#cyber-and-careers

1 messages · Page 89 of 1

dire rain
#

Interesting will totally give this a look tomorrow.

I assume some formal networking fundamental quals wouldn't go amiss either?

meager hazel
#

I found it funny that BHS had complaints from clients that they are potentially telling their employees how change jobs. "How dare you give our employees the information they need to make informed decisions and properly assess their value in the marketplace!"

zinc crown
#

.

solemn marsh
#

Network Operations Center, get experience -> pivot into SOC

paper grove
#

I appreciate the share. I'm also going to check this out. Haven't heard of him before and I only just recently heard of Black Hills Info Sec.

languid hearth
solemn marsh
golden ore
#

NOC, Sysadmin, IT helpdesk all give good background learning for the SOC, but depending on the SOC position you could go straight into the SOC

cold dawn
#

to be truly useful in a SOC you should have experience operating the kind of systems and applications you are monitoring, so that can include Linux/Windows/MacOS, also network devices or specific applications

#

if you have no idea what the 'normal' should be when looking at logging or alerts, then you have no tools to separate true positives from false positives

#

no need to know all the ins and outs, but at least some poweruser level knowledge of how networks and operating systems work from a logging and protocol perspective

peak steeple
sturdy locust
#

HI

#

Looking for someone with a premium subscrition

cold dawn
sturdy locust
#

thanks. I want to go premium on tryhackme, but i'm wondering if the offensive pentesting and cyber defense will allow me to get the necessary skills to be a great ethical hacker.

cold dawn
#

they will definitely be a good start, worth it imho

daring lodge
#

im not sure if its just me but whenever im looking for jobs in cyber security in the uk the description just looks overwhelming when trying to look for entry level

golden ore
#

A lot of positions look overwhelming as they are not always written by the people who do the day to day, try to see if you match some of the criteria and then apply

quartz light
#

I needed some advice regarding prep for oscp. If someone can assist, please dm me.
Thank you.

warm hinge
#

Hey everyone, is there anybody who can tell me about Cloud Security? I find it very interesting

rugged sable
#

I am in cloud if you have specific questions

unkempt nova
#

@quartz light do lots of practice.

cold dawn
warm hinge
trim hollow
serene umbraBOT
#

Gave +1 Rep to @cold dawn

meager hazel
warm hinge
rugged sable
warm hinge
#

Thanks a lot! One more question if you don't mind. I'm going to take the eJPT exam and It'll be the first cert to get. Do you think it'll get me a junior position or should I wait until I add eCPPTv2?

serene umbraBOT
#

Gave +1 Rep to @meager hazel

meager hazel
#

Could help with a junior position in other parts of cybersecurity though

warm hinge
meager hazel
flat sedge
#

An internship is extremely unlikely to be enough of a background to get a pentest role.

silver fjord
#

I have some questions regarding eJPT.

#

How helpful the certification is? Worthy for experience or the cert itself

flat sedge
#

The possibility of breaking things is much higher in a pentest than even normal change management stuff; a pentester needs to know more than just how to exploit systems, knowledge of when to exploit systems is at least as important.

silver fjord
#

Its been 2 months since I started into this field.

#

I got in the top 6% in the ranking. I know this ain't much but I don't get a lot of time to practice

meager hazel
silver fjord
#

That helps , I am thinking to take exam for this cert next week or so. Is 2 months of practice enough? I am about to complete the PenTestingStudent course .

#

After this I think of going for OSCP or CEH

flat sedge
#

CEH is useless unless you need a checkbox filled, or you work in India.

daring lodge
warm hinge
#

I would like to share my plan and I hope it'll help others. eJPT>eCPPT>get an internship/job after I get my master's degree in Software Engineering > PNPT (cybermentor) > OSCP > eCPTX > eWPT > eWPTX > OSWE. With time, practicing in THM and HTB and getting certs, my job position upgrades. What do you think guys?

silver fjord
silver fjord
#

Thank you

golden ore
#

ejpt is a good cert, it is not recognized by many companies yet, but having it on your resume/cv wont hurt and if you get to an interview with someone that knows about it will help you

golden ore
#

masters is not always needed, if you are already in the course then keep going

#

certs and degrees can help, experience needs to go with them though, not all companies will advance position with different certs though

#

I have honestly changed my cert and learning plan many times over the years

crisp zenith
languid hearth
#

still a bad cert tho

solemn marsh
#

CEH is a joke

#

Get Sec+ instead

rich blaze
#

oscp?

rugged sable
#

@rich blaze bias?

solemn marsh
#

Oscp is good but expensive and their lab infrastructure is not that good from what I've heard but its a solid cert

rich blaze
rich blaze
rugged sable
#

🙏

rich blaze
#

ur bias?

#

@rugged sable

warm hinge
serene umbraBOT
#

Gave +1 Rep to @golden ore

crisp zenith
serene umbraBOT
#

Gave +1 Rep to @languid hearth

languid hearth
# solemn marsh Oscp is good but expensive and their lab infrastructure is not that good from wh...

there's a reason why it's not very good.

Everyone looks at it with the wrong mindset (the certification too.)

The OSCP is a certification designed to be taken by people with little to no Pentesting experience. It's designed for System Administrators, Network Admins and those type of people. The crowd that has never exploited a device before.

If you have remotely any experience at all, the labs aren't going to be valuable for you.

solemn marsh
#

If there was an alternative certification that was cheaper and still challenging, heavily recognizable, it would probably lose traction

golden ore
#

CEH was a strong cert for a long time, there have been other certs that are comparable that have come out that many companies have gravitated to

languid hearth
#

tl:dr people over prepare for OSCP and or go in with the wrong experience level

peak steeple
#

Let us not forget other rising stars like eCPPT, IACRB Penetration Tester, From UK we have CREST, CSTM and QSTM.

#

There just seems to a fanboy mentality for everyone to get OSCP like its the only certification in town. It might have been back in the days fot just CEH vs OSCP but no more ...

golden ore
#

Certs have changed like technology, some get better, some fade away, and new ones are always popping up

flat sedge
#

I would argue that CEH has never been 'good', just that there was a lack of competition for a long time.

languid hearth
#

my major issue with els is that it's unproctored.

#

any certification that's unproctored has zero validity to me.

polar rock
#

I have a whole list of grievances of why I won’t be taking another els cert or course again

solemn marsh
solemn marsh
languid hearth
#

yes

solemn marsh
#

Not an entry level IT cert, but like

#

it sounds like a simple cert if you know what you're doing

#

well- I should clarify, I guess every cert is easy if you know what you're doing

#

But I mean, OSCP seems geared toward people who want to learn pentesting, hence the required PWK course

languid hearth
#

(I'm probably gonna catch some flack for this)

#

popping one off boxes isn't pentesting

#

my huge problem with the OSCP is systems irl are interconnected

#

Active Directory runs everything.

solemn marsh
#

I get what you're saying

#

being able to hop from machine to machine

#

that's pentesting yeah?

#

there's a phrase for it

#

but I can't think of it atm

quick forum
#

Pivoting

solemn marsh
#

ah yes

golden ore
#

both Wreath and Holo teach it

quaint flare
#

has anyone ever considered a cybersecurity position in a US embassy? i would love to work abroad

#

i know there's plenty of ways to work abroad but i thought that would be cool

snow kraken
quaint flare
boreal echo
#

My personal opinion though

stoic cave
#

Also there aren't straight Cyber roles from my understanding it's the all encompassing SIGINT/IT thing

undone shore
#

Aside from being, well, crap, CEH also has the disadvantage of being created by EC-Council, who have consistently proven themselves unworthy of patronage over the last few months.

#

If the uselessness of the cert wasn't enough of a reason not to get it, the attitude displayed by the company should be enough to boycott it.

quaint flare
stoic cave
#

No you'd be a government employee

#

I talked to them when I was first starting my job search

#

If i remember correctly it was 6-9 months on rotation before coming back to the US for 3-6 before going on another rotation

#

But then I believe there was another position that had full year rotations

quaint flare
#

6-9 months in the embassy?

