cyber-and-careers

[stoic cave]

Lockheed is an easy example

Lockheed is a private company that does a lot of defense work, as such those employees are cleared

In reference to anything that's federally illegal or otherwise but legal in your state of residence

Weed is a common, easy, example

It's going to be interesting soon though in Texas

But it may just follow the same rules as the weed thing

[quick forum]

What's happening in Texas, without getting political?

[stoic cave]

Texas is invoking the 9th and 10th Amendment on Pew Pew rules

Otherwise known as nullification, which is what states are using to legalize weed

Just know if you Google it you're going to get heavily biased sources that treat it like the world is ending

Or I did when I Googled anyways

[quick forum]

How's that related in this case?

[quaint flare]

so weed is being legalized?

in texas

[stoic cave]

How is Texas related?

Or..

Not sure I understand

[quick forum]

How's it related to clearance?

[stoic cave]

Oh

It would result in loss of clearance. If you indulge in the devils lettuce then you lose your clearance. I would assume that the same rules would apply with Texas and Pew Pews if they go through with nullification

Which would then open a can of worms legally that I do not have the expertise to talk about

[quaint flare]

texas doesnt have taxed tho, that's a +1 for me 😎

[quick forum]

The Texas laws explicitly exclude people federally banned from owning a firearm

So it's not likely to affect clearance?

[stoic cave]

I didn't think anything went into law yet

Is this the new stuff? If that's the case the only people who are federally banned from owning a firearm are Felons

[quick forum]

https://www.ksat.com/news/local/2021/06/01/explained-how-constitutional-carry-will-change-gun-laws-in-texas/
Most factual (no opinion) source I found. I don't see how it could affect clearance.

Avoiding the politics again

[stoic cave]

Ah this is the constitutional carry

That's different

Constitutional Carry has always been up to the state

What I am talking about is Texas nullifying NFA

Which are federally regulated items such as suppressors, short barrelled rifles, etc

As far as I am aware it's only in discussions and no moves have been made yet

[quick forum]

Law scholars are saying that won't work, but it'll be interesting to see how it pans out. Inb4 loads of people get their clearance revoked and the value of people with clearance goes up even more.

[stoic cave]

I don't know how it can't work but then again I'm not a law scholar. Legalizing weed follows the same process and it's working

9th and 10th Amendment give the power to the people and the state to tell the Fed to shove it

But I think it will lead to some interesting legal proceedings

[light urchin]

definitely years of legal arguments there, but I would guess that they can't just allow NFA/class 3 weapons. It would still be illegal according to the federal gov, but probably nobody would get hunted down specifically for just that- everyone would end up just looking the other way, good ol' boy style, unless they find someone they wanted to throw the book at

[stoic cave]

Yeah none of this will be decided overnight

Weed is also still federally illegal. Which means the Fed can go raid every dispensery with the DEA/FBI/ATF and arrest everyone

[light urchin]

yeah. They are just choosing not to

[flat sedge]

I did enjoy reading the lawsuits of neighboring states sueing CO when their residents went on a pot tourism road trip and brought home souvenirs.

[stoic cave]

Lol

[boreal zephyr]

This isn't strictly true. If you have a clearance and were to partake, you are expected to self report. What happens after is up to your history and the situation

[stoic cave]

Both places I've worked since being cleared have said you'll lose the clearance

[boreal zephyr]

Of course they would, but it isn't up to them

[stoic cave]

I've never partook anyways so it doesn't matter for me

[solemn marsh]

valuable advice- really appreciate your criticism man!

[peak steeple]

If you are in UK: This might interest you https://www.cyberpathways.co.uk/

[ocean vector]

hello guys, do you know about any entry level job/positions related to cyber security that I could do in my free time and earn little money? Except bug bounties as I am still learning. Thank you

[golden ore]

you can try looking for a part-time SOC analysts position, a helpdesk type position might also help as it would give good experience working through different issues and give different level of exposure to common user issues

[near path]

Interestingly, the cover pic is one that of CCDL, Connecticut Citizens Defense League, not Texas. Many would also argue that using a serpa holster should disqualify you from handling any responsibility. 😛

[worn spire]

Entry level it position or potentially programming on a security related project can be a good way to get experience.

[tight solstice]

I've done many of the boxes here in THM, have pentest+ among many other certs... Still can't find a job

I mean I do have a job as help desk but nothing related to cyber sec

[sly matrix]

maybe OSCP can do that ?

[tight solstice]

I know 😔

Is just so hard and expensive

[undone shore]

They mean it when they say it's entry level 🙂

Expensive, yes

[sly matrix]

All I can say is it's an investment. Prove me wrong

[fiery blaze]

Entry Level position but require a masters with 7 years experience

[thorny cloak]

Looking for someone in Incident Response for a couple minute chat. Feel free to @ me

[worn spire]

Most entry level cybersecurity positions require 3-5 years of IT experience

[golden ore]

helpdesk experience can be converted to cyber experience, you just need to look at your day to day activities and then look at what a cyber job is looking for and try to figure out how they relate

[thorny cloak]

I kinda got around needing the IT admin exp, backing up what theyre looking for with my engineering projects and system knowledge. Im intrigued by what does the incident response toolkit looklike. Also not sure to what extend is defense automated and I spend my day looking at logs rather than live logs

[warm hinge]

Hello. Is anyone offering paid internships for PEN-200 students? I am desperate to get out of this factory job. I don’t care what I have to learn or what hours I have to work. I will do literally anything it takes to get my career started

[sonic condor]

general question....so my role is evolving into more of a cybersecurity role (well just getting the hat added to my many other hats) work will pay for whatever i want to take....now trying to decide if I want to take oscp or cissp....completely different certs I know, just trying to decide which i should pursue.

[sonic condor]

cissp would probably better for me building cs methodologies...but oscp would be more of a "roll up your sleeves" cert

[distant pier]

Start with the course (notice I did not say cert) that is the closest extension of your evolving current job, which will make it easier to get used to taking courses. It solidifies your area what you are comfortable with. 🙂

After that branch out. 🙂

[sonic condor]

@distant pier agreed...should have stated "work towards". for oscp...until I can comfortably hammer out the thm hards and htb...i wont start the oscp course.pen200

[flat sedge]

Are you inheriting a security program, or is this evolving role you setting that up for the org?

[sonic condor]

evolving

[flat sedge]

OSCP is probably going to be less utility, if you are developing the security organization

[sonic condor]

yeah....i think i am being more selfish in my selction 🙂

probably cissp would be more beneficial to the company

[boreal zephyr]

Do your org currently have a cyber framework in place or would you be establishing it?

[sonic condor]

We would be just establishing it.

[boreal zephyr]

Wow. What would your role be? Deciding on a particular cert would depend largely on what is expected of you. Will you be managing the overall cyber posture or would you be expected to implement cyber through evaluation and testing? The role expected of you would dictate the cert you would need to persue.

Additionally I would really think hard on why it would fall to you, someone who is just pivoting into a cyber role, to establish such a program. Its not a small undertaking and even that is understating it.

[sonic condor]

it is a little more complicated than really what is defined in a few lines. There is a team that will be building this along with 3rd parties. The path I follow for certs are more for personal preference. Both would compliment the team.

[boreal zephyr]

then in line with personal preference, go with the cert that will help accomplish your career goals.

[solemn marsh]

it's been about 4 or 5 days since the other recommendation with no response (1 teacher replied the other didn't) - should I send another email to that teacher or wait it out? I can see arguments with both

On one side, being patient is never a bad thing, on the other side, the teacher could have honestly not been checking his school email so a friendly email as a reminder would help, but then again, it might push the first one further down.

Like, what's the thin line between being patient and following up appropriately?

(in regards to the teacher who didn't reply)

[boreal zephyr]

Let sleeping dogs lie. If you didn't get a response and the email was delivered, I would just let it go.

[solemn marsh]

Yeah I totally feel you on that though

in what cases is it okay to follow up

and how do you do it without sounding impatient?

[boreal zephyr]

If you feel the need to, you could follow up by simply asking if they received your previous email, and if not, reiterate your request. But again, I wouldn't do that. If I absolutely needed another reference, I would seek another source. Most people screen emails like they screen phone calls.

[quaint flare]

i don't think it's bad to follow up tbh. i often do. ive also had teachers tell me they ONLY respond to students who email twice bc they get so many emails that it shows the ones who really care. it's your degree and career on the line, it doesnt hurt to be a little pushy

it's not like theyre gonna hate you for sending 2 emails. the worst they can say is no

[solemn marsh]

Ah yeah - totally valid point. I suppose it also depends on the situation

[solemn marsh]

Do you think it might be smart to wait until I get my recommendation before submitting an application for any listings?

[paper grove]

IMO, if you're ready to apply to jobs but minus a teacher's recommendation letter... 1) does a specific application require letters of recommendation? If so, try to reach out to another person for recommendation letter then apply. 2) if jobs don't specifically state they need recommendation letters but you're ready to job search, apply away. It typically takes tons of applications, follow ups, attending networking events, etc. To land a job. Might as well get started early, right? When the recommendation letter is available, you can add it to new applications. And some will allow additions to applications you submitted earlier

[solemn marsh]

Wonderful point of view- definitely can understand. I'm looking to get an entry level position so I was thinking recommendations would look particularly well even though they aren't required. I'll probably give it a good ol' cover letter and resume and keep it like that until I get my recommendation(s).

[paper grove]

@solemn marsh I feel ya. I'm doing the same exact thing. I'm just trying to get that human interaction but so far haven't landed an interview yet. So I just submit what I can and keep trying my best. Speaking of which, there are some events coming up this week. Might be helpful. Check some out. This is a great site for resources. https://dfirdiva.com/dfir-related-events-for-beginners-july-2021/

[solemn marsh]

Ooo nice- are these online events?

Also, for reference- I have no employed IT experience. I'm looking for a SOC internship or helpdesk job atm

But I want to pivot off of helpdesk down the path to penetration testing as I continue to get more experience

Sysadmin might even be a good goal

I've also only ever been self-employed, so this is a big step for me; I have an idea of how the employed atmosphere is, but being employed by someone else is sure daunting to me due to my lack of experience. Reminds me of when I was going to get my wisdom teeth out, how I heard things about the process, but I had this crazy anticipation anxiety until I actually went through it all

But now after it, I'm confident I could undergo general anesthesia again

so, same concept here- it's going to be quite nerve-wracking and I'm not sure if there's anything I can do about it

other than to accept that nervousness and control it

[paper grove]

I can't say that all of them are, as I haven't looked at all of them, but the 2 that I plan to attend happening this week are fully online.
Yeah, nerves will be there but with experience they go away over time or are manageable.

[north hill]

@flat sedge @boreal zephyr I submitted the architecture. I segmented it into 4 parts:

• VDI
• Services
• Users
• Architecture as a whole

And my boss said it was very well made for a beginner and covered up the Client's needs very well. I segmented the Network into smaller subnets according to level of access, Used NSGs, DLPs and integrated on premise AD to Azure AD on cloud with VMWare VDI solutions. Thanks to you all for all the help and advice. Couldn't have done with your insights

Thanks people. This really means a lot :)

I was in a bad place for sometime now but this really motivated me to put in more efforts :D

[serene umbra]

Gave +1 Rep to @flat sedge

[fair cypress]

I see a lot of people asking about certs on here especially when asking about getting into a job. I think soft skills are just as important and often over looked. I can teach people how to use tools but teaching someone how to be a team player isn't as easy. This article is worth the read.
https://www.cio.com/article/3625550/6-dead-end-it-skills-and-how-to-avoid-becoming-obsolete.html

[warm hinge]

How do you get experience for cyber sec before getting the first job in it?

