cyber-and-careers

[undone shore]

Yeah, writing for a company blog is good. I've avoided it for SBRC thus far as it would involve putting my name on it 😆

[stuck rover]

👀You couldn't even put it on your LinkedIn so not surprised.

Ah by the way. Has using a logo in place of a real picture affected you in any way? Asking for myself.

[quick forum]

Yep

[undone shore]

Nah, although anonymity doesn't last forever

A logo is a lot more iconic than your face -- look at Dark: he's built an entire brand around his resistor

[quick forum]

Diode

[undone shore]

Oops

Shows what I remember of high school physics

Thanks James

[quick forum]

Resistance is futile

[stuck rover]

That was a good one.

[stuck rover]

That's what I thought too but...when a CISO tells you that you should change it to a real picture...

[undone shore]

You thank them for the suggestion 🤷‍♂️

[serene umbra]

Gave +1 Rep to @stuck rover

[stuck rover]

I'm still not gonna do it though. I'm that type of person.

[undone shore]

Really..?

Bad bot smh

[stuck rover]

Ez rep

[stuck rover]

I did.

Still not gonna change it anytime soin though.

[iron mulch]

I use my avatar on zoom calls with Execs on a daily basis

Used to have Hackerman from Kung Fury but people actually thought it was me, so I just use my avatar. Its memorable and has helped people connect my JIRA/Git work to me better than just a name

[stoic cave]

Yeah eventually I may have to go real name on internet

But idk if i like that

[iron mulch]

Yea I've thought about it a few times but I just cant jump that hurdle yet.

[median grotto]

i am having a kick off meeting for my first ever pentest tomorrow. i will be testing the authentication for a few web apps. ive been trying to think of some good questions to ask the client tomorrow, but i am blanking. i was wondering if anyone has some good questions in mind that would be helpful for me to get some useful info from the client?

[lavish cargo]

what is a good host to start a blog, what do you recommand?

[stuck rover]

I kinda do this but I make sure my life's segmented so it's hard to relate the real "me" to my pseudonyms.

[stuck rover]

Medium.

Or you could create a static page and host it free with github pages.

[stuck rover]

Amazing! I can't exactly help you there but looking at the OWASP testing cheatsheet and triaging from there is a good idea.

[stuck rover]

I should really watch Kung Fury. Hackerman has glorious hair.

[stuck rover]

You mean you don't turn on your camera?

[lavish cargo]

Is the free option good on its own, or you should subscribe to it?

[stuck rover]

You don't need to sub for writing. Just reading stories.

[lavish cargo]

so basically if i dont subscribe no one can acces what i write there?

[stuck rover]

No, no.

[undone shore]

Absolutely do not use medium for infosec stuff. They have a nasty habit of arbitrarily deleting it all...

Something something ToS providing hacking instructions

[stuck rover]

They have a system where each reader can access member only stories twice per month without being prompted to subscribe. As long as you disable that option then everyone can read your stuff as much as they want.

[stuck rover]

Interesting. I see many "pros" using it despite that. Maybe they haven't got to them yet?

Off the top of my head, Tiberius and Vickie Li but they also have personal blogs.

[undone shore]

🤷‍♂️
I started out using it. Someone reported my AoC2019 writeup for containing hacking content, and the entire account got removed.

By that point I had already moved everything to my own blog, so I just shrugged and moved on, but I would not recommend using it for anything hacking related.

[stuck rover]

I guess I'll have to work on my own blog sooner than expected then.

To Github pages!

[undone shore]

They're both also webapp pentesters, so no mention of Metasploit or other well-known hacking frameworks.

[stuck rover]

Plenty of people post their writeups containing those tools in there. Maybe it's just a matter of time til they're found.

[undone shore]

Or a matter of time until they're reported for it

[lavish cargo]

ok, i guess i'll stay away from it then. what are some other decent options on the free side if possible xd

[stuck rover]

That's part of what I meant. Welp. Time to learn web dev faster than expected.

[stuck rover]

Github pages.

It's not that hard to set up one.

As long as you know some Python you could spin up a flask or django site. Which is what I'm gonna do.

[undone shore]

Can you run Flask apps on Github pages? I thought it was only static content?

[stuck rover]

I only know about Django tbh and yeah static pages.

[stuck stump]

thank you, I will check it out

[serene umbra]

Gave +1 Rep to @quick forum

[median fern]

So I’m curious as to where I’ll get to when I just get a degree in computer science and go for the OSCP, eJPT, PenTest+, etc

It’s what I’m planning on mostly doing but will I be able to get a high paying job with that??

Just in general I guess

[quick forum]

I'd honestly say only one of those certs? They're a little redundant

[median fern]

Then OSCP since it’s like the most valuable, correct?

[quick forum]

Look at job listings in your area

[median fern]

Alright then

[lavish cargo]

wasnt security+ the most important one?

[quick forum]

100% depends what you're going for

Degree and OSCP can get you a long way in pentest roles

Sec+ is a generic security cert, versatile but not specialised

[lavish cargo]

i see. so its better to go for one that specilises in whatever you want to do

[quick forum]

Sec+ is appropriate sometimes/often

But there's no match for actually looking at job specs and seeing what they're asking for.
That's the way to get localised, accurate, and specific reqs.

[stoic cave]

Sec+ is also a requirement for a lot of government positions

[covert violet]

Hey Folks : I'm hiring for tons of mid-senior level, remote infosec jobs, if you want to learn more, feel free to get on my calendar: calend.ly/gshwrec

[undone shore]

If you drop me an email from a legitimate corporate email address to [e-mail], I can give you a recruiter role to post that in #jobs-board 🙂

[pine elk]

Hey guys I want to get into hacking

What steps should I take

[lavish cargo]

start doing the learning path on tryhackme

[stoic cave]

Hello, in the #start-here channel there is some information on how to get started. Also you may want to verify to get a color and post media. Instructions are below.

!docs verify

[dire rivet]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[vernal flax]

Hey guys. I’m pretty much almost ready to take the Pentest+ certification, my first certification. I have about 5 years IT experience but none in cyber security and an associates degree.
Do you think there’s any benefit in going for the Security+ certification after, since i’m still trying to get my foot in the door?

[polar rock]

It’s very odd to get security+ after pentest+ but it’s also never going to hurt you

[gusty iris]

If you are going to do a general Cyber Security analyst certification it might make more sense to do CySA+ or, better still, an ISACA CRISC. Do a job search for CRISC, then a job search for CySA+ and make your own decision. Doing a general Certification like this gives you a virtual certain foot in the door..... then you can use your Pentest+ to move into the Offensive Security world.

[scarlet silo]

Why is this abnormal?

[native elm]

Difficulty scale. According to Jason Dion, Sec+ is easier than CySA+ which is easier than PenTest+. however, that's just peoples opinions. IMO CySA was hardest out of those 3.

[quick forum]

Because CompTIA's hierarchy says sec+ is below Pentest+

[scarlet silo]

ah noted noted. in THM the PenTest+ path is rated easy, so if i complete that should the PenTest be easy to complete??

[native elm]

I did it that way. I would say yes. Do the PenTest+ path, and then read the pentest course materials real quick. You'll be ready.

[scarlet silo]

sweet thank you 🙂 looking forward to it

[serene umbra]

Gave +1 Rep to @native elm

[vernal flax]

Thanks for the feedback guys

[warm hinge]

hello can someone tell is it possible to become a cybersecurity specialist with doing bachelors

[pseudo creek]

bachelors + certs

[gusty iris]

+1 to what @pseudo creek said. Many employers want to see a cert + a bachelor's degree. If you choose the right bachelor's degree you might find that it has a CEH subject in it and a lot of other good stuff.

[warm hinge]

Is there any opportunities for Cybersecurity volunteering?

I see there's some for coding, but didn't see any for cyber specifically

[pseudo creek]

conferences always need volunteers

or are you talking about things like open source development?

[scarlet silo]

What are conferences?

[pseudo creek]

things like DefCon, Bsides, Blackhat, etc, etc.... basically events that usually include talks, CTFs and other things

[scarlet silo]

Oh ok a literal conference, it seemed like it meant something else the way you used it, thank you 🙂

[serene umbra]

Gave +1 Rep to @pseudo creek

[pseudo creek]

it is a great way to network, a little adder to your resume

[scarlet silo]

I’ll look into it thank you again 🙂

[digital cypress]

How long did it take you to hear back for a job offer?

I had my 2nd round of interviewing 3 weeks ago and he said it would be a little bit because I was the first interview and he had other candidates to get through but 3 weeks seems like a bit much. Think I just got ghosted

[flat sedge]

That's not unreasonable.

If it goes another week, contact the recruiter

be nice about it, being a jerk will pretty much mean your application gets round-filed.

[digital cypress]

Lol I'm nice

[azure bridge]

Hi advice please for my DF/IR path , eCIR, Cysa+ or crest CPIA? Thanks in advance🙂

[steady saddle]

One Common question i'm sn experienced fullstack developer looking for transition in to information security and honestly frustrated with the recruitment process as everyone is looking for "experienced" candidate ? I mean how the hell should i gain experience if i don't get hire anywhere on the basis of certification ?

[pseudo creek]

well it depends what they mean by experienced, do they mean experience in general or cyber? Usually when our job listings list experience, they are talking about general experience

[gusty iris]

@azure bridge - eCIR is fantastic if you want to actually learn useful real-world relevant skills. But recruiters have mostly never heard of it. 😫
Do a search on your local recruiting site for eCIR. CySA+, CPIA, CRISC, etc, look at how many jobs call for each certification, and then make your decision. In my part of the world, CRISC wins by a massive margin. THM is going to teach you the real-world skills, eCIR might help, but something like CRISC gets you noticed by recruiters. Sad but true.

[velvet spindle]

What are your views when it comes to on-site vs remote for an entry level job? How much of a benefit is working in an office?

[pseudo creek]

working in an office is a great benefit for those that are early career

[gusty iris]

Hi @velvet spindle . As a hiring manager, I have not actually IRL met any of the people I hired since April 2020. We work exclusively remotely due to Covid. But my country has chosen to minimize the number of Covid deaths, and in my country online work is mandatory if it is feasible. Most of my team love this way of working and would resign if I told them they had to come into the office. I suspect that it would depend on the country you live in.

[pseudo creek]

basically the networking and in person contact is very important, doesn't mean you can't be succesful remote but I've noticed more careers being stagnated / feeling stagnated due to remote for early career peeps

[gusty iris]

+1 to what @pseudo creek said. Networking is important if it is feasible.

[quick forum]

Being able to joke about and socialise with people in person is great.
Having a dedicated, clearly defined, separate space to work in is great. The commute is time to wake up, then chill out.

