cyber-and-careers

[undone shore]

Feel free to post in #jobs-board at will

[bronze lodge]

Thank you 🥺 while I have you, what's the process for adding certs into my profile here?

[serene umbra]

Gave +1 Rep to @undone shore

[languid hearth]

just ask @bronze lodge

no formal requirements unless you say something like "all of them"

[bronze lodge]

Thanks! I wasn't sure if there was a better way or just DMing, I have quite a number of them and didn't want to just spam an arbitrary chat 😅

[serene umbra]

Gave +1 Rep to @languid hearth

[stuck rover]

GRC and sec clearance.

[weak crescent]

MIT

[shut granite]

@tribal flicker panic at the server!

[minor gulch]

i have some questions regarding ceh anyone free?

[quick forum]

Just ask your questions.
No one knows if they can answer until they see the question

[minor gulch]

i just want to know the format of the exam

also why are their labs slower than thm boxes

like the hell

[quick forum]

That's definitely going to be on their website

[quick forum]

That's pretty common with exam lab environments in my experience

THM spoils you. Sets you expectations of quality quite high

[slate timber]

hello i basically started today and got introduced to the website by my dad, i have absolutley no clue what i am doing if there would be anyone interested in helping me i would greatly appreciate it, my PMs are always open

i have been put in a free room and dont quite know where to start so as i said if anyone knows abit about anything i would gladly hear everything they have to say

[warm hinge]

@slate timber Did it already enroll you into the Tutorial Room?

[slate timber]

no i dont think so i just got put in a free room after completing the two first tasks and idk what im doing in there to be honest im just clicking on stuff

[warm hinge]

haha no worries! At the top of your screen, It'll show Dashboard, Learn, Compete and Other. Click on learn, and then the search button. Search for Tutorial. There will be a button that says, Enroll in this room. Click on that. It should guide you through the basics of tryhackme. If you have any questions through that, feel free to PM me.

[gusty cipher]

@rugged sable wanted to have a chat about the job you posted

[warm hinge]

Hello everyone, I am sorry to bother you, I am writing here hoping to gain some information about the CompTIA Security+ Certification & Exam by someone that has completed it.
I recently approached online quizzes that tried to resemble the Security+ exam and generically got some results shown up, some of them were about choosing one of a few options, while others were about open answers to questions.
I am here to ask, is the exam about multi-choice, open answer or is it structured in a specific way? how much time do you have to complete the whole thing?

I also tried searching up these questions in various places and found generically different answers, so I hope to get some info from someone that has actually gone through the original thing.

Also, is the "Free CompTIA security practice quiz", offered by the CompTIA website, actually a good way to practice, or would there be something better?

Thanks in advance.

[vast totem]

I'm interested!

[willow gate]

#jobs-board

[bronze lodge]

For sure, check out my post on #jobs-board and hit me with any questions you might have in my DMs

[daring haven]

Hello all! What languages should I learn for penetration testing and how in depth should I learn the languages also what languages are common for DevOps?

[pseudo creek]

Python is a pretty solid language to learn

[flat sedge]

For devops? Any application language

[daring haven]

@pseudo creek I already have a very strong understanding of python, I was looking to expand further

[digital cypress]

Is there a difference in titles
Director of cyber security vs CISO

Thought the ciso was a director of cyber security

[flat sedge]

Director is a title for someone that heads up a division within a department

For example, within a security department that rolls up to a VP/CISO, there may be multiple Directors. Compliance, Security engineering (SOC, sec tool management/tuning, vuln management), network engineering may be divisions requiring a director that all report to a CISO.

Not all orgs will have the Director role specifically, but it's not uncommon either.

[pseudo creek]

yeah we have probably 5 or 6 Cybersecurity Directors who all report to the CISO

[digital cypress]

Ty

[gilded dragon]

Can someone help me and tell me that any cybersecurity course which provides certificate for free ?

[flat sedge]

Any certificate or certification that will have job market value will have a fee for the exam or course; free courses/certificates are only good for continuing education credits required by some certifications.

[gilded dragon]

@flat sedge I'm a beginner so I need some course that gives certificate also

[flat sedge]

Why are you so focused on the certificate? #start-here

[languid hearth]

certificates will rarely help you. Certifications will.

[ancient prairie]

pretty much got carte blanche from mgmt for training and courses for security people - what classes/training/certificates would you guys have on your wishlist as a SOC analyst?

[stoic cave]

Is there a SANS course?

[flat sedge]

Anything that gets me out of the SOC - I do not have a good temperament for SOC roles.

[stoic cave]

If so probably take that

[languid hearth]

for500 is another big one if you're doing ir

I'll be honest, I don't really know that any of the 400 level certs are really worth it

except maybe the ICS ones

and 498

[ancient prairie]

i was thinking about for500, there is definitely opportunity to hop into the CSIRT after some time if I ask

[warm hinge]

What certification should I focus on Post-Security+ if I want to focus on Web App Pentesting?

[undone shore]

eWPT(X) would be a good bet 🙂

OSCP -> OSWE for whitebox as well

[warm hinge]

Gotcha, thank you! @undone shore

[serene umbra]

Gave +1 Rep to @undone shore

[undone shore]

Np 🙂

[quick elbow]

does certifications like oscp and ceh equalize with work experience ?

[dense tendon]

From what I've seen and heard, no. Certifications can get your foot in the door and check HR boxes, but there is a qualitative difference between knowing about firewalls and actually configuring a firewall.

That said, certain certs, like OSCP, do require technical ability to earn

[distant pier]

Not to a technical hiring manager. 🙂

[undone shore]

CEH definitely doesn't smh

But no. They prove knowledge and methodology, not experience

There's a huge difference between a cert and a real-world environment

[glossy token]

hi

[warm hinge]

I've gotten pretty invested in Malware Analysis

Is there any other certs besides GREM that gets your foot in the door with malware analysis or is there anything else there that can help out?

[languid hearth]

elearnsecurity has a certification on it, but I don't know the quality

[lilac escarp]

eLearn has its eCMAP Certification

https://elearnsecurity.com/product/ecmap-certification/

[languid hearth]

the best way you can learn is by doing

[static tide]

ine interface is hot trash to learn from 😔

[languid hearth]

there's a fair bit of stuff I wouldn't necessarily say is useful to learn in analysis, I think characterizing the malware (i.e. it's a dropper that retrieves a file from x domain and executed it by y command. Afterwards the adversary collects passwords via lazagne, then evaluates if this is a target they want to proceed interacting with. If so, launch VNC, poke around manually, then pop cobalt strike) is far more useful than knowing how it "unpacks" itself

[lilac escarp]

I'm still waiting when it will be possible to access their "premium" content with a monthly subscription..

[static tide]

i thought they did that

[languid hearth]

just credit card things lol

[lilac escarp]

with monthly sub you don't have an access to their labs..

https://ine.com/pages/plans

[languid hearth]

that's still why I refuse to support them

[static tide]

rip

[languid hearth]

it's utterly ridiculous

[static tide]

i'm just using my sub to watch the videos and use their labs

since using their slideshow thingy is ass

[languid hearth]

I could understand why they didn't do it at first, due to high demand, but it's way past their initial launch and interest has majorly died down

[warm hinge]

Ah, should I be learning C as well?

[languid hearth]

asm over c

but one doesn't just learn assembly

[flat sedge]

The learning path I recommend for ASM is to learn some C first

Then start studying comp architecture

disassemble some simple C programs, see how that converts to ASM

[languid hearth]

when you use things like IDA, everything will be displayed in assembly. Some will convert it to C pseudocode, but as long as you know how to generally read programming languages, you'll be fine

[flat sedge]

then try to implement decisions and loops

there's a lot in ASM that sort of translates to higher level languages, seeing the two side by side will help see the patterns

[warm hinge]

gotcha, thanks!

I'll get started trying to learn some, is it just primarily C or is it also C++?

[flat sedge]

C will be a more direct mapping. C++ encompasses 4 distinct programming languages, so the mapping of things like STL or variadic metaprogramming is a lot more difficult to see.

[warm hinge]

Gotcha

[stuck rover]

How's the content though?

[agile tinsel]

its also really expensive

[static tide]

some of it’s decent, although the spelling and grammar could have been qa’d

[stuck rover]

Lmao. "Some of it." That doesn't give me much hope.

[candid elbow]

Anybody looking for CIRT role (telcom company in usawith great pay pm me. I can have good referralfor u

[covert violet]

Hey all - I'm looking for a senior pentester with 5-7 years experience... no degree required, OSCP pref. Message me for details.

[flat dawn]

Hello all. I am new to cyber security. I studied and was able to pass the security +. I am trying to build skills and get familiar with programs and commands commonly used. Anyone able to point me in the right direction?

I have been completing labs on tryhackme but any advice is appreciated

[flat sedge]

What direction are you looking to towards?

[peak bluff]

what entry pentest cert is the best to get? (considering both for getting a job and actually learning). Thinking of CPT or CEH

btw is two years of work experience an option or requirement for CEH

[flat sedge]

Do you have any experience in IT?

[peak bluff]

I’m in college so I do not

[flat sedge]

Cybersecurity entry level is a bit of a misnomer, pentest in particular. What's your degree area?

[peak bluff]

Double major in Cyber security and Comp Sci

[flat dawn]

@flat sedge I’m thinking incident response

[peak bluff]

I’ve also heard from some sources that pentest+ is a good one to start with

it’s also a lot cheaper so I’m thinking about taking that

[flat sedge]

@peak bluff Unless you are India, CEH is not recommended.

[peak bluff]

I’m not, good to know

[flat sedge]

@flat dawn I don't know much about IR; most of the folks I know who do it have a deep background in networking or LEO.... can't be much help there

It's rare that pentesters get hired without having a few years experience as infra or network - if you like CompSci, your best bet is to get devops or infosec internships while you are in school. Don't neglect to make use of longer breaks to get your foot in the door

Now is the time to start looking for internships, at least in the US. Reqs for those should be opening soon, and most of them will be filled or closed by January.

[peak bluff]

that makes sense, I’m trying to get into a cybercom internship program next year

[stoic cave]

Speaking from experience, applying to incident response fresh out of college is a longshot

[peak bluff]

meanwhile I wanna get a cert to have a better chance of getting in

[stoic cave]

I realized that while applying places and am now working towards eventually ending up in IR vs starting there immediately

[flat sedge]

Dont' worry about certs until after your degree.

The degree is much more valuable, even if it's less useful right away.

