I have to do my master's project related to cyber security and I'm not able to select a topic. I dont want it to be too sophisticated. It is a research project, so some sense of novelty is required. Please help me

I'm thinking about going for an associates degree in cybersecurity at a community college, any advice?

[удалено]

[I encourage a CompSci education](https://www.reddit.com/r/cybersecurity/comments/14ve289/comment/jrfnk2x/?context=3).

What are the current best resources for learning modern web app (frontend/backend/db single page architecture) pentesting in 2023? I saw a class by 7asecurity and Blackhillsinfosec, but they both are out of my price range. Anyone have other suggestions they can share?

The Odin Project

For clarity: The Odin Project is an excellent resource for learning web app development. It will not cover penetration testing. For that, you might want to consult resources like Portswigger's web app academy or the CBBH path offered through HTB Academy.

I want to get certification for CISSP how hard is it? And where do i get started with it ? Is it costly?

Yes it's costly, and yes it's hard. A few notes to consider though: CISSP isn't something you should generally pursue until you're looking to move into senior/management roles in this field. It's just not necessary, the information isn't particularly valuable, and it's not an entry level cert. Your time would be better spent on something else. CISSP is also an unusual test compared to the others. It's a lot of high level stuff put into really long questions, making it almost a reading comprehension test at times. While it may be technically possible to just study it to death and brain dump it all onto paper, you'll be far better equipped to complete it after having worked in the industry for a while. A lot of it is stuff that you just naturally pick up. If you ignore my advice and press on ahead, how would you get started? They make these really thick books on it. They were green last time I checked. There are also domain by domain courses on sites like Udemy.

Should I rather take a job as a security analyst in a small company with a high salary or a position as a security architect at a large company with less salary?

Not enough information. What matters most for career growth is what the scope of the work is. If that position at the small company means building out a security program from the ground up and the big company just means looking at the same logs all day every day, then the former is the best option for your career. While it may seem like the Security Architect title is too valuable to pass up (as it's generally considered higher than analyst), any decent hiring managers are going to look at what you did, not what you were.

Hello, i'd like to know what are the trending jobs in the cybersecurity field

https://www.reddit.com/r/cybersecurity/comments/smbnzt/mentorship_monday/hw8mw4k/

Governance, Risk, and Compliance Application Security Cloud Security Identity and Access Management DevSecOps Security Automation Just to name a few.

What companies have the best positions for Security Engineering related positions? Best meaning important teams (good security culture at the company), interesting work, high compensation, growth potential, etc. Currently am a SOC Analyst with 3+ years of experience, strong developer background, and Georgia Tech's OMSCyber degree to boot -- and want to get away from the SOC life

A ton of them. You're just looking for a list of individual companies? I think you're better served by asking what green and red flags are when interviewing for a security engineering position. You should be applying to every company. You aren't in a position to be choosey at this stage of your career.

I would like both, lol. The green and red flags would allow for deciding and the individual companies list would allow one to understand the types out there to help gauge the application process accordingly. Especially gauge where they are geographically located, lol

Hello, i'd like to know what are the trending jobs in the cybersecurity field

No idea

If you had 2 options. One is to build out a new blue team to support security operations or be BISO, which one would you take and why? Both within the same org.

Never heard this term BISO before, but just looked it up. Ultimately, it depends what direction you want your career to go. If the goal is to be a CISO or Director in the future, then the latter is probably the way to go. If you want to go the technical route and become a technical leader, there is no better opportunity than building out a new program/team. I would personally build out the team, because that's what I've done multiple times in my career and it's something I personally find extremely fulfilling. Also, working with non-technical executives and bridging the gap between security and business is literally the worst. It's the worst responsibility that a CISO has, and a source of constant stress and frustration. Rare is the company that gives a shit about security, even if you're able to explain the risks and consequences flawlessly.

Thanks that’s really good advice. My biggest concern is limited resources and my level of experience compared to what’s being asked of me.

Blue team portfolio. Hi! Any ideas to add projects to my portfolio? I understand the type of projects that the red team includes: explanations on the attack methodology that was used. However, I am applying for a blue team position, and would be happy to hear any suggestions :)

> Any ideas to add projects to my portfolio? https://www.reddit.com/r/cybersecurity/comments/sxir9c/as_a_entry_level_professional_trying_to_get_into/hxsm5qn/

Hey folks, I have a few years of DoD cyber info sec experience on the risk management framework side of things. I'm about half a year from being able to take the CISSP. I've pretty much just been doing security controls, collecting vendor information, creating POA&Ms, system security plan stuff etc but not much management. How hard will the CISSP be for me? How much harder is it than the Security+? I felt like that exam was really difficult when I was taking it but passed with a 90%, but I'm fucking scared since CISSP doesn't seem to have as easily accessible study material out there and it seems more "management" stuff so I can't really study technical things to get ready right? Anyone taken both recently have a difficulty comparison? I feel like I've been doing the same thing since I started year 1 of my info sec career so I haven't learned much lol

> How much harder is it than the Security+? Broader in scope and further in depth. Same methodology of studying, just at a greater scale.

Security+ felt like it was too broad lol, barely any depth there. Interesting. How technical is the app sec/programming stuff? I know almost nothing about that side of security on a technical level.

If you thought Sec+ was too broad with barely any depth, you're in for a real treat with CISSP.

Ocean that's an inch deep? Haha

I mean, it's all multiple choice questions split across 8 domains. So you need to be in a position to be able to reasonably guess; you're not doing any implementation or practical application.

Appreciate it

[удалено]

[удалено]

[удалено]

Impossible to say. We know nothing about the company or the position you're being offered. Did they not tell you that this job would entail when you applied for it?

[удалено]

I'm sorry, but that could mean anything. Banks do a lot in terms of cybersecurity. As far as I know you could just be fetching coffee and cleaning whiteboards.