[pseudo creek]

you can network remotely but its harder

[quick forum]

Building on this, I got a physical book to borrow from my coworker. Couldn't have done that remotely.
We sometimes adventure out the office to the shops etc at lunch.
Team builiding!

[gusty iris]

Absolutely true @quick forum . My team have been remote since April 2020. No culinary adventures for us. On the + side, 2 of my team members moved to the mountains, three now live beside beaches and one moved O/S to a lovely property in New Zealand. As @pseudo creek said, this will potentially stagnate their careers, but they know this. I guess, if they want, they will just come back into the city when it is all over.

[quick forum]

Also work curries, very good

[gusty iris]

Stop. You're killing me.

[quick forum]

Issue is, I haven't had a remote position where I work as part of a team. Only remote stuff has basically been contracting, so I can only give one side of the story

[azure bridge]

Thanks for this advice . Is CRISC only aimed towards risk management ? Or would it help with IR

[serene umbra]

Gave +1 Rep to @gusty iris

[gusty iris]

Crisc is oriented towards Risk Management in an Information Security context - so that includes DR as well as Cyber incidents.

Find a Cert that looks like fun and then type it into your local Job Search interface. Find a winner 👍

CRISC ain't the only Cert that scores well.

[azure bridge]

Thanks for this 🙂

[serene umbra]

Gave +1 Rep to @gusty iris

[wanton wedge]

Hello all,
I am kinda stuck in between two univs for my master's in Cybersec
1st : University of North Carolina, Charlotte
2nd: George Mason, Fairfax
Can you help me out choosing one, with reasons please if possible

Thanks in advance
As of now, I am pursuing my Undergraduate about to pass in 2022

and also please tell, where can we find some good internships easily

[autumn otter]

I got an email back/interview setup for a post-grad security analyst entry position

I don't even graduate til 2023 lol

[flat sedge]

Go work for a few years before going for your masters in cybersec. Until it becomes a requirement for advancement, it will price you out of the jobs you'll need experience in to get to that next level.

[autumn otter]

Honestly, am only gonna go for a master's if a company helps me out. I already hate being an undergrad and having to pay for part of it, I'm gonna utterly hate going for a masters and paying for it myself again

[pseudo creek]

Why are you going to graduate school? What are you hoping to do?

[wanton wedge]

career growth , i literally want to work in Cybersec, options in my country are less, soo ..

[pseudo creek]

so you currently aren't in the US but want to come to the US for school with hopes of getting job? I guess thats difficult because companies in the US really don't like entry level employees with a MS degree.

if you aren't a US citizen, I would not go to George Mason. Most of the recruiters there will want you to be a US citizen as most jobs in the area are gov related jobs.

One thing I'd recommend though is if you do decide to come to the US, you work on certs.

[warm hinge]

Just curious to know..what qualifies a candidate for that recent content engineering job THM just posted?

[static tide]

well they have the requirements section

[warm hinge]

Crap I haven't looked

[warm hinge]

Thanks I'm working on all this now

[serene umbra]

Gave +1 Rep to @static tide

[wanton wedge]

Hey Thanks for your advice, so I passed my SY0 601 recently, so from now I am planning to prepare for OSCP to complete it before my master's end!
is it a good idea or can anyone suggest something else?

[serene umbra]

Gave +1 Rep to @pseudo creek

[tropic ridge]

Does THM offer any internships?

[pseudo creek]

yeah that would be good

[pseudo creek]

they had one before, believe it was limited to specific locations

[tropic ridge]

It is a company from the UK, right?

[pseudo creek]

yup, someone can correct me if I'm wrong but I think the internship I last saw posted was for those who are from the UK / right to work in the UK

[tropic ridge]

Okay, thanks a lot for the info, I'll stay tuned 🙂

[serene umbra]

Gave +1 Rep to @pseudo creek

[summer coral]

i am sub to htb and thm is it enough to prepare for oscp?

[rugged sable]

no

merely subbing to a service does not prepare you, you actually have too put the work in

if you actually do put in work, it again depends on how much work you do 😄

[undone shore]

And what you work on

[lavish blaze]

Take what I say with a grain of salt because I haven't taken OSCP yet. But from what I've heard, if you actually practice exploiting machines manually, and get good at it, that'll be good prep for OSCP

[slender nest]

Any SOC analyst here? Need some help

[polar rock]

We prefer you to directly ask your question rather than ask to ask

[undone shore]

https://dontasktoask.com/

[brave vapor]

Any Java experts around?

[slender nest]

Do you participate in IT audits along with SoC operations ... What exactly do you do in audits? Also how do you validate false positive alerts in siem tools

[polar rock]

I-
Please refer to what we sent directly above you.

We prefer you to directly ask your question rather than ask to ask

[polar rock]

These seem super hyper-specific is this for an exam or homework?

[brave vapor]

it was a reference to this, haha

#cyber-and-careers message

[slender nest]

Yes sir... I have an interview Tomorrow

Is THM only hiring remote working professionals from EU region or from other parts of world too?

[polar rock]

Most of those will be dependent on the organization and their response policies. Auditing really isnt something that I do but there are plenty of resources about it. Validating false positives will also depend on policy, generally its just a matter of cross referencing sources

[polar rock]

THM has hired professionals from all over, location isn't really a restriction. I'm from the US and work with the team

[pseudo creek]

and they will specify if it is country specific if so

[slender nest]

Thanks @polar rock for the information 🙌

[serene umbra]

Gave +1 Rep to @polar rock

[tropic elbow]

anyone have any recommendations for looking/scoping out internships in infosec

sorry if this is the wrong place to ask that 🤣

[pseudo creek]

Join LinkedIn, build a network, also look at college recruiting sites of companies that operate in your country

[cold dawn]

I'll be glad when my hiring spree is over.. I feel like I'm working in HR instead of infosec 🙂

[compact basin]

Sorry if this isn’t the right place to ask this. So I’m a third year student looking to get a bachelors in cyber security. I have a blog where I post about learning Linux and such, but I’ve been very overwhelmed due to the vast amount of information and resources out there and skills and tools to potentially learn that I’m not really sure what to choose to make the best use of my time outside of classes. My goal is to eventually work on the defensive side. What are some things I should be spending my time learning to develop a good skill set as I look to get internships and eventually a job?

[pseudo creek]

I think this provides a good overview https://dfirmadness.com/getting-into-infosec/the-five-pillars/

Certs are huge these days so I'd be eyeing some certs, like Network+ and Security+ and I'd also look at a cloud cert, either AWS or Azure

The Pre-Security path and other paths on TryHackMe are also really good

[compact basin]

Ok thanks! Unfortunately for me I can’t afford certs right now, being a broke college student and all

But I’ll definitely look at that site and use that and be doing the THM paths. Thanks!

[pseudo creek]

I would definitely look at certs before you graduate though, it'll really help with the job search

[compact basin]

Ok I’ll start looking then, thanks!

[normal iron]

@j21 also check with your school and see if theyre able to pay for some of the certs. my school received a grant to pay for any certs for the cybersecurity students

[stuck rover]

There are some that are free rn. Speficially Cloud.

[compact basin]

Oh ok, thanks

[silk mason]

Has anyone done / heard much about TCM Security’s PNPT cert? I’ve been doing a lot on THM/YouTube/Udemy /INE and other sources but looking at my first cert (I’ve got a background in IT)

Unsure what route to take? eJPT / CompTia / TCM

Would it be a massively bad idea to try and dive head first into something like OSCP / CEH courses?

[stuck rover]

OSCP is harder so depending on you, it might be something to work up to. CEH is a waste of money unless you live in India. And tbh the title is deceptive considered it's a theoretical exam. PNPT is extremely practical as the name implies. You're given 7 days to complete the engagement ending with the submission of a pentest report and debrief of the examiners acting as a client. The course material and exam focuses on AD which is extremely common in real pentests plus the exam is unproctored so if being watched while you do an exam isn't something you're ready for rn then PNPT. eJPT is similar but doesn't teach AD and has an MCQ at the end with answers gleaned from the exam so it's less real world. It's also unproctored and you have 3 days to complete it. They both offer free retakes where the rest don't. So they're good for working up to OSCP but there's nothing stopping you from doing it right off the bat. eJPT is the easiest from what I've heard.

CompTIA certs are MCQs too iirc. Sec+ is what you'll see advertised for most blue team roles but don't take my word for it. As always, do your own research and see what's best for you. Cheers!

[unreal geyser]

Anyone from Canada here who is in located in Canada as of now? (btw Thanks for all the help Hydra)
I am planning on moving there for MS in CyberSec (and preferably a job) this feb or sometime around that, was looking for someone local, I can get specific should know stuff from.

[silk mason]

Thanks for your response - I’ve done a load of research about how to break into the field which seems to contain the same information of where to study etc but the major difference seems to be which certs to do first.

I’m struggling with an internal debate of if to do something easy first or just try and deep dive - if I do something easy and pass the plan would be to move onto something harder anyways. So it also seems kinda pointless to waste a sum of money on something easy too 😂

[serene umbra]

Gave +1 Rep to @stuck rover

[stuck rover]

PNPT is hard and practical.

Might be your best bet

[silk mason]

It also seems reasonable in terms of price - how is it with using it to get a job though? Is it “HR Approved” or is it still relatively new?

[stuck rover]

If you want HR approved then you go for SANS or OffSec tbh. The new ones may be more up to date but less recognised.

[quick forum]

Note, that advice highly depends on where you are.

Look on linkedin at job postings in your area/country and see what they're asking for

[silk mason]

Aye I’ve been checking job postings regularly, but struggling to find a “trend” of which qualifications people are after. Thanks for the advice guys 😊

[static tide]

put the qualification in the search box rather than the job title and see how many are returned for each

probably start with terms like OSCP, CEH

[undone shore]

James is right to say check local job postings. As a general rule PNPT isn't really recognised just now though 🙂

[polar rock]

I’ve actually begun to see them on some really large vendors. Clear and Optiv are two that come to mind right now from postings I’ve come across

[stuck rover]

Mostly US though. TCM has been pushing for recognition quite a bit.

Wouldn't be surprised if it surpassed eJPT in a few months not that that's saying a lot.

[undone shore]

Aye, one or two. It's got a way to go

It will get there, but it's not one to rely on to get you a job

[languid hearth]

kekw, I was thinking the same thing

[fringe rivet]

I'm going to enroll in a college IT course next year, after high school, but I feel like it's unnecessary considering I'm able to do 99% of the things on that 4-year syllabus. Do y'all recommend multitasking college and studying cybersec for certs? (Not really a career, but still edu so this is probably not the right channel)

[flat sedge]

I really doubt you are able to do 99% of the things on that syllabus to the same depth of knowledge you'll get in that 4 year program. If you really do think that, please create a github and just go straight into industry. If you are that good already, you won't have a problem getting a job once you can get past the initial HR blockers.