Like something that you can add to your resume? Is there any volunteering out there for it?

[pseudo creek]

TryHackMe....

doing writeups shows that you understand the concepts

there are various certifications out there like Security+

[thorny cloak]

add your github repo

[mental compass]

Hi, i would be thankful for some advice. I am currently bachelor student in business informatics. I didn‘t enjoy the „business“ part but enjoyes the computer science part. I really enjoyed coding and have knowledge in java, javascript(html, css, react) and python but no extraordinary skills in any of them. I am a relatively fast learner in terms of it subjects. I also have some basic it security knowledge like hashing, encryption, cia triade, risk management. I am currently doing my first internship at a big 4 consultancy in cyber security but i don’t really enjoy it as it is more on the organizational site and i want a more technical job in future. I started with the thm beginner path and wanted to see how i will do as i have no extensive linux, networking or hacking skills. I thinking everyday about if i first should pursue a software developer job or a cyber job (pentesting) or if i should do a masters first(cs or cyber security). I don’t know if my software engineering skills are enough for an good entry level job. They are for sure not enough for a entry level pentesting job. I thought about doing some sys admin or helpdesk job but would i be qualified enough and wouldn’t a masters be better? I am weighing work life balance and fun at the job over money. Would appreciate any advices 🙂 Edit: I’m from germany if that plays a role.

[golden ore]

to get into the field initially a masters will not help as much, most entry level jobs like to see the bachelors degree along with some certs (i.e. linux+, sec+, net+, etc), also since you are only part way into the degree you could look at switching to a cs degree if possible

[warm hinge]

Already done but thanks I’ll try the other two

[serene umbra]

Gave +1 Rep to @pseudo creek

[warm hinge]

I haven’t really used it that much, is there a specific language people use in Cyber?

[flat sedge]

Nope. Languages are pretty dependent on the organization, as are 95% of "typical" compliance requirements. What will help your resume the most (aside from actual security experience) will be some way of showing or talking about what your security interests are.

A home lab, even one that is locally hosted VMs or low-cost hardware like raspberry pis, goes a long way to an interview team or hiring manager.

[thorny cloak]

it lets you go as specific as you want to go, it lets you scale as you become more into cyber.. your github will be an in depth portfolio that takes a single line in your cv. I am writing my ctf write ups in there so far

I went to a cyber sec engineer interview couple weeks ago, she looked at me and said: are you aware a big big chunk of the job is about documentation and write ups? not just pentest 24/7. Show them you know that as well

[flat sedge]

that's true for most blue team activities. Reports and documentation are how an org demonstrates they are doing the security things; doing the things and not reporting on them is a huge maturiy failure

[warm hinge]

I never thought about it like that, thanks a lot @thorny cloak @flat sedge

[serene umbra]

Gave +1 Rep to @thorny cloak

[elder panther]

Which App do you guys recommend to restore deleted audio file?

[static tide]

wrong channel and you have given absolutely no context

[fast adder]

Has anyone here made a transition from Electrical Engineer (hardware) to Cyber?

[languid hearth]

Yes! I do happen to know someone. in the ICS/SCADA world you're super valuable

[stoic cave]

You beat me too it Spooky

[tawny hawk]

I know a bunch of people

what area of cyber are you looking at? As they said above super valuable in the embedded systems world

[spiral lark]

YOOOOOOOOOOO i only know that saying because it was sent in a manga I just read :)

[boreal zephyr]

o.o Its a pretty common saying, atleast in the US lol

[spiral lark]

I never had heard it before reading it lol

[fast adder]

@tawny hawk and @languid hearth Sorry for the delay here, I don't have notifications set up on mobile, so I missed these. I have about 10 years of R&D/design/manufacturing/product dev on the pure electrical hardware side, but not so much on the actual embedded systems programming. Everything in "cyber" seems very focused on networks and programming, so I haven't come across a huge overlap with the harware side, but I know it exists - as you mention, the ICS/SCADA, and also things like hardware hacking tools, trusted platform management systems, HW supply chain security, etc.

The jobs for those roles seem to be tough to find - any suggestions on how/where to look?

[tawny hawk]

Look for jobs titled Product Security instead of cybersecurity

And if you have any kind of avionics background the AeroSpace industry is begging to find people

[fast adder]

Awesome, thanks!

[still coral]

How do other people feel about adding their THM achievements to LinkedIn, also why is there no direct way to add you badge to LI? I have seen people posting a screen grab of their current level and Top 3% or whatever.

[pseudo creek]

if you have nothing else... doesn't hurt

[still coral]

Its all I have other than Splunk certs.

[fair cypress]

I don't see how it would hurt. If you have skills showcase them!

[still coral]

Would it be possible for the THM team to create a direct link for LinkedIn that you could use under the certifications area to share your completed courses from THM, along with your current Top % ranking?

[fair cypress]

I am sure it is possible but I don't know who you could contact to make the suggestion. Maybe an admin?

[paper grove]

@still coral I've seen plenty of people sharing either specific badges they earned, screenshots of the total badges earned, specific rooms completed, and pathway certificate posts. It shows we're working on learning content. It's about sharing with the community and sometimes bringing awareness to others who didn't know what TryHackMe offers

[remote sorrel]

In Australia, its normal to see job listings on seek.com.au specifically call out THM as a valid experience path and to share your profile. I dont really have any specific advice on how to share it easily on linkedin, but absolutely add it to your resume and share your profile as part of your experience listings for jobs!

[peak steeple]

I do have someome linkedin proudly exclaming that he's completed all pathways and displaying certs soo it is doale.

[distant pier]

It can help to accentuate your passion and dedication to developing hands-on skills and learning. 🙂

[still coral]

It would be good if the THM team could make LinkedIn specific links to add the info to your profile.

To display my Top percentage currently I would have to screenshot my profile.

[quick forum]

There's a feedback form in #feedback-and-ideas

That's the best place for it, site devs read that

[still coral]

I have added it there as feedback, thanks for the suggestion.

[cold dawn]

As a hiring manager I would definitely trigger on people that invest their spare time on THM or similar sites 🙂 More than completing some Security+/CEH certs.

[marble lichen]

This is reassuring. As someone in the public sector, working on digital forensics (mainly mobile). I’ve been thinking of pivoting to the private sector and moving deeper into cybersecurity. Being able to add THM to my resume is extremely beneficial. I’ve been spending an hour or two each day on THM, as time permits.

[agile tinsel]

thm is alot of fun

[solemn marsh]

Another revision to my resume; how do you think this is looking? Had my cousin who has 27 years of Infosec experience give some valuable feedback. I think it's real strong now.

[solemn marsh]

https://images.imdavidday.com/i/XcsSUvp5TvZpc7lN

[paper grove]

@solemn marsh So, I've been going through some cybersecurity specific career coaching. From that experience, if suggest adjusting your goal to be more of an introductory statement. I'd suggest dropping the word entry level. In the statement, show your passion for cybersecurity. Write about courses or study materials you've used (THM probably). Write down some key tools you've used (depending on your depth in THM maybe include things like Linux, networks, metasploit, malware investigation, nessus, openvas, etc). These can help highlight cybersecurity content. If you've done projects like building a home lab and working with it, also good idea to include a project section

[solemn marsh]

Both experience I've had have been self employed though. I've never been employed by someone else before

I should definitely consider a projects section. I'm hoping I can find a way to fit it on the page though

So, talk about THM in the goal section?

[solemn marsh]

I also will probably split two versions of this resume: one for an entry level help desk and one for a potential SOC internship-

[paper grove]

That's ok with the experience. My previous experience before my first IT job was as a teacher, dental assistant, and cashier. But up selling the security background/training wherever you can is key until you get some work experience.
If you're worried about keeping it to one page, if mostly suggest changing the goal section to "Introduction" and then list the content there. That way you can still list your ideal position there, but also describe your interest in the field

[craggy cloud]

Hey everyone! When applying for my first job in CySec, is it adviceable to look for large companies or is it better to aim for small companies? I have no certifications in CySec yet, but hopefully in the future after saving a bit I will start getting them. So far all I've done is THM courses and I'm coming from a Web Dev (JavaScript) background. I wonder how would it be perceived by employers 🤔

[peak steeple]

@craggy cloud If coming from web dev background - definitely get your teeth into OWASP top 10 and you will be in demand. Everyone wants to work for a big name soo competition is higher - I would get my feet wet in asmall company as that offere s you more room for growth IMO.

[solemn marsh]

So do you think skipping help desk would be bad? Perhaps jumping straight to a sysadmin / Security Analyst role? I guess that's my next question is which roles would be best to go for. I'm trying to get my foot in the door of IT for leverage so I'd think if I can score anything related its all usable to my advantage

[gleaming crescent]

any suggestion for Cyber Security jobs ,what are requirnment
TryHackMe or HTB labs ,Certification
and what about picoCTF

And waht about bug bounty ?

[quick forum]

That question is going to depend on where you are in the world

[cold dawn]

Play around with Burp Suite, learn the ins and outs of HTTP and TLS/SSL (for example by setting up your own webserver and hardening it, nginx/apache are the most common ones there), set up Lets Encrypt certificates with automatic renewal. Also in modern companies everything is done in containers (docker, kubernetes) and automated via tools like puppet/ansible so diving in those areas will also give you unique skills that are in high demand. All of these tools are free open source software so you don't need to invest anything but time.

And while learning about how to set everything up, you will automatically run into potential misconfigurations and security issues to learn more about.

[cold dawn]

There is no hard requirement 'in general', just invest time in learning and don't stop until you have some projects/certificates to show what you know 🙂 Setting up your own github repo with practice projects related to what you're learning is a good way to impress potential employers.

[gleaming crescent]

Okay , but is there any road map for it ?

[cold dawn]

The field is a bit too broad for a single roadmap. There is some overviews like https://pauljerimy.com/security-certification-roadmap/

but certifications are not that super important, you really just have to get into the practical stuff yourself, and keep looking everything up, ask questions, get a mentor, fail, try again, fail, learn, repeat.

Also see the pinned posts in this channel

[paper grove]

I wouldn't say skipping help desk is bad. If you can manage to skip straight to an admin, analyst position or similar, take it. Pay is definitely more. But help desk is easier to achieve and allows you to show that you have communication skills (super important) and gives practice with troubleshooting.
Jumping straight to admin, analyst or similar is doable, but you have to show that you understand networks and systems and willing to learn more.
*Edited "would say" -> "wouldn't say"

[solemn marsh]

Yeah, I completely agree

Thanks for the feedback

[cunning spruce]

@paper grove Would you tell someone who did technical support for a hard drive company that skipping help desk might be worth it since phone support is all communication?

also this might be the wrong channel but is there a particular group of people based in Toronto? I don't really know many people in the IT space (Health Science Major) and was looking to get know some of the people in my position

[cold dawn]

Check out https://hacklab.to/

[cunning spruce]

@cold dawn Thanks will do

[serene umbra]

Gave +1 Rep to @cold dawn

[cold dawn]

or some of the others listed @ https://wiki.hackerspaces.org/Toronto

[paper grove]

Oh crap. My bad. I forgot to check for typos. My post was meant to say "I wouldn't say skipping help desk is bad". So sorry for that.

