and focus less on your feelings about the task. Internships are to broaden your experience and its rare that an intern does the same thing for the entire time. If you really hate this task, just get it done so you can move on to another.

[north hill]

Thank @flat sedge

[serene umbra]

Gave +1 Rep to @flat sedge

[north hill]

I needed that :))

[neat sequoia]

I took a 9 months almost unpaid job for a good work experience in a good company on my cv

my prof says its something ill thank him for later

[north hill]

Tbh the money doesn't even matter if the work is good enough

I can go on coding security tools, learning stuff and try to break things for hoursssssssssss

But documenting stuff for hours is kinda cumbersome

[flat sedge]

The most important task in security is documentation. Because you can do all the cool stuff in the world, but if you can't write up what you did for someone else to understand, all of that time is wasted

Furthermore, if a full-time dedicated security team is doing implementation, that organization is broken.

[peak steeple]

Thanks @flat sedge good answer

[serene umbra]

Gave +1 Rep to @flat sedge

[opal inlet]

Hello hi would showing tryhackme level make me seem like a showoff

[stoic cave]

Nope

Whoops

[stoic cave]

!docs verify

[dire rivet]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[static tide]

everyone in this industry has an ego complex, showing your tryhackme level shows ambition

[burnt aurora]

How's the Georgia Tech Online Msc cybersecurity program?

7000 $ is really cheap, and you get the same diploma

[cerulean mango]

No, they hire a third party

[languid hearth]

coworker is currently going through their online Masters (Cyber Physical Systems) degree and isn't really enjoying it, but he's also got hella experience, so

[flat sedge]

That's really cheap for a post-grad degree. Have you verified that the degree-granting institution is the same for both programs?

[stoic cave]

Yeah i was going to say. My degree and our masters school was $700 per credit hour minimum

[severe scaffold]

Is EC-Council a good University?

[languid hearth]

lol no

[severe scaffold]

What did you experience?

[upper mirage]

Just read supukis certification talk

https://blog.spookysec.net/certifications/

[languid hearth]

speaking of that, I should update it

[upper mirage]

Supuki described CEH pretty good: You can forget everything the course taught you, and you’d be better off.

[languid hearth]

updated, the only thing that's missing is GNFA

[novel rock]

Hello! Is here anybody from Austria willing to talk about cyber-security/development jobs in the country?

[peak steeple]

NetSPI are recruiting: https://www2.appone.com/Search/Search.aspx?ServerVar=netspillc.appone.com

[cobalt escarp]

-mute @merry pollen

[serene umbra]

🔇 Muted SommoDuce#1219 for 1 day

[burnt aurora]

Yes it's the same, it's really a good deal

[stone garden]

So I decided on going to a Community College in September for cyber security I want to become an analyst..Is there any free courses or apps or anything, i can look into to get a jump start on? Thanks in advance.

[warm hinge]

tryhackme.com . Ur in the perfect server as well for any thm related questions if u get stuck doing a room. Since ur focus is security (blue team), do the beginner learning path first to grab the fundamentals if u haven’t already and than u can move into the cyber defenders path on thm to get knowledge u need to put u at a advantage once u come out of college. Overtime, u can learn and apply ur knowledge on other platforms like rangeforce, cyberdefenders, securityblueteam labs, etc. but start on thm

[stone garden]

Ok thanks. I'm going to try that site right now.

[warm hinge]

Np! And good luck in September 🙂

[stone garden]

Thanks

[flat sedge]

You are enrolled in a cybersec program? What's the degree or certs you get out of it? I'd look at stuff like THM as a gap-filler, but the bulk of your training is going to be coursework

[stone garden]

Its a 2 year associate's degree. Just to get my foot in the door for now.

[flat sedge]

AS or AAS?

It doesn't particularly matter - AS is more of a track to transfer for more education, AAS is more oriented towards vocational. I wouldn't worry too much about doing prepwork for your courses. That's the point of the courses. Just look at things like Udemy, THM, Coursera, LinkedIn Learning, et al, as supplementary or outside study.

[glass sandal]

Hello guys,
I am from india pursuing my bachelors in tech cse... i am preparing for eJPT. how can i get a entry level job in security. do i need to do job in india only or can pursue any where in worldwide. like do companies hire entry level international employees do they sponsor i mean?

[flat sedge]

A lot of companies outsource security tasks to firms with offices in India. Those firms are probably going to be your best bet to start; don't count on being sponsored for work-residence in another country until and unless you reach a much more senior position.

[glass sandal]

oh ok thanks for the advice. so can i give interviews just like for practice??

[serene umbra]

Gave +1 Rep to @flat sedge

[flat sedge]

That is a good idea - be aware that there are some huge cultural differences in interviewing across national boundaries.

[glass sandal]

like what difference can you give me some example?

[flat sedge]

It depends on the level of the interviewee and what kind of interview it is.

A technical interview is run totally different than a personality interview.

For a technical interview, I will sometimes say something intentionally incorrect but within the supposed skillset of the candidate. How they correct me tells me a lot about them.

For a personality interview, I'm looking for things that aren't technical but will determine how that person will slot into the team.

[glass sandal]

Thank you for the advice.. it helped a lot!!

[serene umbra]

Gave +1 Rep to @flat sedge

[flat sedge]

Bear in mind that I'm from the US, and I have a personal preference for people willing to step up and say 'no, you're wrong'. My experience working with people in India, is that they won't always speak up because of respect to seniority/authority. But again, that's my experience and isn't applicable to everyone.

[glass sandal]

Yeah, this is what we are told india not speak up to seniors can't deny that. I will keep your advice in mind.

told in india*

[warm hinge]

Thanks @flat sedge... I'll also keep this advice

[serene umbra]

Gave +1 Rep to @flat sedge

[warm hinge]

and here is to why I dropped enrollment into Maryville University in STL $7k a semester.

[languid hearth]

that's a sans certification a semester! I know which I'd rather do

[novel rock]

Hello! Is here anybody from Austria willing to talk about cyber-security/development jobs in the country?

[misty vigil]

Side topic: Would you guys put "Kali Linux OS" or "Linux OS" in your resume?

[quick forum]

Not really

[languid hearth]

I wouldn't put Linux OS because you don't put Windows OS lol

and I wouldn't put Kali Linux because there isn't a Kali Windows

[flat sedge]

I would put the distro(s) I am familiar with and feel confident being an admin for. Like CentOS, RHEL, Ubuntu, OpenSUSE

[quick forum]

I'd say familiarity with them, perhaps. But what makes Kali Kali is the tools. You don't learn Kali, you learn the tools and concepts.

[cerulean mango]

what goes before Jr. Pen Tester? lol, Jr. Jr. ,

[languid hearth]

security analyst kekw

[quick forum]

Trainee

Source: my role that I just got an offer for

[cerulean mango]

congrats! that doesn't exist in the US, they want ppl to magically show up and be pen tester, the jr role is not really even a thing, and then they complain that they can't fill roles,

[quick forum]

I didn't get the role the normal way, sort of headhunted

It probably exists, just rare.