Practical projects that you can build into your curriculum to push you beyond the coursework is going to be a much bigger boost on the CV than most entry level certs, depending on what kind of career you want build

[bronze lodge]

Is anybody interested in some IT roles with a cyber focus? They aren't SOC/Red Team/Threat Intel but general IT infrastructure like server infrastructure gigs with cyber tacked on. They roll up specifically to me and we are hiring in Australia, Europe, and the US and we are remote friendly 🥺

[jagged turtle]

Thanks for that. That link is fantastic.

[serene umbra]

Gave +1 Rep to @pseudo creek

[willow perch]

is there a specific requirement? Im just looking for experience

[warm hinge]

Hey everyone, quick question here. Is it a good practice if I add a "Currently preparing for OSCP" in my CV?

[stuck rover]

Yes, it may get you past an automated filter and it always shows you're willing to self study.

[quick forum]

It's also something I'd definitely discuss in an interview

[warm hinge]

Thank you for the answers

Can you please tell me where I can add it? Should it be in the summary or with the certs that I've achieved?

[stuck rover]

That honestly depends on you. Some people told me it looks better in the summary, others tell me along with existing certs

[warm hinge]

I think I'll just add it in the summary in order to let the "achieved certs" list more specific

[quick forum]

I'd definitely not put it with the certs

Because you haven't got it yet

[warm hinge]

True. Thank you for your time. Have a great day

[serene umbra]

Gave +1 Rep to @quick forum

[undone shore]

I put it with certs myself, but mark it very clearly as "Currently studying for"

That's what got me the job I'm currently in -- I sat the OSCP exam about a week after sending in my CV, got the interview, had received confirmation of passing the day before the interview

[warm hinge]

Does anyone have hands-on experience with the learning platform "Code Red" of EC-Council? https://codered.eccouncil.org/

[native elm]

I just have a list of my certs with the date I achieved them and then below that there is In Progress with the cert and the passing date I'm aiming for

[hallow zinc]

the last advice Dave Kennedy and some others big employer i asked, they all told me that is better to have a blog and github account who show your passion and wiilingness to learn than having big cert on your resume, all that for a junior pentester role.

[quick forum]

Maybe for software dev.
If your github isn't pentest relevant then what's the point?

[undone shore]

Tbf, coding tools and exploits is still good

[quick forum]

That would be pentest relevant

[rain oyster]

Passed the beta exam first time! Couldn't have done it without you Tryhackme

[warm hinge]

Thank you guys for the advices

[bronze lodge]

We are hiring junior and higher level roles, maybe PM me and we can talk further

[bronze lodge]

I saw your post and was like "I need to check my email" and I passed too!!

[runic shoal]

Im guessing you also just got to hear back from the beta? Good job! I did too, i’m so happy

[ionic olive]

Hey guys, I’m slowly trying to get more involved in the cyber security industry. I did several rooms on tryhackme, along with some courses on INE and I’m currently going through the labs on PortSwigger while reading ‘the web application hacker’s handbook’. I started looking for summer internship and graduate position over UK and Europe and I thought I should post something on here as well in case any of you know of any available positions 😅

And I just realized I posted it to the wrong channel 👌🏼

[stoic cave]

This is the correct channel

[ionic olive]

Ah, okay. Thanks

[stoic cave]

If you've done some rooms you can verify by following the instructions

!docs verify

[dire rivet]

TryHackMe

Verify your TryHackMe Profile!

https://help.tryhackme.com/community/discord

From TryHackMe with ❤!

[random solar]

How difficult did you find it?

[rain oyster]

Not terribly difficult. Mainly used the pentest course to study. Spent a month studying 30+ hours a week. The last week was mainly spent going over the exam objectives for the previous edition since the ones for pto-002 hadn't been released. Sections 1 and 5 were likely my weakest as those focus on the business side of things rather than the technical.

[random solar]

👍 sounds good. Im gonna wait a while and get some feedback for pto-002 before paying for the exam 🤣

[vernal flax]

Nice. Did you study at all for those parts ?

[slow olive]

Hey everyone, I've a project coming up in which I have to interview a penetration tester or red team professional for about 10-15 minutes with a few general career questions. Would anyone be willing to help me out? please pm me if so :)

[bronze lodge]

I feel like I really struggled with the code parts of PTO-002 and I focused way more on them since then, I have my CEH tomorrow so hopefully it translates 🤪

[stuck rover]

Good luck!

[bronze lodge]

Thank you! I've been studying long enough and doing enough of it at work that I am confident and more confident now that I passed PTO-002

[serene umbra]

Gave +1 Rep to @stuck rover

[bronze lodge]

Turns out my CEH was today, but I just bodied that. 109/125 lol

[willow gate]

Congrats 🥳
Don't forget to get your CEH role.

[bronze lodge]

Thank you 🥺 i need to get all my certs added I have quite a bit to add!

[serene umbra]

Gave +1 Rep to @willow gate

[stuck rover]

Awesome!

[willow perch]

congratz dude

[hazy moth]

Hi all, I was planning to get certified. Which cert should as opt for eJPT or CEH (Practical)?

[lofty mason]

If I'd be you, I'd go for OSCP

but eJPT is good too

this can give you a clean basic knowledge

You can go for eJPT at first

i don't think CEH is good tho

it expires, and i don't like that

[quick forum]

They said they were in India, OSCP doesn't really hold weight over there.

[pseudo creek]

personally, I'd pause on the idea of eJPT, I'd go for CEH if you are in India

[pseudo creek]

generally, certs that expires will have more value than those that don't

[lofty mason]

Guess what! I'm Indian, but I want to do the OSCP

[quick forum]

You can do it, but it won't hold as much value.

[pseudo creek]

but doesn't CEH just require CEUs?

vs 'expire'?

[lofty mason]

i don't really care about the jobs until and unless I'm 24, but i just want to extend my knowledge as far as possible Got 6 years more ! yayy

[hazy moth]

Does the location matter?

[quick forum]

Yes

[hazy moth]

Why is that?

[quick forum]

Because the jobs market is different in each country

Because government compliance asks for different certs in different places

[hazy moth]

What is the job market in Canada? I will be moving there in a month

[quick forum]

Take a look on LinkedIn and find out

[hazy moth]

Okay

I have lot of collogues who got a job because they were CEH certified

I have no clue about eJPT (but it has better hands on depending on what I have heard)

[pseudo creek]

do you have any other certs? like Security+?

[hazy moth]

no certs

this will be my first one

[quick forum]

In India, yes

[hazy moth]

Eventually, I will do both. But, which one would be good to begin with?

[pseudo creek]

like James said, I'd look at LinkedIn, but I think security+ is pretty good overall

[lofty mason]

certs can get jobs? i'd go for a bunch of certs then

[hazy moth]

In Canada as well, one got placed in Artic Wolf

[quick forum]

Look on LinkedIn and you will see what the job adverts want.

[pseudo creek]

when you are looking for a job, I'd look to see what job listings are asking for... often they will include certs

[hazy moth]

They help the recruiters filter people.

[lofty mason]

ah! yes ! got it

[lofty mason]

I'd love to get a job of a pentester.

[serene umbra]

Gave +1 Rep to @pseudo creek

[hazy moth]

Sure, will do my research. Thanks

[pseudo creek]

who knows what exactly will be required in 6 years but best to talk to pentesters in your area if you can

[hazy moth]

Yes

[keen raven]

anyone here done the CRTP? what impact did it have on your career, if any?

[bronze lodge]

If I wasn't further along in my career, and the choices came up, between eJPT or CEH, I'd go with the former. My company paid for me to take the CEH and I wouldn't otherwise and my next step is likely OSCP or the PNPT

But yeah CEH like a lot of IT certs like from CompTIA can be renewed by doing other certs, going to lectures/events

I recall when I went to GSX in 2019 I earned CEUs I could apply

[static tide]

i know “ceh sucks blah blah blah”, but are any of these courses any good? (considering they’re only $1)

[bronze lodge]

@static tide for $1 I am sure they far exceed the cost tbh

[static tide]

true

i will just add them to my never ending course list

[bronze lodge]

Honestly, same. Especially that python one

[static tide]

which python one?

[flat sedge]

IMO python courses are a waste of time if you already know at least 1 programming language and set of libraries pretty well.

Better off just using readthedocs and working on projects.

[bronze lodge]

Top right @static tide

[static tide]

i kinda agree with juun there, although maybe a mini course on working with sockets or something (but there's a few on youtube)

[flat sedge]

And judging from the title, that course is going to use content from Black Hat Python as its basis. Just go to the book (super easy read, no python experience needed).

[static tide]

ahh i wonder if it's the same as the book

oh yeah lol

[flat sedge]

I wouldn't even go that far, jake. Sockets are trivial in the py networking libs.

[bronze lodge]

Fair enough, I'll take your recommendations to heart then!

[static tide]

hmm

i found it a bit weird learning it for the first time tbh

[flat sedge]

python net libs are way easier to use than C or the C++ Boost libs.

if you can do the beej C networking tutorial, you'll have zero problems with the python networking.

[static tide]

lol

i'd need to learn c first

that's a problem for when i start osep

[undone shore]

OSEP doesn't use C

It's a mixture of C#, PowerShell, JS, VBA, etc. The classic malware scripting languages

[static tide]

oh

c# is what i'll need to learn prior to that then lol

[quick forum]

JS or that weird Microsoft jscript thing?

(which is a version of ecmascript so kinda JS)

[undone shore]

Both 😆

[polar rock]

jscript is not weird.

[undone shore]

It really is. It's also totally dumb

[polar rock]

You’re totally dumb

[stoic cave]

https://tenor.com/view/that70s-show-ashton-kutcher-michael-kelso-burn-gif-4891812

[young shoal]

What is meant by a kernel. And difference between normal kernel and shared kernel. And how can a kernel control hardware of the system.

[flat sedge]

This sounds like homework questions.

[blazing zinc]

Looks totally legit...

[lavish blaze]

@quick forum

[quick forum]

@undone shore I'm on mobile, don't have the option here

[undone shore]

Omega already banned without -ddays

[hexed hound]

hay everyone

am new here

[odd tusk]

hello

i'm new user

[warm hinge]

Hi

[gusty iris]

Hi.

[warm hinge]

So I know jobs like to see what kind of personal projects or your dedication to cyber, is there a recommended site to write-ups or cyber blogs on?

[stuck rover]

You could set up a free website with github pages. Otherwise if you're lazy or can't make websites then medium works fine. Just keep a backup of your blog posts. They're known to take down infosec pages apparently.

[warm hinge]

Gotcha, thanks!