#

what do you mean 2 tours then

stoic cave
#

Keep in mind this might not be the DSS

#

It definitely fell under the department of state though

stoic cave
#

When you're not on tour you're back CONUS

quaint flare
stoic cave
#

Yeah it seemed like interesting work just didn't entirely match up with my current level of experience

#

Are you cleared?

quaint flare
stoic cave
#

You'll need to be cleared for those roles

#

There probably is a pipe to get talent cleared for those roles though

quaint flare
#

my plans change everyday though so we'll see 😂

#

also i just came up with that but it sounds good to me lmao

stoic cave
#

You don't need masters off the bat

quaint flare
#

hmm

#

but it would speed things up right?

stoic cave
#

I went from bachelor to dod

#

No it might slow you down honestly

flat sedge
#

An early M.Sc in compsec can make it harder to land a job.

stoic cave
#

You'll have little to no real world experience

#

And your salary requirements will be too high

flat sedge
#

Because you price yourself out of the jobs you need to get the foundational experience

#

Additionally, it's to the benefit of the company to keep you in a role you are overqualified for - not saying all companies do that, but from a financial perspective, it's better to do the bare minimum to keep an employee than to have to hire a new, higher priced replacement

#

If you want to work in the SOC, work as an admin or dev or network engineer for 12-18 months

solemn marsh
flat sedge
#

Yes

distant island
#

I've also heard from someone that having too much education can make employers think you are purely academic.

solemn marsh
#

path would go IT Helpdesk -> Sysadmin -> Network Engineer -> Security Analyst?

flat sedge
quaint flare
distant island
#

juun, ah, I see

stoic cave
#

I also think limiting yourself to a "path" is detrimental

quaint flare
#

a friend from my school went straight to security analyst with a sec+

quaint flare
stoic cave
#

Blaze your own trail

flat sedge
#

A high school grad with certs or AS degree is likely to have immediate practical value - they can run the console for their product. They lack depth and breadth of understanding across the domains; this isn't an immediate problem.

solemn marsh
quaint flare
#

and also why im talking about it :P

flat sedge
#

In contrast, a 4 year (or higher) degree will have the breadth across more subjects but lack the immediate practical value. it takes 6 months to a year for the 4 year candidate to show the value their education provides, because they know the abstract and not the concrete.

stoic cave
#

The defense space is always hiring

quaint flare
#

yea i wanna get in and get experience immediately

solemn marsh
#

@stoic cave starting helpdesk is important though right? Like, you could go help desk -> SOC, vs straight into SOC with no experience

#

or helpdesk -> sysadmin -> soc even

flat sedge
#

the Bachelor's or Master's degree also has a higher starting salary; you have two entry level SOC positions. Do you hire the candiate with Linux+, Net+ and sec+ and no education, or the BS candidate with no practical experience but coursework in all those subjects for 30% more?

stoic cave
#

I didn't do helpdesk so 🤷‍♂️

#

I did a 3 month Enterprise IT internship and that was it

solemn marsh
#

dang

stoic cave
#

Now I'm a Cyber Security Engineer

flat sedge
#

The BS candidate will also move up higher faster, as once they hit the sweet spot, their education outpaces the immediate value of certs

stoic cave
#

So that's why I say paths can sometimes be detrimental

solemn marsh
#

I mean, you learn important things in help desk, so I've heard - what you learned during your internship, do you think that is similar?

#

you had some form of introduction to the environment

stoic cave
#

I also make sure to self teach a lot of material

flat sedge
#

If you have a BS, or are on track for a BS, skip the help desk.

solemn marsh
#

@flat sedge I'm finishing up my associates in general studies

flat sedge
#

Help desk doesn't need a degree, you will immediately price yourself out of that role.

stoic cave
#

Yeah i had BS, internship, and projects to show that I understand how things work

#

Homelabs are important

quaint flare
flat sedge
solemn marsh
#

@stoic cave Do you think you could send me a list of home labs I could do to prepare?

solemn marsh
flat sedge
#

General studies doesn't provide any concrete value that makes you a more attractive candidate

stoic cave
#

Not home labs, a Homelab

solemn marsh
#

I am going for general studies because it gives me more transferability- I have 2 semesters left.

quaint flare
#

is tryhackme a homelab? 😂

stoic cave
#

Yeah vms are a start

quaint flare
#

tryhackme is on my resume

flat sedge
solemn marsh
#

but 4 year degree is still in the air for me

stoic cave
#

I bought a Dell R710 and run all sorts of infrastructure and open source projects to tinker and build with

quaint flare
solemn marsh
#

I get my college for free so I figured it'd be better to get general studies and then transfer into a program in the future to save on money

flat sedge
# solemn marsh I was thinking Computer Science

You need to talk to an advisor at both your jr college and the university ASAP. Certain CS courses can be taken at the community college for guaranteed transfer; things like Java101 or equivalent. That'll save you a ton of money, and make progress towards both degrees.

solemn marsh
#

assuming the general classes would be required anyway

boreal echo
#

Skills - Education?

solemn marsh
flat sedge
#

Don't make the mistake of getting all your general electives done at the community college - you'll end up doing nothing but major specific electives in your degree path, and that will work you to death.

solemn marsh
#

I just don't want to specialize and then have tough transfer options

distant island
#

Yeah, where I went to college, I needed to take a bunch of pre-requisite courses before I could transfer to a university for computer science.

#

Calculus, Physics, Programming

solemn marsh
flat sedge
#

Pick a university now; local universities typically have transfer programs to ease transition from CC to University. Go talk to program advisors and get that sorted so you can make the best decisions for you

solemn marsh
#

Well, I haven't fully determined if I want to pursue a 4 year program, that's the thing

flat sedge
#

Doing this in a vacuum from paperwork is NOT the right play here.

solemn marsh
#

I would not be a college student, had it not been free, most likely

#

since it's free 2 years, I figured to get the best bang for my buck, I go associates in general studies because it knocks out the required classes should I want to transfer

#

then I only pay half the costs for a 4 year degree

quaint flare
#

thank you. this helps me more than you know

serene umbraBOT
#

Gave +1 Rep to @stoic cave

solemn marsh
#

you're saying I specialize and still save on money?

flat sedge
#

I am a non traditional student, as well. I put myself through CC with a combination of state grants and working 40+ hours; when I got to 4 year I had to take a lot more loans.

solemn marsh
#

CC?

flat sedge
#

It's possible to do, if planned right

#

Community College.

stoic cave
#

Community College

solemn marsh
#

Oh yeah

#

soz soz

stoic cave
#

Damn im slow

solemn marsh
#

XD

#

No, I also appreciate your help - I'm just trying to understand this in full depth

flat sedge
#

Yeah

stoic cave
flat sedge
#

College is almost as complicated as programming

quaint flare
#

can you DM this to me by chance? so i have it saved haha

stoic cave
#

Click the image and download

quaint flare
#

👍

solemn marsh
#

So, @flat sedge , I'll definitely speak with a counselor because you raise valid points. I've only finished two semesters, so I didn't waste any time, yeah? Like, I can probably still specialize

#

I mean, first 2 semesters being general probably won't hurt me by any means

flat sedge
#

Alright, here's my advice (for what it's worth) @solemn marsh : Talk to a program advisor before next semester starts. See if there is a guaranteed credit transfer to a state university for your BS in CS plans. If there is, follow that plan and recommendation.

solemn marsh
#

especially if I transfer to 4 year, they'll transfer as well

flat sedge
#

Semesters of nothing but gen-ed will overload the hell out of you later on.

solemn marsh
#

why overload me?

#

because they're harder classes?

stoic cave
#

No because it puts all your technical classes at the same time

solemn marsh
#

yeah, like more technical all together; that makes sense

flat sedge
#

Save some easy screw-off classes for your junior and senior year, nothing sucks more than having to take 4 really hard major electives (security, networking, OS, distributed computing, adv discrete) because you took all the easy ones your sophmore year

quaint flare
#

it depends on mindset really. 4 classes a semester even if theyre difficult is doable imo

solemn marsh
#

Ah- I really appreciate you thinking about it that way; helps me

#

Another thing, juun-

flat sedge
#

It depends on how much you want to enjoy your time on campus.

solemn marsh
#

I fear having an out-dated degree

flat sedge
#

If you don't mind constant misery for 3 months, please disregard my advice

stoic cave
quaint flare
#

im doing it next semester and as ive gotten used to working hard it's not that bad

solemn marsh
#

will computer science, should I specialize, at least be more applicable and less likely to become outdated?

quaint flare
#

and im still lazy in general

solemn marsh
#

as opposed to say, an IT degree/

#

or a cybersec degree

#

where things are changing

#

VERY rapidly

flat sedge
#

a BS teaches you how to learn about the major subject

quaint flare
solemn marsh
#

I'm just concerned because my high school cyber teacher had a degree that was outdated

quaint flare
solemn marsh
#

I think comp sci will teach me more foundational without becoming outdated for at least a while

flat sedge
#

So you learn from first principles more often; it's why you see a lot more architects with 4 year and M.Sc degrees than you see Sr admins with them

stoic cave
#

I still feel like a dunce with a BS but it opens up opportunities

flat sedge
#

The advantage of the 4 year is it teaches you how to learn on your own. There is some of that with the more practical cert route, but the thing that drives me crazy about certs is that the course material is almost always inadequate in some way

solemn marsh
#

yeah I mean, very true points

flat sedge
#

Not saying that uni courses spoon feed you, but i really hate the response when feeling lost of 'try harder'

solemn marsh
#

my cc sorta sucks tho lowkey for tech, at least from what I've seen

#

they have a whole course on the OSI model

flat sedge
#

And that's bad?

stoic cave
# quaint flare study abroad or just travel?