And your best bet, from my own experiences, is to get the internships while you are on summer break. Having that 3-4 months of experience is much more beneficial to getting a job after graduation than 1 or 2 certs

[stoic cave]

Agreed, I got my current job with no certs

[flat sedge]

unless those certs are something like SANS or possibly OffSec.

[peak bluff]

Is SANS better than OSCP?

[flat sedge]

If you feel like you have to get a cert, get something like the basic Splunk cert. For an infosec engineer or SOC analyst role, knowing anything about how a SIEM works can mean the difference.

[languid hearth]

depends

[stoic cave]

SANS is basically unattainable without financial backing from a company

Just putting that out there

[languid hearth]

GPEN isn't practical, so

[agile tinsel]

honesly your best bet at getting a job is knowing someone

[flat sedge]

Yeah. That's kind of my point though - the certs that would be a wow factor for new hires are not affordable

[peak bluff]

ok, got it

[flat sedge]

get the degree, get hired at entry level, work towards your goal seems like a reasonable plan to me.... but everyone's path to cyber/info sec is different

[ancient prairie]

their work-study program and graduate program are actually pretty affordable ways of taking courses, still not cheap but work-study will run you 2.5k for a course last time I checked and their graduate program is something like 20k in tuition (financing available) which also gets you 4-5 GIAC certs

[languid hearth]

you know

i think i might do the masters degree

thats a ton of money tho

reee

[stoic cave]

I might do law school

[edgy tiger]

Would like to add to this to do side project that you can present on your own blog/github

Especially if your trying to get your foot inside the door 😄

[peak hazel]

Why do you want to get your foot in - won't get your head inside the door be more benefical 😆

[warm hinge]

Is the Comptia Cloud+ cert worth anything

[peak hazel]

@warm hinge Yes and No! Yes, it's okay but basic rather do a provider (AWS/Azure or Google ) cert which is backed by the Cloud provider of your choice.

[drifting basin]

Hey sorry to disturb everyone actually I am new here seeking some advice regarding how can I start learning about cyber security

I know some basics using linux from past 1 year and learning something On basic level but need some serious advice

Pls help

[ebon gull]

I mean as someone who had no knowledge before coming to tryhackme doing the pre-security and complete beginner paths has been incredibly helpful

[drifting basin]

okk thanks a lot i will start with it

[lavish blaze]

Yep. Can't recommend those 2 more. Absolutley fantastic. And from there you have a ton of different options to explore.

[rugged sable]

lol

lol

[flat sedge]

what the shit is that process

[rugged sable]

Amazon

"This position is:

• On-site only
• I can't tell you the salary unless we know what your salary is, so we can lowball you
• Btw you'll do 5 hours of interviews non-stop"

[chrome tendon]

https://tenor.com/view/bill-hader-sign-me-up-gif-10903641

[flat sedge]

Yeah, I had to add several local amazon recruiters to my spam block list

Daily emails for shit I already told them I was not interested in? Hard pass.

[stoic cave]

A bad one

Oh whoops

Nothing loaded

[main flint]

how the hell did we let companies get this ballsy

[golden ore]

I just get the crap I am waaay over qualified for

[iron forge]

I have AWS phone interview coming up as a Cloud support Engineer-Security. Anyone with idea how their interview is and what questions are expected? Pls any help will be appreciated. Thank u

[warm hinge]

I have an interview for Digital Forensics Any recommendations for studying for the role and general interview questions I might see?

[stoic cave]

Uhhh digital forensics isn't a role its an area. Do you have the actual role name?

[ancient prairie]

Order of volatility for artifacts may be a good one that comes up

[stoic cave]

Like Technician, investigator, analyst, etc

Yeah order of volatility is a good one

Basics of triage maybe? Idk how to form a question for that one

[ancient prairie]

our eDiscovery guy has been interviewing a ton of people and been super-selective apparently, turned down a guy from Mandiant last week lol

[stoic cave]

Damn

[ancient prairie]

I think he's looking for a certain certification though, as I'm pretty sure is the case for a lot of DF roles

[stoic cave]

Yeah Crypsis hit me up a while ago for a technician role and then was "oh we'll keep in touch" when I told them my DF was education only

I was kinda bummed because the posting was only looking for 1 year of DF experience

[ancient prairie]

DF is definitely a tough one to break into and takes a certain temperament too, can't even get your hands on 90% of the software and hardware the pros are using to practice with

[stoic cave]

Yeah, that's also why i was kind of bummed, I've only used high level stuff lol

Cellebrite, FTK, Encase, and then some Autopsy

I was Cellebrite qualified for a while too, that cert ran out though

[ebon mica]

I think that 5 rounds is the standard for Amazon.

[chrome tendon]

I like being called someone else's name by recruiters on LinkedIN, keeps me humble

[ebon mica]

The recruiters rarely read your profile, so why would they read your name?

[stuck rover]

I guess that's the problem with blue stuff in general. Not many vendors offer free trials for practice.

[fading summit]

Just got a job in cloud(azure) cyber specializing in sentinel playbook!

[paper grove]

Congrats! That sounds awesome

[bold frost]

Congrats NikitaD!

[peak hazel]

Congrats! Be interested to find out more abuot it.

[quaint flare]

Just got an offer in cybersecurity, thank you guys for kickstarting my career. I knew nothing about cybersecurity at the beginning of the year. I learned so much this summer from THM and plan to continue so long as i'm in the field <3 😊

[rugged osprey]

• What qualifications did you already have at the beginning of the year?
• What parts of THM did you focus on to develop skills, and what skills did you develop with THM?
• What job did you get an offer for?

Big grats all around!

[quaint flare]

In March I had 0 qualifications and no IT experience other than my coursework. This summer I did several hours a day of THM trying to learn as much as I could. I joined groups and networked and joined the Cybersecurity club at my school. I got an offer from a really good company in my city for a 2 year cybersecurity rotational program. So excited :)

With THM I learned Linux, networking, basic hacking, I also knew a little python. More than any skill I have, I think what stood out in the interview were my personality and passion for Cybersecurity and learning.

[distant pier]

That is really great to hear you were able to utilize TryHackMe for your career path! 🙂

[rugged osprey]

Love it. Good for you!

[quaint flare]

thanks! 🙂

[cobalt reef]

so australia based in last year of a bachelor of IT, what would be the recommended certs to look into on last year of degree

[umbral field]

anyone here work in cyber?

currently*

[pseudo creek]

lots of people

[errant acorn]

Can anyone look over my resume

[stoic cave]

Just post a redacted copy

More eyes equals more betters

[stoic cave]

Skills above experience

Umm maybe even education as well if it's a college degree or working towards a degree

[flat sedge]

I wouldn't list all the distros or server versions you know

Roll each OS up to single entry

[stoic cave]

For the experience I wouldn't necessarily have it setup like that, I would only put job taskings, ie "Conducted AARs for the S6... Blah blah blah"

Let me see if I have a redacted copy on my phone

[errant acorn]

This is good stuff

[flat sedge]

Also even out the line endings for every bullet

[errant acorn]

Line endings?

[flat sedge]

The eye rebels because of the line lengths

word wrapping isn't consistent in the screenshot

[errant acorn]

It should be more organized like in blocks?

[stoic cave]

Screenshot of old resume

[flat sedge]

+1 for the LaTeX resume

[stoic cave]

It's more organized and robots can read it

So yeah, +1

[errant acorn]

I've been told about the latex

Is it the move?

[stoic cave]

Honestly yeah

Recruiters cant change stuff either

[errant acorn]

Recruiters change things?

[stoic cave]

If a recruiter asks you for a word doc version of your resume when you've already provided them with a locked PDF, probably

[errant acorn]

And thats diffrent if u use latex?

[stoic cave]

And i shouldn't say recruiter, talent agency is probably the better word

[flat sedge]

latex is a typographic programming language

like markdown turned up to over 9000

[errant acorn]

Wow ill look into that

Ill make those edits real quick

[errant acorn]

So like (Windows Server, Linux, VMWare/ESXi

[flat sedge]

Yep

The way you look to be approaching your resume, is that it's an elevator pitch not a complete history.

[errant acorn]

I'm not sure I understand what that means

[stoic cave]

Snippets, not a novel

[errant acorn]

Less is more

[stoic cave]

The hiring manager needs to get a complete picture of who you are in the time it takes to move 1 or 2 elevator floors

Not necessarily less, just more concise

If you want to add more write a cover letter

[flat sedge]

It should also be the jumping off point for the background interview

Cover letters should be done on request and tailored to the potential job - don't write a generic one.

[stoic cave]

Yeah was just going to say that

[errant acorn]

I was just thinking about writing one

[stoic cave]

If there's a slot I always write and add one

[errant acorn]

So your saying I should wait untill its requested

[stoic cave]

If there's a spot for it in the application, add it

[errant acorn]

I feel like there has to be a way for me to explain the VMware part

The recruiter was asking about it so I added that

[stoic cave]

The resume should be written in a way that its easy for long form conversations to take place

[errant acorn]

Should I leave spaces were the bullet points are at

[stoic cave]

Like "hey I see you have x on your resume, I would like to know more. I also saw that you did y with x, how did that work out"

[errant acorn]

I like that projects section

[stoic cave]

Like during my interview I think I talked about CDP and my homelab for a half hour

[errant acorn]

Really

I've been told to make something for my github to use

And to look into splunk or something

[stoic cave]

I mean sure but don't force yourself into something that you don't need

[errant acorn]

Ok

[stoic cave]

You can also put level of clearance, idk if you just redacted that for here but yeah

[stoic cave]

So education put the start and expected end

[flat sedge]

JS and python should be put into the same category, regardless if you decide to call it scripting or programming

[stoic cave]

Agreed

For your internship, expand

[flat sedge]

I would also clarify VMWare ESXi vs vSphere - potentially two separate ecosystems

[stoic cave]

Try for 3 bullets of what you did not just "gained experience with"

[errant acorn]

almost forgot to add that

[flat sedge]

IIRC both bash and powershell are also turing complete languages - no need to separate them out as 'scripting' unless you want to differentiate administration scripting vs application

[errant acorn]

so basicly just remove python from scripting?

so just put programing

[stoic cave]

I would just put "Languages"

Or yeah programming

To be honest I don't like the listing of technologies in the experience section

[languid hearth]

vmwar

[errant acorn]

lowercase?\

[stoic cave]

The experience section in my mind should complement a skills list section and be more about how you applied said skills to the position

[languid hearth]

there was an e missing

lol

if also try to rate your proficiency in languages

[stoic cave]