[serene umbra]

Gave +1 Rep to @stuck rover

[glacial crown]

Hello

[sleek nimbus]

Hi! I am currently a 3rd year student studying Computer Science, from India. I had recently started to study for CCNA. Today I received an email saying that my Institute has collaborated with EC-Council and are offering CEHv11 courseware with exam voucher. I can pursue and afford only one of them for now. So now I am very much torn between them.

The one with exam voucher is for approximately 210 USD

[pseudo creek]

lots of people have mentioned CEH is valuable in India

plus study groups can be valuable if it is multiple students

but CEH also has a yearly maintenance fee I believe

[sleek nimbus]

I have heard the same as well

[sleek nimbus]

Also if I were to go for CEH later, what will the fee be like as compared to the above screenshot?

[pseudo creek]

can you find out what the fee is in India? sometimes companies adjust their fees for low cost of living countries

in the US, its $1200 it looks like

[sleek nimbus]

It seems that it is around 40k INR

[cursive shale]

$533 then

[languid hearth]

worth

iirc student discount is about 50%

[quick forum]

I can get it for like £250?

[languid hearth]

https://store.eccouncil.org/product/ceh-vue-exam-voucher/ not sure if theres an eu store, but $1,200 us :x

[vague blade]

What kind of assesment could I expect for applying to a internship? (it-security company)

[zenith crypt]

do you think when you have finished jr pentester space and understood everything you are ready for an entry level job?

[fathom vault]

is there anyway to get some mini projects in basic network security ?

[flat sedge]

As an intern? Your questions will likely follow your background; I wouldn't worry too much about it.

[vague blade]

The vacancy says that I have to do a assesment testing my skills, they ask me to note my experience with Linux, TCP/IP, programming and security. So i think it will be something covering those subjects but i have no clue what level of knowledge they expect. Will it be searching for XSS or SQLi? Do you have any experience testing interns?

[flat sedge]

It's an intern role. Your technical aptitude is secondary to your attitude

[polar rock]

Depends on the company and what they do tbh. I’ve applied to companies that just want to know about you and your studies and I’ve applied to internships where there were full on technical challenges (that was a very technical company however)

[flat sedge]

Your technical test likely won't go too far beyond what you have on your resume; usually these kinds of things are to weed out the liars and misrepresentations

Be upfront and honest with both your resume and your answers

[serene umbra]

Gave +1 Rep to @flat sedge

[vague blade]

okay thanks for responding @flat sedge @polar rock 🙂

[mint bridge]

6 years

[barren forge]

Hello everyone! I'm a 20 years old university student in Europe and I'm currently studying for my BSc Computer Science degree. I'm planning to do a MSc in Cyber Security as soon as I finish my BSc. My first thought is to work as a red team operator although I have a couple of questions to do:

1. Which certifications should I go for before I finish all my educational years?
2. I'm currently studying in thm. (I've completed many paths in regards of Networking, Linux fundamentals etc. and I'm in the middle of Jr Penetration Tester). Do you think just trying to do machines in thm/htb would be the best practice for me ?
3. Which role-jobs am I going to land as an entry level pentester ?
4. Which roles am I going to be able to fill later on after a few years of experience as a pentester?
   And finally but not least
5. What's your opinion about teleworking. Is there even possible to that in this field ?

Thank you everyone so much for reading and answering it's extremely important to me! Feel free to dm me if I've caused any spam trouble here.

P.S. Sorry if I did :S

[stoic cave]

Not to rain on your plan, I'm not sure how it is in Europe, but a masters before getting actual job experience may not be beneficial and will actually be a hindrance on your progression. By getting a masters too soon it prices you out of entry level positions and even though you have the education credentials you don't have the real world experience.

Penetration testing also isn't necessarily an entry level position so be prepared to start somewhere else. Security in itself isn't necessarily entry either

Remote work is possible in the cyber field but as an entry level it may not be totally accessible, depending on organization. As an entry level employee going straight to remote may not be the best either. Having in person contact with coworkers really helps when you're just starting out

[barren forge]

Excuse me if I misunderstood but are you saying that MSc is a bad idea? I really want to do it :/

[stoic cave]

Masters are for Management

[barren forge]

I'd love to go higher in ranks if that's what you mean

[stoic cave]

As an entry level they may be more of a hindrance

[barren forge]

I want to go as far as possible in the future

or at least have the chance you know

[stoic cave]

No, you get them when you have enough experience to be management is what I am trying to say

Juun will probably explain it better than I

[flat sedge]

it's not a bad idea - but if you don't have any enterprise or work experience, going for a M.Sc in Cybersec may price you out of the initial entry level experiences that are foundational to security

[barren forge]

Doesn't that mean that even if I'm extra-qualified for entry level I can still fill in the job and perhaps get promoted faster?

MSc + 2 years experience = promotion
BSc + 4 years = promotion

something like that

[lofty ibex]

MSc = struggle to land entry

[flat sedge]

Nope. It usually means you leverage that entry level experience at a faster rate, meaning the organization now has to backfill your role before they've broken even on the investment they have made in your employment

Every role has a cost:value ratio that is targeted by the business people who determine budget. Typically an overqualified candidate is offered a more senior role, but sometimes that can't be worked out.

So the org is better off not hiring overqualified candidates, because they outgrow the entry level role too soon, so a promotion or moving on before the 1 year mark means the business has lost maybe not money but value by hiring

[barren forge]

I totally understand it now, thank you. What would you recommend me to do though?

Because this is kinda a plan changer for me

[flat sedge]

be lazy with your credentialing, and degree. until it becomes a checkmark in your career path, don't do it

it also means that you aren't paying out of pocket for the degree, the company is

[barren forge]

That can happen too ? 😮

[flat sedge]

exception to that is the bachelors degree - that opens many doors much faster than just work experience alone

IMO SOC Analyst I and II shouldn't have Masters degrees. That's too much money for that role.

others who work security as a day job may have something different to say, don't take my word as gospel

[barren forge]

Yeah don't worry all I want to hear now is opinions. All right then, let's say I'm not going for the MSc. That means I've got a decent amount of money saved, what would be my best investment choices ? for that specific role I mentioned earlier

[flat sedge]

put it into retirement or savings

[barren forge]

what about certifications ?

[flat sedge]

do just enough to get the role you want, and let the company pay for certs and taining from that point forward

CCNA|NET+ && Sec+ are great entry level security certs

investing in a small homelab gives you a lot of value to potential employers too

[barren forge]

What about OSCP ? since I want to work as a red team operator

[flat sedge]

"I have a small linux homelab, I installed FreeIPA and a bunch of services on VMs, here's the specs, here's how I manage it, etc"

Pentest and related adversarial emulation really isn't entry level in the true sense of the word.

Entry level to so-called Red Team is really 3-5 years of experience

there are exceptions, but they are pretty rare; it's almost unheard of for anyone to get permission to pentest, red or blue team, within the first few years of their security career

[barren forge]

Excuse me if this a silly question but you're saying that for me to join Red Team I need to have 3-5 years of experience.. of what though? Pentesting? what would be the first job Im going to land in order to get that experience

[flat sedge]

of anything IT related

Development, network engineering, sys admin, systems engineering, SOC roles, et al

some people do come to security through the business side, but those folks usually end up doing GRC

at least from what i've seen

[barren forge]

Oh I see. So, I shall continue studying material in thm/htb and practice machines. I'll get those certifications you recommended me and we'll see how it goes :D. One more last question

so I live in Greece and I don't know if there are many job spots for pentesters in general. Will I have to be restricted to Greece only or can I work almost 100% remotely too?

That's actually my biggest concern to be honest..

[flat sedge]

I don't know. I live in the US for an international company; hiring in EMEA is something I don't know anything about

[barren forge]

It's ok you helped me a lot providing all these useful and interesting information. I appreciate your time and effort

Have a great night sir 🙂

and all of you who answered as well!

[flat sedge]

good luck

[stuck rover]

Remote work really depends on if you're eligible to work in the country despite being located in a different country altogether. You should be able to apply to other positions within the EU.

[barren forge]

And I'm guessing every company has different terms for remote work

[stoic cave]

If you want to have a discussion about homelabs I'd be happy to answer any questions you may have as well. I attribute it to me getting hired as it was a major talking point in my interview

[barren forge]

To be completely honest with you, I have no clue what is a homelab but I'd love to hear more about it!

[stuck rover]

I'm guessing htb and thm can't replace home labs especially for setting up and hardening the system.

[stuck rover]

Perhaps. Some are moving fully remote.

[barren forge]

are we talking about the way someone's practising?

[barren forge]

Oh that's good news

Money is not that important for me but I definitely need to pay my bills haha, so how's the salary in Cyber Security field ?

let's say if you work as a red team operator after a few years of experience

[undone shore]

Entry level positions are still fairly unlikely to be remote though

It's much more likely to get a fully remote position if you're senior

[barren forge]

I'd like to have someone experienced next to me guide me in my every-day tasks

So I'm not seeking for remote work as entry

That was more a future-question let's say

[undone shore]

You, uh, may want to phrase that differently if you're discussing this with a hiring manager 😆

[stuck rover]

The ones I've seen lately are. But tbh it's better to be on site as a junior. It's infinitely harder to learn OTJ in a remote position.

[barren forge]

hahah Yeah I expressed it poorly my bad xD I didn't mean that exactly

[undone shore]

You'll be expected to have some grounding in whatever job you get. They will also usually provide training, and almost certainly some kind of mentor figure, but someone actually guiding you through it is, uh, highly unlikely 😆

[barren forge]

Yeah mentor is what I meant my bad 🙂 That's exactly why I don't want to work 100% remotely as an entry

[stuck rover]

I guess it kind of depends on your role. I'd think it'd be much harder for a junior SOC analyst to learn in a remote position than a junior pentester.

[barren forge]

That is true I can see that

[undone shore]

Don't bet on it. Dunno about you, but I wouldn't wanna let a completely new pentester loose on client systems without close supervision

[stoic cave]

Homelabs are what they sound like, computer labs in your own home. Commonly, used enterprise gear is bought for homelabs but isnt necessary. If your computer is powerful enough you can just virtualize it on that. It allows you to play with technologies in a safe environment. Research - > Build - > Test - > Break - > Research - > Fix - > Repeat

[undone shore]

Best case scenario they know what they're doing. Mid case scenario, they don't have a clue and just sit there wasting time. Worst case scenario, they come from the CTF world, hammer some poor ancient public-facing server and bring down the client's website

[stoic cave]

In my homelab I have the following: media center, pihole, virtualized router, Active Directory, mock work environment for my job, a SIEM, minecraft servers, etc

[stuck rover]

Of course there's gonna be coordination via a call or something but you can't really screenshare with zoom for hours and show the new soc how to parse through network logs lol

[undone shore]

Why not?