Study abroad. I only needed to take 12 credits but they wouldn't let me only do online classes while abroad so I had to take in person and classes to get a visa. They were all history and language classes

flat sedge
#

OSI may be outdated but there is a LOT of value in understanding it

#

especially in security

solemn marsh
#

I mean, it's not bad, but I covered the same content in my cyber class because my cyber teacher talked with the cc about making the cybersecurity class we had dual-enrollment

#

but he rejected the offer because their program isn't as extensive

flat sedge
#

Honestly, I could probably lecture for at least 2 days of material on OSI and how it applies to the entire IT stack

solemn marsh
#

oh yeah, the OSI model is very important, but like, my point being, they don't cover things as much as my high school class did

flat sedge
#

If you got less than 2 hours of lecture on OSI, you got a huge disservice

quaint flare
solemn marsh
#

@flat sedge I got 2 weeks of OSI

#

full in-depth

quaint flare
#

still, traveling is one of my dreams (why i was asking about work abroad)

solemn marsh
#

maybe more, because we started building on top of it

flat sedge
#

Your high school class is also spoonfeeding you more information; in higher ed, you are expected to do the reading beforehand and ask questions for areas you don't understand. If you don't ask questions, it's assumed that you know it.

solemn marsh
#

another thing- they don't gear you toward certs in their programs

solemn marsh
#

let me take a look at the programs again 1s

stoic cave
#

My degree was pretty much Sec+ but extra with digital forensics and management

solemn marsh
#

This is what their program is, for a "certificate"

quaint flare
solemn marsh
#

it's a 1 year program

#

it just sort of seems really foundational and would probably be the exact same thing I went thru in high school

flat sedge
#

Looks like a good basis for Net+ and Sec+.

solemn marsh
#

we used cisco netacad

flat sedge
#

Maybe not quite indepth enough for CCNA, but a good start

solemn marsh
#

Yeah I mean, it's not bad foundational, it's just stuff that I already sort of covered in my class

#

It'd be a gamble because I don't know if it'd be worth going over the foundations again

flat sedge
#

Yes. But your CC isn't accepting the credit. Taking the easy A will give you more time to learn new things on your own, which is arguably more valuable for where you are now.

solemn marsh
#

(it's always good to cover foundational info again but I want to get the most out of my free college tuition and I'd love to cover new content)

flat sedge
#

One thing higher ed does poorly is practical stuff.

solemn marsh
#

I mean, I see both sides

#

I guess there's two ways I could work this out:

#

it's a 1 year program, so I could do this in theory

flat sedge
#

If you re-do this material, you can start to build up your homelab supplementing this coursework to go deeper in depth than your high school class did.

solemn marsh
#

BUT, I would miss out on some gen ed classes I might need to take later on

#

but I could cover stuff I already know, and learn on my own at home

#

with free time

flat sedge
#

You already know my opinion on taking a lot of gen-ed classes now.

solemn marsh
#

OR, I could take like Java / some comp sci classes

#

hmm

#

idk- this seems a little more tempting but it's just sort of a gamble

#

but I mean, I see where you're coming from- it would strengthen the fundamentals

#

ehh, but a whole entire 3 credit course on network layers

#

it just seems like it's gonna be either very in-depth new information

#

OR just absolutely drawn out stuff I already know and would love to cover other things

flat sedge
#

Seriously. Go talk to an advisor for programs you are interested in. You are speculating HARD about a bunch of maybes without getting their input.

solemn marsh
#

BUT, it would change my degree

#

which looks good at least

flat sedge
#

Go do the networking

solemn marsh
#

a counselor is going to say that their program is the best

flat sedge
#

They are the experts for this, listen to what they have to say. Especially regarding guaranteed transfer courses.

solemn marsh
#

Yeah- I'll reach out to an advisor.

snow kraken
#

Just get CCNA if you are working towards it, apply for NOC jobs, profit

#

Could probably even land SOC roles in a metro area with just CCNA

solemn marsh
#

I mean, my end goal would be SOC/Pentester eventually

#

but I have to start somewhere ofc

snow kraken
#

The amount of entry level pentesting jobs is pretty slim compared to SOC/NOC or networking, programming, and sysadmin jobs. Once you got realistic IT experience its usually easier to get into pentesting roles. You can definitely get a pentesting job though, just search up job descriptions and gain those skills

solemn marsh
#

does my college know what they're doing?

#

why are there electronics classes and advanced circuits

#

for computer networking?

solemn marsh
snow kraken
#

IDK, seems more like an electrical engineering class

solemn marsh
#

CCNA R/S

#

outdated lol

#

CompTIA + CCENT Networking Certs

#

nothing listed

snow kraken
#

Yeah, I got CCENT and CCNA R&S

#

its just CCNA now days

solemn marsh
#

yeah

#

I'm going to work toward my CCNA after I finish my Sec+

#

Well, simutaneously I should say

#

because I mean, I'm not from ground zero; I know some networking stuff

snow kraken
#

Nice, shouldn't be too hard there is a lot of good study guides out there

solemn marsh
#

defo

#

My senior high class was centered around ccna r&s and ccna cyberops

#

so I got a lot of good knowledge

#

i honestly feel like this school puts "cyber security" as a buzz word

#

it makes me cringe

snow kraken
#

its an industry term that is definitely umbrella af

solemn marsh
#

and the pictures

snow kraken
#

pretty annoying lol

solemn marsh
#

they make me cringe

#

that's the header for the poorly designed page of my school

#

There's a typo

#

and also, wtf CISSP?

#

THAT TAKES YEARS

snow kraken
#

Yeah you can get the associate version or whatever

solemn marsh
#

ah yeah

#

I'm going for my Security= 😂

snow kraken
#

It's not the worst, once you got the exp you get CISSP and big orgs love that

#

they want you to have it for bigger pay roles

solemn marsh
#

ew

#

Software Design???

#

??

#

i just feel like no counselor will help me cuz they will advocate that these classes are the best things ever

snow kraken
#

I didn't go to college

solemn marsh
#

in reality I'm going to lose 2 years of my life because the classes are so "buzz wordy" and exist for money

solemn marsh
lost wyvern
#

I am still in school

solemn marsh
#

I guess I can't complain

snow kraken
#

free school and youre young, go for it

solemn marsh
#

@snow kraken I was going for a general studies degree because it's easy to transfer

#

but talking with @flat sedge , he recommend I maybe specialize, and it makes sense

#

problem is- my school seems to be weird as crap

#

I just don't know the best route to go

snow kraken
#

honestly some of the best things from school is probably IRL connections

solemn marsh
#

haha, of course

#

during a pandemic though?

#

where all I know is online school?

#

literally class of 2020

#

it sucks

snow kraken
#

If I went back, I'd grind out WGU

solemn marsh
#

I graduate high school, right?

snow kraken
#

once you got CCNA or sec+ you could get into it

solemn marsh
#

so, class of 2020, I had prepared my graduation to be some awesome thing

#

robbed.

#

online.

#

drove up and did an in-person graduation collect-my-diploma ceremony

#

sure, 20-30 mins, it was unique

#

it was special

#

but man, I'll never get another graduation

#

completely robbed

#

I spent 12 years for that?

#

then, college with online school

#

robbed again

#

I wanted to meet new people, get connections from school

#

barely happened to the degree I wanted it to

#

I could go back in person, but 1) I'm not vaccinated 2) I don't feel comfortable getting it, and 3) I am so used to online

#

so there goes my chances of meeting people

snow kraken
#

join local clubs or meetups if you can

solemn marsh
#

and I only have my learners still

#

so I have to get my license or my parents drag me to whatever I want to do

snow kraken
#

if you're in a smaller town it may not be a thing, but you could start em

solemn marsh
#

yeah true

#

but yeah dude- it's rough.

grizzled shuttle
#

does making a writeup on CTF can help me improve in making a pen test report ?

static tide
#

it can do slightly, but a lot of aspects of a pentest report won’t be applicable in a ctf

cold egret
grizzled shuttle
#

thanks guys

tacit bobcat
static tide
#

i think it’d be cool to have a room where there’s like a snippet of an email from a client with all the details that is common in pentest pre-engagement

#

like detailing the why, the what, scope, timeframe etc

#

and actually treating the box like a pentest and reporting on all findings rather than just exploits

quick forum
#

I'll certainly consider it for the next realistic style box I make though

static tide
#

ye i like how wreath has it, was thinking of just a challenge room though with the email bit, not sure i've seen mayor's box with it though

quick forum
#

I heard some interesting rumblings from Muirland's direction that are somewhat aligned with what you're saying, so keep a look out

static tide
#

even a pathway / module with different actual pentest scenarios would be cool i think, ima chuck it in #feedback-and-ideas

trim hollow
# solemn marsh Software Design???

It really depends on how it's taught, it can be V useful to know how software should be planned and written, as opposed to bodged together

thin lion
#

Hi

polar rock
#

Just so I understand what you’re asking. You live in Africa and are looking for remote jobs in North America or Europe?

pseudo creek
#

Remote jobs outside the country of origin are extremely rare and most often require specialized skills. It requires a lot of red tape for companies but if you are the top .1% in your field or something, they may be willing to do it but they usually find you

pearl parrot
#

Snagged an interview for a help desk position today with a large insurance company. Wish me luck.

quick forum
#

Good luck!

native elm
pearl parrot
#

Any tips or tricks you think I should know?

#

Or just general knowledge?

digital cypress
#

Is sec+ pentest+ CySA+ enough to get into cyber?
I have all 3 and no one wants to hire me

crisp zenith
digital cypress
#

Yeah Arizona

crisp zenith
#

That's strange. I mean I'm just starting out too so I don't know why they're not hiring over there.

digital cypress
#

Have you gottena cyber job yet?

crisp zenith
digital cypress
#

I've applied to remote positions outside of Arizona too. Either no call back or not qualified enough.

crisp zenith
#

Wow you even have a BS in Cybersecurity too. That's very strange I mean at least someone should call back because you're resume looks very good.

digital cypress
#

BS is going to be finished July 2022

crisp zenith
vast totem
#

Is CompTia A+ easy to obtain and how long does it take prepare for it?

weak elbow
# digital cypress

Look into remote jobs in Georgia. I know they are short on a lot of jobs, or if you are willing to relocate there is a lot of demand there.

digital cypress
serene umbraBOT
#

Gave +1 Rep to @weak elbow

stoic cave
#

Companies are also hesitant to hire someone on full time when they are still in school

#

You also need to expand your description of the degree. I also wouldn't go past 4 bullets under each job. Give them the highlights and if you really want to write more, write a cover letter

#

Does the real resume have the companies next to each job?

trim hollow
#

Slowly filling out job applications! eek

ancient prairie
#

my follow-up question though would be; why do you want the A+? Speaking as someone who has it, I only got it because most of the jobs I was applying for wanted it, so I got it - it's definitely not a cert you'd want to get if your local job market doesn't demand it

digital cypress
vast totem
# ancient prairie assuming you've never touched a computer before, anywhere from 1-6 months I gues...