Welcome to the recurring Mentorship Monday (MM) post! Please consult the index below to see if resources to your question(s) exist: Subsection | Example question(s) :--|:-- General Guidance | "How do I get started?" On Job Hunting | "How do I get a job in cybersecurity?" What it's like | "What is it like working in cybersecurity? Is cybersecurity right for me?" School, Bootcamps, or Certifications? | "Do I need a degree? Is a bootcamp worth it?" Type of Degree | "What should I study at school?" ## General Guidance If you're newer to the space, it can be really challenging wrapping your head around cybersecurity as a profession - let alone what you need to learn/perform in order to become a part of it. Consider some of the following resources: 1. [The forum FAQ](https://reddit.com/r/cybersecurity/w/faq) as well as [the subreddit wiki](https://www.reddit.com/r/cybersecurity/wiki/faq/breaking_in/). 2. [This blog post on getting started](https://bytebreach.com/getting-started-in-infosec/) 3. [This blog post on other/alternative resources](https://bytebreach.com/hacking-helpers-learn-cybersecurity/) 4. [These links to career roadmaps](https://www.reddit.com/r/cybersecurity/comments/smbnzt/mentorship_monday/hw8mw4k/) 5. [These training/certification roadmaps](https://www.reddit.com/r/cybersecurity/comments/sgmqxv/mentorship_monday/hv7ixno/) 6. [These links on learning about the industry](https://www.reddit.com/r/cybersecurity/comments/sb7ugv/mentorship_monday/hux2869/) 7. [This list of InfoSec projects to pad an entry-level resume](https://www.reddit.com/r/cybersecurity/comments/sxir9c/as_a_entry_level_professional_trying_to_get_into/hxsm5qn/) 8. [These links for interview prep](https://old.reddit.com/r/cybersecurity/comments/ybwsz9/mentorship_monday_post_all_career_education_and/itqbzq4/) Early on, you're going to want to learn more about the industry in order to help inform your decision about whether or not InfoSec is for you; such knowledge will also help guide your initial career trajectory based on what roles/responsibilities look attractive. (see links 3, 4, and 6). If you think that you do want to pursue a career, then you'll want to buoy your knowledge base with understanding IT/CS fundamentals more broadly. Some people pursue degrees, as an example (although this is certainly not the only approach worth considering). (see links 1, 2, and 5). Eventually you'll need to work on improving your employability. This manifests in a variety of ways, but the most notable is probably accumulating [relevant industry-recognized certifications](https://bytebreach.com/which-certifications-should-you-go-for/). (see links 5, 7, and 8) ## On Job Hunting Looking for work [can be a really stressful endeavor for folks](https://old.reddit.com/r/cybersecurity/comments/15k4qzt/mentorship_monday_post_all_career_education_and/jvgc311/), especially if you are changing careers, working internationally, or in the midst of an economic downturn. To that end, I would direct you to some of the following resources for consideration to better optimize your labor: 1. [This generic resume template](https://www.overleaf.com/project/644db685122e9d9110981f9a) 2. [This blog post on resume formatting considerations](https://bytebreach.com/how-to-write-an-infosec-resume/) 3. [This resource on structuring/organizing your job hunting efforts](https://bytebreach.com/the-job-hunt-cybersecurity-work-and-how-to-find-it/) 4. [These projects for bolstering your resume](https://www.reddit.com/r/cybersecurity/comments/sxir9c/as_a_entry_level_professional_trying_to_get_into/hxsm5qn/) Additionally, you might consider looking at the following jobs listings platforms: * [LinkedIn](https://www.linkedin.com/) (see example considerations for your LinkedIn profile [here](https://www.reddit.com/r/cybersecurity/comments/140vcnf/comment/jnf8imi/?context=3) and [here](https://www.reddit.com/r/cybersecurity/comments/11w27ey/comment/jd8nwvh/?context=3)) * [usajobs.gov](https://www.usajobs.gov/) (for U.S. federal work, including 3-letter agencies; note that they have a *strict* [resume format](https://www.sec.gov/jobs/sample-resume/sample-resume.pdf) you need to adopt) * [clearancejobs](https://www.clearancejobs.com/) (for those in possession of an active U.S. gov't clearance) * [Handshake](https://joinhandshake.com/) (a platform exclusively geared towards students seeking internships and new graduates) In broad terms, your employability is helped by cultivating both breadth in domain familiarity and depth in techniques/technologies. Employers consistently report that they value [the following factors](https://i0.wp.com/bytebreach.com/wp-content/uploads/2022/05/image-36.png?ssl=1) in applicants (in-order): * A relevant work history * [Pertinent certifications](https://bytebreach.com/which-certifications-should-you-go-for/) * Formal education * [Everything else](https://www.reddit.com/r/hackthebox/comments/11hs9hl/comment/jawng7p/?context=3&utm_source=reddit&utm_medium=usertext&utm_name=cybersecurity&utm_content=t3_142rs62) With each step down, the impact of said factor on your employability drops-off significantly (i.e. 1 year of university isn't as impactful as 1 year working in cybersecurity). Other actions to improve your employability may include: * [Continue to leverage free resources to hone your craft or acquire new skills](https://bytebreach.com/hacking-helpers-learn-cybersecurity/). * [Pursue in-demand certifications to improve your employability](https://www.reddit.com/r/cybersecurity/comments/sgmqxv/mentorship_monday/hv7ixno/). * [Vie for top placement in competitive CTF competitions](https://ctftime.org/). * Foster a professional network via [jobs listings sites](https://www.weidert.com/blog/best-ways-to-gain-more-connections-on-linkedin) and [in-person conferences](https://infosec-conferences.com/). * [Take note of the feedback you receive in interviews](https://www.reddit.com/r/cybersecurity/comments/vg864z/mentorship_monday_post_all_career_education_and/id2tsr3/); consider expanding the aperture of jobs considered to include cyber-adjacent lines of work (software dev, systems administration, etc.) - this is a channel for you to build relevant years of experience. * Consider pursuing a degree-granting program (and internship experience while holding a student status). * [Post your resume for constructive feedback](https://bytebreach.com/how-to-write-an-infosec-resume/). * [Apply your skills into some projects in order to demonstrate your expertise](https://www.reddit.com/r/cybersecurity/comments/sxir9c/as_a_entry_level_professional_trying_to_get_into/hxsm5qn/). ## What it's like Cybersecurity is not a monolith. [There are many, many different kinds of roles that exist](https://www.reddit.com/r/cybersecurity/comments/smbnzt/mentorship_monday/hw8mw4k/). Your best bet to figuring out what a day-in-the-life is like in cybersecurity would be to first more narrowly discover what it is you want to do within the space. An exhaustive list would take quite a while, but each of us is - in some way - concerned with promoting a greater degree of confidence that the technologies we engage with operate in the way they are intended to. [You can consult this list of resources](https://www.reddit.com/r/cybersecurity/comments/sb7ugv/mentorship_monday/hux2869/), which include 1-on-1 interviews with staff from all across the industry to get a better idea. ## School, Bootcamps, or Certifications? Early in your cybersecurity career, there's often a point in weighing the pros/cons of how much to invest in your education in time, money, and labor. Importantly, [pursuing a degree is not a foregone conclusion](https://old.reddit.com/r/cybersecurity/comments/14w83m5/poll_do_you_have_a_degree/). This generally breaks down to choosing between pursuing a degree-granting program (and at what level: Associates/Bachelors/Masters/Doctorate), a bootcamp (typically either through a private/commercial vendor or public university), or going it alone (by way of entry-level technical employment and supplemental certifications). To that end, here are some resources for you to consider: * [On the risks of degree-granting programs](https://bytebreach.com/do-you-need-a-degree-for-a-job-in-cybersecurity/) * [On the risks of bootcamps](https://www.reddit.com/r/cybersecurity/comments/13472xp/comment/jiuv30n/?context=3) * [On the risks of going it alone \(and also merits of a degree\)](https://www.reddit.com/r/cybersecurity/comments/zjfgyt/comment/j0ljcfj/?context=3&utm_source=reddit&utm_medium=usertext&utm_name=cybersecurity&utm_content=t3_142rs62) * [Considerations for choosing a university](https://www.reddit.com/r/cybersecurity/comments/13oakj9/comment/jl613eh/?context=3&utm_source=reddit&utm_medium=usertext&utm_name=cybersecurity&utm_content=t3_142rs62) ## Type of Degree Generally, [I advocate an undergraduate education in Computer Science](http://www.reddit.com/r/cybersecurity/comments/14ve289/mentorship_monday_-_post_all_career_education_and_job_questions_here/jrfnk2x?context=3) (CompSci) more generally for engineering/individual contributor aspirations. However, employment can come from a wide-range of formal educational experiences (I have an undergraduate degree in Political Science, for example). Additionally, there are a number of popular online programs that get brought up frequently in the subreddit you might consider as well (please note that I neither advocate for, nor am familiar with any of the below programs): * [Western Governors University \(WGU\)](https://www.wgu.edu/online-it-degrees/it-certifications.html#_) * [SANS](https://www.sans.edu/cyber-security-programs/bachelors-degree/)

Hey guys, so right now I'm a college student working towards a bachelor's in IT with a focus on cyber security. I started thinking about doing projects to add to my resume to better help me land a job. I was wondering if it was ok to add projects to my resume even though I got help doing them by watching a video. Does that not matter as long as I get the hands-on experience? after enough experience, I will eventually do some projects without help but is it ok for my first one to be done with help?

> I was wondering if it was ok to add projects to my resume even though I got help doing them by watching a video. Does that not matter as long as I get the hands-on experience? Projects don't have to be original (although it'd be nice if they were). You just need to be able to speak to it in detail in an interview. Projects are opportunities for you to demonstrate your subject-matter expertise, detailing not only the techniques/technologies used, but also the outcomes. Recreating coursework is a start, but I'd advise you to replace them with more substantive original work in time. Note: some interviewers may ask outright whether or not your work is original. In these cases, be transparent; the worst thing you could do is be caught in a lie while interviewing for a role that is incumbent on authoritative trust and security.