Proficiency is usually done by listing the languages in level of comfortability/proficiency from right to left

[languid hearth]

you can put down regex and might get asked a question like "presented with a bunch of application access logs, how would you filter on these x protocols" or something

and you might have http:// smb:// https:// ftp:// ssh://

[errant acorn]

good point

i wound not like to get quized on regex

[languid hearth]

and if you (like me) only know http.+:// lol

[stoic cave]

Everyones scales are different so trying to quantify the level may not be possible

[errant acorn]

ok

[languid hearth]

if someone were to put a 7/10 I'd expect them to be able to do lookahead/behinds lol

if they put a 5/10 I'd expect them to know that a dot means match any character, and [a-zA-Z] means match alphabet

[stoic cave]

Right but that's your scale

[ancient prairie]

good conditional lookaheads are just chef's kiss

[stoic cave]

That's what I'm trying to say

There's no global standard

[ancient prairie]

and then they find out you know regex and all of a sudden you're the splunk dashboard guy

[stoic cave]

Lol

[languid hearth]

right, but if a candidate rates themselves 10/10 and only knows how to match exact strings you have a general idea of what to expect as a whole from that candidate

[ancient prairie]

10/10 would be perfect e-mail regex off the dome

[languid hearth]

brb gotta whip out the rfc

[stoic cave]

I hate regex

[errant acorn]

same

[languid hearth]

there we go

have fun regexin' that

[errant acorn]

how should i format my degrees expected end

[stoic cave]

Date format should be consistent throughout the resume

[languid hearth]

start-anticipatedend

[errant acorn]

like

start- 08/2021, anticipated 08/2025

[stoic cave]

08/2021-08/2025

Lol

Personally I like the month as written

That way there's absolutely no confusion if it's month or day

[stoic cave]

Your date over to the side isn't uniform with the others

[errant acorn]

this websites trash

[stoic cave]

OverLeaf

[stoic cave]

Side date is still not uniform

[errant acorn]

not exactly sure im understanding what you mean

[stoic cave]

Far right the date should either be 08/2021 - 08/2025 or 08/2021 - present

[errant acorn]

i see

[languid hearth]

University of TryHackMe            08/2021 - 08/2025
  * Undergrad in Com Sci

thats how it should be, really

[stoic cave]

It's knitpicky but it matters

Yeah was going to get to that in a second

[golden ore]

THM has a university now?!?!?!?

[languid hearth]

this is how mines formatted

[errant acorn]

was there anything beyond the date i should fix?

[stoic cave]

Any courses you've taken relevant to the field

[languid hearth]

• NETWORKING: DNS Servers,
  Exchange Server......

[stoic cave]

And if you have a baller GPA

[languid hearth]

that bothers me, personally

[errant acorn]

courses like ?

[stoic cave]

Look at mine

[languid hearth]

ex. FOR572 SANS

or maybe Introduction to Cisco Networking from your college

[errant acorn]

?

[stoic cave]

I should have said classes

Not courses in that context Spooky, though a course like that should be on the resume

[languid hearth]

Business Ethics!

almost failed that one...

[stoic cave]

Lol

Yeah we had courses in ethics and law

[errant acorn]

Is that what the extracurricular activity is?

[stoic cave]

Cyber Law was basically "the fourth ammendment is a thing, here are cases that have violated someone's rights"

[golden ore]

I would shorten your USMCR info, give it just a higher overview, you can go deeper if they in an interview

[stoic cave]

No, I assume you're talking about about CDP. That was my senior practicum and it was a live fire exercise against other students

[errant acorn]

Oh ok

[errant acorn]

Like how much shorter

[golden ore]

move the network and server pieces out to a skills sections and cover relevant skills (not many employers care about EIGRP or VTP), that should really contain what you are doing as a Marine,

[errant acorn]

That makes sense

Now let's all assume this employer is Facebook how hard would u say an interview would be

[livid cipher]

This could help you @errant acorn It's an open source project that generates resumes on Latex. You can use it locally, no need for the online website.
https://resumake.io/
https://github.com/saadq/resumake.io

[errant acorn]

Thx

[serene umbra]

Gave +1 Rep to @livid cipher

[errant acorn]

That should actually help a lot with the formating especially the date problem

[golden ore]

also try to setup your resume for the type of job you are looking for, if you want to be a developer highlight more developer skills, if you want to do cyber sec than highlight those type of skills

[errant acorn]

im going to work on that too tonight after i finish these assigments

that resume was for this recruiter because I think he wants to see my general skills to fit me into a position hopefully if im lucky

[stoic cave]

Not saying this recruiter is doing this but just be aware that some think service members are easy targets and try to exploit said group of people

[flat sedge]

I usually keep several versions of my resume in my private git server

so that I can target types of jobs more easily

resume#main is the all-encompassing version, with resume#dev being oriented towards SE, resume#qa for software testing, resume#sec for security, etc

one of the reasons i prefer latex over a word template

[stoic cave]

Yeah i separated mine into IA and DF

The one I posted was rough draft DF

[errant acorn]

i have been told that before, this may sound desperate but tbh rn I just want some more experience under my belt lmao

[pseudo creek]

I just have 1 but I only wanna do 1 thing

[stoic cave]

And that's what they exploit

[errant acorn]

I have been enlightened

ill defiantly look more into this recruiter, ik someone else that already works there for more details

[stoic cave]

It took me 3 months and probably 100 resumes to find my current job

[pseudo creek]

do you know about VetSec?

I guess they are Slack not discord https://veteransec.com/slack/

[errant acorn]

i have heard about it in refence to courses

[pseudo creek]

TheMayor has his own discord with a lot of military veterans, but I think VetSec seems like a great place if you are looking for cyber jobs/info/etc

[stoic cave]

Clearancejobs is another good place

But its not really a group

[errant acorn]

https://www.clearancejobs.com/

[stoic cave]

Yep

[pseudo creek]

yeah I get all sorts of notifications and what not from them

but I'm WFH 4 lyfe so...

[errant acorn]

WFH?

[pseudo creek]

work from home

[stoic cave]

Yeah i get their daily emails about ways you can lose your security clearance

[pseudo creek]

my job 'technically' requires a clearance but I'm full time WFH... mostly requires a clearance just because they like making their cyber people cleared people

I'm just waiting to see what people are going to risk their clearance with the vaccine mandate

[errant acorn]

o i see

[stoic cave]

That's a can of worms

I think it will get struck down eventually but how long it will take who knows

[pseudo creek]

oh yeah it is, there is an uproar by a small vocal minority in my company but like people even started talking about fake vaccine cards and I'm like ixnay ixnay

I think it'll change once Covid gets better, really doesn't matter too much after most everyone gets the vaccine, because even without a booster, the protection is pretty high

[fading summit]

If you are interested in cloud(azure) and cyber, look into CS-900 cert.

[stoic cave]

I would also like to point out that there is a difference between antivax and anti-mandate

Unfortunately, people just like to scream at one another

[pseudo creek]

honestly, I would've never thought myself pro-mandate 10-15 years ago but...

[pseudo creek]

I'm assuming you mean Az-900

[errant acorn]

whats the difference between that and idk a sec+

[stoic cave]

Personally I can't get behind it but that's not a convo for here

[pseudo creek]

Az-900 is an intro Azure cert, its not a security cert

Sec+ is a intro security cert

[stoic cave]

Sec+ and GSEC are the intros

Vendor agnostic as well

[pseudo creek]

oh there is also an sc-900 cert, which is an entry level security cert from microsoft, focused on SOC stuff

[stoic cave]

Interesting

[pseudo creek]

or maybe not SOC but I thought the SC-xxx line from Azure is their SOC certs

https://docs.microsoft.com/en-us/learn/certifications/exams/sc-900

[stoic cave]

Makes sense

[pseudo creek]

AZ-XXX are their azure cloud certs

[errant acorn]

o thats good af to know

starting to have a more clear mantle picture

[fading summit]

SC-900 is more orientated to azure focused course and more beginner friendly as sec+ gives you bigger picture of security and less of cloud ☁️. It's really up to you, what are you focusing on?

[cobalt reef]

thanks will look into it

[serene umbra]

Gave +1 Rep to @fading summit

[deep verge]

Hello

Your advice pls

I am no good at windows investigation at all

But wanna get better

Would u recommend specific course? I be done the investigating windows but I think it is more basic

[languid hearth]

generally, you'll want to learn more about the windows system architecture. I'm sure there's some courses that teach it but generally you want to learn about the following things:

• Parent Processes
• Child Processes
• Kernel Mode
• User Mode
• The Hardware Abstraction Layer
• PE structure
• The Windows API
  And other fun stuff like that.

Also, take a look at the Volatility room (https://tryhackme.com/room/bpvolatility)

[deep verge]

@languid hearth thank you for your answer!! If there is some course to share pls do!

[serene umbra]

Gave +1 Rep to @languid hearth

[ancient prairie]

Case of the Missing Szechuan Sauce is a really good exercise to go through
https://dfirmadness.com/the-stolen-szechuan-sauce/

[deep verge]

@ancient prairie thank u!!!

[serene umbra]

Gave +1 Rep to @ancient prairie

[stoic cave]

I'm forgetting the name of it but I remember the name Jane, it was the first DFIR practice I did

It was an older looking website and they had a bunch of labs that you could download to your machine

[mystic lynx]

Anyone here, think they are well qualified in their job of cyber operations? (The offensive side of it)

Aka someone who "knows their stuff"? I'd like to learn your path and what your job is like.

Apologies if that sounds too front 😦

[ancient prairie]

not to answer for someone else, but that seems like a question better suited for a talk in the style of "A Day in the Life Of" - which I think would be a good idea

but as a general answer, everyone's path will likely be different which is kinda the beauty of the field

[mystic lynx]

Absolutely. I was just seeking some career advice. Some background; Getting out of the military, plan to go to college to learn about this type of stuff and try to major in it. I know jack about it though.

[ancient prairie]

Got any clearances thru the military?

[flat sedge]

Aggressive security roles are not entry level

[mystic lynx]

Not the highest.

[flat sedge]

Secret but not TS or TSSCI?

[mystic lynx]

I would assume so. But I'd like to see how to get there, the pipeline

Just a secret

[flat sedge]

That limits some roles, but there are lots of contract companies who will hire you just because of that, regardless of your skillset. You may not end up doing what you want, though.