[stoic cave]

I don't mess with malware because I don't have a dedicated box but we did malware forensics in my Uni so I didn't feel the need to build out that portion of the lab yet

[stuck rover]

Time and duties, I'd assume.

[undone shore]

Either way you're gonna be sitting staring at a zoom call for hours

Which is why they bring the new starts into the office where a bunch of more senior folks can keep an eye on them, rather than one person having to dedicate their time to it.

No idea about blue team, but pentests are nearly always team things anyway, so the new start gets put into a team alongside more senior people who keep an eye that way.

[barren forge]

I shall continue studying material on thm/htb then and once I feel more confident I'll get into the machines/rooms. Shouldn't I get OSCP since I want to be a Jr Pentester for example? And if so, is it a good idea to get eJPT first so I can get a "taste" of what the examination is like ?

The only thing I'm confident right now is coding and that's because I've been coding since high school non-stop. Reading and understanding code and perhaps inject, is so far my best skill

[stuck rover]

OSCP is your golden ticket to a pentest position as Muiri can confirm.

I'd advise going for the pnpt over eJPT as it's more practical and harder but that's just me.

[barren forge]

I'll definitely check it out!

[stuck rover]

As always, do your own research and see what works for you.

But the pnpt exam seems close to a real pentest engagement.(Feel free to disagree with me on this, Muiri) You even have to debrief the "client" afterwards.

[barren forge]

I'd love to get Muiri's opinion to that whenever he/she has time!

[languid hearth]

what I'll say is there's no junior pentest cert, if there is, you're doing it wrong

security isn't a junior field, especially pentesting.
Your "Junior" phases should be spent out building your enumeration methodology

[barren forge]

Not gonna lie I feel a bit loss...

[languid hearth]

tl:dr junior pentest certs cater to a type of people that shouldn't exist. If you can do eJPT, you can do PWK/OSCP and PNPT.

it's 100% a psychological thing

[barren forge]

so what you're saying is that it's basically a waste of money for me to get eJPT and I should go straight up for OSCP

[languid hearth]

let me put it this way, eJPT didn't exist back in my day lol

if you understand networking, security and system administration, you're ready.

[undone shore]

eJPT is the cert you get if you want a nice easy introduction into what a cyber cert exam is like

If you feel like you need that practice, it's a good thing to get

[barren forge]

Oh I see, now it's clear!

[stuck rover]

"Back in my day." Aren't you like 20? 21?

eJPT came out in 2015 I think

[languid hearth]

yep, but compared to "back in my day", it's accurate 😛

I also don't really consider eLearnSecurity to be a more than 2 year old company tbh

their name has just made the mark

[stuck rover]

eLS is atleast 5 years old. INE acquired it 2 years back I think.

[languid hearth]

I believe it was about a year or so ago now

oh no

the years are blending together

it was 2019

oh god

IM GETTING OLD

[stuck rover]

At 20 lmao

[languid hearth]

me does math to try to figure out how long ago it was that I got my OSCP lel

[warm hinge]

not much pog but UvU

[coarse geyser]

I need help with something, I’m finishing my CSPT soon and I wanted to know what other intermediate certifications there are, professional yet not OSCP level?

[ancient prairie]

not familiar with CSPT and a cursory search turned up nothing, but OSCP is not an intermediate/professional level cert, it is meant to be an entry-level pentesting certification - like literally the bare-minimum you need to know for the field

[coarse geyser]

I meant an exam that is easier pretty much, more like cissp or sec+

Or like eJPT

stuff like that

[ancient prairie]

CISSP is not easier by any means and requires 5 years of industry experience before you can be called a CISSP proper - really depends on what your aspirations are, I enjoyed eJPT a lot but Sec+ will lead to more job prospects

[coarse geyser]

Thanks!

[serene umbra]

Gave +1 Rep to @ancient prairie

[warm hinge]

Welp did some digging and my state happens to be the worst for cyber jobs lol

Any tips for moving for a job? I’m planning to start applying to just all the top states and see what happens

[stoic cave]

Define worst

[warm hinge]

It was listed as 51 for top places for cyber roles

[stoic cave]

Low pay? Bad benefits? Long hours?

According to who?

[ebon mica]

51? sounds upper mid, not worst 🙂 (And I'm being a smartass, of course you're referring to US only)

[warm hinge]

Lol

Sorry I’m having a coffee run before studying so I’m not at the computer to get the site rn

But it was that site that measures each US state with cyber jobs available and what certs people have in the state and what employers are looking for

[warm hinge]

Just listings in general

[stoic cave]

How are they 51st? There are only 50 states. Is this not the US?

[warm hinge]

Lol I took it as it was so bad it got off the US states

[stoic cave]

I'm still confused but I would still apply to places in your home state. You're more likely to be hired if your applying to places within 75 miles I think it was

There's a radius in which a company is more likely to hire you or place you in the applicant pool

[pastel solar]

My guess is they had Washington D.C separated as its own listing

[paper grove]

I'm living in New York working for a company in Texas. Try finding remote jobs if there aren't many cybersec jobs in your area. But anything in a city will likely have more opportunities than where I live, countryside, 45 min drive to nearest city.

[stuck rover]

Keep in mind that the salary might decrease a little depending on where you are

[native elm]

When is a good time to start PWK?
Complete eJPT, reach 0xD on THM, and do the OSCP prep boxes on THM/HTB, then do PWK?
Inb4 varies for everyone
I know, just looking for some suggestion.

Planning to Follow Fawaz's pinned guide;

1. eJPT content - no exam
2. Offensive Path - TryHackMe
3. Buffer Overflow Prep - TryHackMe room
4. Linux/Windows Privesc courses - Tib3rius
5. VHL - 1 month subscription
6. Ippsec videos (Just watch and take notes) - HTB TJNull list
7. OSCP labs

[warm hinge]

Gotcha, I’m trying to find a remote role but not having a lot of luck, thinking about pursuing an internship at this point

[split stump]

What do you guys think about Bug Bounty Hunting? What should be the prep and prerequisite to move forward?

To get started?

[polar rock]

[pseudo creek]

its a waste of time for the effort put in but may make sense if you live in a country that has a low cost of living and limited job opportunities. Better to ask in #bug-bounty

[warm hinge]

anyone got some good advice for uk cyber?

[quick forum]

Learn the basics of the management side too

Anything you eant advice about specifically?

[warm hinge]

just about finding opportunities, is it okay to dm the specifics?

[quick forum]

Seems counterintuitive if you're asking everyone here for advice

[peak hazel]

@warm hinge I m in UK but UK cyber is too general. Do you need advice on anything specifically or which part of cyber security ? For starters you can try https://cybersecuritychallenge.org.uk/

[warm hinge]

Im looking into degree apprenticeships but they are either to far away and don't pay enough to live off. Just wondering whether i should go with apprenticeship or uni course. I didn't pass for GCHQ's degree apprenticeship so just looking for direction.

I just need to break into the industry after doing my college course, and my college course is way to easy and broad

[stone garden]

So, I'm currently in school for my cyber Security associates degree at the University of Phoenix. I want to become an analyst, which certifications do u think I should look into. I want to study them now, so I can take them after I get my degree and hopefully get a job. Thanks in advance for the help.

[pseudo creek]

security+ is a good solid one but I'd try to get it before you graduate if possible

network+ is also good to validate network knowledge

[vast totem]

What is a good internship position to try to obtain as a Second year Cybersecurity University Student

[vast totem]

Would you recommend skipping A+ and going straight to Net+ --> Sec+

[dim fox]

Are cybersec engineer paid well?

[pseudo creek]

if you are looking for a help desk job as a foot in the door, you might want an A+

[pseudo creek]

sure, but thats a very generic job title

[vast totem]

Currently working "Help Desk" at my University I was thinking the next step / other positions that are still entry-level.

Regarding A+ I feel like it would be more worth while to try to go for Net+ as my university degree would essentially display the qualifications of an A+ Cert

[pseudo creek]

yeah, lots of people don't need it but some help desk jobs seem to require it

[vast totem]

Yeah, I'm aware. Do you know some other entry level positions that I could potentially look at for my Internship

[pseudo creek]

I'd start looking for internships as most companies (in the US at least) have already started their application period for summer 2022 internships

[flat sedge]

The deadline for a lot of US IT internships is usually end of december or january - do not delay

[stoic cave]

This is true for large orgs

Smaller orgs will hire all the way into May

I got my internship offer in April and started working in May and my roommate didn't get an offer until May and started working the same month

[pseudo creek]

An offer vs application dates are different

[stoic cave]

Applications were February and into late March

Of that year

[austere ginkgo]

Is it a good idea to do masters in cybersecurity?

I graduated as a biomedical engineer but I've found cybersecurity to be a lot more exciting, and I've wanted to switch since a long time.

I've got a year before my admission in cybersecurity msc begins, and I'm planning to get the certs before that

I'm just not sure if I will have enough opportunities considering the switch in my background

[pseudo creek]

Not without experience first, generally you should get a few cyber certs and apply to jobs

Plenty of people go into cyber with various background. I’ve worked with people whose undergrad degrees were psychology, biology, English, etc

[austere ginkgo]

I'm getting the opportunity to work on 2 internships before I enroll for masters. Meanwhile I will also get my certs

Is that experience enough to set my foot in the door?

[austere ginkgo]

That's pretty cool to hear

[pseudo creek]

I really only can speak for the US, if you are in India, the situation may be different

[austere ginkgo]

Oh yeah, I'll be doing my masters in USA

[pseudo creek]

Then I wouldn’t do a masters

[austere ginkgo]

But I have a year to go

[austere ginkgo]

Ohh

[pseudo creek]

I’d skip masters for now, get certs, then get full time job

[austere ginkgo]

Thing is, I don't want to work in India right now, I want to change places

I thought certs+internships+masters would be good to get an entry level job at least

In USA/Germany

[pseudo creek]

I don’t know about Germany, I think they are more degree focused. In the US, having a masters can make it more difficult to get an entry level job

[austere ginkgo]

Even with certs and internship experience?

[pseudo creek]

Yes

[austere ginkgo]

Oh that's sad to hear

[pseudo creek]

But you can try. Also, cyber is one of the few tech fields in the US that rarely sponsors work visas. Not to say it’s impossible but it’s rare. If you develop a unique skill, that definitely helps

[austere ginkgo]

Oh damn

Thanks for letting me know

Any idea how the market is in Canada or Germany?

[pseudo creek]

I don’t know those markets

[austere ginkgo]

Okay, thanks!

[short trout]

Hi, i want to ask if anyone has any good videos or resources that concludes what to prepare (what skills need to have) to become a pentestor or to begin an ethical hacking career (for interview and future job)?

[merry matrix]

Start here: https://youtu.be/mdsChhW056A

[stuck rover]

I was just about to post that!