[cerulean mango]

yesterday I saw a trainee one, (obviously applied) but kinda stared at it for a while, in disbelief.

As long as they don't call you bru, I think you will be great, lol

[pseudo creek]

And I'm kind of the opposite, I'd just say Linux as the distros aren't really that different from eachother, minor nuances. I don't think there is a need to list every distro

[flat sedge]

That's a fair point. Maybe only list a specific distro if you consider yourself an expert in the nuances that make that distro special?

[stoic cave]

On my resume I think I said "experience working in Windows and Linux OS environments"

I'd have to double check

[young yew]

I wouldn't list them unless you have a special cert for it like a "RHEL Certified System Admin" or whatever it's called

[quick forum]

Debian-based and RPM based Linux

[stoic cave]

"can bash head against keyboard and make things work"

[young yew]

The most important skill

[stoic cave]

I was forced to use man pages again today. My terminal decided it didn't want to have functioning software

Terminal as in computer not the Linux terminal

[mossy igloo]

does anyone working as system engineer?

if you guys did, would you recommend becoming one?

[pastel solar]

I’m only interning but I work for one. I think it varies based on the company your working for.

[stoic cave]

This ^

I'm a Cyber Security Engineer but I do some systems engineering tasks if you want to call it that

[young yew]

The titles tend to have different roles in what they do/don't do between organisations.

I'm a lead system administrator but spend more time doing DevOps work than I do SysAdmin

[flat sedge]

That's fine though - do you really want devs mucking around in your CICD infra?

[young yew]

Very very fair point, not "technically" my job desc. but reduces the headache of dev messing things up

[warm hinge]

If one wants to interview a professional in the field they are considering what would be the best approach?

[flat sedge]

Just ask for a few minutes of their time - politeness and respect go a long way towards getting helpful feedback and information.

Be sure to include a date and time when you'd like to talk to them, and a topic you'd like to chat about.

[stoic cave]

Yep, can't hurt to ask. When looking for a job post graduation I would message alumni in the industry and ask for a moment to chat. 10/10 would respond and if they couldn't chat themselves they would direct me to someone else who could

[warm hinge]

That is what I have heard but I never knew it was that easy.

[stoic cave]

Yeah, just be polite and concise

And come prepared. Don't waste their time with garbage questions

[pseudo creek]

systems engineering is great experience. Like Moose mentioned there can be cyber crossover, my past job was kind of systems engineering + cyber security

[north hill]

Hey guys, just the regular inquiry. Anyone's company hiring interns ? Maybe for Fall ?

I'm really pissed at my new job here

[misty vigil]

Hi guys!
If you were to put "TryHackMe" in your resume, what would you put in the description?

[stoic cave]

Explain what THM is and what you do on it in one to two brief sentences. Also put it in a projects or similar section not an experience section

[peak steeple]

What @stoic cave said and you could also point to any write upd you done on the labs

[stoic cave]

Just a suggestion, this is not a good way to go about this

[north hill]

Yeah, a job is a job

[quick forum]

Yeah I've generally heard it's bad advice to say bad things about your current company

Doesn't reflect so well on you.

[stoic cave]

It is

[north hill]

I have been working with Startups and all, and have been through my share of bad bosses and stuff. But here it's all new.

Borderline comical

[quick forum]

Ok, think about this from the perspective of an employer. Would you hire someone who keeps talking about how bad their current company is?

[misty vigil]

Thanks so much for your help, and as well as Brent1972. I've just started my beginner programme and thinking what to put in the resume

[serene umbra]

Gave +1 Rep to @stoic cave

[quick forum]

It doesn't paint you in a particularly flattering light, it makes you seem like you're going to complain about the new company too.

[north hill]

Yeah got it man. No more of this.

[north hill]

I actually love working and it's not even the pressure. It's the 7-day week and the bad culture

[quick forum]

I'm not saying the complaints aren't valid

But it's a red flag if you're shit-talking your employer.

[north hill]

Got it man. Thanks for the advice. I guess I'm just frustrated.

Atleast gotta hold onto this till better things pop up

BTW I'm re-writing my resume and wanted to run it by someone who has been hiring in this field sometime

[peak steeple]

@misty vigil I just checked my CV and THM is listed under 'Further trainning.' I have listed the labs in 1-2 sentences but described what tools I used for X task if that helps.

[misty vigil]

This is definitely very helpful, thank you so much for your sharing and advice. Deeply appreciated. I will try to do it accordingly 🙂

[serene umbra]

Gave +1 Rep to @peak steeple

[summer reef]

is having 2 CVs common?

I don't have enough space to list all the things I know I'd rather cater 1 cv to 1 type of job like software eng and one type to security

[peak steeple]

@summer reef Not sure if common! I too have 2 CVsIT Support, Cyber and IT Support as each CV highlights what is of interest to that sector.

[summer reef]

yeah that's what I was thinking too

just relevant info and skills relating to each sector is what I thought

[quick forum]

You usually tailor the CV to the job each time.

Use key words and skills that they use in their job advert

[lofty ibex]

I had 4 tailored CVs when I was applying for a new role some months back

as James said just tailor it to fit the role you apply for

[summer reef]

cool, thanks lads

[quick forum]

It's a lot of work, I know

[summer reef]

yeah it sounds like it, I had heard this advice before but forgotten it so thanks for reminding me

[serene umbra]

Gave +1 Rep to @quick forum

[flat sedge]

This. Gossiping about current company gives you a bad reputation as being a complainer; when people start telling horror stories, you can bring up things you hope previous employers have fixed though.

[flat sedge]

I keep a massive CV that is my entire work history, everything I've done. When I'm applying for jobs, I cut it down to what's relevant to that position.

[north hill]

Yeah, thanks to James and Moose for putting it into perspective

[serene umbra]

Gave +1 Rep to @flat sedge

[north hill]

I guess I am just drained and exhausted by this new job

Hey ! Free rep xD

[flat sedge]

Startups are a different beast. It's a 'high risk high reward' scenario - except as an intern, you don't get the high reward part. Either bring up that their expectations for interns are out of line with what the reward is, or just take it as a learning experience and move on at the end of the internship period.

Either way, allowing yourself to be emotionally wrung out isn't worth it. You can only do what you can do, and dumping more and more work on you doesn't fix it.

[north hill]

Well it's neither. Infact we had a startup as well but it fell apart after our lead investor died out of Covid19

[flat sedge]

The other alternative is that you are seen as being too smart for your own good, so you have to play alone until you can learn to get along with others.

Rather "another alternative"

I've had interns my group had to put in time out until they learned to play ball with the team - a couple never learned the lesson though

[north hill]

The case back here is horrible. Like my teammates are useless. And I don't even mean it ironically, last day they spent hours "debugging" my program and creates a mess saying it was all buggy. Turned out they were running it with python2 when it was to be run with python3

[flat sedge]

Did you add the #!/bin/bash/python to the first line of your script?