[cunning spruce]

Ahhh, fair enough. Right now I am trying to look for "entry level" Cyber or even anything a step above help desk but I might be shooting above my league.

[cold dawn]

helpdesk is just a vehicle to get better at analytical thinking, communications, patience, maybe general business skills

if you can compensate that with other things, that's ofc also fine

[paper grove]

The rest of the post I sent seems ok though. Trying to say that it can be helpful but there are certainly ways to jump straight to cyber jobs. And if you can get into cyber jobs, go for it as they pay higher.

[cold dawn]

nobody is stopping you from just going for an entry infosec job without helpdesk experience 🙂

[novel ginkgo]

;

[cunning spruce]

I don't disagree and im not against taking a help desk position. Im only 23, I feel like I have plenty of time to start from help desk and go up. Like you guys said the pay is better if I can skip it so I'll definitely take any "Cyber" roles if I can get one too.

Thanks @cold dawn @paper grove

[cold dawn]

and getting involved in bugbounties or responsible disclosure is always a good trampoline into a companies security team

if you make an awesome writeup

[paper grove]

I myself am still striving for my break into cyber, but I feel it's more fun than help desk

[stoic cave]

I agree with this. While getting helpdesk experience can't hurt, don't let not having it stop you from taking a non "standard" path

[cold dawn]

often the most interesting people in a security team are the ones with a non-traditional career path

that bring unique skills and experience

[stoic cave]

I consider myself fortunate. I graduated and went straight into a Cybersecurity/IA Engineer role

Took 3 months of clawing for interviews but I did it

[cunning spruce]

Damn thats pretty nice lol

[cold dawn]

I interview quite some people and I'm usually disappointed with how little real world experience fresh graduates have. Like they have a masters in compsci or even some security-specialization, yet can't recognize a base64 string or know that cmd.exe shouldn't spawn from winlogon.exe

and then they expect to start working as a (not junior) soc analyst

[cunning spruce]

I knew in my 2nd year of health sci medicine might be a tad out of reach (GPA) and I had people who were hopping in and out of programs. Prob should have made the switch then but thats life I guess 🙂

[cold dawn]

so communities like THM are essential for that out-of-band knowledge the uni's/schools won't teach you 🙂

[cunning spruce]

@cold dawn The one thing I would like to brush up in is basically everything a help desk employee would be familiar/experienced in so, Identity management is prob tops there. I just wish I was creative enough to know how I can spin up a home project to demonstrate those skills

I know some people have git hub journals of Labs they run in their house, which is something I could do but I would prefer something a bit more interactive lol.

[cold dawn]

99% of helpdesk jobs are just human implementations of runbooks/playbooks though, going through conversation scripts with very little room for creativity and improv

but I guess this totally depends on the infosec role you want to apply for

since a lot of entry infosec jobs are also pretty much that

okay maybe 99% is a bit much

[cunning spruce]

Yeah technical support for HDDs (Seagate/WD, I was with one of these two) and ancilliary products don't really get too creative beyond knowledge base or weird niche issue. I liked getting my hands dirty and I am an L2 (just deal with some NAS (legacy) products and RAID ). For probably for good reason we don't really get to offer creative solutions so I feel like im maxed out here

[stoic cave]

I understand that sentiment but I also think that if you are (not you specifically) marketing the position as entry level then you shouldn't have an expectation of them coming in and knowing things. College is more theory than practical knowledge and now it seems more and more companies want that "unicorn" and don't want to take the time to train people up

[paper grove]

The part I really like about my current help desk role is that the customers are admins at other companies. No script so it definitely helps to know your stuff, but they're understanding of we forget some of the terminology or have to research some topics

[cunning spruce]

Yeah its an odd juggle for sure. On one hand you definitely want employees that are going to hit the ground running and be able to assist in security compliance/management but on the other hand unless you work your way up the typical feeder roles it's hard to get someone that checks those boxes

[stoic cave]

I can't tell you how many "entry" positions I came across that wanted 5-10 years of experience and paid less than 50k a year

[paper grove]

Very true

[cunning spruce]

Every employee you bring on to payroll has a literal monetary investment upfront (fees, time etc) and then theres the training aspect.

[cold dawn]

@stoic cave yes job descriptions are usually not very good at conveying what's actually expected, I still have to modify the one for my team that was written up before I took it over. It even has things in it like "Required Education: Bachelor's Degree"

I don't even have that, why should my team members have it lol

[cunning spruce]

LOL

Yeah I always get put off by those because I know when indeed or some other middle-man company software scans my resume they prob will just drop me because they dont see "Bachelor in IT/CompSci/etc"

[cold dawn]

yeah if there is a HR/recruitment dept screening the applications first that could be an issue

since they will look at it without being hindered by any contextual knowledge

[cunning spruce]

Yeah and I don't blame them. THe other day I got a rejection for an analyst role and i noticed from iNdeed's email that it said "Applicants: 142"

It's def a lot for a non-IT orientated dept like HR to have to process and contexualize those applications

[cold dawn]

i'd be much more interested in the people that think they have the skills despite not having finished their uni

but i'm weird like that

whats your stance on giving applicants an assessment to complete in a limited time, as a pre-interview round?

[cunning spruce]

I remmeber seeing a job posting a few days ago that basically read like a plea for help lol. I wish I saved it since i can't find it but it was literally paraphrased something like this: Hi I am an admin at X company and we're having a really weird issue in our networks. our setup is [setup] and we collectively can solve this, this and that but this particular issue is something we are not familiar with. Signed IT admin"

[cold dawn]

just some example detections and 'what are your thoughts on these? how would you approach them'

and instead of having 4 eyes staring at you through your screen having an hour to do research on your own

and come up with the best you got

[cunning spruce]

I like those kinds of practical questions. 1 if you know the information it's a great way to show off and 2 since it's open ended you can take it in ways that might still be interesting to the interviewer

[stoic cave]

I think there has to be a fine line. Pre-interview, im leaning no. During interviews, sure as long as it stays theoretical and doesn't stray into real scenarios

[cunning spruce]

Security+ has a name for those questions I think they're Performance based Questions or something

[stoic cave]

Yeah PBQs

[cold dawn]

just trying to optimize the time spent on both sides

and during their work they would also be able to google or ask people

[stoic cave]

Yeah idk how I would feel if I got that pre-interview

[cold dawn]

so why not during an assessment

if you have no clue then even with google it will show

[stoic cave]

If it was a highly specialized position then sure

[cunning spruce]

one thing I noticed is a lot of entry level positions in SoCs are asking for experience with SIEMs, realistically beyond installing and playing around is there way to get "resume-level" experience in these platforms without in-work experience?

[cold dawn]

yeah tool-specific knowledge I tend to stay away from, except for maybe OS tools that everybody would have access to

you want the job to get experience with the big tools, chicken and egg

the next-best thing would probably be playing with FOSS alternatives like https://github.com/Cyb3rWard0g/HELK learning about that stack

or https://thehive-project.org/

if you know your way around those, then its just applying the same skills in another tool

[cunning spruce]

Do those usually play well with other hiring managers (Sounds like you're one of those good ones) when it comes to THM or open source courses on resume?

[cold dawn]

yeah my sample size is very limited, but I would say the hiring managers that don't care about those aren't the ones you want to work for

but I can understand not everybody has the luxury of being picky

[cunning spruce]

For sure it would be amazing to be in a role with people who want to see me thrive in Cyber but yeah some places really are just looking to fill a position.

but hey that's still experience on my resume so it is what it is lol

[cold dawn]

I mean if you spend a summer on setting up your own jupyter notebooks in HELK and producing some nice searches and graphs

and make a post about it on LinkedIn.. then you're already in the top 1% of people looking for their way into infosec

most wouldn't even go through that effort

[cunning spruce]

true true thanks for that example, when people usually say build a brand with a blog its ussually without examples. That actually sounds really fun to be honest

[cold dawn]

take some random new vulnerability that you can reproduce, push the logs in your HELK

write a hunting query, maybe you'll even be one of the first to do a write-up on it

(sounds easy, but it would be a steep learning curve ofc :))

[cunning spruce]

(when it comes to programming the best I can do for you is a short cron script but I'd like to get better at programming)

But it does sound interesting enough I'd like to give it a shot

[cold dawn]

https://github.com/SigmaHQ/sigma

that's also something to read up on if you want to get into the SIEM/Hunting side of things

[cunning spruce]

I don't really know what kind of role i'd like to settle into for Cyber, for me it feels like the various domains all seem interesting so it would be amazing to develop skills in all domains so that I can find what I want to focus on

Thanks i'll take a look at ti right now

[cold dawn]

the hack.lu talk on it is probably a good intro

[cunning spruce]

Being a generalist is prob not the best way to get into a specialized role but I always enjoyed being a jack of many trades

[cold dawn]

yeah to get into infosec you don't need to be a specialist right away

if you're a specialist very early in your career you'll probably be bored with it halfway 🙂

or your specialism will be made redundant, more likely

things changing so fast

[cunning spruce]

Yeah thats always a concern

Thanks alot for the resources so far by the way

[cold dawn]

np

also I shouldn't have discord open while I want to do some rooms.. ADD ftl

[paper grove]

@cunning spruce you can do some training courses on Splunk through their website I think. One of my friends got a certificate through them I think. I believe it was free but I haven't fully looked into it yet.
Also, I think there are some resources that provide sample logs to check through for events. Again, I've heard but haven't done it yet, so I apologize for not having direct resources to list.

[cold dawn]

This one also goes quite in depth https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/become-a-microsoft-defender-for-endpoint-ninja/ba-p/1515647

[cunning spruce]

@cold dawn So based on the desc on the web page it looks like it's basically a free cert program? Looks interesting and definitely helps give some validity to my resumes
"Endpoint Protection" section thanks a lot

@paper grove https://www.splunk.com/en_us/training.html Heres the link for others as well

[serene umbra]

Gave +1 Rep to @cold dawn

[cold dawn]

Not sure if there is also certification involved, but it definitely covers a lot of ground. Drawback is that you don't really get a practice instance to run it on (none that I know of at least, maybe there is some trial package available)

[cunning spruce]

By the looks of it any of that is going to be self setup

https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/evaluation-lab?view=o365-worldwide#setup-the-evaluation-lab Looks like they also have the microsoft eval lab (never heard of it before)

[cold dawn]

yes thats part of the product, where you can spawn some machines to test things with, and run pre-defined scenarios

nice for tabletop exercises etc

[iron forge]

Someone with Network+ and Security+ what Job title is suits them?

[peak steeple]

Both a juinor level certs and you could find holders in Helpdesk/desktop support and NOC/SOC level 0/1 roles I believe.