[merry matrix]

Also I know this is an infosec discord, but does anyone have any connections/resources for someone trying to get a data analytics/science job. Asking for a friend who’s trying to pivot from business to that field and has been taking classes and working towards it.

[stuck rover]

I only know about the google certificate on Coursera. Apparently, a few companies agreed to take graduates from that programme. Aside from that, I've seen a course on it from freecodecamp and an introductory one on INE's free starter pass

[merry matrix]

Thanks for the tip. But, I'm mainly looking for stuff like Discords/Slacks or anything else where they can make connections and/or find jobs.

[pseudo creek]

yeah I don't know any data science discords

[austere ginkgo]

Is it possible to switch to cybersecurity after working in data science for 2-3 years?

With the right certs and courses

Asking for a friend

[pseudo creek]

sure

[fiery blaze]

Absolutely

[clever musk]

I need advice on CySA+ is anyone online who has taken that exam?

is the Cyber Defense path a good addition as study material?

[languid hearth]

generally no

CySA focuses more on policies and procedures rather than practical elements

ex. you notice a key production server beaconing out to a known c2 server, what do you do?

a. shut down the device
b. capture a memory snapshot
c. quarantine the device
d. contact the device owner

[static tide]

are there multiple answers here

[languid hearth]

I have no idea

that's just generally the kind of shit you'll see on that stupid exam

[static tide]

typical comptia question

[languid hearth]

CCNA CyOps > CySA

[tired elbow]

hey guys im new here, i study cybersecurity and i have a question so i know a bit about general IT. I just wanted to know what do u think about eJPT cert to be my first cert ? or maybe u recommend sth else ?

ofc to get first job in cybersec

[quick forum]

eJPT is not a bad cert, but it's not so respected by employers yet.
Go onto LinkedIn and look at security jobs that you'd want to apply for. See what those are asking for.
Sec+ is often regarded as a good foundational security cert, but certs have different values in different countries.

[pseudo creek]

and eJPT may never gain employer respect as it sound like they are phasing that cert out next year

[ebon mica]

phasing out after just doing the beta program?

or am I confusing certs. Was it SEC+ that had the beta exam...

[quick forum]

Pentest+ Beta most recently

[ebon mica]

So I was mixing them up, multiple times 🙂

[pseudo creek]

yeah apparently INE is phasing out all eLearn certs

[mellow bobcat]

Hey I'm on on a limited budget and I'm looking at cybrary, pluralsight, linkedin, udemy,edx and more sites to learn cyber security IT and pentesting . I'm considering paying for a monthly subscription for one of them. I want to choose the one with the best content alot of content and alot of potential to use on my resume. Which one would you recommend ?

[static tide]

honestly? i'd go with a tryhackme subscription

[mellow bobcat]

Why is that ?

[static tide]

because imo it's the right mix of practical and theory

[stuck rover]

This 100 percent

[pseudo creek]

if you want something for your resume, I'd look at certifications

[stuck rover]

That's what I said as well.

[lavish blaze]

It really depends what you want. If you want to learn and have the option to explore a little bit of everything or even focus in on one topic I'd go with a tryhackme subscription. If you want something for your resume I'd go with a Cert

[ancient prairie]

cheapest way to showcase skills that you can put on your resume is becoming a github contributor and also maintaining a technical blog, both can be done for free

[bronze lodge]

For real, I'm a decade into my career and I'm just now doing this, wish I'd have started way earlier

[clever musk]

Yup TryHackMe is the best bang for your buck

[pseudo creek]

you can also make a blog about various rooms you do on tryhackeme

[stuck rover]

Planning on pushing every program I make to github. Custom automated nmap scripts, malware practice, backdoors etc

[flat sedge]

If you are employed, run that by your director and double check your employment contract first. It'd suck if you did that, and got in trouble because they had a clause that all code and scripts developed under their employ is their property.

[stuck rover]

I would but I'm not employed XD. Don't really expect to be atleast until I'm 18.

[static tide]

this is why you develop stuff on your own pc out of work

[flat sedge]

Depending on the contract, and how litigious they are, that may not matter.

[static tide]

wait what

[stoic cave]

Yeah, doesn't always work that way

Some contracts are written in such a way that they can get you for working on "similar" technologies

[lavish blaze]

Dosent Disney have a contract for animators that Disney owns anything they create during the time they work at Disney?

[stuck rover]

Ew

[static tide]

lol would not wanna work for a company where stuff made in your own time is not your own

[stoic cave]

It's more common than you think

[pseudo creek]

yeah its very common

my husband submitted a request to do bug bounty hunting, they basically look at it, determine its not a conflict of interest and let you go about it

I've been offered side jobs before and I was like 'nah, I don't want to do the paperwork'

[stoic cave]

Yeah i have to put in a management request if i want to try and make money on the side

[quick forum]

Me too

[stuck rover]

Can only pray I don't end up in a workplace like that.

[quick forum]

Side jobs is pretty normal

Them owning the code (or sometimes even patents) tends to be bigger companies. I know Nortel used to do it

[daring haven]

I was reading about careers in cyber security and someone said most of it is policies. I want to do pen testing or security engineering, is he right that the majority is policies as that isn't something i want to be doing?

[stuck rover]

I'm gonna say it depends on your locale.

Like GRC jobs may be easier to get into in the US because SOCs and red team jobs are competitive asf but in somewhere like Sweden there may be less competition

[daring haven]

I want to stay in the UK for now so what do you think?

I understand I'll have to do it regardless but not if it's the only thing I do

[stuck rover]

May be better to ask the UK folk then

James and Muiri come to mind

[pseudo creek]

(I'm not in the UK) I think its important to understand the security lifecycle... risk influences policies and both influence cyber work. A lot of compliance programs require penetration testing. In Europe, my impression is that a lot of penetration testing deals with risk and compliance, meaning validating that a company is following compliance requirements (aka policies). And even in this day and age, lots of companies wouldn't spend much money or as much as they are spending if it wasn't due to compliance requirements.

Overall, any cyber person should understand policies on some level. Some people are the "I can quote policies" while others are the "I know how to follow the policies but sometimes gotta ask/look it up". I'm the latter of the 2 myself.

[static tide]

if you wanna be a pentester in the uk, then that person is wrong. maybe 5-10% will be risk & compliance /policies? (obviously depends on the company but a ballpark percentage based on mine and others experience)

[daring haven]

Alright great thanks everyone, obviously I understand policies are something I'll have to deal with but I don't want to go into cyber security to just spend all my time reviewing and writing policies

[static tide]

my current role as a security consultant (uk) is broken up into smth like

• 50% hacking
• 20% reporting
• 20% development
• 10% other

[pseudo creek]

nah, you only need a few policy writers and a lot of your policy will come from industry policy.

I'm not a penetration tester, the closest to policy I've gotten are whitepapers which aren't policy but guidance on how to implement a specific technology. But again policy can be important to understand, be able to look it up, etc.

[warm hinge]

Hello, I am a trained linguist. As I'm also passionate about technology, I am considering pursuing a degree in computational linguistics. However, I have the idea that such a degree won't be relevant because companies will always prioritize a software engineer trained in NLP over a computational linguist. Did I get the wrong idea? I would like to know your opinion and if I have better options.

[mellow bobcat]

Can you land a cyber security internship without any college experience with certs and experience?

[tidal canyon]

It really depends on how you present yourself, and the company. I worked my way up to a CISO position without any college experience.

[flat sedge]

Internships are typically set aside specifically for students. If you aren't at least a part time student, an internship probably isn't going to be an option. If you are currently working in industry, ask the security team if you can shadow them for a week or twoo.

[velvet spindle]

Depends on the country tho, my friend did an internship to break into the IT industry and she's 30 so you never know

[fierce elbow]

this is news to me, when has INE made that announcement?

[fierce elbow]

i don't see any relevant posts from INE's blog

[pseudo creek]

they have talked about it in their discord according to people I know that are there / have elearn certs

[fierce elbow]

oof... if that's true then that's a shame; i felt the eJPT course+exam were pretty good for showing me the basics of penetration testing

[stuck rover]

All I heard was that they were updating the course material because eLS stuff was very death by powerpoint.

[fierce elbow]

i've asked the question in the unofficial INE Discord server but it seems like the people there aren't quite sure as well

hopefully INE's CEO would answer that question during his AMA on Friday 12th, 1pm ET

[stuck rover]

He's actually the CCO

If you mean Neal that is

[fierce elbow]

i didn't bother checking lol

it's Richard McLain

[stuck rover]

Yeah. Neal is the Chief content officer. Last I checked

[fierce elbow]

it's going to be worth my time staying up late to listen to him answer my question 👀

[left glacier]

Yeah, the whole legacy certs thing was something that came out of a live stream on YouTube from Neal. No warning, no official communication, just all of a sudden they are being referred to as legacy. Definitely needs to be put to Richard to ask for some official communication on this. Getting a cert doesn't happen overnight, i started studying for eCPPT months ago and getting ready for exam now but suddenly hearing your cert is considered legacy before you even get it is really bad. They need to stop leaking stuff via Neal's stream or at least back it up with official communication in my opinion, as a paying customer i shouldn't have to be tuning in to an employee's personal YouTube channel to find this stuff out.

[stuck rover]

I think the certs are still gonna be there. Just updated material and under a different name

[pseudo creek]

well if they don't change the name of your cert then that is a concern

[stuck rover]

I.e in place of eJPT perhaps INEJPT ro something along those lines

[pseudo creek]

like grant you a certification that says 'you are now ... <new cert name>'

otherwise it becomes like "eJPT? what is that?' "well its the old cert, it was renamed" "why you listing an old cert on your resume?"

[left glacier]

Renaming the cert is kind of a problem in and of itself though. eLearnSecurity was the platform that had the name recognition, INE has no real reputation as a cyber security certification body and frankly i'm very worried about them doing that going forwards considering the disaster that there newest foray into certifications is after the Azure and AWS Beta exams. The Azure Beta exam was so bad the whole thing has been scrapped, again no official communications of this had to watch Neal's stream to find that out.

[pseudo creek]

oof

[fierce elbow]

wow i've missed out a lot on INE stuff huh

i should go watch Neal's videos/livestreams

[left glacier]

Seems to be the only way to get any information unfortunately.

He brands it as a good thing that we're getting sceret information via his channel but really it's just a communications failure by the company. As a paying customer i just want to receive this information directly.

[stuck rover]

I asked about this in his server and his response is that you shouldn't take what he says as fact or official communication. So it's all rumours until there's an official statement

[static tide]

idk, it's still common to see "MCSA" on cv's, even though those exams are retired now and i'd still encourage people put them on

[left glacier]

But again, that's the problem. The company itself is not provding any communication and the CCO of the company is then stating things on his own channel so of course people are going to listen. You can't have it both ways, either it's official and it should come from company or it's not official in which case why are you mentioning it and starting rumours?