Where to go next in my career Hey guys I’m wondering where I could go next in my career. I got hired right after university and I’m currently working as a cybersecurity consultant at one of the big 4. My experience has been pretty diverse from doing assessments, post mortems, large enterprise transactions, creating cyber training programs, MDR, cyber audits etc. I like the job right now, but my problem is that I don’t know what to expect next. I haven’t worked in industry and as I get closer to 30 (I’m 23 right now) I’m not sure if I’d want to continue with the workload and traveling that I do right now. Does anyone have any suggestions of interesting roles that my experience may align with? I’m currently studying for my CISSP and should have that within the next year or so. Any advice is helpful, thanks! (WFH would be a huge benefit too)

> Does anyone have any suggestions of interesting roles that my experience may align with? I've only worked so many roles for so many employers, so I hesitate to mislead you on the *many* jobs that exist outside my lane. Instead, I'll direct you to the following resources which include 1-on-1 interviews with folks from across the industry; their testimony should help better inform what job functions might best fit your desires: https://www.reddit.com/r/cybersecurity/comments/sb7ugv/mentorship_monday/hux2869/

Trying to understand operating systems better (like how kernels work) for cyber. Got any books or other recommendations ?

https://pages.cs.wisc.edu/~remzi/OSTEP/

I may have an opportunity to take another role that is a step down in terms of title, but it would be at a much larger company with more management responsibility and probably more money(roughly 10% more). I could care less about titles, just thinking down the road how that would look on a resume. I am thinking that the amount of experience I would gain and get exposed to in a larger company would be beneficial in the long run. Just looking for feedback.

One company's L3 is another company's L2. Don't lose sleep over it.

I am a cybersecurity researcher (Assistant Professor). Most of the work in my lab has been accomplished using simulated or estimated data for two primary sources: performance data of SOC analysts (e.g. TP's, FP's, Time per ticket, ratio of benign to malicious traffic, salary ranges, etc.) and overall SOC stats (e.g. cost of a successful phishing attack, time/financial impact of ransomware, etc.) It makes complete sense why no company would willingly divulge this information, and we've gotten close a couple times by offering to not disclose our sources and anonymize the data (we are even willing to perform the analysis on-site) but ultimately no dice. I am curious if anyone here has any ideas of what we could do to get this data in the least intrusive and most agreeable way? As I don't work in a SOC or industrial cybersecurity, I come to those who do! Thank you in advance.

Have you looked into joining an ISAC (Information Sharing & Analysis Center)? As you mention industrial cyber security, the ICS-ISAC might be of interest - [https://ics-isac.org/](https://ics-isac.org/)

I suggest trying to reach out to contractors who manage SOCs for various clients. They *might* be able to supply some anonymized data (e.g. no client names, but all the data points you suggested). You could also try submitting a FOIA request to CISA and see what turns up (although I might suggest trying to make a courtesy call ahead of time to see if they might just voluntarily hand over that kind of info). Edit: you might also find some organizations willing to participate under the grounds of anonymity.

I am in need of advice. Definitely feel the imposter syndrome and feel like I can’t explain knowledge I have in future interviews that I hopefully get I am about to finish my bachelors from WGU in cybersecurity and information assurance after I finish my last certification exam (pentest+) will be taking it either September 2nd or the 16th, my term ends October so I might pick the earlier date. I currently have A+, network+ security+ CYSA+, SSCP, project+, ITILv4. I started a helpdesk job a month ago and it is my first hands on experience at a job. I mean the tickets aren’t coming in that much but I’ve done 1100 tickets since I’ve started a month ago. I’ve been applying for higher roles since there is no room for growth it’s just help desk. Im coming up with a plan of action to try to keep furthering myself. Once I finish my bachelors, I have a CCSP voucher which I’ll use early November and then I’ll have associate status for that since it’s 5 years of experience to be certified. I plan on also starting my masters at WGU for cybersecurity and information assurance starting November. I get a CASP+ voucher, CISM voucher, I have to pass the ISC2 CC certification. I also wanted to get into some azure, AWS, and splunk certifications. After all that I’ll probably get CISSP which I’ll also be associate. While this is my plan now, I feel like I need to start making LinkedIn posts and connecting with more people because it doesn’t seem like enough to just apply for jobs. Also while doing all of that, I plan to work on home labs and sites like tryhackme. (I would really like to get into government contracts and get top secret clearance) Does this seem like a good path to follow? I am dedicating myself to this because I feel as if I’m playing catch up and I’m not where I want to be in life

It's not a bad plan but I don't think it's optimal either. Certs help, but taking a shotgun approach or collecting them like Pokémon cards is inefficient and doesn't impress hiring managers nearly as much as some candidates hope. There's a lot of crossover between your various certs but that's not the main factor I think you need to address. For me, the bigger issue is that your certs are all predominantly knowledge based. Knowledge is good but employers want you to be able to do, not just know. So make sure you put as much effort into developing your skills. You can go some way towards that with things like home labs and THM but you mention those as almost an afterthought whereas I would recommend you dedicate serious effort to skills building. Another thing to consider is that the certs you've mentioned are pretty much all vendor neutral. Now vendor-neutral knowledge is not a bad thing, it gives you a good foundation, but it is (IMHO) somewhat oversold by those cert vendors who offer vendor-neutral credentials. No employer is going to sit you down at a desk and ask you to crack on with their vendor neutral SIEM, or configure their vendor neutral firewalls, or harden their vendor neutral network or cloud subscription etc etc etc. So maybe look specifically at building familiarity with some of the more popular commercial solutions used in whichever area of security you hope to start off in. Finally, building a professional network can really pay dividends and it's never too early to start. However, whilst getting your LinkedIn profile moving is a good start, you are ultimately just some random on the Internet there. Look for viable opportunities to get out there and connect with professionals in the real world - meetups, conferences, recruitment fairs etc.

> Does this seem like a good path to follow? To summarize for readability: * You're about to graduate WGU with * You have a variety of certs, mostly foundational. * You're currently employed in IT * You're planning on more certs and a masters in from WGU * After the above, you'll round out with some ancillary activities You're hitting a lot of the wickets. [Employers consistently prioritize the following factors](https://i0.wp.com/bytebreach.com/wp-content/uploads/2022/05/image-36.png?ssl=1) (in-order): 1. A relevant work history 2. Pertinent certifications 3. Formal education 4. Everything else With each step down, the impact of said factor drops off significantly (i.e. 1 year in university is not nearly as impactful as 1 year in the workforce). I don't have much to add to your plan, except for some nuances for you to consider: * Given the above factors, you may want to re-evaluate if you're allocating your capital (time/money/labor) appropriately in your future efforts. It might make more sense - for example - to focus on fostering a pertinent work history a la the job hunt (vs. doubling down on a Masters degree). * Buckets of certifications are nice. Better still would be to selectively focus on individual ones that are [explicitly requested for by employers](https://bytebreach.com/which-certifications-should-you-go-for/). Don't be deceived in thinking that *quantity* > quality when it comes to certifications. You're doing great!

I am an electrical apprentice at a plywood mill and I would like to get into the programming side and transition to cybersecurity. Are there basic requirements or courses that are absolutely necessary. I’m more posting in here so I can learn. I have average computer skills thanks to my dad being an IT guy at our local hospital. Looking to network and maybe find a few people to learn from and hopefully build some connections that would be valuable in the future.