[north hill]

And then they blamed me for not documenting it whereas the first line mentioned it was there

[flat sedge]

python3 not python

[north hill]

#!/usr/bin/env python3

[flat sedge]

it's also considered best practice to add the runtime environment in the README.md

which you should do for every project

it's one of those things that may not get explained "because everyone knows"

[north hill]

This was another instance. All I said was please upload all docs as Markdown files.

[flat sedge]

Did you document your code with something like sphinx?

[north hill]

I really like my stuff well formatted and neat

[north hill]

Not really. It wasn't even something great. But I did add all the important stuff and test cases with relevant data.

The thing is I have to clean up after them. Plus this 7-day week doesn't leave much time to learn. But I can't even leave the job yet

That's it. Like I have been working hard for a long time and now I am paired with these people. Feels like all of it was in vain.

[flat sedge]

Are you hourly or salaried? As an intern, I hope hourly.

And that you are being compensated for that overtime.

[north hill]

Nopes. It's a one time payment of 10K INR for 3 months which translates to about 130 USD

And no, there's no overtime

These are the working hours

[flat sedge]

What country are you working in? I can't imagine a first world country that is legal in

[north hill]

It's a ERM company, sorry I can't disclose the name yet

I like to work @wild citrus, like I really love working no matter the pressure. That's what I learnt working for a startup but I need good motivating people. It's not even the money which matters

[flat sedge]

Ok. I think I have an idea; it sucks that is the situation, but do what you have to, to see the other side of it. It sounds like you are letting the stress build up enough. There is a book I think you may benefit from

[north hill]

I rather look for a good work culture

[flat sedge]

https://www.amazon.com/Subtle-Art-Not-Giving-Counterintuitive/dp/0062457713

[north hill]

Aah this one xD

Will surely give it a read sometimes

Meanwhile, I'll hopefully develop a few more rooms on THM and try to get that Content Engineer thing going

Someone once told me that till you're 30, it's not the Company you work for, its the people you work with and the Boss you work for

That's what I am looking for

[west moss]

Can anyone help me with this

[north hill]

When you install Ubuntu server, they give you the option to install Docker and Kubernetes. It also installs the security updates if you choose to do so.

So that works to begin with

Setting up specific docker instances is a whole new story though

[stoic cave]

It says to use ansible

I'm sure if you Google there are tutorials on how to do this

[light urchin]

it's always more about the people, IMO

[north hill]

Yeah. That's what I am looking for. A good team and mentor

[ebon mica]

I'm not sure why this would end at 30

[north hill]

That was just a saying

But the general idea remains the same

Btw, @ebon mica has your company opened Fall applications ?

[ebon mica]

I've no idea.

[north hill]

Can you lemme know in your own time ? Really really really need a job/internship

[ebon mica]

What I know is that we only have summer internships in Finland.

[north hill]

Oh. Nevermind then :)) But as a general question, what do you seek in a Fresher's resume ?

[ebon mica]

Nothing - I'm never involved in early phase recruiting. And rarely even in the later phases.

[light urchin]

Something that shows self-motivation and the desire/willingness to learn

[north hill]

Well I'm willing to learn, as I said, a good team and a good boss is what I look for but I haven't been lucky of late

[stoic cave]

There is a difference, and I'm sure others can explain it better than I, between saying and showing your willing to learn. Companies don't necessarily take what candidates say at face value as their first priority is the protection of said company. By showing through extracurriculars, personal projects, etc you're more likely to break down that first wall

[north hill]

Yes, that's another question we often discuss among friends. Is this (in a security context) implied by personal projects, CTFs, THM, curating voluntary content and stuff ?

[light urchin]

In your case- you've created a few rooms here. That's worth putting on a resume, IMO

"Achieved highest level possible on THM and have also given back by creating X new rooms for the cybersecurity training community" or something

[north hill]

Thanks man. I'll be sure to add it on my resume once the rooms are out :D

[warm hinge]

@mild crystal Here 😄

[ancient prairie]

saw this interesting editorial that summarizes my thoughts on WFH pretty well
https://ez.substack.com/p/the-work-from-home-future-is-destroying

[shadow bobcat]

Even when it was proven that people can do their work from home and still be productive... employers want you to suffer. They want you to fight through traffic, come in, sit in your little cubicle box, and sweat through a whole day where at a moments notice they can come to you and bother you about something inconsequential.

Bosses suck.

[flat sedge]

I think there is value in coming into an office. Don't undervalue the social comradery that comes from seeing your coworkers and team members on the daily. A bad manager is going to make the team miserable regardless of whether its 100% remote, hybrid or 100% on site

[stoic cave]

I don't think that matters. They are paying you, sometimes an incredible amount of money, to perform the work and frankly they can dictate where you work and when you work.

You don't have to work for x company

[shadow bobcat]

They most definitely can. I think it comes down to micro managing. They want to see you. Even if your job can be done from home, most employers aren't on board with that yet. Even after COVID.

[stoic cave]

Which as a company, is their prerogative. If the workers don't like it they can seek employment elsewhere

[shadow bobcat]

Absolutely.

[flat sedge]

To an extent, I agree with you Moose. There is a balance of power that needs to exist between the corporation and the employee for both to be successful. If the loyalty and relationship only goes one way, it's not healthy in the long run for either part.

[ancient prairie]

agreed 100% - it would be nice to have a in-person mentor, i think my main takeaway from the article in particular is how theres this whole class of middle-managers who can't wrap their head around this new power dynamic

[flat sedge]

It really comes down to how much does a company value retention

[stoic cave]

I think it will also help when people realize that loyalty to a company is pretty much dead and isn't rewarded

[flat sedge]

People are loyal to people, not abstract entities. Advocacy goes both ways, it's not a corporation treating employees right, it's other employees treating employees right.

[pseudo creek]

As a senior person, I love working from home. It’s quiet and I can avoid the drive bys that happen in the office. I can avoid IMs easier than someone sitting on my desk next to my computer.
On the flip side, I think it’s horrible for growth of junior employees. Networking isn’t as great and having someone face to face to show you things is so much better. Some people also have a lot of distractions at home or lack the space needed to work properly.

[pastel solar]

I’m an intern and if people are micromanaging their workers, it’s largely hurts productivity in my opinion. We operate on a trust basis in my office and I’ve never seen so many people working hundreds of times harder than they would being micro managed. Micro managing is poor leadership plain and simple.

[light urchin]

Yeah, if my job forced me to come back to the office, I'd just find another one. Plenty of options out there

thankfully, I think I've found a great job/company/group of people, which is really hard to find

[solid compass]

Which certification should I opt for as a fresher in ethical hacking? Any information shared will be valuable for me. Thanks!

[pseudo creek]

which certifications do you have? If none, I'd start with Sec+

also if in India, you'd want to eventually get CEH, if not India then there are other options

[snow cedar]

if you could provide what area you want to work in would be help full but i would go with OSCP first .