I would say I’m pretty tech savvy but wouldn’t classify myself as some computer wizard. I’ve built a few PCs in the past and attending university for Cyber Security (just meaning I’ve taken courses regarding the topic)

I’m seeking an CompTia A+ Cert Bc I am looking for an internship next summer. I’ve been going through TryHackMe Pre-Security path and though obtaining a Cert would make the search easier.

digital cypress
stoic cave
#

B.S Cyber Security gives zero information

#

You should have the place you're attending, GPA, honors, relevant courses

digital cypress
#

It has the University name on the real resume

flat sedge
#

If your GPA isn't good (3 or higher) don't include it

digital cypress
#

4.0

#

No honors

ancient prairie
digital cypress
#

If I listed relevant courses on my resume that would take up 2 pages.

#

2 courses for my A+
Course for N+
Course for Sec+
Course for PT+
Course for CySA+
Course for SSCP I haven't finished yet
SQL Course
Legal issues in infosec
Cryptography Course

vast totem
ancient prairie
#

sure I don't mind but I recommend you keep it in here as the info may help someone else in the future

craggy latch
digital cypress
#

Are these considered accomplishments or do I leave them as bullets under my work experience?

Automated my L1 help desk job.
Learned powershell on my own. my Job title had no expectations of us To even know what PS was.

Act as SME for co workers
Led a few training sessions
Update our knowledge base
Improved ticketing process and greatly reduced ticketing errors through servicenow incident templates. Brought attention to the biggest offenders of backlog incidents through servicenow reporting.
Consistently scoring as quarterly top performer for call handle time and first level resolution rate

Most of these seem like accomplishments that look good for another help desk role. Not infosec

#

The only projects I have is homelab and tryhackme

craggy latch
#

PS is a good skill. You could automate security task. You should try learning Python too. It's a good and versatile scripting language.

digital cypress
#

I know basics of python but not like stackoverflow level

craggy latch
#

Other stuff seems like it should stay under your job stuff

#

It would be great if you could add metrics to it.

digital cypress
#

I made a reddit bot in python to scrape comments looking for a specific phishing trend I've seen going around reddit.

#

But idk where to mention that on my resume

craggy latch
#

Having a home lab is good. Put it on there, as well as that you're doing tryhackme

digital cypress
#

I have a github. Wasn't sure if I should add that or just stick it on applications when they ask for social links

craggy latch
#

Maybe put some of the rooms and/or learning paths that you've completed

#

If you have a github, I would add it at the top with your personal info

#

Do you have a Twitter?

#

If not, you should get one

digital cypress
#

Not one I'd want an employer seeing lol

craggy latch
#

Infosec is on Twitter

#

Make a separate one

#

Start following the big names

#

If you don't already, try joining local cyber security groups. Attend some local security conferences. Network! Pretty much everybody in cyber security got in b/c they know somebody.

#

The first word of your bullet points should be "action words". Provided, instead of provide.

digital cypress
#

Ty updating it after work

craggy latch
#

No problem

#

also, you'll want to have your education in a separate category of its own. With more detail, such as what institution and dates attended

#

Try looking at sample infosec resumes on the internet

meager hazel
#

This is my second year having someone from their lineup review my resume and it's always useful

native elm
#

nice

craggy latch
#

Kirsten is great! She's also usually in the Car Hacking Village

worldly gale
#

Any jons out there?

#

Jobs

zealous junco
misty vigil
#

Hi! May i know what are the skills do i need to brush up if i want to become a SOC Engineer?

native elm
cold dawn
#

Graylog, Elasticsearch/Kibana, Lucene, Kusto Query Language, Splunk are some of the languages and tools you might need daily in a SOC

#

And for more analytical heavy roles experience with Jupyter/Zeppelin notebooks, Presto, visualisation libraries for python

cold dawn
#

(not Kibana Query Language, which also uses KQL as acronym)

native elm
cold dawn
hot fog
#

I think someone asked this before, but is the blue team more valuable than red in terms of income? I've heard that it's a much stressful job being in defence.

peak steeple
#

I assume they are both as vaulable. If the Blue Team is not tested - they could be complacent AND if the Red Teams dont simulate the latest attack vectors will be easily caught. However I believe its easier to land a BLUE Team role than Rad from what I hear.

cold dawn
#

Stress is a sign of a bad company culture or boss, that shouldnt be present in either side

hot fog
#

Oh i see, thank you both :)

undone shore
native elm
cold dawn
worldly gale
#

Thank you

quiet sand
#

Anything can be stressful. Anything which has deadlines or something chasing targets is stressful

mellow hatch
#

since we're discussing income... what's your opinion on income of a web developer vs red or even blue teamer?

rugged sable
#

depends entirely on contextt

#

web dev at Google level 6 with 40 years of experience will out-earn a red teamer with 2 weeks of experience by 100 times 😛

#

i generally think all tech jobs pay around the same

#

🤷

mellow hatch
rugged sable
#

no dumb questions 🙂

#

just questions !

misty vigil
serene umbraBOT
#

Gave +1 Rep to @native elm

native elm
quaint flare
#

In another server I’m in, there’s people like this with this many certs. Is it ever practical to have this many certs for a certain job position?

image0.png
#

It’s awesome but I guess is it useful after a certain point to have so many

solemn marsh
#

came back from vacation that I wasn't looking forward to but I ended up having a blast

languid hearth
#

it's honestly expected that you'd likely have that many end of career

#

it adds major negotiation power to your salary

quaint flare
#

having to renew them all

languid hearth
#

you dont really need to

#

employers dont really care if its active

#

i've never been once asked to verify any of my credentials and I work for a fortune 150

quaint flare
languid hearth
#

depends

quaint flare
languid hearth
#

your negotiation skills

quaint flare
languid hearth
#

well, if you have 3 big name certs and 20 no name certs

#

i.e. OSEE, CISSP, CCIE

#

you're going to have a lot more negotating power than someone who has ITF, A+, Network+, CCENT, Linux Essentials, LPIC-1...

quaint flare
#

interesting'

#

where are you based? if i may ask

languid hearth
#

U.S.

quaint flare
#

how long did it take you to get so many certs?

languid hearth
#

3 years?

quaint flare
#

interesting

#

i will get there eventually :P

#

thank you for your input @languid hearth

serene umbraBOT
#

Gave +1 Rep to @languid hearth

cunning pagoda
#

Hey, guys. I have 2 questions. At the moment I am working as a full stack developer, but I want to get into cybersecurity. As my professor of network technologies used to say: "you cannot study cybersecurity, you need to come to it, because how can you protect the system if you don't know how it works." What do you think about this? Did you immediately come to IS or did you do something before that? And 2 question. If I'm interested in offensive security, what should I focus on? Pentest and network technologies? And what certificates should be obtained in the future?

frosty dove
# cunning pagoda Hey, guys. I have 2 questions. At the moment I am working as a full stack develo...

I partly agree with what your professor said. However I also think that anyone can get into cyber without prior knowledge. I did security first although I did know a bit of Linux already. If you’re interested in offensive security, try some of THM’s learning paths, probably pre security, then beginner, then offensive security. In terms of certificates, one of the most common is the OSCP. It’s fairly advanced but there are other easier ones like the eJPT. Correction: I also knew some python before starting, but you don’t need to know it.

cunning pagoda
#

Ok, thanks, that was useful @frosty dove

serene umbraBOT
#

Gave +1 Rep to @frosty dove

peak steeple
cunning pagoda
#

Nope, EU. Why do you think so?

meager hazel
#

I might be biased but I think that's a better approach than focusing on OffSec from the beginning. With your developer background you might be asked to do tasks because "you speak developer" but if you focused just on OffSec that might hamper you.

cunning pagoda
# meager hazel I also came from dev - more front-end than full-stack though - and predominantly...