[pseudo creek]

yeah but MCSA was a gold standard for so long and was well known

[rugged delta]

Well eLearn were purchased by INE only in the last couple years, and now INE is owned by Pluralsight. Just sends more people to OffSec

[left glacier]

I had no idea INE was owned by pluralsight, when did that happen?

[rugged delta]

Oh wait I'm getting mixed up, they bought A cloud Guru just after they bought Linux Academy... too many platforms

[left glacier]

Hehehe! No worries 😄

[pseudo creek]

I’m waiting for Pluralsight to buy INE

[velvet spindle]

A bit of an off-theme question - would you include non-cyber related tech projects in your resume? Especially something completely stupid and useless, but fun?

[vast totem]

What type of positions would you recommend for college students?

[flat sedge]

Internships

[stoic cave]

Honestly doesn't matter where it is in the tech field. Cyber, IT, etc. It's experience that you wouldn't otherwise have to put on the resume

[vast totem]

Yeah but would type of internships are considered "entry level"

[flat sedge]

That's the actual point of internships. They don't require special knowledge, they don't require the student to know anything that would be valuable. It's a try-out for the company and the student, in the best case. The most important thing for an internship is an attitude, not a skillset.

[stuck rover]

Tell that to crowdstrike and facebook.

Well meta now

[gleaming cedar]

Yeah, crowdstrike's internships entry requirements are higher than graduate/ entry level jobs

[native elm]

CS are not an entry level company, even within netsec. Same with Rapid7 or any company like that.

Unless you are an omega-student like Muir and James etc.

[flat sedge]

IMO, companies that do that are missing the point of internships

[native elm]

I had to do my internship with my colleges internal web design team, because I had so few internship opportunities 🤷‍♂️

[stoic cave]

I got an interview with CrowdStrike's malware team

It was a hard interview

[full sandal]

I have no idea what good benefits looks like but I am thinking this isn't the best benefits package. Pay is not great either.

the big list of "employee paid" seems like a red flag

[static tide]

mad to think these are work benefits in america

[stoic cave]

All of those employee paids are extra types of insurance it looks like

Without seeing actual numbers I can't tell you anything

VSP is great vision insurance

PTO is similar to my PTO structure

You have a decent amount of education reimbursement

The 10 holidays are all the federal holidays

[flat sedge]

that 401k contribution is non trivial in the US

typical employer matching is up to 1% of salary

[languid hearth]

not bad in terms of benefits

401k could be better

[flat sedge]

yeah, 5% is really good - 1% is very common. 3% isn't bad, but not what i would think as top tier

[stoic cave]

I forget what mine is

I know its more than 1% and less than 6%

[flat sedge]

the tuition reimbursement is kind of meh, but much better than i hear about in non-tech companies

[stoic cave]

Yeah it's more than a mine but my company is also super flexible and doesn't really say no

[languid hearth]

tuition reimbursement is really meh in general

i think my company does like 2k a semester at approved schools, but mine isn't 😐

[stoic cave]

Oof

[stoic cave]

So, everything looks average

[languid hearth]

yep! I know places that don't do 401k matching, so having any is still better than none

[stoic cave]

The health insurance is going to be a deeply personal thing though

So we can't necessarily help with that

My health insurance went up 11% this year

[flat sedge]

the PTO is pretty typical of US entry level

[stoic cave]

Yep

More than I get

[flat sedge]

it's pretty straightforward - only things to ask about are unused PTO at EOY and compensated OT

It's not uncommon for salaried employees to get additional PTO instead of OT for hours work over 40

[stoic cave]

I get neither

[flat sedge]

Ah, I lied. The benefits sheet doesn't include bonus schedule. Although that's usually part of compensation not benefits.

[full sandal]

the problem with tuition reimbursement is they said to expect 50-60 hours a week and the ability to work remotely on call

so im not sure how i would attend school at this job

[flat sedge]

universities are likely to be flexible. you don't have to take full time credits to make progress towards a 4 year degree

[languid hearth]

check out WGU

[flat sedge]

It'll take longer, but you won't have nearly as much debt

[stoic cave]

Sounds like you'd have to take night school or some similar

[flat sedge]

if it's remote on call, so long as you can get the emergency calls in class and the prof is willing, that shouldn't be a blocker

[full sandal]

i dont know if i want to risk taking out student loans for a job that will only pay $4k of my tuition a year, especially when its a call center where they already said expect 60 hour work weeks and being on call

for $17.44 an hour

[flat sedge]

if it's a call center, you should be making OT for everything past 40

assuming it's a US center

[full sandal]

it is, just doesnt seem like the best

i dont wanna rely on ungarunteed overtime to pay rent

[flat sedge]

If that's higher than minimum wage in your area, that's a good wage for a call center.

Depending on the contract you're on, don't expect to be there for longer than a year, two at the most

We can talk about the numbers of attrition for call centers, but it's not really interesting... it's more horrifying and appalling than anything else

[full sandal]

they said it would be a 6 month contract to hire and i have zero idea what the pay or benefits are at the actual place

i did apple tech support for a bit and it was pretty awful

[stoic cave]

Fedex is always hiring

It will be grunt work and hard but you'll make OT

[ancient prairie]

you're getting those benefits as a contractor? thats pretty damn good

[flat sedge]

Big difference between being a 1099-T contractor and having an employment contract

Temporary employment contracts are very common, from BPOs.

[spiral garden]

@quasi stream how did you find a company to ask to get an apprenticeship?

you said before that you had contacted on at 15

could you give some tips

[split stump]

Can anyone tell me about PNPT, personal experience, review, recognition, etc...

Something that is not mentioned on site.

[merry matrix]

Haven't taken it, but from what I've seen/heard, it's a good cert to test/grow your skills, but maybe not the best for trying to land a job

If your reason to get the cert is a pen tester job, OSCP is probably your best bet. If you just want to learn, I don't see why not.

[split stump]

Well i am thinking about PNPT, it's not too costly as well compared to OSCP or eCPPT

What about eCPPT is it recognised?

[merry matrix]

I'm no authority on certifications, but I believe so.

[split stump]

Is it true, that eLearnSecurity's certificates are deprecating.

I read in this chat

[stuck rover]

I'm just gonna say that anything that isn't GIAC or OffSec(regretably CEH too) in the pentesting realm isn't gonna be as good as the oscp for getting past HR

eCPPT is a learning cert and so is PNPT. Besides, eCPPT is kinda the same price as OSCP unless you grab the training while it's discounted

[split stump]

I'm just gonna say that anything that isn't GIAC or OffSec(regretably CEH too) in the pentesting realm isn't gonna be as good as the oscp for getting past HR
@stuck rover Yup, I think you are correct

[stuck rover]

Damn your discord version must be old.

[split stump]

I cannot spend money on two expensive certs, one for learning and one for recognition. Besides that, I think PWK is a very good learning material too.

[stuck rover]

Then you have your answer, my dude. Go get that OSCP💪

[split stump]

Yup

[calm bridge]

I thinking about trying to switch from Software Development to pen testing as a career. My question is two fold. One, is that switch even possible, and two, what does a professional pen testers job generally entail? Like, is it a lot of technical write-ups?

[flat sedge]

Think about how much writing and documentation your testers do for a product release - it isn't unusual for a pentest report to be at least as in-depth, and contain a lot more high level language to explain the findings and informational items to management.

[calm bridge]

Would the switch even be possible for someone who is currently in Software dev?

[flat sedge]

Oh, definitely.

It's a pretty big leap from software engineering to pentest, but it's doable. You'll find things like BOF a lot easier, but some of the system config vulnerabilities will take some time to pick up.

[calm bridge]

BOF?

[flat sedge]

buffer overflow

[calm bridge]

Also, should i get a cert before trying to land my first job?

[flat sedge]

It's very rare to jump straight into pentest without some other sort of security knowledge

Sec+ is a good cert to have to make that transition. A good chunk of pentesting is destructively testing someone else's code, I would suggest speaking to your QA team about how they address security issues, reported bugs, and test strategies that they use to expose your code.

[warm hinge]

Instead of trying to get a cert immediately, try to gain some base skills instead, then after a while I'd recommend going for the OSCP, its a very well known cert and actually teaches you a lot.

As for the dev base you've got, that's really good. Being able to understand how Softwares work and how they are build is going to be an enormous help to your learning process.

[crude thunder]

Yooo guys

Well couple of months back perhaps two or three, I once came here to nag bout my lack of purpose in life and all and how much I love pentesting and all

Lots of guys from this particular discord came out en masse and talked me through things 😂😂

Thanks allot @stuck rover

[serene umbra]

Gave +1 Rep to @stuck rover

[crude thunder]

Well even tho I was already given where to start, I still didn't start early with it, procrastinated it for a long while
Until last month when I decided for some reason to just start it

Then I still used the excuse of not being able of not being able to learn as a subscriber and in the subscriber only room I stopped progress for a day or three

But I came back started running free rooms my hand can get too

Became a bit addicted to this stuff

Then resolved to get subscription next year January but still keep learning

Now I'm having my school exams (3rd year computer science) and I don't even know what we are to read there 😂😂

I pull all nighters for this stuff

My only mistake was not creating a blog to document my learnings 😂

Thanks @stuck rover for listening to me nag and being patient with me right from the beginning

[serene umbra]

Gave +1 Rep to @stuck rover

[stuck rover]

Hey, no problem at all, man. I don't know if I mentioned this to you before but if you aren't able to get a subscription anytime soon then you could always do INE's Penetration Testing Student which is completely free and then use TryHackMe for challenges to practice and come back to the subscriber rooms once you have it.
https://checkout.ine.com/starter-pass
Just sign up and create an account. It's all free.

[warm hinge]

Any advice for getting into Security Engineering?

[pseudo creek]

look at job listings, see what they are asking for in terms of experience/certs and work towards that (Security engineering means 100 different things to 100 different people)

[warm hinge]

Gotcha

[stuck rover]

I'd also look at enterprise security, sysadmin, configuration of firewalls etc

[crude thunder]

Thanks allot sleepy

[serene umbra]

Gave +1 Rep to @stuck rover

[meager hazel]

Are you in software development now, or in infosec and wanting to get into development? Both require different paths

[warm hinge]

I'm in infosec (or rather trying to get into it right now, I'm a Cybersecurity college student graduating next month)

I've been learning Python and some Golang as well

[vital laurel]

Ohh, I love security engineering

[hollow lance]

Hey guys, im a fresh Cybersecurity graduate and im very lost, i don't know what to do career wise, what should i do?

I've been practicing on TryHackMe and learning alot but what's needed to land a job?