[mystic lynx]

I want no limit so, I could just get out go to college and become an officer and apply for the TSSCI there

[flat sedge]

Part of the problem of cybersec is that even so-called entry level requires a pretty good understanding of a specific domain and how security can be implemented in that domain for organizational goals

[ancient prairie]

thats def an advantage, I'm not sure how long those clearances are active for but you should leverage that unless you are set on school

[mystic lynx]

Is college not the best way to learn?

[flat sedge]

I think clearances also expire after 3 years if you don't have a sponsor, so someone more knowledgeable than I am can speak to that

[mystic lynx]

Ill ask my guys about that ty juun

[flat sedge]

It depends on what you want to do, how high you want to go, and how much time you want to spend being poor.

[mystic lynx]

Money ain't an issue

[ancient prairie]

ehh just think about it, by the time some material even reaches a full-blown curriculum its likely to be outdated already by the time its taught

[flat sedge]

It's very rare that upper management doesn't have a Masters, a BS or BA is almost required for the step up to management

[ancient prairie]

school is definitely valuable but on-the-job experience trumps nearly everything

[mystic lynx]

And management is where the money is huh

[flat sedge]

Being poor is more of an opportunity cost than an out of pocket, I assume you have something like GI Bill.

Eh

[mystic lynx]

I do

[flat sedge]

The money is in being really good at something

[mystic lynx]

And I been livin poor for a while anyway so, it aint bad. Food and a roof is enough

[flat sedge]

Typically technical people are lured into management by higher salaries, but that isnt' always the case

I wouldn't necessarily say that, Droogy. A lot of the upper level security stuff is as lot of mathematical theory. Like Bell LaPadula modeling.

If you are going to school just to learn a little about everything, a CompSci degree ought to have enough electives to give you a taste of everything if you seek it out

If you just want to enter the workforce immediately through on the job and are looking for a low cost low barrier entry, getting certs from a partnered college (like a vo-tech, junior, or community college) is a good way to crack that door.

Joining local meetups for IT is also a good way to make the social networking contacts needed to have a successful job search

[mystic lynx]

Networking is a life skill.

All valid points ty

Im still unsure of so much though

[flat sedge]

Another thing to consider: the TSSCI basically means you live in the IT closet working on systems at minimum 5 years old.

Greenfield is not a thing most clearance holders touch in their career as a systems integrator for a prime contractor.

[mystic lynx]

So that means... it might not be beneficial to go for the TSSCI?

[flat sedge]

It's a guaranteed stable job

[mystic lynx]

It could be but it could also not be?

[flat sedge]

Flipside of that is it is unlikely to ever touch any 'sexy' IT stuff

Most SCIF programs I've heard about are using 2000-2015 software and hardware; the more secure it needs to be, the older it is, generally.

[mystic lynx]

Makes sense

[flat sedge]

I'm not saying don't do it, just making the case to think about where you want your career to go.

Sorry Droogy, didn't mean to take over the conversation 🙂

[mystic lynx]

Absolutely

Mind if I ask about what the jobs are actually like?

[flat sedge]

That I can't really talk about from experience. This is gathered from a lot of co-workers who have clearances

[mystic lynx]

All I can see it as really is connecting it to cyber warfare. Emp's, overtaking satellites, blinding radars or something along those lines. Stealing information.

[flat sedge]

I have worked SCIF adjacent but not inside for a couple years

[mystic lynx]

Ahhh

Yeah kinda hard to find a clear answer. Obviously lol

[flat sedge]

Do you have an idea of what you'd like to do?

[mystic lynx]

I know it sounds naive, but the offensive side of things. I'm infantry in the army but I got interested in the idea of the other side of warfare, information and electronic.

The idea that hostile takeovers of sattelites, or emp's that charge off twice to take out the backup generators in a nation were real threats. How to defend against that, how to do it?

In the "field" it was about monitoring radios or jamming them

[stoic cave]

It sucks

[mystic lynx]

Boredom eh?

Having to plan to piss ahead of time cus of how long it takes to sign out?

[stoic cave]

No, it's loud and cold and any problems you have you pretty much have to grind until you think of an answer

[mystic lynx]

Sheesh, loud? Why?

[stoic cave]

Because we have racks of servers

[mystic lynx]

Ahhh. Grind til you have an answer, that sounds like it sucks...

[stoic cave]

Yeah somedays you won't be able to think of a solution and then the rest of your day is thrown off

[mystic lynx]

Guess thats a flaw for me then. I like to step back and focus on something else for a bit then come back and see it in an entirely different light.

[flat sedge]

You need to have a really good understanding of how things are put together before you can take them apart in an intelligent way - it's not like disassembling a vehicle or field radio. Many of the components don't have visible components. Start with the #start-here material, and if you like it, it'll give you a taste of the sorts of things you'll have to learn for that kind of role.

[mystic lynx]

Ty absolutely

[warm hinge]

is there any point of learning advanced lvl offensive pentesting or cyber defense if u cant get a job in the near future? for ex ur in high school, and have a couple yrs till graduating, should u learn anyway or put it off till its relevent for u? cause this is 1 thing tht even if u enjoy learning u cant really practise it if u know wht i mean

[glossy jetty]

Learning something will never hurt I guess

[warm hinge]

but isnt this sorta the type of skill tht unless u practise ur just gonna forget?

[remote horizon]

Hi everybody !
I will pass the CEH soon and I wonder what paths or courses should I follow for prepare myself as well as possible (we can talk in French if you want) ?

[warm hinge]

like tht has happnd to me, ive learned c++ and python in the past but i just couldnt find a gud use or place to practise and i just forgot

[glossy jetty]

If it's something you like you can keep using the various tools you've available online to practice and improve your skillset

[lavish blaze]

I mean, they're both an endless learning game. So the more you learn the better. Long as you keep learning lol.

[warm hinge]

ive learnt some beginner lvl penetration stuff before, like sql injections, ddos attacks etc, but i cant really practise them, if u know a site where i can pls share it

[glossy jetty]

Well, tryhackme

You can also use other services like hackthebox, for example

Or doing CTFs

[errant acorn]

So with the resume edited by some people on this discord I have upgraded from being ignored to now getting replies not interviews but this is an upgrade

[warm hinge]

f

[errant acorn]

Lmao idk id say otherwise

I was able to make my resume look more appealing and got replies back

And looking at it i could tweak it more for more specific roles

Rn its somewhat vague because of experience

[remote horizon]

Please, could somebody give me some advices ?

[full oxide]

hello

[pseudo creek]

The CEH really isn't that popular around here, there is a discord called "Certification Station" that may be able to help

[hot viper]

Are you taking the CEH Practical? if not then maybe that would be worth considering maybe

[flint willow]

Hey anybody here who can enlighten me with cybersecurity careers ?

[pseudo creek]

what you mean?

[pseudo creek]

review the rules, rule #1 says no unsolicited DMs. Generally career questions are best for the channel to crowdsource an answer

[flint willow]

Oh sorry , actually I did CEH and confuse wheather should I go for networking path, security testing , cyber forensic path

[pseudo creek]

well... whatever interests you

[flint willow]

I got interest in every path of cybersecurity , just wanna know which is more beneficial for the future

[pseudo creek]

it depends what you wanna do in the future, any of them would be solid choices

[flint willow]

Then I should go for cyber forensic ig

[lavish blaze]

its all about what you find interesting. A friend of mine and i got into cyber sec at around the same time and now im on the offensive path and hes on the defensive. Find something that interests you and explore it. Worst thing that cna happen is that you dont like it so yuo try something else

[flint willow]

I understand thank you :)

[chrome socket]

Does anyone know much about the quality of Open University's Cyber Security BSc? 👀 I feel a bit awkward doing a bachelor's degree in cybersecurity since I see a lot of people doing some sort of computer science bachelors degree followed then by a cybersecurity masters.

[stoic cave]

Masters may be a detriment more than a benefit early career. It moves your salary too high compared to your actual experience. I have a Bachelor of Science in Computer Security and Information Assurance and I was able to find a job so don't feel awkward. I don't know anything about Open University.

Masters are for Management

[flat sedge]

If you are in the US, don't go to any school that is not accredited.

[stoic cave]

Are they not accredited? Then definitely not

Or is it the UK school

[chrome socket]

I'm from the UK and Open University degrees are accredited

[chrome socket]

yeah it's in the UK but it's known for its distance-learning and flexibility :P

[chrome socket]

hmmm ok :O

[stoic cave]

Are you from the UK?

[chrome socket]

Yup

[stoic cave]

Whoops

Didn't see that

[chrome socket]

hahahaha nono it's ok :D

I don't think I mentioned it actually 😅

[timid plaza]

hi guys, i have a question about the try hack me path certificat, is it useful to include it in a resume ?

[quick forum]

THM fits well in a resume as a hobby. Do not count it as experience.

[timid plaza]

can it be counted as a certificate ?

i mean for me a certificate is more like CCNA ...

[distant pier]

Certificate of Completion is separate from an exam certification. 🙂 Hope that helps.

[quick forum]

Yeah, it's not a certification

[timid plaza]

very helpful, thank you 🙂

[serene umbra]

Gave +1 Rep to @distant pier

[timid plaza]

alright, thank you for your help 🙂

[flat sedge]

Rule of thumb is that it's a certification if there is a proctored exam - otherwise it may count as continuing education credits for job or ongoing certification renewals.

[timid plaza]

thank you 🙂

[serene umbra]

Gave +1 Rep to @flat sedge

[ancient quail]

Hello 🙋‍♂️, I heard that if you want to apply to a job it's important to have projects in your CV. What kind of projects can you make that involve security, hacking or maybe automation testing ? I also want to mention that i am entry-level and learning everyday . Thank you !

[velvet spindle]

Homelabs, tools that you've created, blog with writeups on CTFs/boxes, YT channel if you have one, you get the idea

[tawny eagle]

Setting up an opensource siem like an elk stack or greylog on your homelab is a good security project

[languid hearth]

yessir

splunk also has a free 500mb index allotment a day

[rugged sable]

kibana is so good to me

[rugged sable]

you can allso contribute to tools rather easily

I think contributing to tools is easier and you get the added benefit of working in a team which is great! 🙂

One of my projects PyWhat has a lot of good-first-issues for newbies to look at (10! But I can always make some more if you don't like any of the ones there :D) 🙂 https://github.com/bee-san/pyWhat/issues?q=is%3Aissue+is%3Aopen+label%3A"good+first+issue"

We even offer mentoring / a lot of support over in the Discord if you're confused by something or need a lil more help 😄 https://discord.com/invite/zYTM3rZM4T

[lucid vine]

I need some advice for career in cyber security

I have some cyber security experience but the pathway i took was kinda bad. I am in the middle of a crossroad and need some advice

[twilit shard]

try to be more specific about your problem.