IS for now more like a hobby, but I'd like to make steps in there. a mile wide, inch deep - This is a good rule for those who are just getting into security. But still, someday, I'll have to make step deeper and learn something, which will be related to my specialty, not essentials, but, I think, I should already know 'vectors' of my development. As you say, with my developer background, I already a little bit know how it works, so, that's why I wrote what I would like to do

peak steeple
#

What does it take to become a security architect (expereince, skills and certification-wise) ?

distant pier
golden ore
#

architects are usually the group that design the security for a company then hand it off to an engineering team to do the actual work

peak steeple
#

While I want to start in Pentesting/Cloud Security - I want to reach security architect in due course. Any advice welcome 🙂 So far CISSP has been recommended by others.

golden ore
#

CISSP is more of an admin cert, if you are looking for cloud/pentesting certs you might want to look elsewhere

peak steeple
#

@golden ore Thanks! I will do! For now I will focus on pentesting and cyber sec basics.

serene umbraBOT
#

Gave +1 Rep to @golden ore

static tide
#

that’s my ideal journey too brent :) i wanna end as a network security architect

#

so for me, along with my pentesting certs i’m going for ccnp security, and i think cisco nuked the design cert but if not then i’ll look into that too

golden ore
#

architects rarely get to touch systems, usually using visio or other products to design, put me in the trenches where the fun is

pseudo creek
#

Architecting is fun

#

And security architects would want a CISSP, at least in the US

pseudo creek
#

And I'll say that a security architect, generally have a wide breadth of knowledge. I'm a Cloud security architect, which requires knowledge in a variety of operating systems (Linux, Windows), understanding of various cloud services, possibly with multiple cloud vendors (Azure, AWS and GCP being the most common), understanding of web applications, databases, storage, understanding of automation / orchestration tools, understanding of authentication mechanisms, understanding of networking & various associated devices. And although you aren't an implementer, you should be willing to get in there and test things out, try differentt things, deploy in test environments, etc, etc.

peak steeple
#

May I DM you if you dont mind @pseudo creek

opaque laurel
#

yeah, and on top of all that, being aware of all the new technology as it comes out as well, it's a pretty wide scope role

pseudo creek
peak steeple
#

Looks it going to a long track but it's my long term goal as I have been stuck in some job for too long as I wasn't sure where to jup ...

pseudo creek
#

yeah it definitely is a long road

golden ore
#

cloud adds a lot of dimensions to almost any roll at it is always changing and you may need to know multiple clouds depending on the company

pseudo creek
#

generally if you learn 1, its easy to learn others. I think knowing 2 overall is best but even when I only knew AWS, I'd still get a ton of recruiters for jobs using Azure

#

One thing that is hard with learning is getting distracted easily, knowing AWS really well is better than knowing a tidbit of Azure + AWS. Once you know one cloud service provider really well, then adding another one should be your goal if you want to work in cloud

vast totem
#

Do all Help Desk Jobs require a certification such as CompTia A+?

golden ore
#

no, but it helpful

#

most helpdesk are entry level positions so they usually don't require certs but do have them listed as optional

vast totem
serene umbraBOT
#

Gave +1 Rep to @golden ore

paper grove
vast totem
iron forge
#

I’m looking for an entry IT job folks. I have CompTIA Network+, A+ and Security+ is in view. I need to get hands on experience and I would not mind the pay for now. I just need a job to help build the experience and take care of my family. I live in Washington DC. I would appreciate if anyone can help or recommend me. Thank u in anticipation. Felix

snow kraken
#

You might be able to find a job that will sponsor you for a clearance in DC if you don't have a bad background

#

Once you get Sec+

iron forge
snow kraken
#

Fill out a Dice/LinkedIn/Indeed profile fully and try to tailor your resume for an IT job best you can

frank kernel
#

What is the first certification that i should strive for? CREST, CEH?

peak steeple
#

@frank kernel If really depends where you re and CEH has fallen out out of favour! If you have an eye on CREST then you 2 options: OSCP > CREST CRT or CPSA >> CREST CRT. Note that there are other providers out there QSTM, CompTIA. Personally I have gone CREST as am UK and more and more countries recognixe BUT some might not.

static tide
#

i would not advise oscp > crt

#

the whole point of taking crt is to become ctm which isn’t an option with the equivalency

peak steeple
#

@static tide Morning jake, Excelent point! I know some people are OSCP fans which is why I added it. Jake is spot on. CSTM/QSTM is another opton but CREST seems to lead the way so far any way.

static tide
#

ye i'm also gonna have oscp but i did cstm too

dire rain
#

Situation: I'm in an IT Helpdesk role.
Question: What is my good first qualification that will be a step towards the CyberSec industry?

peak steeple
#

@dire rain There are quite alot. CompTIA, isc2 SSCP, CEH, OSCP, PEH - really depends what country you are.

flat sedge
#

@dire rain One avenue into security from a helpdesk role is governance. Understanding policies, guidelines, and procedures and how they apply to the helpdesk tasks builds that familiarity. Reaching out to an infosec or cybersec engineer or compliance analyst is a good next step; the primary security-specific function that helpdesk executes is policy enforcement.

dire rain
peak steeple
#

Another route is just look for Helpdesk roles in Cyber sec companies and work your way up once you have a foot in the door. Never tried this but I have seen similsar roles.

dire rain
#

@peak steeple , UK based, btw 🙂 .

peak steeple
#

@dire rain Another Crew of the UK massive 🙂 Consider isc2 SSCP, CSTM or CPSA.

lofty ibex
peak steeple
#

@lofty ibex Correct: CSTM leads to QSTM as they are different providers. CRPSA leads CRT ect.

lofty ibex
#

You can do QSTM without CSTM afaik, so would likely disagree that CSTM leads to QSTM

#

one is tiger scheme and one is crest

#

QSTM however, is more about spotting the rabbit holes and niche ways they word their exam/practical

peak steeple
#

All good! I ma just giving my opinion - if you disgree then you disagreee. All goo 🙂

dire rain
#

Hell yeah @warm hinge , reppin' Scotland 😄 .

Man... CyberSec sure does like its qual abbreviations 😂 .

lofty ibex
#

Oh they love them 😂

#

The generalised theme in the UK, is that most roles like to see OSCP or any of the certs that can lead to an application for CHECK team member

peak steeple
#

I would advice just visit ajobboards and see what roles you like and then aim for that. I have friends who with SSCP, CSTM\QSTM and little of me working on CPSA/PEH. Soo many roles in cybersec so take you pick. All the certs I mentioned are more offensive. I msure there are defensive and cloud ones iif you sek them out 🙂

dire rain
#

So generally the best bet will be to look at job roles and see what they're expecting?
Are any of these qualifications considered practical must-haves for entrance to the industry?

peak steeple
dire rain
#

Oh nice, I'll have a look now, thanks @peak steeple (and same to others who chipped in xD )

serene umbraBOT
#

Gave +1 Rep to @peak steeple

static tide
#

@lofty ibex @peak steeple cstm and qstm are totally different, cstm is cyberscheme and qstm is tigerscheme, both allow you for check team member but you only need to do one

#

to get ctm you either need to go:

crest (cpsa and crt)
cyberscheme (cstm)
tigerscheme (qstm)

peak steeple
static tide
#

no, cstm is an exam by cyberscheme which is a different company to tigerscheme

peak steeple
#

I bow to your accurate knowledge @static tide . Thanks

serene umbraBOT
#

Gave +1 Rep to @static tide

static tide
#

crest just like to split their practical from written into two separate exams which is why there's cpsa and then crt

#

whereas cstm has it all in the one exam (and i haven't done qstm but i assume they do similar to cstm)

full sandal
#

Secured an IT position at a company that does school IT. Not exactly a cyber security career but it feels good to have a stable job and not be doing random contractor jobs that end within a few months

meager coral
full sandal
tacit minnow
#

@dire rain you said one could ping you about that job you posted, right? I can't send messages in the jobs board, so is it fine to ping here?

quaint flare
uncut skiff
#

What certificates are relevant if I want to pursue pentesting?

sly matrix
dire rain
#

@tacit minnow , yes please. Feel free to @mention me and I'll pock them up after work.
Just letting you and @quaint flare know I'm aware of your messages now , but will be around 6pm UK time before I can properly have a chat with you.

warm hinge
#

What is the name of the role who's job is to identify attacks against an organisation

severe lagoon
#

hey Guys, iam planning to take CompTia pen+ PT0-001 , But PT0-002 will launch in coming october.
should i wait for new release or go for PT0-00Q?

cobalt escarp
warm hinge
#

Yes bro

#

Thank you

#

👍

warm hinge
#

i am now 15 i have interested in ethical hacking can i take it as an career option

cold dawn
warm hinge
#

ok brother

peak steeple
#

Can anyone tell me more about these roles: Threat Hunter, Resource allocation Specialist and Cyber detect Analyst ? Thanks

languid hearth
#

Threat Hunters look for IOCs, known TTPs working primarily with Threat Intel trying to identify potential threats in an environment

#

Cyber Detection likely works w/ Suricata, Snort, Security Onion and all of those technologies trying to develop signatures on known TTPs

tacit minnow
tacit minnow
golden ore
#

pretty useful guide put out by CISA it has a companion
pathway tool that helps with looking at different roles and what might be needed for each of them https://www.cisa.gov/publication/cybersecurity-workforce-training-guide?utm_source=socialmedia&utm_medium=Twitter&utm_campaign=CyberGuideAug2021

Cybersecurity Workforce Training Guide | CISA

The downloadable Cybersecurity Workforce Training Guide is for current and future federal, state, local, tribal, and territorial (SLTT) staff looking to expand their cybersecurity skills and career options. This Guide helps professionals develop a training plan based on their current skill level and desired career opportunities.

peak steeple
#

This is neat! Thanks @golden ore

serene umbraBOT
#

Gave +1 Rep to @golden ore

quaint flare
#

i have an exam at 6 @dire rain so I can't talk then but I can afterwards

dire rain
#

No problem. I'm off work now until Tuesday, so we can arrange a time that suits you to chat.

crisp vapor
#

Hello guys
im new to pentesting environemnt
I have been following owasp framework for testing web apps
for carrying out 'network' pentesting specifically what framework should i follow?
SANS NIST or any other frameworks I looked up doesn't mention specifically about network services like how to test each server specifically
what im trying to ask is is there a framework like owasp for network testing?

tacit minnow
languid hearth
crisp vapor
serene umbraBOT
#

Gave +1 Rep to @languid hearth

severe lagoon
#

can anyone tell me whats this +1 Rep ?

native elm
severe lagoon
serene umbraBOT
#

Gave +1 Rep to @native elm

severe lagoon
native elm
#

You're welcome 🙂

tacit minnow
native elm
severe lagoon
#

is there any best uni for cybersecurity in texas? with good reserch

potent iris
quick forum
summer reef
#

@quasi stream Hey man, autumn is coming up soon. Did you end up applying for a master's?

undone shore
severe lagoon
summer reef
severe lagoon
#

which country has best standards UK or USA?

summer reef
#

I have no idea but from what I know the fees are more manageable in the UK

#

as for course contents it depends on the uni as well of course

#

I was just wondering what CMNatic ended up deciding since we spoke about this like 2 months ago so was curious

severe lagoon
summer reef
#

I'm all but certainly going to attend UCL and study Information Security

#

just haven't deposited any money for it yet so I can still change my mind

severe lagoon
#

?

severe lagoon
severe lagoon
serene umbraBOT
#

Gave +1 Rep to @potent iris

peak steeple
#

Why are the requirements for this role soo specific: https://randori.bamboohr.com/jobs/view.php?id=24&source=bamboohr. Is this a Senior or Junior role? Seems to asking alot of applicants.