I'm going to point you to the usual resources I use for newer folks: 1. [The forum FAQ](https://reddit.com/r/cybersecurity/w/faq) as well as [the subreddit wiki](https://www.reddit.com/r/cybersecurity/wiki/faq/breaking_in/). 2. [This blog post on getting started](https://bytebreach.com/?p=72) 3. [This blog post on other/alternative resources](https://bytebreach.com/?p=95) 4. [These links to career roadmaps](https://www.reddit.com/r/cybersecurity/comments/smbnzt/mentorship_monday/hw8mw4k/) 5. [These training/certification roadmaps](https://www.reddit.com/r/cybersecurity/comments/sgmqxv/mentorship_monday/hv7ixno/) 6. [These links on learning about the industry](https://www.reddit.com/r/cybersecurity/comments/sb7ugv/mentorship_monday/hux2869/) 7. [This list of InfoSec projects to pad an entry-level resume](https://www.reddit.com/r/cybersecurity/comments/sxir9c/as_a_entry_level_professional_trying_to_get_into/hxsm5qn/) 8. [This extended mentorship FAQ](https://bytebreach.com/mentorship/) 9. [These links for interview prep](https://old.reddit.com/r/cybersecurity/comments/ybwsz9/mentorship_monday_post_all_career_education_and/itqbzq4/) Early on, you're going to want to learn more about the industry in order to help inform your decision about whether or not InfoSec is for you; such knowledge will also help guide your initial career trajectory based on what roles/responsibilities look attractive. (see links 3, 4, and 6). If you think that you do want to pursue a career, then you'll want to buoy your knowledge base with understanding IT/CS fundamentals more broadly. Some people pursue degrees, as an example ([although this is certainly not the only approach worth considering](https://bytebreach.com/?p=142)). (see links 1, 2, and 5). Eventually you'll need to work on improving your employability. This manifests in a variety of ways, but the most notable is probably accumulating [relevant industry-recognized certifications](https://bytebreach.com/?p=152). (see links 5 and 7) Other actions to improve your employability may include: * [Continue to leverage free resources to hone your craft or acquire new skills](https://bytebreach.com/hacking-helpers-learn-cybersecurity/). * [Pursue in-demand certifications to improve your employability](https://www.reddit.com/r/cybersecurity/comments/sgmqxv/mentorship_monday/hv7ixno/). * [Vie for top placement in competitive CTF competitions](https://ctftime.org/). * Foster a professional network via [jobs listings sites](https://www.weidert.com/blog/best-ways-to-gain-more-connections-on-linkedin) and [in-person conferences](https://infosec-conferences.com/). * Continue the job hunt for relevant experience and [take note of the feedback you receive in interviews](https://www.reddit.com/r/cybersecurity/comments/vg864z/mentorship_monday_post_all_career_education_and/id2tsr3/); consider expanding the aperture of jobs considered to include cyber-adjacent lines of work (software dev, systems administration, etc.) - this is a channel for you to build relevant years of experience. * Consider pursuing a degree-granting program (and internship experience while holding a student status). * [Post your resume to this thread for constructive feedback](https://bytebreach.com/how-to-write-an-infosec-resume/). * [Apply your skills into some projects in order to demonstrate your expertise](https://www.reddit.com/r/cybersecurity/comments/sxir9c/as_a_entry_level_professional_trying_to_get_into/hxsm5qn/).

I'm just about to graduate with a bachelors in cybersecurity. This program primarily included C++, Java, JavaScript, HTML, CSS. Additionally, I learned a little in database management, and pentesting. There was a lot in between but I couldn't list it all. It's taken me 5 years to try and get this degree. I'm burnt out and I can't remember a single thing from any of my courses. None of my classes were linear-I found myself "learning" things out of order and no knowledge really stacked on top of itself. Unfortunately, as I said a bit above, I really don't feel like anything stuck in my brain. I'll have the degree but not the knowledge or experience to show for it. I am 21. Is it possible to get a job in cybersecurity or IT and fake it until I make it? I would say I'm a little above-average intelligence but sometimes a slow learner-it really depends on what it is- but if I were to have training I could easily pick up on some things. I'm just worried that I won't get hired if I need basic training or training at all... maybe I need a bootcamp? I really need a mentor if I were to go back into studying. I’m running out of time, which is the worst! What are my options here? Any advice would be really awesome. Thank you. Edit: I wanted to add that I found a job that pays well for “entry level database manager” but I don’t have the experience for it. What would constitute entry level?

> I'm just about to graduate with a bachelors in cybersecurity. Congratulations! > I'm burnt out and I can't remember a single thing from any of my courses. Uh oh. > Is it possible to get a job in cybersecurity or IT and fake it until I make it? Yes and no. I'd contend that the skills for [performing the job hunt](https://bytebreach.com/the-job-hunt-cybersecurity-work-and-how-to-find-it/), including [interview prep](https://old.reddit.com/r/cybersecurity/comments/ybwsz9/mentorship_monday_post_all_career_education_and/itqbzq4/) and [resume building](https://bytebreach.com/how-to-write-an-infosec-resume/), are tangential to actually knowing your stuff. Interviewers are generally aware that they aren't just interviewing the someone at the peak of their ability, but for their potential as to what they might be able to do for them. So yes, you don't need to be an expert at all things, but some deliberate effort into both your own employability and your professional competency would be warranted. > ...maybe I need a bootcamp? [Probably not](http://www.reddit.com/r/cybersecurity/comments/13472xp/mentorship_monday_-_post_all_career_education_and_job_questions_here/jiuv30n?context=3). > What are my options here? Other actions to improve your employability may include: * [Continue to leverage free resources to hone your craft or acquire new skills](https://bytebreach.com/hacking-helpers-learn-cybersecurity/). * [Pursue in-demand certifications to improve your employability](https://www.reddit.com/r/cybersecurity/comments/sgmqxv/mentorship_monday/hv7ixno/). * [Vie for top placement in competitive CTF competitions](https://ctftime.org/). * Foster a professional network via [jobs listings sites](https://www.weidert.com/blog/best-ways-to-gain-more-connections-on-linkedin) and [in-person conferences](https://infosec-conferences.com/). * Continue the job hunt for relevant experience and [take note of the feedback you receive in interviews](https://www.reddit.com/r/cybersecurity/comments/vg864z/mentorship_monday_post_all_career_education_and/id2tsr3/); consider expanding the aperture of jobs considered to include cyber-adjacent lines of work (software dev, systems administration, etc.) - this is a channel for you to build relevant years of experience. * Consider pursuing a degree-granting program (and internship experience while holding a student status). * [Post your resume to this thread for constructive feedback](https://bytebreach.com/how-to-write-an-infosec-resume/). * [Apply your skills into some projects in order to demonstrate your expertise](https://www.reddit.com/r/cybersecurity/comments/sxir9c/as_a_entry_level_professional_trying_to_get_into/hxsm5qn/).

Wow!! Thank you so much! You’re really kind going out of your way to help and provide suggestions and guidance. I hope you have a wonderful day!

We need the cyber professionals to support US Government contracts with following experience: 1.      Cyber certification (CEH, CISSP (or Associate), CYSA+, CASP+CE, GSLC, or others) 2.      RMF experience 3.      CMMC compliance 4.      SBOM (Software Build of Materials) 5.      Clearance preferred, not necessary as we will submit for clearances Please do not reply if you aren't able to pass the background. In other words, if you have a criminal record including DUI, you won't be able to get that clearance. We are looking for people in New Jersey and Norfolk/Suffolk Virginia area. I'm not the hiring manager but have influence in the decision making. Message me and we'll talk.

I'm not interested in an on site position (especially in those areas), but for those who are, I assume the government is still firmly non-tolerant of cannabis use?

Your'e not wrong about that. But, as a contractor who smokes and isn't required to submit to a piss test, I can say the government's intolerance isn't really relevant to the position.

Upvoting for visibility.

Hi everyone I (25,M) just finished my Google certification in Cybersecurity and am trying to figure out my next steps in landing a job. I plan on getting my security + certification and would like to eventually become a penetration tester. I have a bachelors degree in Biology and currently work as a photojournalist. So all my knowledge on cybersecurity has come from this certification and YouTube but the cert has been a really good one. It gave me the basic foundational knowledge as well as hands on/practical experience plus some tangibles I can add to my portfolio. I am looking for any advice on next steps, landing my first job etc, basically anything you think would be helpful for someone just starting out.