[lucid vine]

I am confused of what I am doing with my career and wanted a change but have no idea how.

I graduated with an IT degree and worked a year as a post sales engineer in a telecom selling firewall. Then moved to a big firm doing pentesting. I am hired bc they are desperate for talent. Without any training, they straight away put me in projects doing insider attack, Web penetration test and vscanning. I had a really hard time completing the tasks as I am so lack of the skills required. I self learn everything from thm and am able to do some of it. But now I am afraid to take another project as I know I won’t be able to complete them.

The web pentest and insider attack were really fun. But I don’t feel like I can or should go on with this job as I am far too behind for the skills required.

Besides, I am moving to Canada in 2023. I am not sure how the job market there is for offensive security. I feel like after a year i will still be a beginner in this field.

Therefore, I would like to know what kind of job i can do now before attempting the pentesting career again and should I do blue team stuff instead if i want to secure an entry level job when i arrive in Canada?

[pseudo creek]

thats very... Canada specific but I'd say generally security jobs are similar in various ways from country to country. Honestly, even after 20 years of experience, sometimes I feel like I know nothing 🙂 After 1 year, you are definitely a beginner. What you should've had is someone to help guide you. If you want a more entry level position, SOC analyst surely is that but you'll need to look at various skills required to get there.

What certs do you have? What are you interested in overall?

[lucid vine]

I can’t find anyone willing to guide me. And probably no one would want to?
I have CISA and CCNA. Both are quite useless for a hands on security job i think. I would like to work in pentesting. Interested in cyber security. But probably will be jobless if enter Canada looking for pentesting job. No idea what skill to develop to prepare for

[pseudo creek]

Security+ would be a good one if you want to do anything security wise as would Splunk certs if you want to do SOC. Basically, a company when they hire a junior should be willing to guide you. If not, its not a good company

[lucid vine]

Not all companies use splunk i think. I saw some using kibana. Yes terrible company but multinational company. Good on paper

Will security+ help me to get a job? I wish i can find a cybersecurity pal to guide each other

[pseudo creek]

if you know splunk, then at least you understand the concepts.

security+ will help show you do have base security knowledge

[lucid vine]

I want to get cissp and oscp instead. My friend got cissp by only studying for 4 months. It seems to me is not a difficult cert too

I only know Splunk is a monitoring platform with search head. Log forwarder from client site to send log to soc. they use spl language to find event and create alerts

Logs from on perm, cloud platforms. Azure gcp etc.

[stuck rover]

If you have the experience then sure. If not, you can only get the Associate's.

[pseudo creek]

CISSP (full) requires 5 years of experince in cyber. Otherwise, I'd recommend Security+. OSCP would be good for pentesting but it is still considered an entry level pentesting cert. If pentesting is what you want to do

[lucid vine]

That’s why the problem is I don’t know what i can do now after i leave this pentesting job. I don’t know what i can apply. I don’t want to suddenly be jobless

Feel so useless

[stoic cave]

I order to move to Canada don't you need to have a job waiting for you in Canada?

Canada has very strict immigration standards

[undone shore]

Immediate family members with citizenship is enough as well

[stoic cave]

I'm fairly certain that you need someone to take financial responsibility of you for 7 years after your entrance date. Meaning if you go and then you stop working and paying taxes they will held responsible

That is true

[undone shore]

I've looked into it a bit. My grandfather has dual citizenship, which, according to them, is enough for me to be allowed to emigrate if I wanted 🤷‍♂️

[stoic cave]

Yes

If you have family it's fairly simple

[warm hinge]

I'm very new to this. Can anyone help me to learn hacking

[undone shore]

Oh, have you seen the change in rules btw Moose?

Went through this morning 🙂

[stoic cave]

I've just found that many think emigrating/immigrating? To Canada is simple

[lavish blaze]

Do the pre security pathway

[stoic cave]

Must have changed after I went to bed.

Thank you

[warm hinge]

How ?

[undone shore]

!rule 11

[dire rivet]

Rule 11: No distribution of illegally obtained materials within the discord. Do not pirate books in #bookclub. This also applies to classified (or potentially classified) materials, which should also not be posted in the server.

[undone shore]

🙂

[stoic cave]

#start-here

[undone shore]

Do you have an account on https://tryhackme.com?

[warm hinge]

ok tq

[stoic cave]

You're going to want to head to this channel and it will explain everything for you

[quick forum]

Did uh
Did someone post some stuff with a secret squirrel marker?

[undone shore]

Don't ask 😆

[quick forum]

If it's the twitch stuff, it should say leaked senstive data instead 😉

[undone shore]

Nah, it was vaguely government documents

[pseudo creek]

funny how that has to be stated

[trim hollow]

It's not a "Higher Diploma" is it? is there any more context?

[stoic cave]

Hardware Design?

You're welcome

[stoic cave]

Why would a junior Systems engineer be doing helpdesk?

[stuck rover]

I still don't see how help desk exp is required for sysadmin stuff.

[flat sedge]

It's usually not - it's a stepping stone position to get familiar with process and config before 'graduating'

helpdesk can encompass everything from answering calls to on-site support

[golden ore]

sysadmin helpdesk is usually a bit more tied to helping users with server errors that they may be getting that the user doesn't have access rights to fix

[ancient prairie]

helpdesk is a solid pre-requisite for most IT jobs

everyone should really do a stint in helpdesk

[flat sedge]

I would say customer service, in some capacity.

the most useful things that I've seen people get out of helpdesk is the set of soft skills

[lean chasm]

is it hard to get a job in cybersecurity without a college degree?

[languid hearth]

very

[stoic cave]

Without a degree yes, without certs not necessarily

[rugged delta]

You should read the 'Tribe of Hackers' book series. They give excellent advice on where to start

[lean chasm]

i'll check them out

[lean chasm]

even with certs?

[stoic cave]

Do you have prior experience in the field?

[rugged delta]

They're basically a set of interviews with experts in the cybersecurity space in various contexts. There's 4 books in the series but yes they discuss certs to a certain extent, as well as the importance of gaining experience and how to go about it and the importance of networking and making connections

[lean chasm]

nope, still in high school

[stoic cave]

Then you need a degree

Security is not entry

Or in most cases it isn't

[rugged delta]

Yeah you need to show some level of proficiency in sysadmin, programming, networks, cloud etc.

Some certs are very good indicators of your ability, some are good at showing you've followed a course but you should gain some experience building things. Also, getting a start in tech support/junior systems engineering/Code QA should be on the list of roles you're looking for as a summer job or first job out of school/college

[lean chasm]

so would it be possible to get an entry-level job in something like tech support or junior systems engineering without a degree and then use that experience as a substitute for a degree in the future to get into cybersecurity?

[rugged delta]

Well it would be a good idea to research the availability in your area. There's likely jobs fairs in your region from time to time, also local recruitment agencies would be able to advise you.

[stoic cave]

There may also be apprenticeships in your area

But you're still going to have difficulty with breaking into the space without a degree even with the experience

It's also heavily depends on the company, some have graphs where x number of years in the field = degree

And vice versa

If person A comes in with a degree and experience and person B comes in with just experience but more of it, depending on the company, person A may be taken more frequently than person B

[lean chasm]

okay, thanks for all the information. i'll definitely spend some time researching all of this

[stoic cave]

I would also look into scholarships and grants as they can greatly reduce the cost of college

[warm hinge]

hey, is it worthy to mention devops skills when applying for pentesting job, is it relevant? is there any way to put it in practise or in use in a cybersec carear

[golden ore]

many pentesters write their own scripts during tests, so putting the code you know and skill level can help

[languid hearth]

docker is super valuable

[zenith isle]

What do you guys think are my chances at getting an internship (for university) as a pentester (or the like) in europe having no experience besides multiple CTFs and THM, having a degree as an IT assistant (ITA), studying CS and having multiple years of work experience as an developer and sysadmin? Also there are little to no explicit internships advertised in my area but many full-time offers - shall I enquire them about an internship anyways?

[languid hearth]

cc @quick forum @undone shore

[undone shore]

Quite high, I would say

Certainly in Britain

[flat sedge]

It never hurts to ask - if nothing else, it helps broaden your network for when you start to look for full time work.

[rugged sable]

Very high if you look at wider areas than just your local are, if you live in a small village of 30 people and want to work locally it’s quite low

I did internships with far less experience than you

[warm hinge]

Hi

[quasi stream]

No reason why you can’t reach out and enquire about an internship

I made my apprenticeship by contacting a company when I was 15

[warm hinge]

15?

Wha

I'm curious, if u guys don't mind me asking, can u tell me how much u guys make and ur job role?

[rugged sable]

when i interned i made like ~£1500 for ~3 months or so but accommodation was provided so it was cool

[stuck rover]

On that topic, are unpaid internships common?

[stoic cave]

Not really anymore and honestly you shouldn't take it if thats the case

When I was an intern I was hourly only working 40 a week. Not going to give you an exact pay but I was making more than first year chemists in the Greater Boston area

Housing was also paid for

[flat sedge]

In the US, my advice is to never take an unpaid IT internship, especially if the internship is with a tech company

[tulip sinew]

guy i need to encrypt file like 28gb sized and decrypt easily

with password

[stoic cave]

Wrong channel but if you have Windows versions higher than Home you can right click and go to properties, click advanced, and then go to Compress and Encrypt.

You also have GPG

[tulip sinew]

and

i cant do both compress and encrypt

its also includes subfolders

and i have to wait for 22 hours?

[stoic cave]

So zip the folder structure with something like 7zip or Winzip

Large files take time to zip and perform encryption on

[tulip sinew]

i want to upload this files on a website

[stoic cave]

Most websites arent going to let you upload 28GB

unless they are a file sharing website

[stuck rover]

🙏You have my thanks, Juun and Moose.

[serene umbra]

Gave +1 Rep to @stoic cave

[barren anchor]

I've just got my first entry-level cyber job as an SOC Analyst making 23500 GBP just by having CompTIA Security+ and doing THM. I do have a masters in Physics but that was >5 years ago.

[peak hazel]

Any good sites for applying for Cybersecurity jobs Worldwide? I am considering relocation and just want to understand job market before committing.