[peak steeple]

Blackout - you always deliver the goods! Thats an aweesome list.

[quartz light]

I completed blackbox pentesting lab 1 of pts in 3 hrs.
I will be attempting the two left tomorrow and will go over the last segment of PTS in the next few days.
Can I think of attempting eJPT in the next 7 days?

[ancient prairie]

If you can clear the blackboxes without much difficulty then you are good to proceed to the exam

[peak steeple]

Where are these blackboxes please ?

[ancient prairie]

they are labs in PTS which you could access for free, I think the blackboxes (3) are attached to the last module in the course

[peak steeple]

Thank you

[serene umbra]

Gave +1 Rep to @ancient prairie

[quartz light]

Okay, thanks a lot.

[serene umbra]

Gave +1 Rep to @ancient prairie

[quartz light]

Also, is eJPT Big on privEsc?

Cuz there was none in the lab 1

[unreal arrow]

It's mainly pivoting

[solemn marsh]

This is what I have now for my resume

https://images.imdavidday.com/i/6hsvnUsVhQOqEjTD

[stoic cave]

Wait im confused, how did you get those two positions? I thought you had some freelance stuff? Not accusing you of lying but know you'll be asked technical questions regarding each position during interviews

[solemn marsh]

it's freelance self-employed positions

[stoic cave]

That you have a W2 for or have been paid enough to be taxed?

[solemn marsh]

I was recommended that by someone as advice, and well, I don't want to lie, but I figured I could put my experience as a "self-employed" thing and give myself a title to come off more professional

[stoic cave]

I'd still be cautious

[solemn marsh]

Yeah no, I completely agree because I mean, I didn't feel that great about it personally

Do you think I could keep the titles and change the section to look less deceptive?

I removed my music production experience/graphic design experience (also self-employed, so I mean, same situation it would have been)

and I mean, I've never actually had any commissions through my tech self-employed thing; it was just a recommendation by someone

idk, it's a little gray- I feel uncomfortable about it

Let me change it and send another version- I have an idea

[stoic cave]

Have you been paid for any of these freelance positions

[solemn marsh]

Nope - only music & graphics

[stoic cave]

Not like family giving you money for events or work

[solemn marsh]

https://images.imdavidday.com/i/Qq5RzYWcbPW9JQAq Do you think this is better?

[stoic cave]

If money has not exchanged hands for the work don't put it

[solemn marsh]

Because to make it clear, I completely agree and I want to be fully honest.

[stoic cave]

If i was an interviewer and found out about this current resume I wouldn't be happy and would drop you

[solemn marsh]

I applied with one job with the resume- if they ask, and if I get an interview somehow, I want to be absolutely clear with them that I do not intend to be dishonest

Yeah I completely understand- I shouldn't have taken the dude's advice so swiftly.

[stoic cave]

I don't care where you come from, everyone has to start somewhere, but if you lie... You're done

[solemn marsh]

Well I mean, that's just it- technically anyone could be self-employed, is it lying?

I don't feel good about it even still, just to be clear. I never intend to lie for personal gain.

So, is the way I have it now better?

Or is giving myself a title still a little extreme?

[stoic cave]

Self employed to me means they have an S-corp or an LLC

Not they did some work that one time, no offense

[solemn marsh]

Yeah I mean, I get what you mean- I'm planning on getting an LLC for my music work, but that's not in question here.

[stoic cave]

However, if you come in for say a helpdesk position with the music stuff on your resume im going to be interested

Some of the music equipment is highly technical and if you can show that you had some trouble with said equipment and fixed it, it shows me that you have the mental aptitude to work through problems

And produce solutions

[solemn marsh]

But yeah dude, I really appreciate you telling me how it is.. I once again, feel really bad about it. I don't want to be percieved by this employer the wrong way if I do get an interview, but I mean, I can only live and learn. I'll own up to my mistake- I shouldn't have listened to the person's advice; I justified it as "well, I could in theory do this work freelance.", and that wasn't right for me to do.

[solemn marsh]

I mean, I don't know- I feel like they won't really care

Some people associate music with rap and little skill

They don't associate it all with EQ, Compressors, FX modules, Mastering, and Mixing

That's the thing- everyone tells me something different

[stoic cave]

I really don't think so

Troubleshooting is troubleshooting

Music equipment is notoriously difficult

[solemn marsh]

I mean, it's not difficult for me, so I guess I don't see it that way

[stoic cave]

I talked about lifeguarding and teaching kids how to swim for probably half an hour on my Cyber Security Engineer interview

[solemn marsh]

Dude I really hope I don't get that job- I'm not a liar nor do I want to be ;/

I made a honest mistake.

[stoic cave]

And brought it in to how it helped me in other aspects of my life and on the job

[solemn marsh]

I mean, yeah, but that's the interview phase

Not the resume

once I get into the interview, I can mention music 100

100%

[stoic cave]

It was one of two jobs on my resume

[solemn marsh]

it's a card I can pull out and get impressions with

[stoic cave]

Entry doesn't care as long as you do not lie

[solemn marsh]

I got an idea

[stoic cave]

I submitted 100 resumes to get two interviews

And was hired by that second company

They didn't care about my other jobs, they just saw that I was absorbing information on the job and applying it

[solemn marsh]

https://images.imdavidday.com/i/lGBihhVbonELYKVE

I think this will work, right?

I don't see how this is unclear/gray anymore

Because, I'm not putting any title, business, etc.,

I've framed it completely honestly

and I feel a lot more comfortable with that

kk I have it all redone now

I owe you a thank you, Moose- I really didn't want to lie to begin with. I didn't even think it was a lie, but I thought it was very gray and not really the optimal thing to do. I totally understand what you're saying and I'm glad I changed it. I hope we're still on good terms.

Here's the new version

https://images.imdavidday.com/i/XXF7tV4pgg7w11ah

[dense nymph]

Anyone know if 501 study material will be useful when studying for Security+ 601?

[cunning spruce]

Somewhat but I would recommend looking at 601 material. The distribution of questions for each topic is shifted such that there is more focuss in areas that had less focus in 501

i.e cloud security focus

[dense nymph]

That's helpful. Thanks!

[serene umbra]

Gave +1 Rep to @cunning spruce

[cunning spruce]

np

You can actually go on Comptia's site for the break down

[dense nymph]

Yes I'm going to download the exam objectives shortly to see if they match up

[cunning spruce]

https://www.comptia.org/blog/comptia-security-501-vs-601

[dense nymph]

dude you're awesome

[cunning spruce]

No problem 🙂

We're both in it together for the 601

[dense nymph]

Maybe you can help me translate infosec language

I don't think I've ever seen so many adjectives and abbreviations in my life

[cunning spruce]

Yeah for real lol the jargon can be a bit tricky

Did you start studying got it recently?

[dense nymph]

What do you mean?

[cunning spruce]

Start studying for the 601* Sorry mixed up chat rooms there

[dense nymph]

I haven't started yet. Most likely going to start tonight. I just finished up my Net+ and passed recently and was going through THM and learning some Linux basics

Hoping to take it mid to late August

[cunning spruce]

Congrats 🙂

[left warren]

hey everyone, new here

hope i can get some tips here regarding on enhancing skills in security infra

[fossil helm]

My question is more like I BEG YOU to tell me your day to day general job tasks
I would REALLY appreciate if I can get some insight this will help me A LOT please

[quick forum]

You'll want to ask the question in context

[fossil helm]

Ok so I am learning some linux in general for the past 2 months been working with Kali and Parrot, I have been learning networking in general also have some previous newbie experience setting up access points and routers etc (no subnetting or harder stuff)

I find everything very interesting but what really motivates me is that I can potentially have a job one day since I found out that Pen testers use Kali etc to do ethical hacking for companies etc.

So in that context my question is like what do this Pen Testers really do every day because I have no clue, do they test denial of service or test the networks with some attacks or like please just tell me some things like list of some tasks example doing this doing that etc PLEASE

@quick forum

[quick forum]

90% of what pentesters do will be writing reports.

[fossil helm]

umm ok summary of work done is good but what is the other 10% please

But thanks this explains it because 8 hours a day job how much hacking can there be 😄 so if 90% is writing the report that really helps me

explaining myself this job 😄

Please just give me some day to day real tasks, I mean I know that that can mean anything for any company and any circumstance but anything you tell me means a lot to me

@quick forum

[flat sedge]

Pentester isn't normally a job title, @fossil helm . A typical penetration test engagement will have clearly defined bounds of what is under test, and may call out specific techniques, systems, and approaches as disallowed. It's very difficult to say what is day to day, as each engagement is a unique situation that may not have similar needs as other engagements.

[fossil helm]

Do you have any examples you could give me of any sort of engagements like what do they engage

[static tide]

you could be on a web pentest where they say “here’s a new web app we’re building, test it before we put it in prod pls thx”, and they just give you a domain

[peak steeple]

https://www.coresecurity.com/blog/day-life-pen-tester : You like this.

[fossil helm]

that's really cool, one day I will also like to test web apps after I learn Javascript

[flat sedge]

Scope of an engagement could be any part of any IT domain. A lot of it depends on allowable risk and business requirements.

[fossil helm]

Well how do people prepare for such job where ANYTHING and/or EVERYTHINg can be part that is required to be done today.

so you see why I am in like this state of unknown and confusion 😄

[fossil helm]

Reading it tnx 😄

[worn spire]

I feel like the pentesting life, time spent Reporting > Hacking

[flat sedge]

Be an expert. It's not an entry level job

[fossil helm]

Ohhh I see

[fossil helm]

im ded.

[flat sedge]

With few exceptions, a pentest job requires several years of experience and an understanding of potential consequences

Additionally, the value of a pentest is the report, not the hacking part. An engagement is successful if it clearly identifies the weak points in the security topology within the scoped work and opens the conversation to remediate those weak points.

[peak steeple]

Do pentesters start as SOC - or can we go in as a junior tester ? I cant find an answer onlie 😦

[flat sedge]

Finding a ton of vulnerabiltiies is great, but if those can't be communicated to the teams that manage those assets, it's a waste of time

[flat sedge]

Depends on experience and background.

[static tide]

either or brent :)

it will be easier coming from a soc just cause of that sec exp

[worn spire]

Honestly a lot of pentesters I talk to and myself included are from systems administration or developer backgrounds, mainly because the broad knowledge base systems administration gives you, and because programming is a way to have a good understanding of vulnerabilities in systems(not always though).

[flat sedge]

Not necessarily. SOC gives a good idea of what a landscape looks like, not necessarily how to take advantage of it. In all honesty, I think being a network engineer, sysadmin, or a low level programmer gives more insight into the aggressive security portions of IT.

[peak steeple]

@worn spire I'n sys admin soo we are in the same ball park - I just need your cyber skills 🙂

[worn spire]

@peak steeple At a certain skill level it is all about networking and selling your skillset

Some of it is even educating sometimes the people who are interviewing you, often an employer doesn't understand what their needs even are.

[limber narwhal]

I like both Programming and doing stuff server side and don't know where I should start in my carreer

[peak steeple]

@limber narwhal World is your oyster! You could go application security, Devops or just pick an area that atttracts your interest and work your skills there. Just my thoughts ...