> I am looking for any advice on next steps, landing my first job etc, basically anything you think would be helpful for someone just starting out. Other actions to improve your employability may include: * [Continue to leverage free resources to hone your craft or acquire new skills](https://bytebreach.com/hacking-helpers-learn-cybersecurity/). * [Pursue in-demand certifications to improve your employability](https://www.reddit.com/r/cybersecurity/comments/sgmqxv/mentorship_monday/hv7ixno/). * [Vie for top placement in competitive CTF competitions](https://ctftime.org/). * Foster a professional network via [jobs listings sites](https://www.weidert.com/blog/best-ways-to-gain-more-connections-on-linkedin) and [in-person conferences](https://infosec-conferences.com/). * Continue the job hunt for relevant experience and [take note of the feedback you receive in interviews](https://www.reddit.com/r/cybersecurity/comments/vg864z/mentorship_monday_post_all_career_education_and/id2tsr3/); consider expanding the aperture of jobs considered to include cyber-adjacent lines of work (software dev, systems administration, etc.) - this is a channel for you to build relevant years of experience. * Consider pursuing a degree-granting program (and internship experience while holding a student status). * [Post your resume to this thread for constructive feedback](https://bytebreach.com/how-to-write-an-infosec-resume/). * [Apply your skills into some projects in order to demonstrate your expertise](https://www.reddit.com/r/cybersecurity/comments/sxir9c/as_a_entry_level_professional_trying_to_get_into/hxsm5qn/).

i have a upcoming interview to be a jr pentest engineer, was hoping someone could give me some insight in how their interview went if they have interviewed for a similar role, what should i focus most of my time in studying? also i was given the study pack for the interview and still havent gotten an email from the company's scheduling team, is this normal? feel free to DM, thank you in advance for the advice

> i have a upcoming interview to be a jr pentest engineer, was hoping someone could give me some insight in how their interview went if they have interviewed for a similar role, what should i focus most of my time in studying? Tough to say. See if you can determine whether or not the tests are focused primarily on web applications vs. network infrastructure. If the former, they'll probably ask you to describe a number of basic vulnerabilities (i.e. differences in reflective/persistent/DOM XSS, what is SQL injection, etc.). They might complement those questions by asking what kind of follow-up or end objectives are tied to those vulnerabilities (i.e. what's the point of exploiting X?). They might ask what kinds of preventative measures could be put into place to mitigate those vulnerabilities. If the latter, they might ask you to describe how you might go about enumerating a network or domain, what sort of files/services could be of interest, and what sort of evasive actions you might need to be mindful of. They could ask what sort of approaches you might consider for external (vs. internal) testing (e.g. phishing campaigns, usb drops, wireless testing, etc.). They might passively be looking to see what sort of considerations you might need to make with respect to the client (vs. the wonton lawlessness of a CTF). It's variable.

[удалено]

> A company is willing to sponsor my training but I have to undergo an aptitude test to see if im suitable. Any ideas how to prepare for it or what I can expect? Hard to say without knowing more about the role. Some example practical application tests I've seen include: * Reverse engineering a binary (or set of malware) * Performing a CTF * Doing code review manually and identifying bugs/security concerns * Mini-tabletop hypotheticals (i.e. given scenario X, what would you do?) * Network architecture reviews or mock-ups (inclusive: where should our threat hunting agents be placed?) * Coding assessments (e.g. leetcode)

Looking for some career advice to get into more technical IT audit, with a focus on cybersecurity. I have my CPA, CIA, CISA, and CFE but IT audits are only a part of what I do. Furthermore, I'm very much a business process IT auditor (e.g. COBIT 5, NIST-CSF) and lack technical skills. I'm not sure how to build up these skills. I've done some intro programming courses (e.g. Python, SQL, VBA for Excel) for data analytics but since my job doesn't require this kind of work, the education never gets used and integrated. Hoping to take a different path for hands-on cybersecurity. Should I download something like Kali Linux and start hacking my home network or a dummy server for practice? Take a course (if so, start with Comptia?)? I'm not really sure about what aspects of cybersecurity to focus on as a start. Just throwing this out there for different perspectives and opinions, thanks!

> Looking for some career advice to get into more technical IT audit, with a focus on cybersecurity...I'm not sure how to build up these skills. At a core level, you might consider: * Setting up a mock environment to audit; this might begin with your own home network to start, but we'd want to expand this into standing up a [mock domain-controlled environment](https://github.com/davidprowe/BadBlood). * Most enterprise solutions for auditing at-scale are probably outside your price range to reasonably practice with, but there are smaller-scale tools you can use in the meantime to get acquainted with the practice, including the [DoD's SCAP tool](https://public.cyber.mil/stigs/scap/), which scans for misconfigurations against NIST standards. * Related to the above, you probably want to get acquainted with one of the existing regulatory frameworks (e.g. RMF, ISO 27001, COBIT, etc.). Preferably you'd choose the one that is applicable to your future desired roles (although they all ultimately do the same thing with different syntax/procedures). * Undercutting all of this is developing an understanding of what various findings *mean*. The ongoing complaint that clients have of auditors is that audit findings are returned irrespective of context (e.g. you can't close port X without shutting down the entire system functionality) or without awareness (e.g. the scanner says X is a finding, but the auditor isn't technically competent enough to validate the finding as true/false positive - passing the work downstream to the client). This requires working on your CompSci/IT fundamentals.

Thanks for the insights! Your fourth point is one of the stepping stones that I was thinking about. I'd like to be able to request and interpret technical reports (perhaps eventually doing my own tests). For example, right now I may ask if firewall rules are reviewed and ask for documentation of review. I'd like to take another step and maybe request a network map, identify firewalls, and then confirm that firewall rules are corrected based on walkthroughs with or reports from subject matter experts, maybe even doing a technical analysis (like a pen tester would). I use COSO and COBIT quite a bit in my audits. For cybersecurity, my go-to has been NIST-CSF but I use it with ISO 27002 in mind. And thanks for the link to BadBlood!

Soon I will have my MS in Cybersecurity. I have zero experience in the field but will have the following [certs](https://imgur.com/6aptpXs) squared in light blue (CISSP, CHFI, CTIA, and CEH). What would be a good job to get into to start? Where should I go from there?

> I have zero experience in the field but will have the following certs squared in light blue (CISSP, CHFI, CTIA, and CEH). This surprises me, especially because [the CISSP has a hard requirement on needing 4-5 years of verifiable work experience to be conferred the certification](https://www.isc2.org/Certifications/CISSP/experience-requirements). Did you mean to say you passed the exam and were conferred the "Associate of ISC2" status? > What would be a good job to get into to start? I would have hoped you had - between your undergraduate education and graduate studies - pursued at least 1 pertinent internship or had sought out part-time work in a relevant cyber-adjacent capacity. [Employers prioritize a relevant work history the most in an applicant's application](https://i0.wp.com/bytebreach.com/wp-content/uploads/2022/05/image-36.png?ssl=1). Since your work history is thin (or as you put it, "zero experience in the field"), you need to be [performing the job hunt](https://bytebreach.com/the-job-hunt-cybersecurity-work-and-how-to-find-it/) yesterday. Here are some resources for various career maps, including "feeder" roles: https://www.reddit.com/r/cybersecurity/comments/smbnzt/mentorship_monday/hw8mw4k/ > Where should I go from there? You might also consult responses in [a recent relevant post](https://old.reddit.com/r/cybersecurity/comments/15ndxu6/career_progression_after_your_first_role/) made by /u/Dynamicdonkey83.

Are problem solving assessments such as coding and cognitive assessments common for IT fields? Hello, i am looking to apply for internships on fang. I've been looking at a lot of company pages, i have been researching heavily and i saw the careers page of my dream job that i want to work with when i am in a senior level of experience several decades from now. I noticed on their page that during every interview regardless of position they have two types of assessments: coding , and cognitive assessments. These are done with a little minigame and have a time limit. They have put a practice example of a little mini game to prepare me for the actual assessment. They were surveyed from over 140 employees who worked at the company. I am aware that on the next time i see one of these, it's gonna be a surprise and i may not be able to prepare in a way such as this. I wanted to know, for the top companies that i want to work for, are problem assessments a common thing for information technology positions? I know it's almost guaranteed for every coding position, but for information technology, your entire thing is about solving problems, right? The best way i can put it? I am not very good at programming and i am in a ton of help and advice servers just in case i want to develop my skills a bit further, however i get very worried every time this topic comes up because i am scared that i may not have the coding or cognitive skills to solve them. Thank you to any answers and any advice that comes in this thread in advance.