HOC Attacker - Denver, CO/ Waltham, MA/ Remote

HOC Attacker - Denver, CO/ Waltham, MA/ Remote

Have you ever been chomping at the bit to throw an amazing 0-day, but you have to wait for the tooling to be stable enough to make it work? Have you ever been rushing to rapidly leverage an n-day disclosure, because you’re certain you’re going to lose the

pseudo creek
peak steeple
#

I just have not seen a role with such a list of requirements - I'm looking for a juniorish role -willl give a miss. Remote opps are rare.

pseudo creek
#

and even they say that they don't expect everyone to have all those requirements but its a good check list if you want that type of role

#

what type of role are you looking for?

peak steeple
#

Junior Penetration tester would more my level. Too old for internships and apprentischips would pay enough.

pseudo creek
#

ahh ok, I keep a look out on the roles at my company but a junior pen tester is pretty rare

peak steeple
serene umbraBOT
#

Gave +1 Rep to @pseudo creek

pseudo creek
#

also apparently there is a retirement trend lately so you may even just seen an uptick in senior roles, more than usual

peak steeple
#

I did not know that! Thats good to know.

quaint flare
#

@dire rain i'll be available today and tomorrow, if you want to chat. Feel free to DM me!

warm hinge
#

For a thousand years

#

I lay dorment

#

WHO HAS THE TESTICULAR FORTITUDE TO PING ME

native elm
warm hinge
#

Oh

#

Of course its him

#

Cockwomble that he is

native elm
languid hearth
#

fuck

#

he's here

#

he totally saw that

warm hinge
#

Most unis dont really focus on cyber until your a grad student

#

Atleast around here anyway

#

Rice will probably be the best

#

But you should do some research on your own

languid hearth
#

wgu > traditional 4 year

pseudo creek
#

It depends on your goals

potent iris
languid hearth
#

online, at your own pace

potent iris
#

ah

pseudo creek
#

wgu is great if you are already working and don't expect that you'd have interest in academic research but are trying to meet an employer requirement for a degree

#

(that is my second hand knowledge based on what people have said and just a review of their curriculum)

golden ore
#

I had to do a lot of research for my degree, the academic structure is much different than a standard university but they still have to cover the requirements of the degree

#

it is designed around more non-traditional learners that may not have a large amount of time or that have issues sitting in a lecture day after day

pseudo creek
#

you had to do a lot of academic research? I guess one perceived advantage would be that you could do research project under a PhD and be published, which is a path to a PhD. As you'll need letters of recommendation, have started to be published, etc, etc. And really that is for academia vs not.

golden ore
#

I did the masters program so most if it was focused around report writing and doing research though, I know many of the bachelors are more designed around different certs

pseudo creek
#

Although their are professional (non academic) MS degrees, that is very, very rare in the BS realm. Although Community Colleges have the flexibility that would offer night/weekend classes, 4 year universities often still require people to work around their schedule.

#

I would say their MS is still a professional masters, even with research. I also did a professional masters, and yeah research was critical but being published wasn't a requirement.

#

with professional masters, there usually isn't a path to an academic PhD, most PhD programs would still require an academic MS. But for employers, employers heavily rely on professional masters.

#

although Doctor of Engineering is an emerging higher level degree that is more of a 'professional' Doctorate

golden ore
#

I'd rather have a doctorate in cyber, then it would go great with the BS and MS in cyber

pseudo creek
#

yeah and those are the doctor of engineering degrees that are available at a few universities

#

personally, I don't see the point ... I sometimes think that I'd like a PhD in Math but I'd have to go get a MS in Math first

#

but like I said, thats why it depends on your goals on whether WGU is better than a 4 year or not. WGU MS seems pretty equal to the dozens/hundreds of professional MS programs out there.

stoic cave
stoic cave
#

Consistently in the top of the rankings

native elm
hybrid elm
#

Hi guys, I'm kinda lost at a request I got today, as I don't work yet on the cybersec field (I'm a network admin). A client requested for us to scan and search for vulnerabilities for his entire network (actually 5 /24 networks) wich includes ~100 servers (all kinds of SOs from server 2008 to rhel) firewalls and all that things, my question is how would you quote this and explain how this request is not trivial (he has support hours already paid for, but I don't consider this request to be the current pad support hours). I'm sorry if this is not the right place to ask this, if so delete my comment.

vital laurel
stoic cave
severe lagoon
severe lagoon
serene umbraBOT
#

Gave +1 Rep to @pseudo creek

warm hinge
#

has anyone done oscp

forest knoll
uncut skiff
#

Why are the pentest salaries that small? (Maybe I watched the wrong sites but the salaries are veery small comparing to other security jobs)

ancient prairie
#

just had a good interview and wanted to share some questions they asked, might help other people brush up

"What do you know about IAM?"
"What do you know about SSO?"
"What do you know about AD?"
"What is your experience with scripting?"

#

this was for a IAM Analyst role (even though the job listing was for a Security engineer lol) they seemed really interested in the scripting part and asked some follow-up questions there

opaque laurel
#

oh cool, awesome info @ancient prairie thanks

serene umbraBOT
#

Gave +1 Rep to @ancient prairie

ancient prairie
uncut skiff
#

Eastern Europe..

peak steeple
opaque laurel
#

@peak steeple read the next line ;D

peak steeple
quasi stream
summer reef
#

doing masters in Information Security

#

also got my postgraduate SFE loan approved today

quasi stream
#

Oh that's wicked!

#

Nice work 😎

#

Msc in Cyber Security in the end for me

summer reef
#

Same thing, more or less I guess

#

congrats to us both 😎

quasi stream
#

Indeed 🎉 excited for it?

summer reef
#

of course

#

I took a break from all the stuff this summer so I'm excited to get back into it now

quasi stream
#

Ah that’s great! No rest for the wicked here. I need to switch from work mode to study mode 😅 enough to keep me busy I suppose!

brittle helm
#

I can enrol in bsc hons CS program in a good uni but have been unable to get in a good uni for a btech CS degree, should I take a drop and try again for btech or go for bsc this year instead, would it impact my career in a big way?(Assuming I stick all the way through with cybersecurity)

polar rock
#

tbh no one will give af between the two

#

You’ll just be another person with a cs degree

rugged sable
#

I would pick bsc over btech for sure

#

btech is like college level / higher national institution which is memed about in the UK (like CEH but for actual academia) whereas a BSC isn't 😛 (and I have a btech!!!)

brittle helm
quick forum
#

UK used to use BTech for batchelors with placement years but abandoned it

brittle helm
high sable
#

Does anyone know what AWS is?

undone shore
high sable
#

Uhhhh

#

No

#

😂😂

#

I have some certifications with them and it’s super hard trying to find a career

#

And I was wondering if anyone has tips

#

@undone shore

undone shore
#

Is it architecture or cloud security you're trying to get into?

high sable
#

Architecture

#

But I can work on cloud security

#

I have AWS solutions architect

#

And AWS cloud prac which isn’t much obviously but yeah

undone shore
#

I suspect @pseudo creek (apologies for the ping Zojja) may be your best bet there. Generally speaking we tend to focus more on the security side of things, but I a few people have a bunch of experience in that side of it.