Ignore the sticker i accidently sent it

Any guidance is much appreciated

[vital laurel]

hmm

Well you're a graduate, but don't know about career.. Not a great position, but graduating is a good start. Do you know anyone in the industry already?

[hollow lance]

Nope

I don't know anyone

[vital laurel]

What country?

[hollow lance]

I'm currently in France lol

[vital laurel]

Darn, I'm not sure I could be as much help. Find an internship?

[hollow lance]

I am currently doing an end of studies internship but its just so dull man, all im doing is collecting info amd putting them in a word document im not learning shit

So i definitely need to find something else after, but french is just killing me

And moving is not an option

I either find something or im done for

[lavish blaze]

Do you have any experience in any part of Cybersecurity?

[flat sedge]

That is 90% of security work right there. There are things to learn in every job, if you take the route of 'this is a waste of my time' you aren't just wasting your time, you are wasting the opportunities at that company.

[hollow lance]

Nope

[hollow lance]

I see

[flat sedge]

Network while you are there, make connections with your bosses and the IT implementation groups you work with and around. Why are you doing the documentation? That's a key insight to have into GRC for enterprise.

[hollow lance]

Im the youngest member of my team, and the language barrier is killing me, i can't connect well with them

[flat sedge]

As soon as you have the attitude of 'I'm better than this' you've lost the most important thing for security: attitude to learn all you can and grow. If you think what you are doing is pointless, ask your supervisor for help understanding why it's been tasked to you

[hollow lance]

The documentation is basically for summarizing all the needed info of a system to make correlation rules to prevent attacks

[flat sedge]

Security teams can teach skills and impart knowledge, what they can't teach is attitude.

[hollow lance]

I understand what needs to be done, it's just it's dragging too long

I'm not saying im better than this, I'm just demotivated

[flat sedge]

I have known and worked with at least 2 interns who got post-internship jobs based on the strength of their report writing skills

[hollow lance]

Im 40 pages in, it's not ending 😂

[undone shore]

Only 40 pages? 😆

[hollow lance]

For now yes, my tutor was like we will keep upgrading and adding to it, i was like yeah cool

faints

I'm pulling info out of 15-20 documents, 2 of them are 3200 pages long, ive been spamming ctrl+F for 2 months now

[warm hinge]

As a technical writer i feel your pain lol

[hollow lance]

Haha

At least what certification should i start with as a beginner

[stuck rover]

It depends on where you want to go and the opportunities where you are.

Generally, sec+ seems to be it for blue team. OSCP for red team. Feel free to correct me on this

[hollow lance]

Always found pentesting is fun, i might venture in it, also i noticed that a good understanding of programming languages is needed in order to bypass/attack websites or systems ir whatnot, i suck at programming tho, im gonna try to work on that

[stuck rover]

Do CS50 then! It's awesome for learning programming.

[silver coral]

Does anyone want to start a pentesting team?

Dm me

[hollow lance]

I don't know what that is but ill definitely look into it thank you

[serene umbra]

Gave +1 Rep to @stuck rover

[stuck rover]

Programming is definitely something you want to learn earlier rather than later

[hollow lance]

Yeah programming is a key factor in everything

Never too late

To learn

[stuck rover]

https://cs50.harvard.edu/x/2021

[hollow lance]

Saved the link

[stuck rover]

It's gonna be a useful base going into exploit dev, malware dev(if you're that sort of person👀), automation, reverse engineering.

[hollow lance]

Im into everything i wanna learn, but its just too much, that's why it's getting harder and harder to live on this planet

Alot to learn, we're not immortal

It's confusing

[warm hinge]

Got recommendations on what languages to learn aside from Python?

[hollow lance]

No clue lol

[warm hinge]

I was going to start learning Javascript but wasn't sure how it holds up by itself

[hollow lance]

As i said, alot to learn

[flat sedge]

JS is a garbage language, but it's ubiquitous. IMO, unless you have a very specific thing you want to learn JS for, learn a statically typed language pretty deeply before branching out

[warm hinge]

Gotcha, since you say statically do you recommend learning Java? Wasn't sure because I thought it's being phased out

[flat sedge]

Java isn't going anywhere any time soon. I wouldn't put any faith in Java going away until Oracle stops selling JRE and JDK licenses

Java is a good language for prototyping and learning how things sort of work. The biggest problems with Java are bad devs locking their Java apps into specific versions - really breaks the idea of WORA if codebase is locked that way

Nothing like going into an environment and seeing 5 different versions of Java on the infra.

[lavish blaze]

If you don't know C I'd say learn that.

[quick forum]

PowerShell is fun

[flat sedge]

C is a big lift for a casual learner - there's so much to pay attention to, it's easy to get lost. I would say take a course or two through a vocational or junior college if going that route. The structure will make it much easier.

[lavish blaze]

True true

[ebon mica]

And you shouldn't be writing code in C if you can avoid it

[flat sedge]

Arhu isn't wrong about that

to be fair though, some things kind of have to be written in C, if only because the community glares menacingly at any code written in another language submitted to the SIG

And in environments that have a requirement for absolute performance, C is really the best option

[quick forum]

It's nice to write some C and then realise why you shouldn't have used C for it

[hollow lance]

Imma learn python

[quick forum]

Or write some ASM and see why you should have used C

[ebon mica]

For limited resource systems C is often the way to go. But then again, C isn't a guarantee of performance.

[flat sedge]

C does give better control over what's happening - it is the ultimate way to shoot yourself in the foot

[ebon mica]

For example, when the language does not, by default, provide any data structures to work with, people tend to not use them.

[flat sedge]

James, have you had the fun of writing C that injects ASM? debugging that is a great learning opportunity

[ebon mica]

or do their own implementations of DS&A, which... quite often isn't a good idea

[flat sedge]

In limited resource environments, the standard libraries are often too weighty to use

[quick forum]

I avoid ASM when I can

Haven't got to the memory injection stuff yet, that's after OSCP

[flat sedge]

https://gcc.gnu.org/onlinedocs/gcc/Using-Assembly-Language-with-C.html 🙂

[quick forum]

Yep

[stuck rover]

I know a dude that legit wrote code in C++ and Rust then rewrote them in C again "because the binaries were too big." Absolute mad lad.

[flat sedge]

There are certain things C is the absolute best at, among high level languages. Callback latency is also top tier

[warm hinge]

Im only 15, but I have a subscription to thm and i really like computers and cyber. I just don't know exactly what I should focus on for my career down the line. Are there any resources you could recommend for this?

[flat sedge]

Don't worry about it; keep exploring and finding what interests you.

It's better to build a career off things you find interesting than to chase a paycheck

[warm hinge]

word. thanks

[serene umbra]

Gave +1 Rep to @flat sedge

[dim umbra]

Is getting certs on top of a degree worth it?

[quick forum]

Practically required in some places

[dim umbra]

Really? What would an example of that look like?

[quick forum]

What?

Pentest roles in the UK often advertise requiring a degree or experience, and then certs on top of that.

[dim umbra]

Ah ok

Sorry that second question didn't make sense lol

[distant kelp]

So is uni actually worth going to, I'm still in college in the UK but trying to decide if I should go for a degree or 3 years experience and self teaching

[quick forum]

In the UK?
The loans are a tax. Don't let anyone tell you that they're not a tax. They're paid back as a tax.

[distant kelp]

Yeah in the UK

Trying to decide if spending 3 years and money is even worth a qualification

Surely employers don't just care about a uni degree?

[quick forum]

They don't just care about a degree, correct.

But they do care about degrees

And graduate programs are still great

[distant kelp]

Aren't they were they pay for you to go to uni?

[quick forum]

No graduate programs are, as the name suggests, for graduates.

[distant kelp]

Which is the one where an employer pays for your uni?

Pretty sure some employers do that

So they can train you from the ground up

[quick forum]

Degree apprenticeship?
Sponsorship? - more common with Masters degrees

[distant kelp]

Something like that

[spiral garden]

@quasi stream , can you explain how you found a company to contact at 15?

I'm looking to get a cyber sec apprenticeship after gcses (may 2022)

[static tide]

i would recommend you go for a degree apprenticeship sniped

[stuck rover]

Maybe more polite wording would be, "Would you please explain to me how you found a company to contact at 15?"

[static tide]

gchq offer some as well as other non government agencies if that ain’t your thang

[quick forum]

They can be hard to get into though. Get applying @distant kelp

[static tide]

yeah i applied to one at some point in 6th form and didn’t get past the first round lool

gchq one^

[stuck rover]

RIP

[static tide]

it’s okay i got something better now😅

[spiral garden]

Sorry, my natural speech habits online aren't too polite

[undone shore]

What's wrong with that?
It's direct, but not impolite -- no more than bluntness ever is online 🤷‍♂️

[vague lantern]

Has anyone here ever had any experience with the CyberCorps program?

[stoic cave]

The one in the US? Pay for a bit of college and in return you work for them for the amount of years they paid?

I know a little about it. They recruited heavily out of my college

[vague lantern]

Yeah

[stoic cave]

What questions do you have?

[vague lantern]

How hard is it to get into the program? If you get in, are you guaranteed a job once you graduate? Is it actually worthwhile?

[stoic cave]

Ok so I'll go line by line

Hard is a subjective term and is also up to the professor in charge of handling all the applications. This is how it was done at my Uni anyways. I applied for help with my Masters but was denied by the professor who didn't think I was a quality enough candidate. Strictly based off my GPA which was tanked due to me being in a Biology/Neuroscience Bio 101 class

As far as I am aware, once you are in and you take that money, you owe them

The job is guaranteed upon graduation and your salary is capped at $65,000 a year i think it was

Between 55-65 thousand

[vague lantern]

ah

So that's the catch

[stoic cave]

The up side is that you now have a government job and it opens a lot of doors

Especially if you get picked up by certain agencies

[vague lantern]

oh, are there preferable agencies?

[stoic cave]

If i remember correctly you're thrown into a pool and the agencies select out of that pool

That may be another program though

[vague lantern]

Sounds cool

[stoic cave]

An example would be you apply your sophomore year and get selected. The program pays for your junior and senior year of college. At that point you now owe the government two years of work

[vague lantern]

Yeah, a couple of the schools I've applied to had it so I figured I'd see if the people here had any info.

Thanks!

[stoic cave]

Not a problem

That is a program that it's catered to those on the backend of their degrees

Also, if you want to intern with any of the major government agencies you're going to have to apply your freshman year

[stoic cave]

Most of them want you for two summers

[vague lantern]

Wait so you have to apply two years before you're even gonna start doing internships?

[stoic cave]

As an example, the NSA wants you your sophomore and junior year summers

So you'll have to apply end of freshman year

[vague lantern]

Hmm

Seems like I wouldn't be qualified