[solid compass]

I'm a fresher and I don't have any certs as of now

[light urchin]

OSCP is a fairly advanced cert, probably easier to do something like Net+, Sec+ or Pen+ first

[snow cedar]

there are ton of resources out there to learn from if you want to learn from

[solid compass]

I would like to work as a Pentester / Ethical hacker or even as a security analyst

[solid compass]

What about C|EH?

[snow cedar]

oscp is a go to then spend time doing THM and once you are in a good shape take OSCP but remember you have to work a lil harder for it then any other cert

[snow cedar]

dont go for that thing

[light urchin]

I've heard CEH is not very useful anymore. What Zojja said earlier is what I've heard a lot of people say

[solid compass]

U talking about CEH ANSI or practical?

[light urchin]

the non-practical

the practical is newer, I know very little about it

[solid compass]

Oh

[snow cedar]

OSCP is beginner focused course but the exam is hard for that you have to practice a lot

if yo do THM well and after taking OSCP course u practice there lab yo can crack it

[solid compass]

I've also heard about CISSP

Hows that certification when compared with CEH?

[snow cedar]

yeah there are lot of certs

[solid compass]

Okay, thanks a lot guys

[languid hearth]

cissp requires industry experience (5 years iirc)
Both C|EH's are really impractical and not worth it at all

if you want things that focus on real world pentesting, look at OffSec's 300-level certifications like OSWE and OSEP.

[solid compass]

Oh

[solid compass]

Okay, thanks.

[serene umbra]

Gave +1 Rep to @languid hearth

[bright vortex]

CEH practical is also worth less. Go for eJPT instead.

I just cleared CEH practical last month and don’t think it’s worth it to pay $550 and eJPT cost only $200.

[solid compass]

Okay, thank u

[serene umbra]

Gave +1 Rep to @bright vortex

[pseudo creek]

It also depends on the country, CEH has value in India, outside of India, not so much

[north hill]

Any good certs between eJPT and OSCP ?

I cleared my eJPT and now gotta plan those finances accordingly

[peak steeple]

@north hill A few good ones are! eCPPT, VHL, Pentest+ VHL (Virtual hacking labs) is getting rave reviews online and so it eCPPT.

@north hill This might interest you:https://www.cbtnuggets.com/blog/certifications/security/how-i-passed-the-oscp-on-the-first-try/

[north hill]

Imma sort it like I sort my wishlist. Prices low to high

[north hill]

Thanks dude. Gonna start the prep soon(once am done with this job). Especially with web and windows.

[serene umbra]

Gave +1 Rep to @peak steeple

[peak steeple]

@north hill Aweesome! Also ping any members with OSCP for pointers.

[north hill]

It's gonna be a while xD. As someone who earns as low as 130USD in 3 months, OSCP is gonna take a long while xD

[peak steeple]

Totally understand! I hear there's lots of priv escalation and pivoting so definintely ace all the THM labs on simillar topics.

[pseudo creek]

I thought you were in India? Or am I imagining it?

[north hill]

Well it's the equivalent in INR. 10K inr in 3 months. To put it into perspective, eJPT costs 15k inr

[pseudo creek]

No i mean your focus, I’m not but it seems everyone says CEH is basically a requirement there. I’d focus on that before OSCP unless you’ve heard otherwise

[north hill]

I wanna get away from here. I still got 2 years of uni so might do it while in the final year if nothing else works out

Gotta grind till I get a good Internship with a humane environment

[north hill]

I'll start my prep though. I love this field

[pastel solar]

The path that I was told was from hyd3sec he said eJPT > eWPT > OSCP

[peak steeple]

@pastel solar That path seems solid to as eWPT will cover the web apps side.

Many roads lead to OSCP as long as you cover syllabus topics 🙂

[pastel solar]

For sure, I really struggle with web concepts sometimes so I think it’s even better for me.

[peak steeple]

@pastel solar No worries! Dont forget https://portswigger.net/web-security Not used myself but I have on very good authority that it's free and provides solid web apps coverage 🙂

[north hill]

eWPT is like 400 USD Man

Too expensive right now

[pastel solar]

Then I would recommend using the free resource that Brent sent. And complete the web path on tryhackme

[north hill]

I got a one month pass and completed all 4/5 Pathways. This summer, I'm planning to get stuff going with the web app thingy

[pastel solar]

Great man good luck on your journey I’m sure you’ll kill it!

[peak steeple]

Good luck man! I am sure you will indeed kill it. @north hill

[exotic vortex]

Does anyone in here work as an ethical hacker / pen tester?

[languid hearth]

I can answer questions regarding the roll - former pentester

[lofty ibex]

I can also answer some questions 🙂

[dull niche]

Question: I am trying to break into the cyber security field, and i was wondering if i should include activities or certificates from things like tryhackme or hackthebox. I dont have any experience in the IT field, im coming from a restaurant/corporate dining background. I have earned a BS in Information systems with a concentration in cybersecurity *programming as well as the security+ cert. any advice?

[ancient prairie]

I also came from a restaurant background with 0 IT experience and you are way more qualified than I was on paper, I wouldnt mention them specifically per se but I would maybe include a line about CTFs under a "Continuing Education" section

[exotic vortex]

How close are these certificates to actual experience? I've only done desktop / server type IT work.

[ancient prairie]

but if the job posting specifically mentions anything about CTFs/HTB/THM, by all means lean into that a bit and even mention your level - I've seen a few mention HTB/THM by name so you should respond in kind there

[ancient prairie]

some of the conceptual stuff you'll retain from certifications - but in my limited anecdotal experience they rarely translate to actual experience unless its a tech-specific cert like an Azure or AWS specialist

[peak steeple]

@exotic vortex Hi adm, welcome. When not on THM- I can be fi=ound googling for similar answers omline. What I understand is that they provide the foundations to work towards higher mo0re realistic csrts like OSCP/CEH/eCPPT, You can check the value of a cert by the level of employer demand. Visit any job board and take a note of what the employers are asking for yourself.

[lofty ibex]

If you have a lack of relevant experience then putting CTFs on there can be quite nice, you can always talk about the concepts you learn from them in interview to draw in the links

Even now I still put CTFs on my CV even after working in industry for almost a year

[dull niche]

Awesome thanks for the info guys I appreciate it

And I wanted the security+ cert as a stepping stone towards pentest+ as that is the goal for me right now

[warm hinge]

Can i be prepared in one year for the oscp exam

If i am starting from zero

[lofty ibex]

easily

It comes down to your drive to learn and ability to question what makes something work

[warm hinge]

How should i question things
And what should be my strategy of preparing towards my goal

[peak steeple]

@warm hinge I definitely cant tell your strategy but wha would I ? I would 1st complete THM beginner and Offensive path - get your basics down. Then I will try and locate which THM courses match OSCP syllabus. Once done - complete either eCPPT <elearnsecurity> or VHL <Virtual Hacking labs >, make you have wen app skills and then finally tactle OSCP, If in India, I hear CEH is BIG there - so you can add that too before OSCP. Good luck and take lots of notes.