#

She's offline just now, but I'm sure she'll respond to that ping at some point when she gets back 🙂

high sable
#

Ooo okay, thank you. And what certs do you recommend for cloud security

undone shore
#

Cloud security? Honestly, afaik, just the same proprietary architecture certs as you're going for just now. I believe SANS might have some cloud specific ones, but don't quote me on that.

high sable
#

Okay thank you much

undone shore
#

Np 🙂

vital laurel
#

The amount of open S3 buckets is insane.

azure juniper
#

Hi everyone, I graduated a few months ago in Computer Science(Information Systems Security), I also have 2 azure certifications and security+ that I got a week ago. I'm using my OPT voluntary with one small company(msp). I would like to stay in the US, but I will need visa sponsorship. Do you have any advices, or do you know some recruiters that I can talk to, for some entry level job in cybersecurity.
I'm currently 40 min from Sacramento

rugged sable
high sable
#

@rugged sable USA

solemn marsh
#

can someone give me some advice on this unique situation I've been trying to gain comfort in? So, I'm a music producer, and I brand as David Day - I have a personal instagram with my profile tag as with my first name, middle initial, last name - I only add IRL/close friends on this personal instagram account, but I do post links to my music from time to time, hence, drawing a connection from my music identity to my IRL identity - at some point, I dabble with privacy , and then I find my progress redundant because I also want to grow as a music producer/content creator; what's the point in trying to be private, when it's feasibly seeming to be impossible to grow without sacrificing some sort of anonymity? What are the draw backs? 0day's instagram has his alias connecting with his full name, so I mean, I guess it can't be that bad since he's an elite hax0r and obviously seems like he knows his stuff enough to know he's not exposing anything crazy. I just want to be safe, but I also want to grow, and it's stupid to say that this type of thing is stunting my growth as a producer, but it is, and I've been fighting it for a while now - my first name is David, but my last name isn't Day. Is my branding too close to my real name? I guess at the end of the day, it all depends on what I want to sacrifice. Should my music blow up, my irl friends would eventually leak my real name, wouldn't they? (given it's tied) , or, my face leaks, and someone ties it to a LinkedIn page, or something along those lines - at this point, I've tried everything, and I'm wondering what I can do from here; does it really even matter that match? It's been driving me crazy. (For reference, I was one of those people who would change online aliases every month and I always am crazily on edge with paranoia)

#

Another layer to note to this is that I would be pursuing information security, so at some point I believe that my music and infosec careers would overlap and my real name would be figured out as some point- there's only so much you can hide, especially considering my real name is attached to my music on the back-end.

native elm
# solemn marsh can someone give me some advice on this unique situation I've been trying to gai...

Relax. As long as you aren't posting your bank details and your accounts are secure, there is literally no drawback besides 'people know who I am oooO'. IMO people in this discord in particular act like we are all criminals with their approach not only to privacy but policing others accepted choices of privacy. I asked 0day about this in voice chat and he even gave me his full address because he has given it to loads of people and not one malicious thing has happened xD For me I really dont see an issue when you have nothing to hide etc. In other cyber discord people just post their linkedin, but here people act like they are secret agents kekw

solemn marsh
#

Like, eventually I'll show my face as an artist probably - I think that's sort of something I want to do

#

Worst that can happen is a hitman or something I suppose

native elm
#

Bit of a stretch 😄

solemn marsh
#

lmaoo

#

naw but dude I do appreciate you taking the time to give a well thought out resposne

#

it means a lot

native elm
#

No worries man, I get tired of the browbeating about privacy here. Literal rank 1 dude has a FB page where he talks very frankly about his life and experiences.

#

That's why my goal is to work for myself/at such a high level, that sharing myself and being authentic is not a crime

solemn marsh
#

lmao yeah- I mean, that's very comforting honestly

#

and when you're #1 you have enough knowledge about hacking to where you're a threat IF anything should happen 😎

#

like, nobody will fw you lmao

native elm
#

Yeah but they can't really do shit with the basic info anyway except maybe sign you up for fraud stuff which you could sort out easy enough

solemn marsh
#

I mean, yeah

native elm
#

Yeah everybody scared of 0day, hes super nice and friendly tho haha

solemn marsh
#

You know, I thought of the other layer to this, is that I know all the vulnerabilities, so I have the inside scoop and paranoia

#

but people on the outside don't see those

#

it's the spotlight effect

native elm
#

I often have non-techie friends think because I work in Security I should have OTT-privacy going on. Some of my friends do. Like only encrypted messages, no social media, etc. There is no need, we aren't gangsters. It's a personal choice

solemn marsh
#

Yeah

#

I mean, honestly, my threat model is data brokers

#

BUT

#

There's going to be some sacrifice

#

bc not everyone is using Element

#

or Signal

#

etc., etc.,

#

Like, as a content creator, it's impossible to get big without using the big platforms

native elm
#

or telegram

solemn marsh
#

yea lol

native elm
#

yeah about your original thing, I know what you mean, since I also want to promote my music but I don't want to be some wannabe influencer

#

It's a dance we are all forced to do

solemn marsh
#

like, good luck getting a fanbase of like 2M+ on a platform other than the mainstream tech that will sell your data

solemn marsh
native elm
#

unless you are like dre,kanye, joyner lucas, who are already famous and make their own platform

solemn marsh
#

oh yeah definitely

#

Dude- you're speaking my language. Thanks for being so relatable 😛

native elm
#

Hahah that's a good compliment. Have a good day, @solemn marsh

solemn marsh
#

😂 yeah dude - anytime. It's a pleasure to speak to people who are interested in the same stuff as you, especially after growing up trying to communicate to your family and they're so uninterested in the topic

#

Like, idk- I've always felt like I lacked the relation with people, until I met discord servers that literally are full of people who speak your language. It's an amazing feeling.

#

and I regret not joining discord servers like this sooner.

#

unfortunately it just never crossed my mind to join a hacking discord or a music one until last year or so

#

why? Idk- I live my life on repeat it feels; same thing, everyday

#

so, it just never crossed my mind

#

but something changed the sequence, and here I am

native elm
solemn marsh
pseudo creek
# high sable Architecture

So solutions architecture (AWS and Azure have certs in this) are focused on creating a design based on the specific solution (e.g., AWS) but that isn't necesarily security architecture. For Security Architecture, Cloud or otherwise, you'd want a wide breadth of knowledge. Wide understanding of Cloud services for 1 or more vendors, knowledge of Unix (mostly Linux these days), Windows, Windows AD, Authentication in general, Automation and Orchestration (e.g., Ansible, Terraform, etc), Containerization (e.g., Kubernetes), Networking, Networking devices (e.g., routers, firewalls, proxies, vpn), and probably other things I'm missing. And then you'd want to understand how to secure all of that.

If you are currently in cyber, I'd look at getting the CISSP, if not, look at Security+ and CCSP (ISC2 cert for Cloud). If you want to focus on AWS, I'd aim for the AWS Solutions Architect Professional. A lot of the other things I mentioned may not require you to have a certification in those things but understanding them will go a long way to becoming a security architect.

severe lagoon
#

Can anyone suggest me best resume template as well as cybersecurity resume sample.

warm hinge
#

any oscp here?

iron rivet
#

Hey guys, can someone please give me a hand thinking through my plan? Ill be finishing my bachelors in CS in spring of 2022. My dream job is an application security engineer, and my plan of attack was to try and work as a software engineer first, and then transition to a role that is more cyber focused. I've been spending this summer mainly prepping for technical interviews, and just started sending out apps for internships. I haven't had any SE internship's yet, only a volunteer experience learning and teaching basic cybersecurity concepts with CodePath and IQ4. I figured I could volunteer my time and try to work with cyber as much as I can through a software developer role and leverage that experience to get into cyber. Is this a dumb way to go about getting into cyber-security? Do you think it would make sense to try to get into a master's program for cyber-security while I'm pursuing SE roles? Sorry for the long post, but I would really appreciate any feedback.

pseudo creek
# iron rivet Hey guys, can someone please give me a hand thinking through my plan? Ill be fi...

Some of this may depend on what country you are in. In the US, I'd say absolutely do not go for a Masters.

Are you saying you have 0 work experience? With graduating next year, that should be your #1 priority. Anything remotely CS related should be your goal. If you can't find a job, look for local organizations which help others in tech. Things like Girls who Code. Make a blog, have stuff related to security on your blog. Have a Github and projects on your github.

Then look at certifications, get Security+

Doing software engineering to app security is a path. You could also see if you could find junior app security position. Start looking at job listings now and see what they are asking for. I would get a Masters in cyber until after you have a cyber position.

iron rivet
#

if im going to go SE to app security, do you think I should wait until i get more SWE experience before doing the cert?

pseudo creek
#

no, I'd get the cert now, its a good generic cert

iron rivet
#

okay cool. I do have tech experience, its just all unpaid and related to cyber - not SWE. I was worried if I couldnt find a SWE internship before I graduate that I might have a hard time finding a full time position -- which is what made me think maybe a master degree would allow me to go straight into appsec and skip over working as a SWE? But ill still need some type of entry level tech experience regardless?

iron rivet
pseudo creek
#

overalll, it would be harder to find a job with a masters than without it unless you have a few years of industry experience

warm hinge
iron rivet
#

I think I get you, overqualified for an entry level position?

pseudo creek
#

yeah, so they rather pay someone who is cheaper

iron rivet
#

If anyone has the time to scrutinize my resume, I would appreciate it. I'm going to continue my original pursuit of SWE roles and try to work my way into appsec.