[flat sedge]

For many people, the first job will do a lot to determine career trajectory. It's fine to take a job you know won't be permanent if it gets you closer to where you want to be

[worn spire]

The big thing to remember about cybersecurity is that it is on a foundation of a lot of IT knowledge. Often getting an entry level IT job will be the first route for many entering the field

While not impossible for your first job to be cybersecurity or have cybersecurity or IT security in the title, those jobs are far more rare.

[golden ore]

many teams are looking to automate the small stuff so you can now get a job that combines programming with day to day work as well, I rarely saw a job posting when I was looking that wasn't asking for some familiarity with a programming language

[fossil helm]

What about the role of Web App penetration testing, why isn't it called Website penetration testing

[golden ore]

not all webapps are websites

[fossil helm]

I am watching youtube explanation videos

but you could help a bit by explaining why

not all webapps are websites

[golden ore]

Web application is designed for interaction with end users. Website basically contains static content. The user of web application can read the content of web application and also manipulate the data. The user of website only can read the content of website but not manipulate

https://www.geeksforgeeks.org/difference-between-web-application-and-website/#:~:text=Web application is designed for,of website but not manipulate .

[fossil helm]

before web apps people went to WEBSITES and logged in/out entered stuff etc. That is manipulation and it is a website NOT a web app

so yeah i don't know where the line is drawn

some experts may know exactly what you mean but I don't

[peak steeple]

Try this site: I am a simple man and like pictures: https://www.browserlondon.com/blog/2020/06/08/web-site-vs-web-app-whats-the-difference-does-it-matter/

[plain crown]

Does anyone actually like writing penetration testing reports?

[quick forum]

I don't mind it

It's somewhat crucial though

[plain crown]

Any advice? Definitely the end product

But I always get writers block

[quick forum]

It's a technical document, I'd say there's not much creativity needed so no room for writers' block

You're mostly stating your findings and explaining why they matter iirc? It's late here

[plain crown]

Maybe I'm just not doing it right. I like writing the detailed sections, it's when I come up with a key findings summary, exec summary, business speak I start to drop ahaha

[quick forum]

Writing technical things in a sort of... High level way that can he understood, that's the skill

[undone shore]

Technical stuff just write yourself a database of pre-made responses for common vulns

If you come across something unusual, write something new and add it to the DB

Then you just need to copy/paste and tweak the response per client, rather than re-writing from scratch

[plain crown]

Sounds like the approach, I keep a Wiki for that

[meager hazel]

Think I get away easy since my reports are mostly read by developers or technical project managers. I found Google's Technical Writing course really helped writing for that audience

https://developers.google.com/tech-writing/overview

[plain crown]

thanks @meager hazel

[serene umbra]

Gave +1 Rep to @meager hazel

[warm hinge]

oh

[gusty trout]

Hi guys, just wanted to share that I landed a job as a security consultant. Thanks to the people that gives advice here. It was 2x interview. one for my background as systems engineer. next one is for my methodology(watch TCM video where he did a mock interview on a senior penetration tester it really helps me a lot) and lastly they have an assessement where I got 24 hours to hack into a web-server--> pivot into internal network--> Taking over a domain controller and then write a report.

[snow kraken]

awesome! sounds like a good lab

[peak steeple]

@gusty trout Congrats! Well done on landing the role. What THM videos did you watch and type of questions asked ?

[gusty trout]

This is the video guys

https://www.youtube.com/watch?v=IDpjaS6OYPU&t=1157s

[fossil helm]

What is your advice for me

Be me 30 and living in Croatia(Europe)
Sister + Cousins are long time US citizens live and work there and would/will hook me up with a remote job
the only thing they ask from me is to find a industry I can be good at so I can get paid $2k a month (thats enough for here locally)

so what should I focus on that is IT related since going into security seems to always be like client based jobs were you go in and out its not a steady month-to-month job

Like I have some experience with IT in general I need to get my shit together in 3-6 months and just tell my family what job to look for me

any advice welcome

[cold dawn]

why do you think security is not a steady job? it just depends on the company and position you apply for, if you go for a consultancy/freelance thing then yes it would be more risky and based on short-term assignments but if you get into an entry level position at a company that is hiring internally then I don't see why it would not be steady.

[fossil helm]

Well they tried to hook me and my hackerman friend with a cybersec job like pentesting etc and they were all part time or even a one-timers

So now yeah
I need to look into something that can be done remote and on monthly basis like maybe IT help desk or something
I was just asking for ideas about that
thanks though @cold dawn any help is appreciated

[serene umbra]

Gave +1 Rep to @cold dawn

[cold dawn]

why is remote a requirement? couldn't you try for an IT job in Croatia?

[static tide]

would u not need the company to sponsor a work visa too?

[fossil helm]

no because IT in croatia pays $1k I need double that

no need for work visa I will still live in Europe for several years

[static tide]

but you’ll be working for a us company

[fossil helm]

yep

[static tide]

oh you@dont need one then?

[fossil helm]

I have already worked for US companies before in Customer Support

[static tide]

oh nice

[fossil helm]

Yeah if you are a qualified worker you don't need any other document to work remotely for US company

[cold dawn]

it could be done through an EOR that is in your own country

[fossil helm]

I mean it may depend, in my case I didn't even sign contract

I worked Customer Support for 2 hotels in Miami and 2 hotels in NY

for 3 years...

pay was good but 60 calls a day was NUTS

I am just looking for a skill required job in IT that is remote and long-term really

I have no idea what those jobs are

[static tide]

security might be hard doe because lots of what i’ve seen (security) requires you to be a citizen (or at least eligible for security clearance of that country) because of some of the clients the company works with

[fossil helm]

because I will still need to train

yep that too

[cold dawn]

I'd say go trough https://www.indeed.com/jobs?q=cyber&explvl=entry_level&remotejob=032b3046-06a3-4876-8dfd-474eb5e7ed11&vjk=3c35beddf9fec31b

[fossil helm]

give me some advice what to learn like I am tempted to go and finish my FE web dev coruse

[cold dawn]

remote entry level jobs

[static tide]

i’m sure there’s some agencies that would help with this type of stuff?

[fossil helm]

I already did html css

[cold dawn]

well if you are going for cyber security you should be looking beyond the front-end and look into the serverside parts

start doing THM rooms 🙂

you will find out which parts you need to learn more about, and keep track of the new things you're learning as you go, then you can put that in your resume

being able to learn yourself new skills is essential if you want to do this without formal education

and there are plenty of resources around the internet to become an expert on anything

[fossil helm]

That is pretty cool my man but I was looking to already start working within 6 months and going into any cybesec job needs years of experience really 😄

Do you work in IT?

[cold dawn]

not really, if you can show you have skills you shouldn't need years of experience in the job you're applying for

Yes, I've been working in IT for about 15 years now

But working remote is.. meh. You really miss all of the interaction and experience you would get in a company, and you'll always be considered 'high-risk' for leaving.

[peak steeple]

https://www.cybersecurityexpo.co.uk/

[quasi stream]

The place is good if you're already in the industry

I've been as I was near graduating -- no one there was really interested until you've got experience

But not may be the same this year you never know

[peak steeple]

@quasi stream Thanks for letting me know! I just though it would a good networking opportunity and also find out about vacancies. Hopefully my THM and other certs will help 🙂 Otherwise it will just be a nice day out.

[serene umbra]

Gave +1 Rep to @quasi stream

[quasi stream]

Oh yeah definitely (:

no harm in trying!

Good luck with it

[flat sedge]

Many US companies have an employment requirement that you can prove you are allowed to work in the US. Some companies do have remote work available, but that is typically only allowed for certain regions. Your best bet to find an IT role is to work support desk for a service company, and use that as a transition. Security is very stable, but be clear about what you are looking for: governance is very different than SOC, which is very different than penetration testing. Sys admin entry level is very doable in less than a year, especially if you can get a couple entry level certs like Linux+ or RHCSA or windows engineering equivalent.

[solemn marsh]

I got an interview for a computer network technician job!

[north hill]

Is the new content Engineer job limited to UK?

[peak steeple]

What cyber skills does one need to be a Blue Power Ranger ???

[cold dawn]

The 'Cyber Defense' path on THM is a good indication of what skills are relevant

[fast adder]

In the cybersecurity world, is there any distinction between roles which are more "technician" level, as opposed to "engineer" level?

And, as someone new to this world, what's the best way to distinguish those two?

[cold dawn]

Hard to say, as titles aren't really the same across companies. A SOC Analyst in one company might just be clicking on alerts and following a playbook, where in another company they might be responsible for handling an incident from start to finish including remediation recommendations and changes to the SOC platform such as tuning and testing new solutions.

Cybersecurity is a pretty new field so people just make up new titles and positions all the time.

[fast adder]

Interesting, ok. I'm coming from the electrical engineering world, so it's much more established.

The engineer/tech difference is well defined, and even within engineering, there are people who kind of just turn the cranks each day, and there are those who are designing and leading projects.

[flat sedge]

EE also has a lot of professional organizations that standardize what an engineer does. PE is the qualification I think? No such organziation exists that I've encountered for IT

[fast adder]

Yeah - PE is more if you're working on construction or civil projects. Things where you need government signoff.

No one in consumer electroncs, for instance, has a PE.

But you're right, it's much more established. IEEE, for instance does a lot of that stuff.

[flat sedge]

A union would probably fit to define some standards across industry, but there has not been a lot of traction within the industry

[fast adder]

I'm looking into switching from EE to cyber, but I want to get on an "engineer" track within the cyber world.

I know I'll have to start at an entry-level, but I want to make sure I'm setting myself up for success and not stagnation

[cold dawn]

engineer in cyber usually means you build things, as opposed to analytical/research/operations roles

[fast adder]

So heavy emphasis on software development, I'd assume?

[flat sedge]

Not so much

Cyber/infosec engineers focus more on building the organization maturity, through tool training and ensuring policies and procedures are sufficient

once a certain amount of maturity has been reached, it can usually be maintained by the SOC

[tropic kite]

Heyho! Am I allowed to post a job opening here?

[cold dawn]

#jobs-board is made for that purpose, I believe

[golden ore]

you have to have special access to post there

[tropic kite]

Oh thanks

I'll ask a mod

[golden ore]

I think muiri handles it

but you can check with any mod as well

[tropic kite]

hm but I can't provide a link and stuff. It's more of an informal (but legit) offering.

Anyway, if there are any German speaking folks here who are looking for an entry position in Cybersecurity, please write me a PM. First experience in Azure and M365 is required. Maybe you're working in DevSecOps and wanna go full Security/Pentest? Hit me up! Certifications, trust-based working hours and (if you want) full remote work. Pay is also good. Hope that's okay to post 🙂

I'm basically just a Cybersecurity engineer who doesn't want his boss to grab my colleague from the regular job market. If you hang around here, you should be a good fit.

[thorny cloak]

@tropic kite ive seen many entry level cyber jobs offering full remote in germany. would this be full 100% german projects or they want you to understand it? im thinking about adding german into my study schedule

[tropic kite]

It's for a Germany based company and we have (mostly) German speaking customers. Actually when I was looking for entry level security jobs in remote I could barely find any. Especially the remote part is quite difficult (if you also want to travel and work from abroad).