[edgy tiger]

1. eJPT content - no exam
2. Offensive Path - TryHackMe
3. Buffer Overflow Prep - TryHackMe room
4. Linux/Windows Privesc courses - Tib3rius
5. VHL - 1 month subscription
6. Proving Grounds - 1 month subscription ( TJNull list )
7. Ippsec videos (Just watch and take notes) - HTB TJNull list
8. OSCP labs

Thanks to @thick sable

[serene umbra]

Gave +1 Rep to @autumn robin

[edgy tiger]

Before this indeed the THM Beginners course

[muted gyro]

hello
is there a way to bypass an rfid scanner without having credientiatls??
i have good knoledge with linux and bash scripting and python
i use kali linux(parrot sometimes)
i got an arduino and am doing some testing

[hidden arch]

I've been studying cyber security for about 1.5 years now and just passed my eJPT from INE. I'm currently the top one percent of users on TryHackMe.com and have dabbled a bit on HackTheBox.com.

Right now I'm trying to figure out what to do and what "learning path" I should take. My next goal is to complete the "Cyber Defense" learning path on TryHackMe.com. Im currently halfway through it. I'm also looking at BTLO/BTL1 (https://securityblue.team/certifications/).

I have a lot of questions that hopefully you can help me with:

• Is it worth going to school for a cyber security degree?
• What do you think of gamifing hacking platforms like TryHackMe, HackTheBox, BlueTeamLabOnline and RangeForce?
• Would you recommend teaching ones self through these platforms?
• What certifications would you recommend?
• Which certifications should I pass on?
• What person are you looking for when finding new team members?
• When is some "ready" for their first entry level SOC 1 role?
• What credentials / qualifications does someone need to gain the attention of recruiters?
• What are something that you wish you could tell newer employees?
• What is one thing you wish you did that you didn't do?

What I tend to hear from people who work in infosec is very different from what HR Departments are job postings. There's not a lot of great information online right now to navigate this industry and would really like some help.

Thanks!

[quick forum]

My first recommendation would be taking a look at Linkedin/other sites for job postings for things you'd want to apply for.
Look what they're asking for, skills and certs and experience wise. Let that guide you.

What I tend to hear from people who work in infosec is very different from what HR Departments are job postings. I disagree with this.
Certs get you past HR. You need to check their boxes. You need to get an interview.

[raw heron]

anyone know what's the statistics of who got in/who got accepted?

[tidal wave]

Yeah. Who they like🙂.

Only they got in

[raw heron]

I'm asking for stats :)

[tidal wave]

Search on linkdin

[warm hinge]

Almost everyone got who applied...and those were rejected whose form weren't completed properly....this is what they said

[raw heron]

i see. makes sense, looking at the number of people in the meet XD

[warm hinge]

Yep

[frank breach]

Anyone have idea about masters in cybersecurity

?

is it worth it to do masters?

[static tide]

where are you? what’s your experience? what’s your plan?

[frank breach]

I am from india completed graduation in computer science

No experience

[misty vigil]

Hi everyone! I require your word of advice. I finally obtained my Diploma in Computer Forensics. I've been looking for positions in cyber security, but I've always been turned down because I don't have a degree, certifications, or work experience.
• But now I'm seeking for a job to obtain work experience, and none of the companies are interested in hiring me.
• Degrees and certificates require time and money to obtain, and I've been working hard to earn and save money for while hoping of gaining work experience.
• I've even included TryHackMe in my Further Training Programme to demonstrate that I'm genuinely always learning.

Do you have any advice for me?

[acoustic jewel]

Are you only looking for cyber security roles? Or also looking at help desk jobs etc to get some form of relevant experience

[misty vigil]

I believe that the best way for me to acquire job experience will be through cyber security positions that will allow me to learn relevant skills and experiences.

[pseudo creek]

cyber security entry level jobs are few and far between, usually people get a job in IT then pivot to security, not always but its most common way

especially if you don't have a degree

[flat sedge]

Second what Zojja said. 'Entry level cybersec' usually means '2-5 years in sys admin, infra management, net admin, dev, telco'. Picking up security without having at least a working professional's basic knowledge and foundation in a domain is really challenging

[acoustic jewel]

The relevant skills you're referring to can most definitely be picked up in non cyber security jobs though, which is probably the experience you are currently lacking

[cursive patio]

I know the general consensus is IT for a few years then pivot to security, but in y'all's opinion would solid internships, relevant degree, and OSCP net me a JPT interview?

[pseudo creek]

possibly but no guarantee, not a lot of junior pentester roles out there

that don't want years of full time experience

[cursive patio]

Thanks, certs don't allow you to cheat the experience system I'm finding lol

[pseudo creek]

nope

oh and James don't come in here talking about your job (or do) 🙂

[quick forum]

Depending on where you are, over here they're mostly asking for a (degree || exp) && (OSCP || CREST)

[quick forum]

I recognise I'm at a huge advantage here because I was referred for the job by a lecturer

[cursive patio]

I heard that security companies tend to hire red team out of college more frequently than an enterprise would hire blue team

[flat sedge]

certs are usually proof of continuous learning, and a baseline of specific knowledge. The hardest part of IT is getting into the industry; one technical role leads into others. Internships as part of a BS or BA program can be a huge help.

[pseudo creek]

theres a lot of variables, college hires are cheap

but if you are on a red team, you can screw stuff up majorly

my company hires blue team and various cyber roles straight out of college but usually they have been interns for our company prior or have had military experience

[flat sedge]

Red team hires out of college? The whole point of red team is understanding the risk vs scope scale of actions, in my experience most college grads think they know a lot more than they actually do and risk production more than the scope of the SoW allows.

but YMMV. Most of the interns I've worked with have been pretty good, but they need a certain amount of initial spoon feeding because of the differences between academia and industry

[cursive patio]

That's what I think I'll be emphasizing once I'm closer to graduating. Demonstrating a lot more soft skills and practical experience that bridges the gap between academia and actual IT work

Thanks guys

@quick forum I can substitute an OSCP for this?

[languid hearth]

h

[quick forum]

...Perhaps add the word cybersec to your search query.

[lofty ibex]

So the thing with CREST is you are required to work under a check team leader in order to be recognised as a check team member

[cursive patio]

hahaha

[lofty ibex]

You can gain the required CPSA into CRT or QSTM which will help gain a job within a CREST accredited company massively in the UK

Also James was it Nick that recommended the role to you?

[quick forum]

It was

[lofty ibex]

ooo 👀

[languid hearth]

it was to get you quiet about uop Throwback, bet

[quick forum]

it didn't work.

[languid hearth]

[lofty ibex]

They just ended up muting the entire discord

No more riots 😭

[languid hearth]

ggwp

[quick forum]

Let's just be careful around Rule 2 here 👀

[cursive patio]

Is CREST more relevant in the UK than the US?

It seems really important, surprised I haven't heard of it sooner

[quick forum]

https://www.crest-approved.org/crest-in-the-americas/index.html I mean this is their webpage discussing CREST in the US

Doesn't look overly US focussed

[lofty ibex]

CREST is in the US but it's certainly not as big/adapted as the UK iirc

[misty vigil]

Thank you so much for helping me to answer my question.