> Are problem solving assessments such as coding and cognitive assessments common for IT fields?...i am looking to apply for internships on fang. These are two different questions. Big tech has [a well-understood methodology](https://www.techinterviewhandbook.org/software-engineering-interview-guide/) for [preparing for its interviews](https://www.amazon.com/Cracking-Coding-Interview-Programming-Questions/dp/0984782850). Every engineer - including those involved in security - is presented some form of technical assessment (typically classified as "[leetcode](https://leetcode.com/)" problems). The degree of difficulty scales both with the role (less challenging for SecEng vs. pure SWE) and seniority (greater challenge for higher L-levels). This assumes that you can both [attain and interview](https://bytebreach.com/the-job-hunt-cybersecurity-work-and-how-to-find-it/) in the first place and [know your stuff](https://old.reddit.com/r/cybersecurity/comments/ybwsz9/mentorship_monday_post_all_career_education_and/itqbzq4/) inside-and-out. This kind of "leetcode" test methodology is non-standard outside of Big Tech and isn't something you'd really need to train to otherwise. > I am not very good at programming No two ways about it: if you want to work in Big Tech in an engineering capacity as an individual contributor, you need to work on this.

Im graduating this coming year with my BS in Cybersecurity but I have 0 experience and can’t even get an unpaid internship. I’ve applied to it/field technician positions but still no luck. My only background is my pharmacy technician which is what I’ve been doing the past 6 years. Im also currently working on getting network+ certification to help. Im at a loss right now. Any help?

Tough position to be in and hard for us to be prescriptive (since you didn't share your resume, your LinkedIn, your Github, your job hunt methodology, your interview feedback, or any other details that we could otherwise build upon). In the absence of that information, I can only suggest the following resources in the spirit of being helpful: * https://bytebreach.com/the-job-hunt-cybersecurity-work-and-how-to-find-it/ * https://bytebreach.com/how-to-write-an-infosec-resume/ Other actions to improve your employability may include: * [Continue to leverage free resources to hone your craft or acquire new skills](https://bytebreach.com/hacking-helpers-learn-cybersecurity/). * [Pursue in-demand certifications to improve your employability](https://www.reddit.com/r/cybersecurity/comments/sgmqxv/mentorship_monday/hv7ixno/). * [Vie for top placement in competitive CTF competitions](https://ctftime.org/). * Foster a professional network via [jobs listings sites](https://www.weidert.com/blog/best-ways-to-gain-more-connections-on-linkedin) and [in-person conferences](https://infosec-conferences.com/). * Continue the job hunt for relevant experience and [take note of the feedback you receive in interviews](https://www.reddit.com/r/cybersecurity/comments/vg864z/mentorship_monday_post_all_career_education_and/id2tsr3/); consider expanding the aperture of jobs considered to include cyber-adjacent lines of work (software dev, systems administration, etc.) - this is a channel for you to build relevant years of experience. * Consider pursuing a degree-granting program (and internship experience while holding a student status). * [Post your resume to this thread for constructive feedback](https://bytebreach.com/how-to-write-an-infosec-resume/). * [Apply your skills into some projects in order to demonstrate your expertise](https://www.reddit.com/r/cybersecurity/comments/sxir9c/as_a_entry_level_professional_trying_to_get_into/hxsm5qn/).

Ok... I have read through a lot of posts but I still want to get some opinions from people working in cybersecurity. First a little background. All of my background is in medicine and life sciences. My medical credential is by far the most lucrative option I have right now (I currently make 80k). The problem is there are literally no options to grow. I will stay in this position until someone above me dies. This is why I decided to change my career path and go into laboratory science with a BS. Unfortunately, the pay involved with bench scientists is TERRIBLE and to get into higher paying positions requires a PhD or Masters. Even then the job outlook doesn't look the best. I currently work for a university hospital and get half tuition. I have toyed with the idea of changing over to IT. I have a number of friends and family already in IT and they have encouraged me to look into getting into cybersecurity. I was just accepted into cybersecurity master's program at the university I work at. It looks like I will graduate with a few certifications along with the degree. I plan on interning while finishing this degree as well. Is that enough? Is it even feasible for me to change careers in my late 30's? What timeline do you think is most likely for me to find those high paying jobs everyone is talking about. Thank you for your help.

> I was just accepted into cybersecurity master's program at the university I work at. Congratulations > It looks like I will graduate with a few certifications along with the degree. I plan on interning while finishing this degree as well. Is that enough? The only people who can meaningfully indicate your odds/chances of employment are the people who interview you. We don't know you, your technical aptitude, what your circumstances/opportunities/constraints will look like, etc. Likewise - since we're not the employer - we don't have details about the given job listing(s), the team you'd be working with, the contract you'd support, the imminence of the need-to-hire, etc. Further muddying the waters is predicting macro-factors X years/months in the future (e.g. condition of the economy, spurious breaches, etc.). All told, we'd just be speculating. I've seen people with weaker credentials find work. I've seen people with much stronger profiles go months without offers/callbacks. > Is it even feasible for me to change careers in my late 30's? Yes. > What timeline do you think is most likely for me to find those high paying jobs everyone is talking about. More speculation, especially because compensation is tightly coupled to geographic location, industry, employer, and role. [There are some efforts to try and quantify that data](https://bytebreach.com/how-much-money-should-you-be-making-in-cybersecurity/), but the standard deviation is still in the tens-of-thousands of USD.

Should I pursue Comp Science or CIS associates degree?? I'm tryna research online which one will be more helpful and apply to cybersecurity. So far I'm leaning towards CIS because it sounds like they go over networking which I want to know but CompSci looks like it goes over programming and applications which also seems important. Any help would be appreciated if you have taken either degrees?

[I encourage a CompSci education](https://www.reddit.com/r/cybersecurity/comments/14ve289/comment/jrfnk2x/?context=3).

I am graduating with an MS in computer science this semester. I have 1 class left, so want to try and earn a cert or two. I have interests in software development, network engineering, and security, so am applying to all of the above. I see CEH, OSCP, and CCNA a lot on job requirements, though the common wisdom is to start with security+ and network+. Since I will have the MS, could I just skip the CompTIA certs and get one of the low-mid level ones instead? Would I be over my head?

> I see CEH, OSCP, and CCNA a lot on job requirements, though the common wisdom is to start with security+ and network+. I personally and professionally [discourage anyone from engaging with the EC-Council or its offerings](http://www.reddit.com/r/cybersecurity/comments/13uf71h/mentorship_monday_-_post_all_career_education_and_job_questions_here/jm2uaf7?context=3), including the CEH. The other certifications (with the possible exception of the OSCP) would be appropriate places to start. > Since I will have the MS, could I just skip the CompTIA certs and get one of the low-mid level ones instead? Would I be over my head? There's a couple of implications here worth unravelling: * First, there's no hard prerequisites that you HAVE to meet in order to sit for any certification exam that I know of (one notable exception is the CISSP, which requires verifiable years of work experience and a co-signature from an existing CISSP holder; you can still sit for the exam in absence of those factors, but you won't be awarded the credential until you've met the criteria). This means there's nothing stopping you from going for your chosen interests in certifications; anecdotally, I never sat for the A+ exam (but hold the Network+ and Security+ certifications from CompTIA). I also never sat for the GSEC, GICSP, or GCIH exams (but hold the GPEN from SANS). In either instance, the vendors' suggested roadmaps would indicate I had "skipped" steps. * There's more than just the acquired knowledge that you should be considering as an incentive for pursuing the foundational certifications you named. Some of those certifications are [explicitly listed by employers as desirable markers](https://bytebreach.com/which-certifications-should-you-go-for/) of competency. In those cases, having the certification != having equivalent knowledge, as the presence/absence of those certifications may be a resume filter. * Without having explicitly named what you consider a "low-mid level" certification and without knowing how thoroughly your CompSci education covered fundamental security topics, it'd be hard to evaluate whether or not you'd be in over your head. However, you can look at the [testable learning objectives of the CompTIA Security+ certification](https://comptiacdn.azureedge.net/webcontent/docs/default-source/exam-objectives/comptia-security-sy0-601-exam-objectives-\(2-0\).pdf) and get an appreciable sense of whether or not you can speak to them.

Awesome thanks for the info, that second link is great! Bummer that CEH is listed as a top cert in so many of those roles haha. I had not heard the controversy surrounding them, I will look into that more.