[peak steeple]

Check this out: Another UK cyber event https://www.cyberpathways.co.uk/

[dense stump]

i really want to learn cyber security

and waht does it means\

does it means hacking someones pc or laptops???

[warm hinge]

I suggest you to read #start-here it will help you for sure. And no it's way more than that, especially in cyber security, it can be part of but it's unethical ( illegal ) which is forbidden here

[cold dawn]

you're confusing cyber crime with cyber security :)

unless you have permission from the owner of whatever you're hacking

[acoustic jewel]

How do you know you want to learn something if you don't know what it is? 🤔

[hoary ridge]

Question here, Do security analysts get payed more than pen testers or other way etc on average? or are they quite similar in salary?

[flat sedge]

Security analysts are usually full time employees; pen testers may be full time, but they are typically engaged on a per-contract basis

like most consultants

[hoary ridge]

[golden ore]

It will depend on the company and how they roles setup

[flat sedge]

it's pretty rare that a pentester is employed full time in a pentesting role; internal pentest is usually handled by a cyber or info sec engineer

[hoary ridge]

before starting out learning i was kinda considering pen tester without even having a look at security analyst but they both are good

like good options

[flat sedge]

security analyst roles have driven me crazy - there are only so many hours i can stare at a log aggregate console without getting distracted by something shiny

[golden ore]

unless you work for a pentest company, most company's will give their internal pentesters a red team type role or vuln management as well

[hoary ridge]

im not sure what to pick

il learn both anyway

[golden ore]

analyst are blue teamers and pen testers are red teamers, both have skills that can be used for the others job as well

[hoary ridge]

Yea

idk what team to pick

il go red team

[golden ore]

I work as an analyst currently, but use the skills I have learned on THM to find the baddies faster

there are often more blue team roles that exist, analyst is a good starting point

[hoary ridge]

Okay thank you

[cold dawn]

I can only speak for what I've seen here in NL, but I would say when comparing fulltime positions, a starting pentester will usually have a higher compensation than a starting security analyst. But then again I would assume that the pentester has some experience in security to start with.

[thorny cloak]

I hardly see any movement in the spanish market. Our over the river neighbours in the UK got a lot of movement

[warm hinge]

Has anyone heard anything about working for Synack red team? All I can see is their FAQ. Not a lot of people talk about the work experience

[undone shore]

@thick sable you're up

[thick sable]

I don’t think am allowed to say much but it’s a good way to earn money if you can write good reports and a good pentester

It’s not a full time job, you get paid for your findings

Way better than bug bounty

@warm hinge if u get other questions let me know

[warm hinge]

Is it so competitive you never get paid, or is it reasonable

[thick sable]

I just joined and didn’t hunt yet so no clue

[warm hinge]

Oh ok

How difficult was it to get accepted?

[thick sable]

It’s a very long process

If ur good you won’t have issues

[warm hinge]

How is “good” defined

If I do some boxes on thm with decent writeups, does that count as good?

[thick sable]

Not sure tbh

It’s pretty challenging

[warm hinge]

Alright thanks for the help

[solid crown]

For sure. But what tools do you mostly use at work?

[safe root]

Burp anyway

[muted tundra]

i want learn cybersecurity

but can't afford a paid course

is there any free course?

plz help me

[warm hinge]

check #resources and its pinned messages

[ruby remnant]

UK Uni Students

What do you look for when choosing whether to sign your team up for a company's CTF?
How do you try to find CTFs to enter?
What would draw you to enter? Prize money? Guaranteed interview?

Please @ me in responses 😄

[quaint flare]

do you guys think it's worth it/beneficial to put a section like this on your resume for a cybersecurity analyst position?

[meager coral]

I would have a section of keywords/skills because software often makes the first cut of submitted resumes based on keywords 🙂

[quaint flare]

what kinds of keywordS?

[meager coral]

Words that appear in the job listing, and things like you listed - tools or technologies that are relevant to the position

But obviously don't list things you have no idea about... I like to ask folks about the more obscure tools they list to see if they just added random stuff. 🙂

[quaint flare]

yea of course

like i have used all of those tools in thm

i'm just not sure if they're relevant for a cybersecurity analyst position thouh

[meager coral]

I structure mine more like a paragraph, with the skills/tools separated with commas. It's more dense that way. Keep your resume succinct. I usually don't look past the second page if I have a stack to go through...

Until I filter it down to just a few

[cold dawn]

you can name some example situations/projects even if its just personal experience, if it shows you have some skills the reader is looking for

[grand zenith]

Hey everyone, I’m currently getting my Bachelor in Cyber security. I wanna work in a project to put in my resume but I’m blank rn. Any ideas of projects I can do?

[rugged sable]

Hey! If you're stuck making projects, here's some links to stuff:

https://skerritt.blog/make-popular-open-source-projects/ A blog post I wrote on this
https://www.youtube.com/watch?v=WhPq-CPiLBE A youtube video on the same subject (kinda shorter, not so much about ideas. Read the blog post)

You can always contribute to open source too instead 😄

[grand zenith]

Thank you so much!

[craggy latch]

It's best tailor your resume to each job you apply to. With that in mind, try to include keywords/skills/software that you have/are familiar with that are listed in the job post.

[scenic vault]

What about past work experiencing if your applying for your first IT/Cyber job?

Experience*

[stoic cave]

Just put Jobs you've had W-2s or Jobs you've had to pay taxes. If it's an entry opportunity there should be an understanding that you are trying to break in to the space

One thing that is an absolute no no is lying

It doesn't matter if the work experience you do have is in a completely different industry. It can give you talking points and also relating the past work to the work you're applying for will sound good in interviews

[flat sedge]

If you can relate that previous experience to either a technical or soft skill relevant to the position you are applying for, and also lack a background that maps to that position, include it.

[solemn marsh]

so, I landed an interview- should I print out my resume that landed me the interview and the updated version of it, as I've revised it? Or, should I just print out the one that they saw and go with that?
And, should I print out my letter of recommendation from one of my teachers?
to take along

[languid hearth]

I brought my resume in with me to my interviews, it gave everyone something to look over as I was talking. It happened to be a panel interview too. I don't think everyone there had seen my resume, so it might have helped me. Just remember that if you do that -- everything on there is fair game to be asked about. So be careful.

Personally, If I was hiring I'd like to see an updated copy (as long as there was meaningful things to add to it. It shows growth.

[thick sable]

@languid hearth hmmmm

[languid hearth]

y u ping me

[thick sable]

Why not

[languid hearth]

y

I didn't do nothin'

[thick sable]

Sure

@languid hearth sureeee

[languid hearth]

sureeeeeee

[spice storm]

https://tenor.com/LGDd.gif

[solemn marsh]

But like, should I bring 2 resume copies?

because they're within a week old of eachother, but I just changed some formatting to be better / removed/added information that I thought would strengthen it

like, I went hard on my resume for the past 2-3 weeks, about 3 hours a day

[mossy yacht]

You should bring a copy to everyone who is inviewing.

[languid hearth]

unless it's any major qualifications updates, I don't know that I would bother bringing 2 revisions.

I'd just say bring your latest with you. Bring extras too. I brought 10~ and ended up needing all 10

[solemn marsh]

they're 2 different resumes- one is updated, one is a week old; do I bring both versions?

[mossy yacht]

At the end write a thank you letter . But at the very end of the meeting

Bring the updated one

[solemn marsh]

So, if I landed the interview with a different, version, I still bring the newest version?

[mossy yacht]

Yes

[languid hearth]

as long as you're still you, shouldn't be any issue lel

[mossy yacht]

Just incase they ask

[solemn marsh]

it's not necessarily new information - I just changed a bit of things like removing my high school

and adding different bullets

[languid hearth]

do you at least have that you have a HS Diploma?

[mossy yacht]

Change your info to be more recent

[languid hearth]

because that is important

[mossy yacht]

Yep

[solemn marsh]

on my resume that was taken in for an interview, it has my HS diploma

on my current version, it has my associates degree

[mossy yacht]

Nice

[solemn marsh]

no HS diploma

because it's sort of a given

[mossy yacht]

Ya

[solemn marsh]

and it took up space

[mossy yacht]

And I'll be old info

[solemn marsh]

let me find a quick example

[mossy yacht]

They really care about the most recent timeline

[solemn marsh]

this is my first interview so I want to do it as good as I can 😛

[mossy yacht]

Oh

[solemn marsh]

and I really appreciate your feedback ;D

[languid hearth]

btw in the initial interview, if they ever tell you about something, do it. For example, if someone comes into the SOC for an interview and they've never had any hands on experience with Splunk, we tell them to check out Fund 1 - a free splunk course (by splunk). We had a bunch of people ignore that. One person didn't. That one person ended up getting the job

[mossy yacht]

I also recommend reading the a plus book. It has great info on interviews

[solemn marsh]

this is my most recent resume

with maybe some minor revisions I made

and then the one I got the interview with is this:

[mossy yacht]

Show the more recent dates one

[solemn marsh]

they're not too much different, but they're definitely different

[mossy yacht]

Not the old one

[solemn marsh]

even though the old one got me the interview?

I agree tbh

[languid hearth]

also, ask for a couple of things:

• Book recommendations
• If there's anything they thought you could do better at. Explain that you're always looking to improve. It'll basically force them to dump their notes on you.

[solemn marsh]

book recommendations?

so you don't recommend bringing both versions in?

I mean, most likely they'll have the old copy on hand

because it was thru indeed

so they could always print the older one out if they needed it I guess

[mossy yacht]

Check out #bookclub

[solemn marsh]

you mean ask the employer for book recommendations?

[languid hearth]

Yep. If you're in the field and you're not reading a book that has something to do with your job, something's wrong with you.

My manager is having us read Intrusion Detection Honeypots: Detection through Deception. There's a specific reason for that. He likes something about it. Show that you care enough to care about what they might be doing.

[solemn marsh]

Oh- I purchased a lot of books a few weeks ago

I'm reading Kevin Mitnick, Edward Snowden, and Eric Cole atm

[languid hearth]

especially if the next time you meet you can have a discussion about it, it'll make you far more memorable

[mossy yacht]

Day also do some research on the company. The more you know . The better

[solemn marsh]

They're a local business and my cousin's dad knows the owner

I had a brief convo with my cousin's dad to gauge the owner a bit better

so I'm feeling more confident about thigns

so this is my most up-to-date resume, with the main change being the dates aligned differently

I'll print 3 copies of this out

[mossy yacht]

Also make sure that first handshake is a good one

Just be your self. Smile

[languid hearth]

don't forget to respect social distancing if they're still doing that

[mossy yacht]

Ya

Bring that mask

[solemn marsh]

https://images.imdavidday.com/i/HhsVUjcGhlGYY0hX

[mossy yacht]

Also try know what the dress code is

[solemn marsh]

Oh yeah- I'm definitely going to make sure I land that first handshake

[solemn marsh]

I asked my cousin's dad about this; it's semi-business casual

[mossy yacht]

You don't want to go their and not knowing what to wear

[solemn marsh]

I'm going to wear a nice dress shirt and dress pants

[mossy yacht]

Yep

[solemn marsh]

nothing like a suit and tie; they wear polos with their logo on them

[mossy yacht]

Well day

[solemn marsh]

Yeah- I'm not vaccinated yet, so I will definitely be cautious of this

[mossy yacht]

I wish you luck

Stay positive

[solemn marsh]

thank you man- it means a lot; my main goal is to make sure I'm not over-confident/arrogant

[serene umbra]

Gave +1 Rep to @mossy yacht

[solemn marsh]

that will 100% ruin my chances

[mossy yacht]

And you will get this job

I know you can

[solemn marsh]

I'd like to say I'm a good communicator, and I have a really strong willingness to grow. I admit there are always people I can learn from, and I don't know everything

so, I think with that mentality, it will protect me from coming off as arrogant

[mossy yacht]

Oh I forgot

Have good eye contact

[solemn marsh]

Oh yeah definitely

but yeah- print off the most recent resume?

a couple copies?

it's not a huge office but I'll be prepared and print about 5-6 just for safety

[mossy yacht]

👍

[solemn marsh]

because I don't anticipate more than just the owner and I in a room, but I could be totally unaware of how it will go

so the more the better

[mossy yacht]

Ya

[solemn marsh]

and I should bring it in a nice folder?