[glossy jetty]

I would suggest LinkedIn

[warm hinge]

hi lads

i'm applying to UIUC, UC berkeley, stanford, caltech, georgia tech, ucla, usc and gonna major in computer science; i'm also probably gonna go to grad school to study cybersecurity or AI/ML. which path would y'all recommend?

i wanna get rich off stocks too, so i don't want a career that's too busy (10+ hours a day)

[lofty ibex]

@warm hinge I'll answer you here as it's more on topic for this channel.

To answer your question usually a post-grad degree is overkill for entry cyber security roles, though a degree does act as a check box there are other certifications that can hold an almost equal value such as OSCP.

The key thing you'll want to do is start developing an understanding of how to use tools such as NMAP, burp suite and study vulnerabilities such as OWASP top 10.

As you progress you'll also need to cover infrastructure so learning how to attack Active Directory, general windows and Linux is also going to be required to get a start.
Though a lot of employers don't expect juniors to have an insane knowledge base, they do expect a base standard so ensure you understand everything you're doing

[lofty ibex]

if that's the case, cyber isn't for you

though you won't be working 10+ hours a day every day. There may be some days you are required to work additional hours

[warm hinge]

i'm in high school right now lol, and idk anything about hacking and shit.

the only thing i know is how to do calculus, physics, how to do well on the SAT, etc

LMAO

so yea what should i do?

should i focus on getting into a college with a decent cs program first?

[warm hinge]

oh...

[lofty ibex]

College especially in the states is a big checkbox to fill. A lot of roles will require a degree to get through to interviews so focusing on college is a great start but you can also use the time in college to learn these skills and get a head start

sites like TryHackMe and HackTheBox do great work in teaching these skills through interactive walkthroughs and challenges

[warm hinge]

okay

when i go to grad school, should i study AI or cybersecurity?

i feel like cybersecurity is fun in one way, and AI in another

although i secretly feel like AI is more "advanced"

[lofty ibex]

That isn't for me or anyone else to answer. It totally depends what you find interesting and want to study

[warm hinge]

i mean, i just wanna earn a stable income and use that income to become an investing God, tbh.

[static tide]

lol

[lofty ibex]

there are easier fields to break into for a stable income if that's your only goal

[warm hinge]

and if i wanna earn a stable income, i'd rather do something i'm half passionate about, so i'm doing IT

lol yes i'm dumb i know

but i just love investing

[lofty ibex]

any IT field requires a lot of time and drive to learn, advance and progress. Even though a cyber security job may be 40 hours a week, you'll actually do closer to 60 through self-guided learning

due to how fast it advances there is no real downtime

[warm hinge]

jesus 60 hrs a week?

i'll probs be dead by 35

i cannot imagine that even though i stay up until like 3am everyday cuz of AP classes

[static tide]

40 hours of work + 20 hours of your own time studying

[lofty ibex]

You can work 40 hours a week as per your contract but chances are you wouldn't last too long as you would never remain on top of emerging attack vectors/vulnerabilities

[warm hinge]

so basically a 9-5

[warm hinge]

yea i'll just do AI LMAO

[lofty ibex]

I think those are fair numbers right? Obviously self-study differs for everyone but isn't too insane?

[warm hinge]

cybersecurity is WAY too complicated for me

AI also is

but i like AI a bit more i feel like

just cuz cyber is for geniuses

[carmine heart]

Its maybe not for you.

[warm hinge]

yk what? i might just major in finance

i'm so fucking done with life

idk what to do

i don't have any skills

[static tide]

yeah sounds about right, i do about 2hours/day of stuff loosely related to work, and then probably another 2 hrs/day/average of just anything it related

[lofty ibex]

If you're still in highschool no one expects you to have your entire life mapped out especially career. This is what high school and college are for

[warm hinge]

are you an MIT grad?

[static tide]

no lol

[warm hinge]

then how are you studying cybersecurity

[static tide]

i didn’t even go to university

hard work

[warm hinge]

bro i feel like i'm so behind and worthless; the only thing i can do is get good grades, good sat, and those aren't even valuable skills in the job market

[lofty ibex]

You'd be surprised how many of us haven't got any university qualifications based

[warm hinge]

if you wanna work at BIG companies such as google, you kinda have to have a degree don't you?

[lofty ibex]

honestly it's something to think about (career wise) but like I said, no one is expecting you to have it your life and career plan mapped out at your age, you have plenty of time to work it out as you go. Figure out what interests you and see how to go from there.

The main thing is managing your own expectations, as long as you see progress and take steps towards your chosen path that's better than nothing

[lofty ibex]

Sure in some instances, but a lot of the time experience speaks for itself over a degree

[warm hinge]

that makes sense. i'm probably just stressing too much rn because it's college application season

for the love of God, please, please, at least one top 20 accept me.

i will literally kill myself if i get rejected from everywhere

i worked my ass off

4.0, 11 AP classes, all 5s, 1570 SAT

i'm sorry i've said too much

[lofty ibex]

Yeah that's a stressful season, best thing to do is just take a step back and chill. You've already said you're getting good grades so there's not much more you can do once those applications are fired off

if it's meant to be, it's meant to be 🙂

[warm hinge]

🙂

i'm gonna play some fifa lol

btw, is tryhackme.com for beginners?

like does it start from "what is hacking" or something?

like really basic stuff

[carmine heart]

yeah

[warm hinge]

no preliminary knowledge required?

[lofty ibex]

nope they cover topics from the ground up aimed at complete beginners and have content that tapers up to more advanced topics

[warm hinge]

yay

i'll try tryhackme

[lofty ibex]

Best thing to do is dip your toe in and see how you find it

[warm hinge]

yep

also i have a question for the cybersecurity experts on this server

is white hat hacking the exact opposite of what hackers do in the movies?

as in, is it boring af?

[carmine heart]

I wouldn't say that its boring, but the stuff you see in movies are mostly exaggerated 😄

[lofty ibex]

hacking is completely different to how movies depict it. Some parts are really fun and others aren't. It's all part of the package

[warm hinge]

guys

if i become a cybersecurity engineer(?)

will i have time to learn about the stock market and invest?

[stuck rover]

Work full time and put your money in an index fund like the S&P 500. Day trading sucks and you will lose money 70% of the time. Seriously, your average day trader loses money.

[warm hinge]

i know, obviously i will invest long term, but i've got my homies who are literal investing Gods

man made $500k from $1000

in like 6 month

months

so i wanna be able to like communicate with em and trade with em

[stuck rover]

Well you can make ~40k from 0$ in 6 months with a career in cyber.😆

[ebon mica]

You can also make $0 from 40k by investing.

[quick forum]

Very quickly and easily

[ebon mica]

tbh gambling is more reliable in that.

[cold dawn]

And for every success story like that there are a 1000 failures you won't hear about. Also this is not really ontopic for this channel or discord server.

[molten juniper]

hello, i am currently studying computer science (cyber security track), there is a lot of fields in cyber security. how can i find my self into one ? i have been confused. which is the most common for jobs?

[rugged delta]

Cybersecurity is a broad field within computing. If you want to get into any of these roles, you'd be expected to have good general computing knowledge as well as an understanding of the security field. There is no 'most common cybersecurity job', and there are no entry level jobs in cybersecurity. You're expected to know what you're up to.

Understanding the concepts discussed in certifications like Security+, SSCP, CCSP, CISSP etc are a good way to grow, but you should also understand the topics discussed in this space, like hacking/pentesting, cryptography, systems security, risk management etc... Having a decent grasp of Linux, Windows, Networks, Scripting, Coding etc would be expected in most cybersecurity roles. choosing the role that appeals most to you is down to your own investigation in the field.

A lot of people will already have some experience in tech support, system administration, coding, qa or other roles prior to going for a cybersecurity role. Gaining knowledge and experience and being able to discuss and operate the tools of the trade are an important part of your studies.

There are a lot of resources you can find; such as Conferences, vloggers/YouTubers, bloggers, a lot of really good books from publishers like No Starch, Wiley, Sybex, O'Reilly and others and then of course, training platforms like Try Hack Me and others. Of course you can learn a lot through academic or professional certifications/qualifications and you can also learn a lot by practicing in a safe environment.

Of course, understanding Law and Ethics will be a big part of your journey but the general idea is to not break or break into something you don't have absolute permission to... Your lack of knowledge of the law does not absolve you of punishment, no matter your intentions.

Where you go from here is up to you but there's lots of good advice in here

[warm hinge]

my homies don't lie with their calls

trust

[nocturne tide]

hey

i want work as a remote internship

doing pentest

do you know which company is hiring

[languid hearth]

good luck getting remote internships for pentest

[stoic cave]

Yeah, unfortunately I do not think those exist

[ancient prairie]

they do exist but typically at top firms - FireEye I think just closed their round of applications for next summer's internships, which are remote and include a wide range of stuff, but yeah its uhhh a little competitive

[flat sedge]

I would imagine that FireEye would also have residency requirements for any remote positions, internships or not

[languid hearth]

can confirm FE/Mandiant's interview process is rough

[autumn otter]

😬 there's a cybersec internship for summer 2022 that opened up, but I don't want to take my chance at the stupid application AI pruning..... is it a bad idea to send my resume to the senior director through email if i have it?

[languid hearth]

i wouldn't

external attachment filtering and all that

[stoic cave]

I got an interview with Crowdstrike for Malware Analysis when I was looking for internships.... It didn't go well

"so do you have a github with any of your previous disclosures?"

Ummm I has college coursework

[stuck rover]

Oof. I applied for one but just have home lan stuff.

[molten juniper]

Thanks a lot, that's the most logical answer I got.

[serene umbra]

Gave +1 Rep to @rugged delta

[rugged delta]

If you actually know a director personally and they have given you their email address or if you have a very close mutual contact then it might be acceptable to get in touch, however, most organisations have internal application platforms and you will still need to apply through there. If you do know them, they would have suggested the best way to get in touch or make an application so that they could initiate a referral but they still need you to go through their system

[stoic cave]

Many larger orgs also have Nepotism rules now

[flat sedge]

If you know the director, ask them for advice to get noticed - they may have a backchannel that is approved.

[knotty nexus]

Hi all. As someone just starting out in cybersecurity, do you think there's benefit to doing write-ups to completed rooms (specifically CTF style ones) and then having them available on a website for potential employers to read? I figured it would allow me to show procedures and thought processes.

[brave vapor]

That's a good way to show your process, it may be beneficial to start writing a blog or w.e as you work your way through a room and what you're currently learning. Not only is it good for potential employers but it's good for you to get in the habit of documenting everything you do.