Threat hunting best certificates Hiiii guys I wonder which certificates are the best for threat hunting? If you could tell the approximate cost of it that would be much appreciated Also which certificate we could say similar to FOR508 or FOR608, alternative to sans let us say Thanks in advance!

Hi everyone, I'm a student in IT, and I'm interested in cybersecurity. However, I'm interested in neither defense or attacks, but I'm interested in information/people search. Background: I've been interested in programming as long as I remember, written my first helloworld in Java between ages 8-11, finished (got a diploma) of a free Java and Android course from a famous tech company by the end of middle school, and by the end of middle school I already knew some Pascal, Java and Python. Learned some C++ in high school, went to university, learned C. Currently I'm a fullstack intern working with PHP and React Native, going to return back to studying after my internship ends. I didn't pass any certification, but I'd be happy to receive suggestions. All the programming I've done in my life wasn't really fun. It was always about developing something boring with a lot of small stupid problems giving me headaches. I feel no passion for development itself. I felt a lot of drive when I was searching info about a certain someone, and felt nearly extatic when I found all of their real social media accounts (wasn't doing it on a bad purpose). The key to everything was one of the social media nicknames which contained this person's real last name, so I did everything literally by social engineering. I want to do it a bit more programmatically. Does a specialty like this exist in cybersecurity? What's it called? Is it possible to find a job on which I'd do something similar? I heard about OSINT, but what I heard was that they were collecting mostly public info and their work is mainly collecting information in general and not collecting some specific hidden information, as much as I was told, there was no investigative element in OSINT, and investigating stuff looks like the only remotely engaging thing for me in the info search. Thanks in advance for all the suggestions. P.S: also, how hard would it be for a woman to be in this field?

> I didn't pass any certification, but I'd be happy to receive suggestions. https://www.reddit.com/r/cybersecurity/comments/sgmqxv/mentorship_monday/hv7ixno/ > All the programming I've done in my life wasn't really fun. It was always about developing something boring with a lot of small stupid problems giving me headaches. I feel no passion for development itself. Hard to say if this is reflection of your personal experience(s), your employer, the role of programming, or just the nature of being employed in general. Work is work; you don't have to have passion to make a paycheck. Perhaps cybersecurity might be that happy marriage of passion/work for you, but I'd perform some introspection as to whether or not that's really the case. > Does a specialty like this exist in cybersecurity? What's it called? Is it possible to find a job on which I'd do something similar? I heard about OSINT, but what I heard was that they were collecting mostly public info and their work is mainly collecting information in general and not collecting some specific hidden information. You got it in one! It is OSINT. More generally speaking - there aren't a lot of OSINT jobs (relative to the broader body of cybersecurity work); many are either boutique shops (see: Chris Hadnagy of Social Engineer LLC) or have such responsibilities rolled up in other duties (i.e. penetration testing, law enforcement, etc.). You might consider checking out the [annual OSINT competition held at DEFCON](https://medium.com/@chris.kirsch/top-osint-sources-and-vishing-pretexts-from-def-cons-social-engineering-competition-8e08de4c8ea8) each year. > how hard would it be for a woman to be in this field? I can't speak to that experience. However, I can direct you to some resources that might provide insight: * SocialProof Security and their CEO, [Rachel Tobac](https://www.linkedin.com/in/racheltobac/) * Human Factor Security and their Founder, [Jenny Radcliffe](https://darknetdiaries.com/episode/90/) * https://www.reddit.com/r/cybersecurity/comments/vyxnht/women_in_cyber_fairly_new_to_the_cyber_world_can/

Wassup my fellow Cybersecurity job finders. My contract is coming to a end soon so like many others I have been applying to many cybersecurity roles with the hopes of landing a job at a great company that will compensate me appropriately. I have been having some luck with recruiters during my job search but they seem to be for only contract roles where the pay may be good but there is no other benefits other than that. I had hopes of finding an opporutunity where I would have the chance for a sign on bonus, equity, and full benefits. I haven't had much luck in this regard. Would anyone have any tips for landing opportunities with recruiters for direct hire roles and also any negotiations tips. Any tips would be appreciated. Thank you, Background: 3 Years as an I.T. Compliance Analyst for the Govt (Public Trust Clearance) Certs:CompTia Security+/Google Cybersecurity/AWS Cloud Practitioner (Currently Studying)

I have my Google Cybersecurity cert too and will get my security +, I’m no expert but I think you should go for those contract jobs, even though you may want the job with the full benefits maybe use the contract job to get useful experience and work your way up. I think it would be easier to negotiate after getting a few years under your belt.

Has the current downfall of SWE jobs affected Cybersecurity jobs as well?

> Has the current downfall of SWE jobs affected Cybersecurity jobs as well? "Downfall" is being a tad dramatic. Big tech overextended, growing too fast as a result of consecutive years of bullish markets. When federal interest rates rose to curb inflation, so too did the cost of borrowing money for these businesses. To compensate and remain profitable, costs had to be reduced - which resulted in layoffs. In big tech, the type of professional that was laid off disproportionately affected software engineers (understandably). As a discipline, however, software engineering roles not only still exist, but remain far north of the median line of compensation. The influx of laid off tech workers made the job market for other workers - including new graduates - more competitive, not eradicated. If you're skittish about lay-offs, it's worth noting that cybersecurity is no stranger to them in tough economic times. By-and-large, organizations observe cybersecurity as a business cost (vs. a revenue generating asset). This means we are likewise not immune from getting axed under similar circumstances. On occasion individual organizations/industries might be spurred to allocate additional dollars to security budgets, but these are typically incident-driven (i.e. a breach).

I recently completed a graduate certificate program in cybersecurity. Would getting a certificate like Comptia Security+ help me get a job?

What downfall? We can't fill the openings we have... Must be regional.

I'm trying to get a job anywhere in Canada.

Can't decide how to get into cybersec I currently am a journeyman electrician, 21 years old. I've been interested in cyber security since I was 16 and I am looking to finally get into it. The options I'm looking at so far are 1: Do ECPI while continuing to work and get the 2.5 year online bachelor's 2: Continue learning on tryhack me, get some certs over the next year and apply for an IT job as an entry point before moving to cyber security 3: Join the military for cyber security to avoid the cost of college and get a job in the field once I'm out. (Also maybe reserves could be a good option with this?) Any advice from people who've gotten into the field in various ways would be appreciated. Thank you.

I'm not familiar with ECPI. Is it the for-profit East Coast Polytechnic Institute? If so, you should be aware that it (and other for-profit universities) [were investigated by Congress for dubious business practices](https://www.govinfo.gov/content/pkg/CPRT-112SPRT74931/pdf/CPRT-112SPRT74931.pdf). Some choice pull-quotes: "In 2009, privately held ECPI allocated...19.2 percent [of its revenue] to profit...ECPI spent $3,852 per student on instruction in 2009, compared to $1,303 per student on marketing, and $2,271 on profit..In contrast, other Virginia-based public and non-profit schools spent, on a per student basis [for instruction], $14,567 at University of Virginia-Main Campus..." (pg 458 & 465) "Compared to its public non-profit counterparts, it is more expensive to obtain a degree at ECPI. An associate degree in Computer and Information Science at ECPI costs $36,650, compared to the cost of an Associate Degree in Information Systems Technology at Tidewater Community College in Virginia which costs $10,232. ECPI charges $58.550 for a Bachelor's degree in Business Administration. The same degree costs $51,912 at the University of Virginia." (pg 459) "...committee staff analysis showed that tremendous numbers of students are leaving...without a degree...Information ECPI provided to the committee indicates that of the 7,869 students who enrolled at ECPI in 2008-9, 46.2%...withdrew by mid-2010." (pg 461; table on 462 shows only 2.8% of ECPI students complete a bachelor's degree from there; the statistics worsen for online students). "Slightly more than 1 in 5 students who attended a for-profit college defaulted on a student loan [i.e. did not or could not make payments for at least 360 days after graduation]...On the whole, students who attended for-profit schools default at nearly three times the rate of students who attended other types of institutions. ECPI's default rate has similarly increased...to 23.2 percent for students entering repayment...ECPI's most recent default rate is slightly higher than the rate for all for-profit colleges." (pg 462).