• What role would you recommend me to go for in IT before pivot to cybersecurity?

[serene umbra]

Gave +1 Rep to @pseudo creek

[misty vigil]

Thanks man, agree to have at least a working professional's basic knowledge and foundation. To be honest, I needed a working experience which will really help me a lot to understand the live experience

[misty vigil]

Yeah man, experience is what im currently lacking now and needed to build on that

[main egret]

Hey 😊 new here, ive been lurking today to pick up on the advice given but definitely open to any wise words of wisdom! I'm in my first year of a full time degree in cyber security so due to graduate 2023. I'm studying the degree full time whilst working full time as a manager (and also trying to find time for PC gaming) so its pretty exhausting and id love to source a role within the IT industry to get a foot in the door whilst I'm studying as I'm really keen to work within a relevant role as appose to my current job. Has anyone had any experience in gaining a basic entry level role in IT support or something very low level with no experience in the field? I'm prepared to take a pay cut for the greater good so if there are any other roles you can suggest looking into im all ears!

[pseudo creek]

Common entry level is IT help desk. It may help to get A+ certified for that, possibly looking at network+ as well, but I'll say... its hard to balance gaming, I miss gaming a lot but... got goals

[lone shell]

Hey guys, i have been working at my company for almost 2 years doing network security(mainly creating firewall policies) and i am ready to move on into a more IT focus role, ideally a cyber security analyst or SOC position but am having a bit of trouble.

1. How did you guys know what you wanted to do next? Did you just apply to anything that caught your eye or did you guys have a plan in mind?
   2)How did you go about planning for technical interviews? Currently this is my biggest as I have only done 1 technical interview which was for the internship that lead to my full time position now. I am currently making my way through THM complete beginner learning path just to ensure i have the basics down packed but i still feel like its not enough. My fear is that im going to be stuck in my current role and i dont want that to happen.

Any advise you guys can give would be great!

[golden ore]

Network security is an IT role, I was a network engineer for many years. When I made my shift, I had just finished an MS in cybersec and was ready to take the knowledge I had gained further. You need to have an idea for the role you are looking for, I would recommend starting by looking at the job boards and trying to figure out where you want to get and what is needed, then apply to the jobs you want to move to. When it comes to technical info, think of them like a walkthrough room, here is a scenario how do you respond.

[pseudo creek]

I was doing network security for a few years and I knew I wanted to do something different but wasn't 100% sure what, then I saw an internal job that caught my eye (security engineer), I applied then got the job

[lone shell]

Thanks for the response, as far as looking at job descriptions go, the one thing i lack is the 5+ years experience some of these "entry level" positions require. I have majority of the skills and i know i can learn what i need to once im in but it seems like my application gets filtered out from the lack of experience any idea on how to combat that?

Also in regards to the tech interviews is there a particular way you prep?

[serene umbra]

Gave +1 Rep to @golden ore

[lone shell]

Thanks for the response! So did you prep any before applying or did you just go for it?

[pseudo creek]

I just went for it

[golden ore]

you can sometimes offset experience with schooling depending on the company
when it comes to prep for tech interviews, review any software/applications that are listed in the job listing, you don't have to know all of them, but if it matches something on your resume make sure you know it, be prepared for scenario type questions of how you would respond to an incident

[indigo iris]

Sorry to slip in but, what positions I can look for with NO EXP ? 🥲

[pseudo creek]

help desk but they'll want you to have a cert / some background

[indigo iris]

I dont think they will skip cert if I have MS CyberSec, will they ?

[flat sedge]

A very common route I hear of people taking is something like best buy or staples desktop support - you can get those positions with zero background

[golden ore]

no IT experience or no cyber sec experience

[flat sedge]

Then transition into a more traditional IT role (support desk, jr admin) after some experience

[indigo iris]

well can be considered both. I just have half a year exp in Web Development

[lone shell]

As far as education goes BA in compSci with a concentration in cyber security and a Sec+ cert. Would it worth while adding some of the THM stuff on the resume to show the hands on stuff ive worked on?

[golden ore]

I have heard both ways as adding the THM stuff, there is various opinions for it out there but it should be more of something you use to stay current on tools and TTP's. I personally don't list it, but do mention it as a resource that I use to stay current during the interview.

[pseudo creek]

no, certs are better than MS in CyberSec

[pseudo creek]

depends, how empty is your resume? you could add it as a personal development section, its kind of a bonus

[visual nova]

Is their any cybersecurity engineers in here

What route did you take if you don’t mind me asking or is there anything in college I can learn to shoot for engineer positions

I’m getting a Bs in cybersecurity also sec + with some internship experience

[flat sedge]

Find which security domain interests you - security is so broad that a really open question like that is going to get you a different answer by everyone who is or has worked infosec or cybersec

[visual nova]

Network security specifically

That’s what my bachelors is in , I will jump into application security next

[flat sedge]

CCNA is a good choice - following that, firewall policy and log analysis are good paths down that track

[visual nova]

Or at home as I do currently but my bachelors degree is focused on network security if I am not mistaken going into junior year

[flat sedge]

if you can link to your degree path, that might help us give you a better answer as well. without knowing your courseload and expected coursework, it's tough to know what we could recommend as supplementary advice

[stoic cave]

Am cyber security engineer

[visual nova]

Yes I will do that now

@stoic cave thank you

[serene umbra]

Gave +1 Rep to @stoic cave

[visual nova]

https://www.chc.edu/cybersecurity

I believe it focuses on Network security , and I have internship next year more likely soc analyst work or that nature

[stoic cave]

I was hired straight out of uni, with no certs

Which is rare

[visual nova]

Im also going to obtain sec + next summer, but my goal was to apply for engineer positions out of school I have programming experience Python , and JS

[stoic cave]

I think

[visual nova]

Ok what did you learn out of curiosity @stoic cave

[stoic cave]

My degree? Computer Security and Information Assurance concentrating in Digital Forensics and Information Assurance Management

[visual nova]

Oh ok

[stoic cave]

At work I learn something new more than once a week

Always learning and possibly doing something different every week as well

Writing Technical documents, editing said documents, systems administration, software testing, networking, hardware testing, etc

[daring holly]

Hey guys, so I graduated with a BA in Poly Sci. Long story short, law school did not work out during the pandemic, and I am looking to go back into an original interest in Cybersecurity. Is a certification into a Masters in Cybersecurity program worth it? It’s a bridge program.

[golden ore]

you may want to look at doing certs vs a MS, most companies in the US weigh a BS the same but certs can go a long to help as they are more specific on knowledge

[summer reef]

I applied to UCL in London for a Master's in CyberSec but the thing is with the money I spent on 1 year of study I can probably pay in full for 30+ certifications

and I don't really think I get much out of it

[pseudo creek]

I would look at industry certs, Sec+, CCNA or Net+, etc vs a Masters.