[paper grove]

lol, love the name. Yeah, that's an amazing way to document the process, and shows that you're continually active and learning.

[quick forum]

@ionic shale Not really the correct channel, and please don't ask the same question over multiple channels

[stuck stump]

Hello, everyone. Question for those who perform vulnerability scanning and phishing campaign: what are some of the general resources do you guys recommend for this? I am about to start in a few weeks and just want to prepare myself. this will be my first security role. I have done help desk roles for 3 yrs prior to this position. thank you!

[quick forum]

Vulnerability scanning is a lot of Nessus and Qualys IIRC

[flat sedge]

Those are common tools, but there are many vuln scanners that exist as on-prem, centralized, cloud and/or hybrid.

Nessus/Tenable, Qualys, Rapid7 (Nexpose and Insight? I think?), OpenVAS/Greenbone are all pretty common. I'm sure there are more, that's just the top of my head

[ancient prairie]

phishing typically would not be wrapped up into a VM role - I don't do that work but we do have a VM team I meet with regularly. It's a lot of research and coordination with SecOps and Infra to make sure your tools have proper coverage and also report your findings. There's a ton of KPIs and OMs you'll most likely have to visualize

[flat sedge]

Depending on the scanning needed, OpenSCAP may also be in use

[quick forum]

Honestly I'd ask them what tech, or the job position actually ought to say

[stuck stump]

thye mentioned Nessus (tenable)

[quick forum]

There's a THM room for nessus

[stuck rover]

Good luck waiting for it to set up though. Mine took close to two hours.

[maiden estuary]

Hello everyone, im new to tryhackme and have a question, what is a good start into becoming an intern where i can learn the work environment? im willing to work for free and just gain experience in the field right now

[rugged delta]

Most people in cybersecurity start in another IT position. You might have to work your way up from a support role. You should already be fairly familiar with some aspect of tech like programming, networks, Windows, Linux etc and get some familiarity with each of them. Working up to a sysadmin/programmer role would be beneficial and of course learning along the way, building things and knowing how they work.

Pretty much everyone in cybersecurity has a background in some form of tech and roles tend to require some level of expertise. I'd recommend reading a book called 'Tribe of Hackers', it's a series of interviews with cybersecurity experts discussing the various ways to work towards and into a role in the field

https://www.amazon.com/Tribe-Hackers-Cybersecurity-Advice-World-ebook/dp/B07VPLR1DS/ref=sr_1_1

[maiden estuary]

@rugged deltaIll take a look at the ebook, thanks for the reply.

[serene umbra]

Gave +1 Rep to @rugged delta

[stuck rover]

The Pentester Blueprint is awesome too and features curated interviews from that. @maiden estuary

[flat sedge]

@maiden estuary Interns are not expected to know things or be productive. If the company you have an internship for has high expectations of producing value for the company you should run the hell away from that internship.

Internships are a try-out for both company and intern, the company to locate and groom potential talent, the intern to start to get a feel for how workplaces are different than class projects.

[clear hornet]

@maiden estuary I am in my last year of school. my first internship was for state department that had nothing to do with cybersec and had to do with ML, then by practicing myself i added tools and skills to my resume along with that experience and also got a beginner cert. Then last summer did an internship for Facebook for Threat Hunting. This is a good place to learn tools and get hands on experience with them too. Learn the tools and add them to a resume and just start applying. And what juun said, most places dont expect you to know everything, its more a learning environment where you have fun and gain knowledge.

[stoic cave]

Let me tell you about my internship then

[flat sedge]

Yeah, but your career path is borked

[stoic cave]

I was expected to know things as an IT intern

It didn't go well

[stuck rover]

I'm expected to know how to reverse engineer malware and not blow up my VM. Among other things like wireshark and SIEM stuff. Honestly hard to find internships with loose reqs these days.

[maiden estuary]

@clear hornet@flat sedge@stuck roverThank you all for your replies i will have to keep all this in mind when start to apply. really happy to be apart of the tryhackme community only been here for a week and learned so many things 👍

[flat sedge]

If you are expected to do real work as an intern, that company is abusing you. Internships are short term and expected to be as much a recruiting tool as a teaching tool

[still parcel]

Anyone with CySA+, where are you now and what are you doing?

[quick forum]

@brazen yew let's steer away from extreme politics. Or politics at all.

[stuck rover]

Noted.🙏

[little mason]

From September until now I got rejected on at least 30 companies, I don't have experience relevant to any of the IT positions available because until now I was a Sailor, CNC machine's engineer and freelancer. I'm also student at department of engineering and management of technological systems, navigation, maritime and river transport so i'm not into any of the relevant IT universities. I applied on any entry level positions, internships, didn't care at all if they were paid or not, I got access to three tests, before interview, that's how far I managed to go, no interview yet. The tests were mega stupid, than one was relevant and not fully, three networking questions and one basic C language question and after that only stupid questions. I'm not sad or upset, I think I'm quite capable of getting into an internship position but if it wasn't to be, that's it. Where I want to go with this discussion is that all the companies I found and applied for, required a lot of experience, expected to know a lot of things and to be super productive in the first three or six months, given that I think most people who apply are students like me, and some of us really trying to get into the game and are real motivated to learn as much as possible.

[little mason]

Fair enough

[tawny sphinx]

Can someone suggest me some project ideas for Cyber Security??

[native elm]

Bit of an open ended question. I have a job. I had it before I had CySa though. It's a good certification for getting an analyst role for sure.

[pseudo creek]

This is mostly true of summer interns and especially first time interns in my company. Our company has a small number of year round interns, which are basically repeat summer interns who have shown interest in working throughout the school year.

[paper grove]

I got lucky enough to land a 3 month intern role with guaranteed progression to full time role in digital forensics. I have 10 months experience in help desk, a handful of entry level certs, went through 2 full pathways in THM, and completed a cyber sec boot camp. There are opportunities out there, but they are difficult to find. I had applied to over 150 jobs for about 6 months before finding this. And as they say, you may get many "no's" but you only need that one "yes"

[iron mulch]

It aint easy in any IT field at the moment. HR and Hiring managers are a well known hurdle. Best advice I can give is don't think of a single one of your interviews as a failure. Each one was a learning experience. Play them over in your head and think about all the details. What you wore, what you said, what the interview(s) asked and what their attitude was, etc. Think about what you did right and what you did wrong and how to conquer it in the next interview. Also - although they often ask technical questions.. do NOT get hung up on them. The interview is just as much evaluating your fit at the company as it is your ability to perform the role. Many people get a position they aren't qualified for on paper but they cliqued with the interviewers and gained their trust.

It took me 2 years to get my first tech job after working in the automotive industry and gov - and I can attribute finally getting it to not having a stack of certs or interview questions memorized but instead 2 things.

1. Gamify interviewing. If you're interested in CyberSec consider your interview a Social Engineering exercise. Think psychology and recon. Learn about the company, learn about its culture (Facebook, Linked-In, employee's social media accts). Play that character when you get into the interview. Don't be fake, but think about what kind of language you are going to use and your body language, etc.

2. CHEAT! Look at the job posting you are applying for. Look at it CLOSELY. Each application you submit should be tailored for that job posting and that job posting only. Create a resume template and not a 'catch-all'. The job description and requirements for it should be what is on your resume. Don't outright lie and don't outright plagiarize, but definitely gain 'inspiration'. They are going to compare your resume to the job listing, so try and match them up.

I'm out of characters and this is already a wall of text. Hopefully it helps someone. Good luck!

Also, Black Hills Infosec has a great set of videos on getting a cybersecurity job that covers a lot of this. I highly suggest watching them.

[little mason]

Thank you for the reply and advices. The thing is, I already did those things and really didn't liked to do that at all... umm, I never ended with an interview at all, that's the funny part. I only participated in tests on different platforms that they gave. I will not look at the situation I am in now as a failure, I am one hundred percent sure that in a year or two most likely the companies that refused me they will start to bite their nails at the decision they made. I will continue to work and continue to learn, I will progress, and I will prove to myself that I am the one who made the mistake of applying to such companies. I just wanted to express my point of view and what happened when I applied to internships in the above conversation #junn mentioned

[serene umbra]

Gave +1 Rep to @iron mulch

[iron mulch]

Right on 🙂
Just keep the positive attitude and your nose on the grindstone, and DONT burn out! The second most dangerous thing you can do is spread yourself thin learning all sorts of different material to try and cover the random crap interviews/job listings ask for when its not what you actually want to work in. Focus on your interests and you'll learn a lot of the other stuff tangentially. Keep applying to positions. Keep taking notes. And remember you can call/email the company and ask where you went wrong/what you can improve on. Often they are more than willing to give you some advice. Sometimes, they may turn around and offer you the job. You may have been candidate #2-5 but it didnt work out with candidate #1 for some reason.

[stone plinth]

hey guys does any one know how can i find remote internships in cybersecurity ?

[brazen yew]

that was VERY clearly a joke

[iron mulch]

https://www.linkedin.com | https://www.google.com/search?q=remote+jobs&oq=remote+jobs | https://www.dice.com
Find local companies, browse their websites, call their hiring departments.
Are you in college/university? Generally they have internship programs and the companies work with them to source candidates.
Do you have any IT experience? Do you already have a degree?

[quick forum]

Either way.

[brazen yew]

sad world that we live in

[pseudo creek]

it would vary by what country you are in. Lots of internships these past 2 years were remote in the US but who knows if they will be remote summer of 2022

[ancient prairie]

the last hiring round of internships I saw that start next summer were mostly remote, probably will see some tapering off there for sure outside of the larger firms that can afford/have the means to do remote internships

[pseudo creek]

yeah they may be still advertising as remote as they don't know what summer of 22 will look like yet but they have to start hiring now for interns

[ancient prairie]

I have mixed feelings about remote internships anyway, no one wants to commute as an intern to do crappy work no one else wants to do, but at the same time you miss out on interactions with seniors/mgmt/etc

[pseudo creek]

yeah I didn't have a car in college, it would've been very hard for me to do an internship in college

[ancient prairie]

yep, plenty of kids are in that same situation that have plenty of talent, it's a really thorny issue - im a bit biased because I directly benefited from a remote internship, it would have been really hard to come into the office everyday to do the work I was doing then

[stone plinth]

i'm from Morocco and looking for a remote English internship from a company abroad, i don't like the fact that my country second language is French i studied cybersecurity by my own using english resources (I'm a 4th year engineering student in network and telecommunication) we use French for teaching and inside the companies in my country this is why I'm looking abroad, hopefully i can find something but it's hard once i tell them im from Morocco

[pseudo creek]

yeah generally internships are for either students in that country or citizenship. Even if you have citizenship in one country but live in another cuntry, it can be difficult. I would ask your school for advice on english language internships.

like I know my company will allow for foreign students for internships but they have to be enrolled in a US college/university

[iron mulch]

Internships are generally used as recruiting tools for companies. If you're not eligible to work at that company after the internship your probably wont get it in the first place.