[mossy yacht]

Yes

[solemn marsh]

in addition to a couple copies of my recommendation letter?

I was going for two, but only one of my teachers said they would have it done by tomorrow afternoon

[mossy yacht]

That should be good

[solemn marsh]

I mean- I have no work experience by another employer, other than some stuff I've done on the side

so I'm pretty confident about this, given the fact they're calling me in with that in mind

[mossy yacht]

Do you have some skills

Any certs

[solemn marsh]

yeah- in my resume there's skills/certs listed

[mossy yacht]

Nice

[solemn marsh]

Customer service skills as well

[mossy yacht]

Oh wow

[solemn marsh]

I've been producing music for 6 years and I've been doing graphic design commissions as well for around 4-5 years

so I've built up some experience by communicating with my own customers doing free-lance.

It's not enough revenue for me to consider it a business perse, but it really gave me some foundational knowledge of the best methods for selling my work, to ensure that customers are satisfied and continue to purchase my work in the future.

[mossy yacht]

You got this

[solemn marsh]

The music production is definitely an interesting element that helps me stand out

[mossy yacht]

You'll be 🙂

Well nice talking to you

[solemn marsh]

And I volunteer as a videographer/video editor/audio engineer for my local church

[mossy yacht]

Nice

[solemn marsh]

recently because of COVID, we had to move our services to online

But yeah dude- it's a pleasure connecting; we'll be in touch

[mossy yacht]

Yep

I'll be on tomorrow

[solemn marsh]

heck yeah

[fossil helm]

i talked to this guy only 22 they took him with no ZERO knowledge or experience into the SOC to make coffee and trained him
now he makes 120k year

NO certifications or degree nothing

it show how the right contact can make you an expert LOL

[paper grove]

@fossil helm that's awesome

@solemn marsh Best of luck! And yeah, it's always a good idea to have some extra copies of resume or cover letter or letter of recommendation. Might not always need it, but better to have it just in case.

[cold dawn]

yes without a degree all it takes is one employer that has some faith in your motivation and ability to learn, if you get that then you can get far 🙂

[solemn marsh]

Yeah definitely will bring an older version just for safety

3 copies of older resume version with the formatting that landing me the interview, 5 copies of the up-to-date resume that I made changes to with formatting mainly, and then 3-5 recommendation copies, since I only have 1 recommendation letter in time for this interview

all compiled inside a nice folder

dressed up presentable for the occasion, but not too formal , because understanding the business is going to be different than the typical dressy dressy suit and tie

[paper grove]

You going to a career fair or one company specifically?

[solemn marsh]

it's a local business

[paper grove]

Ok. I was figuring just 1-2 extra of each. I don't think it's necessary for 3-5. But honestly do what makes you feel comfortable. I think feeling relaxed and focused is good for an interview

[solemn marsh]

Yeah I mean, 3-5 is definitely probably overkill

but I mean, let's say I pull 2 papers out, and the business owner interviewing me spills his coffee

those other 3 will come in handy

Lmao

Idk- I figured I'd just assume worst-case scenario; 5 won't hurt anybody

[paper grove]

True enough lol

[solemn marsh]

But yeah, he won't probably even know I had 5

I'll just pull it out of my folder

it'll be like a magic trick

some slight of hand

pulls out one resume, spills coffee

oh psh, no worries my magic folder has 500 more where that came from

😂

(4 but he doesn't need to know that part)

[paper grove]

That's also very true.
Lol then he can be like "got damn, we need to hire this wizard. He keeps pulling resumes out of his folder"

[solemn marsh]

damn yeah this dude's too good for us

they already read a cover letter- no point in copying that either yeah?

gosh that magic trick would be so sick

[paper grove]

Well, I read most of the conversation prior but not all. When you went about this setup for interview, did you officially apply or just word of mouth?

[solemn marsh]

pen and teller setup right there

[paper grove]

Lol

[solemn marsh]

I used indeed to "officially" apply

submit a cover letter, resume, and all

so they have a resume/cover letter on file

[paper grove]

Ok. So if they've already had a possibility to read all, and you make copies just in case, might as well make copies of everything just in case

[solemn marsh]

My heart is telling me, bring old resume just in case they need quick copies of it, bring new resume, with copies

and bring cover letter with copies, and then recommendation letter with copies?

Might as well lmao

[paper grove]

Yeah

[solemn marsh]

it'll help me look prepared too 😂

[paper grove]

What's the title of the role?

[solemn marsh]

I mean, I might not even use the extra copies but it will show a level of desire to be professional

Computer Network Technician

[paper grove]

Nice. Have you prepared for some possible questions?

[solemn marsh]

Yeah- I've practiced about 3-5 days this week verbally for a few hours, just recording myself, listening back, writing down basic answers, just trying to get the flow of communication as it's been a while because of COVID

I'd say I'm pretty good at communicating with people, but being out of the loop for a while, it definitely helped to have a refresher

at least for confidence sake

[paper grove]

Ok. Have you looked up some possible technical questions for the role? Just in case

[solemn marsh]

Yeah- I went through a couple of possible technical related questions; I'm definitely going to try my best with those questions, and admit that I have room to grow, if I don't know the answer,

Like, I'll truthfully admit that

I studied all the network toplogies

bus, mesh, star, wireless mesh, wired mesh, etc.,

I also know the osi model front to back

like the back of my hand

[paper grove]

That's usually best. It's ok to admit you don't know done topics if it comes to it. But try to give something for an answer.

[solemn marsh]

physical, data link, network, transport, session, presentation, application

all off the dome

[solemn marsh]

Oh yeah definitely- they want at least 1 year experience with windows & AD

and so, I have around 10 years of windows experience, growing up on the OS

[paper grove]

I had 2 interviews that asked detailed questions about certificates. It's not my strong point. I admitted I didn't know the one detailed question but then gave as much info on certificates that I do know

[solemn marsh]

and then I put 0 for AD, because I only skimmed the surface, but I have an openness to learn it; I'll definitely make sure to mention that.

[solemn marsh]

Ah dang

Yeah- I also mentioned that I'm studying for the Security+ in my cover letter

because I have MTA Security Fundamentals + Fortinet NSE 1

[paper grove]

Yup, sounds good so far

[solemn marsh]

They wanted some A+ stuff, but I mean, I can get that later; I studied some material in regards to A+ but I didn't certify at all

if they absolutely want A+ cert, it's something that can be obtained

perhaps they'll even pay for it

I bought the Sec+ voucher out of pocket

in the cover letter I mentioned the exam date as well

[paper grove]

A+ won't cover too much of AD anyway, so no worries. I have A+ already and SEC+.

[solemn marsh]

ooo ncie

nice

Yeah, I mean, admittedly, getting the hands-on with opening a computer and switching out components will go further than watching mike meyers do it all

so like, landing the job will ultimately help me learn 10x faster most likely

[paper grove]

For network technician I'm surprised they wouldn't prefer net+. But SEC+ will still be good though for sure

[solemn marsh]

and man, this is the hardest part for me

I have no experience in the workforce yet, other than doing some commissions for graphic design and music production- so I have a bit of customer service experience

but, I've not been employed other than doing my own stuff;

[paper grove]

Yes. I love Mike Meyers for the ground level CompTIA certs. I watched him too

[solemn marsh]

I don't have a business license yet either- I started treating it more seriously last year and this year with sales, so I'm not too late to get a license or anything

But I'm going to make a goal to get an LLC for my music production by the end of the year

Just to protect it and legalize it a bit more- I'll feel more confident putting it down on my resume as experience

(I shouldn't need too though if I land this job because I'll have valid IT experience)

I'm probably arguably at the hardest part of my career,

getting my foot in the door of IT

once I land an IT position, I feel like I'll have lots of doors open in the future

[solemn marsh]

yeahhh - I like him, but I feel like he rambles quite a bit about things and it catches me off guard from what's important and what's not; some people learn really well from him though

[paper grove]

Usually works that way, yeah. I hope this role works for you for sure. But if not, keep applying to similar roles or help desk to keep grinding for that first role

[solemn marsh]

yeah bro - I'm definitely open to anything; this was something I saw locally, and I was like, wll, it's not help desk, but it will give me lots of great experience

in some way, might be closer to being more security focused than help desk

[paper grove]

Yeah, sounds it

[solemn marsh]

because I mean, in the job description there was mention of some security/privacy

and, overall, I would want to make the pivot from this position to a security focused position

well- maybe not that big of a jump

BUT, anything that will get me to a SOC

I see it like Computer Network Technician -> maybe a higher level of some varying form (sysadmin?) -> Security Analyst -> ?? -> ?? -> Pentester

[paper grove]

Same here man. Just keep plugging away at security training like THM and other platforms and then it won't be considered a "big" jump

[solemn marsh]

I mean, that's a rough idea of how I'd like to go

[solemn marsh]

Yeah dude- I really want to focus tryhackme more once I get my sec+ out of the way

it's sort of ironic, but I don't know how I'll balance school with this job

it seems like this job will be more worthwhile than my associates degree in some cases

like, getting paid to learn

I mean, I'm getting my associates for free, but like

I'm still going to do my best in both

if I need to switch my degree to part-time I will as well; I think I'll still maintain my scholarship

[flat sedge]

In the long run, a degree is more valuable than a cert. Because the background and soft skills you learn getting the degree are more transferable. The limited knowledge and practical depth from a cert doesn't really transfer.

[solemn marsh]

Well yeah, I mean, I see that- I'm saying though in regards to this job being hands-on experience and a foot in the door of IT, versus the degree being general studies, I find more transfer in learning on the job versus learning general things for my associates degree

more than a cert? definitely- I don't disagree with you at all

[flat sedge]

Don't undervalue the general studies - they may not be technical, but they WILL provide proven value. Possibly more so than your actual major area of study.

The most under-rated skill across business is documentation - learning how to write a good technical report has more in common with your rhetoric and writing classwork than any amount of system administration or programming or network engineering.