[daring holly]

You guys don’t think MS overall would give me an advantage down the road for managerial positions? I’m interested in cloud security @golden ore @summer reef @pseudo creek

[golden ore]

it may help down the road later, but at the start of a cyber sec career the certs would be more useful

[quasi stream]

Almost the exact same boat here. Coin-flipping Masters because of that, but I am genuinely interested in the syllabus

[summer reef]

We're not applying to the same one, are we? 😂

[quasi stream]

Most likely not 😄

[summer reef]

the syllabus interests me, yes, because it's what I'm interested in

but I don't really find it all that

[quasi stream]

Well, I haven't put in anything for London so that's a start I guess ahaha -- awfully temping though

[pseudo creek]

down the road, if you are in the US, it may put you at a disadvantage

[daring holly]

How so?

[summer reef]

it's hard explaining that I don't want to do a master's to my mum who's very traditional and degree-focused

she believes the degree solves every problem

[quasi stream]

It's a really good course but the expenses is what made me put it aside for UCL specifically

[daring holly]

My parents are also extremely degree focused.. I would do certs on top of the Masters

[quasi stream]

Owch. That's a environment I'm very thankful not to have been bought up in

[pseudo creek]

companies sometimes have minimum requirements for pay, so they may have to pay someone with a MS more and if that person has 0 experience / less experience, they would rather get an entry level person for much cheaper than paying them more because they have a MS

[summer reef]

I mean she just wants the best for me really, it's just that she doesn't understand some things is all

[pseudo creek]

and certifications give you more cred for entry level

[summer reef]

she has no idea how the tech industry even works

ultimately it's all still up to me

[daring holly]

Exactly this

[pseudo creek]

basically companies will say you are 'overqualified' to avoid hiring you

[summer reef]

yeah the expenses are over the top. I can take out a loan but that probably won't cover all of it

plus Russel Group universities are just prestigious for the sake of it you can't change my mind I've already studied at one and I saw nothing that appealed to me at all

nothing that made me go "wow this sure as hell is worth all this money"

[quasi stream]

Hahaha

[summer reef]

at least I learned how to self-learn properly

cos some modules were utter trash with terrible lecturers

[quasi stream]

every cloud? 😄

[daring holly]

That does make sense. The market is full of sec careers in the US, though. The certs alongside the Masters would be different though, no?

[pseudo creek]

the market is full of mid level positions, entry level are still a bit of a challenge, like I said, many companies hate hiring entry levels with Masters

[quasi stream]

Aye well good luck with it! I've got my foot in to do my cyber sec masters up at Bristol 😎 so if our paths cross then ((:

[pseudo creek]

its not impossible, but your money/time is better spent on certifications, get a foot in the door, then do your Masters

[summer reef]

probably not but good luck to you too 🙂

[pseudo creek]

chances are, you will start at IT help desk regardless of.a Masters or not

[summer reef]

I might still just go for a software engineering position somewhere

[pseudo creek]

sometimes you can get entry level SOC analyst or entry level network/sys admin

[summer reef]

that's what I'm good at currently, CyberSec's still learning

[quasi stream]

Thanks Zojja (:

[pseudo creek]

what what?

[quasi stream]

Didn't want to be rude haha! You give some good advice 👍

[pseudo creek]

ha

[daring holly]

If I got a Masters just to end up at an IT help desk I’d retire

I know a few people who got a bachelors in security and got consulting positions

[pseudo creek]

look at it at the perspective of the company, if you have 0 IT experience, why should they hire you?

[daring holly]

Yeah that’s my biggest concern

[pseudo creek]

thats why IT help desk is a common entry level position

but the general advice is get a few certs, make a blog, get on linkedin, post projects, share information, and network your butt off and apply far and wide for that entry level position

lots of people graduating with Comp Sci and Cyber degrees have internships in IT during college so their chances of getting a job in cyber are higher when they graduate from their BS

[misty vigil]

Hi! Anyone has gotten this cert called CompTIA CySA+?

• Is it hard to get this certificate?
• How long you studied?
• Does it required practical exam such as using of linux?

[raw heron]

how do i get recognised by THM on linked in? do i tag or put hashtags?
I'll be 0xD soon and i wanna flex

[warm hinge]

I have Cysa+. If you don't already have network+ and security+ it's going to take you significantly longer... how long is up to your abilities and dedication. A lot of the exam is reviewing logs and simply reading a book or watching a course video isn't going to prepare you to do that... need knowledge of variety of attacks. I also got a surprising amount of questions on how to use egrep and regex to search for a specific string. The thing that people seem to get tripped up on as well is that the Security+ CySA+ ( i believe pentest+ as well) heavily focus on overall...uh... business related cybersecurity concepts?.. for lack of a better description.

As far as the simulation questions none of the ones that I got were hard enough to even remember. If you're interested in CySA+ I would recommend getting network+ (or probably a better idea is CCNA!) & Sec+, completing the complete beginner and defender pathways on THM, using the Sybex Cysa+ book, and don't forget to get comfortable reading a variety of logs including router, firewall, IDS/IPS...

I would also keep in mind that I don't see as many job listings asking for CySA+

[misty vigil]

Got you man, thanks so much!
This is extremely helpful and i thank you for sharing generously with me because I was thinking to take up this certification and go for a career in cyber security analyst. In addition, I'm planning to learn those that you mentioned. Currently, I'm in the beginner's room at THM

[serene umbra]

Gave +1 Rep to @paper plover

[misty vigil]

What you've shared is truly gold to me, love it. Thanks once again man!

[static tide]

while it’s not great in terms of employability, the content leading up to it will make someone a 10x better analyst

[warm hinge]

Yeah, I don't regret getting it it all but just something I've noticed.

[warm hinge]

Not a problem. Good luck on your journey.

[boreal zephyr]

The terms your looking for are policy and governance. As you move up the blue team ladder, your career shifts from log review and SOC work to control selection and risk management. (atleast thats the route I took, I know there are many other routes out there and its up to you to decide the path thats right for your goals) You might end up being responsible for assessing a system or network, selecting controls, and then implementing and testing those controls. You might also write organizational security policy, such as disaster recovery processes or creating a change control board. For more of an idea on these topics, you should refer to the NIST 800-53r5 and NIST 800-53B. Cysa+ and similar certification will introduce these topics, and certs like CISSP are basically all about organizational policy and the like.

[astral estuary]

Hey Guys! I am currently looking for beginner level cybersec internships and was wondering if someone could provide me beginner level resume samples since I couldn't find a suitable one online ?

[pseudo creek]

google for 'college student tech resume' and then look at the images results

[ancient prairie]

I strongly recommend Jason Blanchard's resume-building technique, https://www.youtube.com/watch?v=Air1c697tjw - look for local internship job postings and basically copy and paste out snippets that are relevant to you and use those snippets to build a tailor-made resume

[trim hollow]

Snap, I'm almost there and totally want to show off XD

[cunning steppe]

Can people outside of UK can apply for software engineering internship by TryHackMe or is it only for UK based students?