You work for free or little money for the company, they get to evaluate you and bring you up to speed and hopefully bring you on as an employee at the end of it.

Gotta remember companies as a general rule have no interest in 'helping you' learn it/security out of the kindness of their hearts. They participate in internships because it benefits them.

[pseudo creek]

lets repeat that... internships are kind of a way to brainwash you/get you onboard before you graduate college so that they can underpay you but you have a feeling of loyalty to them 🙂

[iron mulch]

Even better description haha.

Get you up to speed to where you benefit the company while at the same time convincing you there aren't better opportunities out there and this 'guaranteed job' after college is the best and most perfect opportunity for you.

(Which... sometimes that IS the case... lol)

[stoic cave]

At my internship we had an individual get fired day 1

[iron mulch]

wut?

[pseudo creek]

yeah, it could be a great opportunity but you are likely to accept less pay/benefits

[iron mulch]

How can you fk up that bad lol

[stoic cave]

Had lied about certain things and was a foreign national

[pseudo creek]

ahh

[stone plinth]

i'm actually just looking to add something to my CV so i can continue my study abroad and maybe learn bit of english while communicating and build relation with ppl

[iron mulch]

Oh. Yea. That'll do it.

[stoic cave]

Also admitted to trying to bypass security protocols on corporate equipment.... Day 1 at a company that held gov work

[pseudo creek]

we allow foreign nationals in our internships which is weird because there was discussion about extending an offer to a foreign national intern and the discussion was like 'she is a foreign national' 'oh, nevermind'

[iron mulch]

Look at online conferences and group participation activities through THM etc

[pseudo creek]

also blogs are a great way to expand your CV while also practicing english

[stoic cave]

Yeah that internship was rough, definitely didn't belong, lack of communication on both sides exacerbated issues, etc

Great learning experience though all things considered

Getting Global admin day 1 should have been a red flag

[iron mulch]

lol

[stoic cave]

Yeah and what I mean by didn't belong is that I was the only intern who wasn't an Ivy League/high caliber engineering school student

Twas reinforced when I was told I wasn't the first choice

[pseudo creek]

how stupid

most of our interns are state schools

[stoic cave]

The other interns were great though

Super nice

I was thrown to the fire though, and I burned

Like to think I turned it around at the end though

[tropic ridge]

I'm currently doing an internship and I don't feel this way at all, maybe it is something country-related

Or maybe I will realise when I actually have a job

[pseudo creek]

I mean I don't think you'd feel like it when you are in it at all

[tropic ridge]

Yeah that's what I meant with this

I'm fine as long as I like it

[stuck rover]

While on that, do bligs really help THAT much?

[pseudo creek]

I mean its really they are trying to grow good will with potential employees, they are also interviewing you without an interview

[pseudo creek]

if you are trying to show interest and ability blogs/github are a good way to do that, its a little bonus

[flat sedge]

Having a blog with some decent entries is a good way to demonstrate competency - it can also become a selling point for consulting or IT services

"Contract with us! Our consultants are experts, see here's their blog"

[stuck rover]

I see everyone doing ctf and room writeups to the point where I feel you're just another speck in a pile of dust so I'm taking a different approach. Blogging about security in emerging tech, unconventional ways I find to earn extra cash while still practicing infosec stuff, my thoughts and reasons for learning a particular discipline and how I think it makes you a better professional etc.

I don't know if that's "enough."

[flat sedge]

The point of writeups isn't to produce novel documents.

[pseudo creek]

thing of blogging as a bonus as well as possibly being something a future employer could look at

[flat sedge]

It's to demonstrate your ability to write something reasonable and understandable

[pseudo creek]

and writing/explaining technical concepts is important

[tropic ridge]

I just blog to share it with my friends that are interested in some topic tbh, I'm not expecting to make a difference or be popular

It helps me learn and I have fun

[flat sedge]

Agree with Zojja. The softskills of communication are by far the most important skills for a SOC or infosec engineering role

being technically competent is important, but without being able to communicate your viewpoint in an understandable way, none of your security knowledge is useful

[stuck rover]

🤔 I suppose doing room writeups isn't that bad. I think I'll pump out a few on rooms I found challenging and had to either adapt or learn a new skill for. I'll make sure to make them more educational than the copy pastes I see everywhere else though

[lavish cargo]

yeah i'll also start doing these myself once when i decide to redo all the rooms i`ve done so far, to see how much i remember and reinforce it

[lavish blaze]

I started doing writeups for rooms that I haven't done yet. My goal Is to convey my thought process as a learn new skills so I sort of just hot down the entire process I go through

[iron mulch]

And don't think of blogs as just an extension of your resume. Lots of CTF writeup blogs are borderline useless and generally from people who just copy/pasted the whole box, and it shows in their blog. Use it as an opportunity to reinforce what you learned. The writeup of the CTF is just the skeleton, flesh it out with information related to different techniques, technologies, etc. Also, approach them as an audit report you would present to a client. Its an important skill and the writeup is an opportunity to demonstrate your technical writing skills which are very important

[stuck rover]

That's what I thought. I try to teach someone with everything I write. Assuming they're willing to follow along.

[lavish blaze]

Yea exactly. For any of the longer ctfs I do or any that involve multiple machines I do my writeup in the form of a pentest report. Granted, nobodies ever taught me how to properly write one but i try to follow the offensive security template when I do them.

[undone shore]

Nothing more annoying than someone just copying your work and passing it off as their own from the perspective of a creator as well

One sure-fire way to piss me off, although some people seem to think it's a mark of respect (yes, genuinely seen that) 😆

[iron mulch]

Yep. Especially when they plagiarize your screenshots even. 0 effort.

[lavish blaze]

Do people actually do that?

What's the point?

[undone shore]

Had one guy do exactly that then claim that it was his own work when I called him out on it

[iron mulch]

Definitely

[undone shore]

Even if I didn't recognise my own writing, and hadn't cross referenced with the room

You really expect me to believe you have a white terminal with a bash prompt of muri@augury?

[lavish blaze]

Damn that's crazy

[iron mulch]

Lots of people want to get into the field without putting in the work. Just plagiarize everything and hope the dont get called out on it.

It shows when they have to step up to the plate tho

Even companies in the field that will rip off your work

[lavish blaze]

Well, that happens everywhere sadly

In any field

[iron mulch]

Very true

[iron mulch]

What a mouth breather. What kind of idiot thinks they can pass that off?

[undone shore]

It gets worse 😆
The frequency with which I have to reject copy/pastes of my walkthroughs that people have submitted as writeups to the room is simultaneously depressing and hilarious

[lavish blaze]

😂

[iron mulch]

Muiri - You should put a Wall of Shame up on your blog 😄

[lavish blaze]

How stupid does someone have to be to try to submit a copy paste of the room as a writeup

[undone shore]

I dread to think 😆

[undone shore]

Ahahaha. So tempting, but something tells me Dark would yell at me

[iron mulch]

Possible lol. I'm sure you could censor the names enough to demonstrate plagiarism will be caught

Without getting into trouble that is 😉

[undone shore]

Tbf, it's no worse than Troy Hunt's wall of spam shame

[iron mulch]

I agree. If people dont want to be blasted for doing it.. then they shouldn't do it.

[stuck rover]

I love the symbolism in your host name being augury by the way.

[stuck rover]

Yes! I found a blog just like that the other day. It was one of Muiri's rooms too lol

[undone shore]

Disadvantage of writing easy-to-understand beginner content

The people who plagiarise are the ones who can't write for themselves yet.

i.e. newbies in the field and EC Council

[lavish blaze]

Lmao

So true

[stuck rover]

Doesn't copy pasting actually make your prospects worse though?

I could never copy paste because I feel it's over done and I'm damn lazy.

[undone shore]

It makes you look lazy, and it shows you have no regard for intellectual property

[stuck rover]

Thought so.

[undone shore]

So, yes. I certainly wouldn't hire someone who I had seen do that

But that doesn't mean that complete newbies would know that. If they think they can get away with it 🤷‍♂️

[stuck rover]

Same. All too often people think just putting out content helps but they don't think about the quality.

A reason why most people's blogs are empty.

[undone shore]

I really need to use mine more

It used to be my main "CV Bolster"

That and I liked writing on it 😆

[static tide]

i rarely write anymore cause i only wanna put out "perfect" content which takes a whole ass while to actually perfect

[stuck rover]

Writing something useful feels amazing. Can't wait to hit the sweet spot with about ten plus amazing articles.

I have like 4 drafts now. I should finish one and publish it tomorrow.

[stuck rover]

Being distracted doesn't help either.

[stuck rover]

Really? I thought your rooms did that.

[undone shore]

Jake's hit the nail on the head with that one 😆
It's all about time. The better you get, the more you have to write about, but the less time you have to sit down and do it.

[undone shore]

I had my blog before I started writing rooms -- which is part of why I don't use my blog as much now

[static tide]

from a room i have yet to finish 🙁

You are the only one in this room. and this room is 150 days old.

also that should be a comma, not a full stop tut tut tut

[undone shore]

Beat that 😆

[static tide]

gimme

[stuck rover]

Right? When I was a noob. Which was a short while ago, I had no ideas for rooms or articles but now I do but can't really sit down to perfect them.

Actually I'm still a noon

But atleast now I can root a box XD

[quick forum]

Done.

[undone shore]

Nuh uh, three users 😆

[quick forum]

Skidy and Ashu

[undone shore]

Still count!

[quick forum]

Fine, my super hard box

[undone shore]

Wait, wtf. How has it been that long since you started building that one?

It can't have been

But yeah, you win 😆

[quick forum]

It was when covid first hit IIRC

[stuck rover]

Did the blog help with getting a job by the way?

[undone shore]

The job I have just now? No, that was because they were expecting a second year student and I gave them a presentation on exploit dev.

The internship I had over the summer was my OSCP

I don't think any of my employers have actually seen my blog 😆

[stuck rover]

Somehow I expected that.😂

[quick forum]

I wrote something neat for my current comp, we'll see if that's published

I want to do more content like that, a deep dive into a topic