[solemn marsh]

Oh yeah- I mean, it's all valuable; you raise excellent points. I'll keep the degree in high regard, especially for soft-skills

And yeah, documentation is crucial. I would say I do pretty good in all my writing classes, which is a huge plus.

[flat sedge]

Especially if you stick with security instead of going for an engineering role. Security is a business function, not a technical function; so the reports that get generated are the most valuable part of the entire security organization.

[solemn marsh]

oh yeah definitely

[quaint flare]

anyone have any suggestions or see any glaring issues in my resume?

[flat sedge]

You haven't graduated yet, change that date to expected

put ECs below experience

Your objective statement doesn't look directly relatable to what you are applying for

your objective should be relatable to the job, not what you want to do with your life

[quaint flare]

so im just sending this resume to talent forms for now

should i put cyber security analyst position regardless?

[flat sedge]

what?

[quaint flare]

im not using this resume to directly apply for any specific position

[flat sedge]

Your resume is in english, i would expect that you are fluent. You don't need to add that.

[quick forum]

Although I imagine that's different if you're in a country that isn't US/UK?

[flat sedge]

Why is a location attached to THM?

[quaint flare]

oh true lol

[quick forum]

Also THM is def not based in Charlotte NC

[flat sedge]

Employers will also not care how often your cybersec club meets. Common club activities and events are more relevant.

Youth Conservation Camp: Great, what were your duties? I don't see anything there about why this is relevant

[quaint flare]

just leadership experience

[flat sedge]

I would ditch the course projects section entirely. If you have relevant coursework, that's different

[quaint flare]

communication skills

[flat sedge]

That's a step in the right direction. What kinds of activities did you lead? What communication skills did you learn?

[quaint flare]

maybe i could combine the 2?

[flat sedge]

If you can't list anything, don't list anything.

If you want to include a course project list the skills and knowledge gained. "Primary architect of a RDB using MySQL/MSSQL/PostgreSQL for [use case], implementing 1NF normalization for [industry] - limited details available upon request" would be acceptable for a database project. Just saying you did a project doesn't add anything.

[quaint flare]

i would like to include the html website bc i did a lot more direct work on that one. any suggestions of how to include that one?

[flat sedge]

Is it straight HTML or did you use a dynamic website?

[quaint flare]

hmm

so this one was straight html but i did do another dynamic one with html and javascript from a database with mongoDB

but i dont have access to it really anymore. should i include that one instead even though i dont have access? @flat sedge

[flat sedge]

HTML by itself is pretty useless. I would not list it at all.

If you used a dynamic page system, like JSP PHP Django, et al, that would be good t o list

[quaint flare]

if i have relevant courses that im taking next semester (pen testing course, cyber defense, etc) but i havent taken them yet, could i list them?

[flat sedge]

Everything on the resume you should have an expectation that you WILL be asked about it

if you don't have anything to say other than 'i'm interested', i would recommend that it not be listed

[paper grove]

You could add those to your LinkedIn page if you wanted to. Treat that more as a fuller explanation of you for people who are interested enough to click on for more details. Just be sure to update it after you complete them

[quaint flare]

do you think it's worth it to have a section like this at all?

[paper grove]

I agree with @flat sedge , probably not on the resume, but sure for LinkedIn.

[quaint flare]

okay thank you 👍

[flat sedge]

If you are going to have relevant coursework, be sure to include 1 sentence of what was covered. Different schools cover roughly the same topic, but with much different emphasis or with different toolchains. Sure you learned relational databases, do you know relational algebra? Which RDB engine did you use?

Those details are one of the things technical hiring managers will use to filter resumes into the round file vs the good pile.

I, for one, definitely prefer to see 'relational algebra' as an understood topic over a specific variant of SQL. Knowing relational algebra means that I can trust they have studied a methodology of query composition instead of just assembling SQL keywords until they return a view that looks 'reasonable'.

[quaint flare]

do you think adding a section for cyber related tools like nmap, splunk, metasploit etc would be good?

[flat sedge]

For a ubiquitious tool? not so much. Splunk yes, msf yes, nmap not unless you can script a new module

[warm hinge]

hello

is it possible to install kali on apple M1 without parallels?

[cold dawn]

endless lists of tools don't really help anybody, write your CV to match up with whatever you're applying for, explain how you used the tool(s) to achieve some specific goals, make sure you have some story to tell about them; what do you like about it, what annoys you, etc.

[molten juniper]

which is better for cyber security?

[flat sedge]

Yes

[cobalt escarp]

Correct me if I'm wrong but I think it would depend on the area of Cyber Security?
Computer System and Network sticks out to me but is there a way to see the course contents?

[flat sedge]

All of those programs have applicability

Mostly technical, but even the CIS emphasis can come at it from the (arguably more important) business side

[molten juniper]

https://www.um.edu.my/computer-science-and-information-technology here

click at each one to see the courses

[languid hearth]

yeah, honestly it's heads or tails.

I'd pick 1, but it all depends on what you want to do.

I'd do any of them void the last one

[feral crag]

hi guys, I start my Career as a QA Engineer and now I would like to involve more for security domain

my question is that which path I should start first offensive or defensive ?

any advise guys ?

[native elm]

@feral crag depends on what you want to end up doing, amigo. Good thing is to look into the available jobs in your area in Security and see what interests you, then go from there. Anyway, finishing the paths is great but there is no rush to do so. I move between both paths quite often.

If anyone is looking for a mentor to assist in getting hired in Security (blue team) feel free to DM

[feral crag]

thanks Fluctuate

[serene umbra]

Gave +1 Rep to @native elm

[peak steeple]

In Support desk we need hit a certain ticket closure rate to show we are doing our jobs, what is the equivalent as a pentester?

[meager hazel]

Depends on the company but for mine it would be engagements completed, which isn’t great since we don’t have total control over that

[peak steeple]

Please can you elaborate for me? Cheers.

[meager hazel]

I’m an internal pentester so my main KPI is how many engagements, both pentests and retests, I can complete in a year for maximum coverage of our stuff. I don’t have control over how many get assigned to me, but I can control the engagements to make sure I complete them on-time, or sooner with smaller ones so I can take on more if I have more in the backlog

Pretty sure this would be different in a pentest services company

[peak steeple]

Thank you! This is a side not oftern spoken and very informative.

[serene umbra]

Gave +1 Rep to @meager hazel

[cold dawn]

Looks like they have a lot of overlap either way. I guess you can specialize into something security-related?

[crisp zenith]

Hey everyone. What would be the best entry level Cybersecurity cert? I have my sec+

[cold dawn]

what do you want to achieve with the cert?

[peak steeple]

@crisp zenith Take your pick: Pentest+, eJPT, eCPPT and other CySec CompTIA certs are ones I see requested most.

[peak steeple]

Great question! I alway assume everone wants to pentest *** hangs head in shame *** Answer this and we can best guide you 🙂

[crisp zenith]

I was looking to join the Air Force after my degree is done and they have a Cybersecurity path. I was interested in that and they require a good defensive background.

[flat sedge]

So you are primarily looking at defensive roles? Which domain(s) do you have interest in?

[crisp zenith]

Yes and I would say network security.

[crisp zenith]

eJPT is a good one

[cold dawn]

I know the US DoD is the #1 client of SANS certificates, so I wouldn't invest too heavily in certs privately when joining there, they have good training there.

Also maybe get in touch with https://www.linkedin.com/in/chris-pizor-58b6b083/

[crisp zenith]

Yes you're right. Maybe I can do that after joining them.

[cold dawn]

he's a really nice dude, SANS trainer, cyber sec trainer and curriculum lead for US Airforce

[crisp zenith]

I will talk to him and thanks man.

[serene umbra]

Gave +1 Rep to @cold dawn

[flat sedge]

Network security is primarily firewall policy management - Cisco certs will help with that if your degree doesn't include equivalents. Next steps, I think, should be things like CISSP and CISA. Practical non-certification steps would be looking at NIST SP 800-153, NIST CF 1.1, and FISMA docs to understand the role network security plays in anorganization as a whole.

[crisp zenith]

Got you and see I'm totally a beginner so what would you recommend? Which will be good in the long run.

[flat sedge]

Network administration and engineering is a good place to start. Where is your current level of understanding? You said you are working towards a degree, when is your graduation and what is your major?

[crisp zenith]

I'm almost finishing up my associates in Information Technology. I have a good understanding of network, security, and cloud. As soon as I finish I will go for Air Force and they have a Cybersecurity path there which I'm interested in so I just wanted to get as much knowledge I could so that I could be more valuable when I get there.

[flat sedge]

When you say you have a good understanding of network and security, what has been the coursework you've taken?

[crisp zenith]

In network, like the basics also I'm working on the Net+ too. In security, I have the sec+ so you can say the basics too.

[peak steeple]

If looking at networking - you should be looking at CCNA level as Net+ while good is really basic. Dont need the cert - more the knowledge I would say.

[crisp zenith]

Yes ur right. Certs only to say that I know the stuff but of course knowledge is more important and I realize that

[flat sedge]

Certs, like a degree, are an easy way to show a baseline knowledge. They are recognized as something an employer can reasonably expect the holder to know right away, as opposed to having to spend time and money to develop the resource.

Having the knowledge is great, being able to show you have the knowledge is better from a hiring standpoint.

[peak steeple]

I recommend contacting the person Sling recommended as eh will give more accurate in this area and this might help also https://www.cybercom.mil/Employment-Opportunities/

[cold dawn]

there are a lot of free CCNA-level network courses out there, always good to learn more about

and make sure to grab one of those network emulators/simulators if you don't have a home lab with a rack of network devices

like https://www.gns3.com/

[crisp zenith]

Absolutely right

[crisp zenith]

Will do that and thanks

[serene umbra]

Gave +1 Rep to @peak steeple

[crisp zenith]

Thanks sling

[quaint flare]

when applying for a position do you guys recommend sending a cover letter?

[meager hazel]

Probably more useful if you're starting out in your career, need every opportunity to shine since you won't be able to flaunt much experience

[stoic cave]

Yes, I always do. A resume, in my opinion, should only be bullet points and short technical descriptions. The cover letter is where you can expand and paint yourself as a potential employee

[quaint flare]

this makes senses. thanks!

[serene umbra]

Gave +1 Rep to @stoic cave

[flat sedge]

depends on the application. Some companies require it, some do not.

[dire rain]

Hey guys, before I go bombarding you all with questions, is there a pin for recommended beginners qualifications for getting into CS?
I can get things funded through my work up to a certain point, and have a couple spaces available on my PDP.

[ancient prairie]

The best qualifications are the ones that employers are actually asking for, checking what current employees have too will give some insight -- I recently checked out a fairly popular infosec company near me, nearly all of their junior analysts (~20) had just an A+, which is kind of unusual but hey if they want an A+ and it gets you a job, you get the A+

heres a good methodology I've seen people have success with when it comes to job hunting, Jason Blanchard also does live streams and will literally job hunt for you
https://www.youtube.com/watch?v=Air1c697tjw

[stoic cave]

Shill 😛

In all seriousness his live streams helped me get my job so I will also shill for Jason

[ancient prairie]

literally anything related to job hunting I either repeat what he says verbatim or just refer people to him haha, I didn't know about him when I was job hunting unfortunately but I used very similar principles