[quick forum]

That sounds like something you should ask them directly?

[cunning steppe]

Where?

Isn't official discord right place to ask? 😅

[pseudo creek]

if only they had included an email address

[languid hearth]

@sage ivy @feral birch could possibly answer

[cunning steppe]

Oh

[feral birch]

Hello,
The internships are only UK based :))

[junior fjord]

Hey everyone! Career move question: I have no IT background and yes, did get Network+, Security+, getting in July Certified Ethical Hacker and a Masters in Cyber Security all in the last year. There is role, Sensitive Data Management, in my company dealing with mostly (discretionary) access management and trying to automate that and improve the process. Question is: Would that role be a good entry point to get into Cyber Security or should I try to apply for SOC roles or help line? I'm willing to work hard and learn what I can to grow into the Cyber security industry. More background if needed: Almost 40, making close to $85k a year currently in a role I don't like, been with current Fortune 100 company for almost 15 years. I appreciate any suggestions and ideas.

[gentle tapir]

I can actually relate to your question. The first path seems more 'high-level' (as in: not as operational). You have to ask yourself if you see yourself enjoying process design/improvement more than doing blue teaming.

[pseudo creek]

What do they mean by trying to automate the process? Any programming involved and do you have that programming experience? Honestly, it wouldn't hurt to apply if it sounds interesting to you.

In reference to what 0ldb0ss said, high level positions will generally pay more than operational jobs but some people love operations.

[junior fjord]

Great point. I agree with your assessment. I have to noodle on that. Appreciate it!

[junior fjord]

Hey Zoija - I think it's working with the IT teams because right now it seems like the team uses some sort of software or system that manually add people privileges to applications for our data analysts. Very minimal python coding on my end but I want to learn and plan to do so this year. Hoping that will help build skill sets. Appreciate your response.

[pseudo creek]

Honestly my first ‘real’ cyber job was throwing caution to the wind and applying and it treated me pretty well

[gentle tapir]

Cool!

[junior fjord]

Would you kindly share what your first cyber job that you applied to was? I also applied to be a SOC analyst - that seemed exciting to me.

[pseudo creek]

It was a security engineer but basically someone who provided network security guidance

[gray thunder]

Hi All like @junior fjord I too am looking to career change and would like some advice:
after a number of years working as a Quality Manager (all levels of SDLC experiences with large companies & complex systems) The blend of tech and management skilled have left me hitting a ceiling in the positions I am able to go for/ offered and more importantly I just don't enjoy my work any more😫 . Pandemic came along and allowed me to investigate some avenues, take some online taster courses and network with those in different roles in CySec. I get movement could mean a pay cut but to leverage that (as I know there will be a whole host of work myside before I could even quit/ move away from my current job) am reaching out to you guys in the the real CySec working world for some advice.
I am at the very start of the journey and (whilst doing the day job) keen to learn/ study, and follow a path in Cloud CySec (though as I learn more I may pivot, but that's the current target) suppose my ask is, any advice on:

1. how to I start to get "experience" in any relevant areas?
2. start to look for groups & forums where I can grow what I am learning (safe space for a nube learning🙂 )
3. fundamentals you have picked up that you wish you had known when you started your journey
   any advice welcome as like I say am willing to put in the work, but advice and experience of others is always a bonus.
   thanks

[serene umbra]

Gave +1 Rep to @junior fjord

[distant pier]

For a structured approach to Cyber Security, start with the Learning Paths on TryHackMe: https://tryhackme.com/hacktivities

[pseudo creek]

and grabbing a few certs within Azure or AWS is good for getting started in Cloud

[manic kindle]

I'm a pharmacist IRL but interested in branching out, looking at getting an engineering or CS degree online! Any ideas of how a medical degree can fit in with CS/software engineering?

[gentle tapir]

I am an literature & linguistics grad. There's nothing stopping you! Your background seems like a strength, as medical research facilities and/or hospitals are prime targets for hackers. I can see you leveraging that quite nicely tbh.

[warm hinge]

pharmacogenomics is a booming field at the moment, and comes with a(nother) big demand for CS/software engineering

[gentle tapir]

Fax has a more sensible answer, yes

[warm hinge]

just more specific to his background (and I happen to know the field a bit by chance), but what you said is all true as well! I think CS/s.eng always profits from also having a strong knowledge of the domain

[warm hinge]

would suggest also being open to other entry points such as data science or bioinformatics. CS helps but is not a pre-requisite for either (not in the job market I know anyway)

[manic kindle]

Thank you both for your insight! At the moment I'm specialized in oncology and hematology (2 year post grad residency training). I love it, but also have other passions too. My undergrad is biomedical science, and as the first one in my family to go to college I didn't really know what to go into so I just picked the first thing I saw on the STEM degree list and did that. I'm extremely strong in biology, chem, biochem. Weak in physics, and math (as in it does not come naturally, I really have to study hard for those classes). Now that I have a decent income I have extra money that I've never had access to before and thought I could get more education with it as I simply love learning. Do you think something like chemical or biomedical engineering would be more suitable for someone in my situation?

[serene umbra]

Gave +1 Rep to @turbid latch

[warm hinge]

I can't speak for chemical or biomedical engineering since I don't know them. Your mileage may vary with engineering curricula but you are likely to find a strong emphasis on math. Perhaps less so with newer fields in engineering nowadays? I've lost touch. Then whether you will actually need it on the job though is another matter, it completely depends on what you end up doing.

[junior fjord]

Awesome! Important stuff! Thanks for sharing.

[serene umbra]

Gave +1 Rep to @pseudo creek

[warm hinge]

as just two completely anecdotal data points: in a little over 10 years so far I've never had to use any of the calculus I learned in my soft. eng. degree; some of my friends work in computer graphics and have kept their calculus pretty sharp 🙂

the intersections of biology and IT that I know of (+) can have a relatively big math component, but more on the statistics side rather than calculus.

(+) big disclaimer there, I'm sure there are far more intersections than the ones I am aware of (around genomics) 🙂

[ancient prairie]

Just finished the PT+ beta and feeling pretty darn confident about the results - the questions were not really difficult at all besides one of the PBQs. Feels a lot like they moved away from the usual "gotcha" style of rote memorization that CompTIA usually requires and more towards inference based questions

[peak steeple]

@ancient prairie Where there any practicals on PT+ exam?

[ancient prairie]

yes one of them was pretty tough

[light urchin]

Possibly look into more of a data science role? I've worked in healthcare and can maybe help bounce some ideas around

[lost willow]

Hi Everyone, I'm have been working as a "Security Analyst" for about 6 months now, doing the following:

• Creating Vulnerability Remediation Tickets from our Security provider's scans
• Investigating alerts from our Security provider
• Watching how Third Party audits are completed
  I am not exactly confident in my technical abilities as I really don't have to do anything too technical in my role. I would like to work as a Tier 1 SOC analyst on the weekends to build up my skills. Hoping someone has some opportunities or suggestions