#

Thank you guys/gals for the input, the pressure is on -- graduation is coming quicker than I thought it would 😆

warm hinge
#

Good luck @iron rivet

ancient prairie
# iron rivet If anyone has the time to scrutinize my resume, I would appreciate it. I'm going...
  1. Was this resume crafted for a specific job listing?
    1.a) If it was, then make sure that you are using phrases and keywords from the job listing itself.
    1.b) If not, I would suggest you re-examine how you make your resume, i.e. tailor your resume for the position itself
  2. I'd probably cut out the part about being a contractor - I have a similar background with 8 years in an unrelated field, I always leave it out and if it comes up, I'll tell them about it briefly and just tell them it wasn't relevant for the position, in my experience they don't really care
  3. I'd turn Projects and Technical Skills sections into one just called Professional Development.
  4. Going back to point 1.b, list skills and word the Professional Development section in a way that mirrors the job listing, for example, if the listing is for a SOC analyst, they are probably gonna want someone with SIEM experience or familiarity, so you should tweak that section to reflect skills related to SIEMs, e.g. you have a website so talk about how you monitor the logs and handle incidents, etc..
#

also list some classes you've taken at CUNY or maybe some sort of capstone project

#

also name and contact info should be front and center, wouldn't hurt to throw in footers too, you have no way of reaching you listed here - understood if you purposely redacted that info for this though

iron rivet
serene umbraBOT
#

Gave +1 Rep to @ancient prairie

iron rivet
ancient prairie
#

understandable, I've made that mistake of sending out a resume and forgetting to include contact info lol - best advice I can offer is to not do the spray-n-pray approach across LinkedIn/Indeed and take the time to do a little OSINT and find the talent acquisition/hiring manager at the company itself and reach out to them directly

iron rivet
#

plus prob gets lost in the stack of resumes when web scraping half the time too

ancient prairie
#

yep, also depending on the company there's potentially dozens of people you could just try reaching out to instead of just sending in your resume just once

vital laurel
#

Glass Door and Linkedin. You can tell how good your profile is by the amount of traffic you get, it's been blowing up lately.

pseudo creek
#

yeah LinkedIn has been super active lately

brave linden
#

don't know if this is the chat for certs, but what certs do you guys recommend?

native elm
peak steeple
umbral geyser
#

Just realized that it's less specific on certifications than I remembered ...

peak steeple
vast totem
#

I really hope I will be able to obtain my CompTia A+ Cert during my school year. #NoSocialLife

quaint flare
#

how important is it to know AWS/Azure for a security analyst role?

#

and would getting AWS certs be beneficial for an analyst role?

vast totem
quaint flare
vast totem
quaint flare
#

i'm a senior. next semester is my last semester

vast totem
#

Exciting stuff!

quaint flare
#

exciting and scary haha

#

but absolutely exciting :P

vast totem
#

Yeah, I can honestly imagine.

quaint flare
quaint flare
vast totem
quaint flare
native elm
# quaint flare how important is it to know AWS/Azure for a security analyst role?

I mean, I spent 5 years as an analyst and I didn't need it at all. I worked with Azure AD before and cloud-based log sources but that's fine. I'm not saying 'dont study it' but it would definitely depend on where that job is. Really if you study azure/aws it would generally indicate a DevSecOps path, which is a good and profitable path. As an analyst, not so much.

quaint flare
#

yea a friend was saying he really wants aws certs and stuff

#

but i didn't know if they were necessary for that position

quaint flare
serene umbraBOT
#

Gave +1 Rep to @native elm

cunning spruce
#

Wanted to ask if anynoe here is familiar with Cybary and whether or not that is valuable to someone looking to get into "entry level" positions i.e SOC L1. I guess a better way to phrase it would be for people lacking experience or "2+ years in [...] position"

distant pier
distant island
cunning spruce
#

Thanks @wooden tundra @distant island That's what im sticking with, I know that THM does offer a little certificate at the end, out of curiosity do you know if that is favorable on resumes

serene umbraBOT
#

Gave +1 Rep to @wooden tundra

cunning spruce
#

Sorry I meant to thaank @distant pier

distant island
crisp vapor
frosty perch
#

just wanted to know guys, it is necessary to have a ccna for your pentest career .i.e if u aldry knw about networking

#

?

static tide
#

it’s not necessary, no

#

it’s good to have though to prove fundamental network knowledge :)

frosty perch
#

thank you @static tide 👍

serene umbraBOT
#

Gave +1 Rep to @static tide

quaint flare
#

@dire rain are you still interested in chatting about that help desk position?

azure juniper
#

Anyone wiling to take a look at my resume and tell me what jobs should I apply for

#

Where I have chance

brittle helm
#

would a comptia a+ be a good addition?

merry lily
#

Hi guys. What do you think about the masters in Cyber Security in EC council university?

distant island
# brittle helm would a comptia a+ be a good addition?

I think that if you're struggling to get your foot in the door with a helpdesk job, it may help appeal to the employer. But honestly, consensus from what I've heard is that experience beats it, and also that it's useless once you've already landed a helpdesk job. That's just what I've heard. I studied A+ and Network+ to learn the material, but only ended up actually taking the Security+ exam to enhance my job prospects.

#

@brittle helm In short, if you have nothing else, and are trying to get a helpdesk job, I say go for it. Otherwise, you can probably pass. Just my two cents.

undone shore
brittle helm
#

Same with networking+

distant island
# brittle helm I don't want to do helpdesk as a job, I just want to learn the material because ...

If you're just starting out and want to make sure you've covered everything, I would recommend skimming A+ just to tick off all the boxes in your mind of "I know this" or "I don't need to know this". Some of it is really boring and not immediately useful. Network+ I would pay closer attention to, assuming you want to get into pentesting. It covers concepts like TCP/IP and encapsulation, which are very important. However, regarding either of the exams, I would not recommend them personally, as I have heard they don't carry much weight among employers.

merry lily
undone shore
zenith vault
undone shore
#

They started off by posting an extremely sexist comment then blaming it on the intern in a very insincere-sounding apology

#

Then about a month later they were caught plagiarising a whole bunch of prominent infosec writers, effectively word for word

#

If memory serves, they were also removing gender inclusive language from the plagiarised articles, although that might have been a different scandal so don't quote me on that one

zenith vault
#

Wow

undone shore
#

Yeaaaaaah

merry lily
serene umbraBOT
#

Gave +1 Rep to @undone shore

undone shore
#

Add that to the fact that their certs are quite literally memes and there is precisely no reason to give them your money 🤷‍♂️

undone shore
severe lagoon
#

Can anyone share best source for CompTia Security+ mock Tests.

rugged sable
#

They stole some of my worst articles haha

solid jacinth
#

Hey y'all, I'm a senior year undergrad from india (4-year bachelors in ComSci), and it is seeming increasingly unlikely that I'll be able to travel abroad for a masters in CyberSec. What online-only Masters do you guys recommend for Cybersec? I've been looking at ASU (via coursera) and Georgia Tech (via EdX) so far

#

I looked at Abertay as well, that's in my shortlist too at the moment. Athough I have a slight preference towards blue-team and maybe cybersec from a business standpoint

#

Also, a parallel question. I keep getting shit about online masters not being a good idea, that it is not the same as an offline masters, and things like that. Do those claims hold any ground?

rugged sable
#

Why do you want to do a masters?

brittle helm
serene umbraBOT
#

Gave +1 Rep to @distant island

native elm
fallen magnet
#

can anyone suggest me, some best hacking course on udemy, intermediate to advance ?

severe lagoon
fallen magnet
severe lagoon
serene umbraBOT
#

Gave +1 Rep to @native elm

crisp vapor
#

Hi Guys , what are the main prevention methods for business logic attacks?

gusty palm
#

Hey guys !
I am a 4th year CSE undergrad from India.
I am pretty confused about going for a job or masters from USA in cybersec.
.
I seek advice from the professionals here, what's more valuable - a masters degree in cybersec or work experience worth of 2 years in the field of Infosec ?

crisp vapor
merry lily
severe lagoon
severe lagoon
serene umbraBOT
#

Gave +1 Rep to @merry lily

severe lagoon
#

Robocop varg

solid jacinth
# rugged sable Why do you want to do a masters?

Because, at least here, it seems impossibly hard to get into an entry-level IT role (helpdesk or even L1 support) without any experience. I'm not looking to do a PhD anytime soon, so thesis-based graduate degree is not a necessary thing I'm looking for.

unreal arrow
#

I have an interview tomorrow and i was wondering what are some good questions to ask the team?

static tide
#

what position?

unreal arrow
quick forum
#

Good Luck Blackout!

rugged sable
# unreal arrow Infrastructure technician

“What incident management software do you use and how many incidents do you have. Do you have zero blame incidents? On average how many times are people paged a week. “

peak steeple
#

Good luck Blackout anidab

tacit minnow
#

Hi everyone. Are there any companies hiring international remote interns? Everything I see require you to at least be in or a citizen of a certain country.

quick forum
unreal arrow
#

Alright thanks, i'll be sure to ask them

quick forum
#

Your questions are a chance to interview them back

peak steeple
tacit minnow
peak steeple
#

Fair point! Like I said I can't vouch for it soo investigate as you can first.

severe lagoon
gusty palm
#

Thank You guys for your input. Appreciate it! blobfingerguns @severe lagoon @crisp vapor

serene umbraBOT
#

Gave +1 Rep to @severe lagoon

rugged sable
#

((we have a security infrastructure team too))

flat sedge
crisp vapor
ancient prairie
# gusty palm Hey guys ! I am a 4th year CSE undergrad from India. I am pretty confused abou...

Cyber degrees can be somewhat worthless and impractical outside of a few reputable schools, there probably like 2 dozen worldwide that are even worth considering for strictly a "cyber-security" degree .

In the US work experience is king, getting a Masters with no exp can kill you bc some employers are required to pay those with Masters degrees more and will choose someone cheaper with experience 99% of the time

gusty palm
serene umbraBOT
#

Gave +1 Rep to @ancient prairie

flat sedge
#

BS and M.Sc are often seen as fast track in cyber or info sec to management or advanced roles; but those senior roles are usually inaccessible without experience even with the degree.