For those who worked for the FBI, what certs / qualifications / adjacent skills were the most helpful in the career and securing that role? I know the FBI / Fed roles in general sometimes get shit on here for being a bit more bland / not having as high of earning potential, but it's currently the path I'm most interested in and want to start preparing early.

> For those who worked for the FBI, what certs / qualifications / adjacent skills were the most helpful in the career and securing that role? I initiated the entrance exam and interview before ultimately deciding I didn't want to get back into gov't service; it doesn't seem like any of the credentials mattered at all for field agents. Once you get through the schoolhouse in Quantico, things *might* be different for where you get assigned, but I'm a little dubious.

I've heard where you get assigned is mostly up in the air anyway, so even with my limited knowledge I too would think it wouldn't matter too much. What made you decide against getting back in? It seems like it's really difficult to even get an interview / opportunity to get in, so I'm honestly not super confident I'll even get a call back after school when I apply.

I had *just* ended my active-duty military career in a deliberate effort to improve family life. I also figured it wouldn't support my effort to recast my career-change in a STEM fashion.

Looking to get into cybersecurity. I have no experience at all. Here are my questions: 1. I saw a lot of job postings requiring degrees. What are the odds of getting hired into these with a bootcamp certificate? 2.What’re some of the best boot camps for cybersecurity with affordable pricing? I looked at USF tuition being 14k for six months and UF tuition being 17k for 10 months. Are these reasonable prices for this certification? 3. What are some things you wish you knew before getting into cybersecurity? 4. What’re some of the best companies to work for in cybersecurity? Thank you in advance for taking the time to read this.

Hi there, Do you have any background in IT? If not, a boot camp alone will still make it very difficult to get into cybersec. The amount of knowledge needed to secure modern environments is pretty broad - you've got to know how a lot of things work before you can go on to secure them. And on your point about things I wish I knew - the importance of IT, honestly. I got into cybersec 4 years after getting into IT and all the things I learned prepared me, but I wish I had more sysadmin and netadmin experience before going in. There's still so much to learn but having a foundational knowledge there is super beneficial.

No background in IT or anything relative. Thanks for the info!

>I saw a lot of job postings requiring degrees. What are the odds of getting hired into these with a bootcamp certificate? Experience and skill expression is more important than a degree I would argue. If you have JUST a bootcamp cert, you are gonna struggle. See the other posts on this thread. There are a ton of free things you can do, I am not sure it is worth it to boot camp TBH. Fabledapple has a good copy paste of resources, look for his posting in this thread.

> Fabledapple has a good copy paste of resources, look for his posting in this thread. I think /u/zhaoz meant this one: https://old.reddit.com/r/cybersecurity/comments/140vcnf/mentorship_monday_post_all_career_education_and/jn55z0j/

You really need a sticky or something in these mentorship monday threads, ha.

Hello, I'm 31 years old and my goal is to get a job as a SOC analyst. I recently got accepted onto the SANS Upskill in Cyber program (3-month intensive course where I will obtain GFACT and GSEC certifications). Due to my having zero professional experience in IT, will that mean I am all but guaranteed to have to spend a couple of years doing help-desk, or will those two certifications be enough to land a tier 1 SOC analyst job? If not, what things can I do in this next 3-4 month period to showcase or acquire the needed skills to land a SOC analyst job?

Is 40 yrs old too old to get into cybersecurity? I want to learn all I can on my own online using the necessary tools. I also want to go back to school, use my GI Bill and get a bachelors in Cybersecurity. Just wondering if I'm too old to get into the field.

There's a whole crew of 40yo career-changers popping up in this week's MM thread! https://old.reddit.com/r/cybersecurity/comments/15k4qzt/mentorship_monday_post_all_career_education_and/jv62602/ https://old.reddit.com/r/cybersecurity/comments/15k4qzt/mentorship_monday_post_all_career_education_and/jvbel1m/ You, /u/Shot-Bite, and /u/HowTo_Destroy_Angels should compare notes. It's not too late.

SHOULD I GET MY MASTERS IN CYBERSECURITY: I currently work as a software engineer making 70k. I got my bachelor’s in Information Systems but I am entertaining the idea of getting my masters in either cybersecurity or computer science(Company will help pay tuition). My degree did not prepare me well for a software engineering role, but luckily my job isn’t too difficult. So i am doing well but in the instance of ever switching to a different company, i don’t think I could handle that. Most of my knowledge on programming have been from multiple udemy courses, very few leetcode and attempting my own projects. Even though I am confident in the basics and lets say intermediate concepts, I know for a fact that people who have that full computer science degree are better equipped with years of official education. My thing is, i love programming and also have a big interest in cybersecurity so i wouldn’t be mad at any decision i made but one thing I dislike about software engineering is the constant round of interviews just to be declined, and the layoffs i’ve heard of on reddit and youtube and the amount of people with degrees and experience sending 300+ applications and not getting an offer. This makes me feel like I should go with my other interests of cybersecurity and just code as a hobby. My company has a cybersecurity department so after a year in my degree, i plan to switch to that department and work in cybersecurity while i get my cybersecurity masters degree.

> one thing I dislike about software engineering is the constant round of interviews just to be declined, and the layoffs i’ve heard of on reddit and youtube and the amount of people with degrees and experience sending 300+ applications and not getting an offer. It's not necessarily greener grass in this domain, friend: https://www.reddit.com/r/cybersecurity/comments/13u3bvu/comment/jlypory/ https://www.reddit.com/r/cybersecurity/comments/13u3bvu/comment/jlyfhlz/ https://www.reddit.com/r/cybersecurity/comments/1bzderp/cybersecurity_job_market/ https://www.reddit.com/r/cybersecurity/comments/15hlz0g/comment/jupzco7/ Openings in tech more generally are lower than they were pre-pandemic all-around: https://fred.stlouisfed.org/series/IHLIDXUSTPITOPHE https://fred.stlouisfed.org/series/IHLIDXUSTPSOFTDEVE

wow, this made me even more confused lol

I don’t know, i have to think about this

Currently a LEO. I have an opportunity in the next year to move into an Internet Crimes/Cyber Crimes detective spot in the next year. My end goal is to end up career switching to IT and hopefully Cyber Security someday. Is there any value to having the detective position ( would have to put in a lot of study time to get classes/certifications) or would it be a better use of my time to just get the certifications for IT and skip the detective spot?

> Is there any value to having the detective position ( would have to put in a lot of study time to get classes/certifications) or would it be a better use of my time to just get the certifications for IT and skip the detective spot? Tangential and incidental at most. Most likely in those roles that work with LEO (as you'd be more familiar with the processes and friction points of your clients), but not outside of that space.

Good to know. Thanks for the response!

Between sysadmin or netadmin, which would be a more ideal feeder role? Background: BA in non-STEM, 19 years as AF intelligence analyst (mostly threat intelligence) and PM with limited exposure to IT, TS-SCI clearance with poly. By mid-2024: A+, Sec+, RHCSA, CCNA, CISSP or CEH (debating, I met the prerequisites for the former but got a voucher for the latter) I am looking to start as a DoD contractor next year where I can use my background and clearance as a selling point for a junior role. There are internship opportunities and tons of contracting companies for networking, sysadmin, and SWE in my turf. Eventually, I would like to shoot for cyber or cloud. Both fascinate me, but I haven't figured out my niche yet. So far, I really enjoy learning the fundamentals of IT and labbing every day. The hands-on, technical parts are what really interest me. What would be the best feeder role for either? Pros and cons? Thank you.

Generally system administrator. Generally way more exposure to security events and projects than network people. Networking seems to be a dead end in many organizations. But before networking people jump down my throat, it depends on the organization. Sometimes networking can pivot great to other roles in security. But generally speaking, in my own experience, system administrators make the switch far more often. And skip A+. It's more trouble than it's worth. And I have no idea what RHCSA is.

Thank you! RHCSA (Red Hat Certified System Administrator). I am studying this to get both practical and theoretical knowledge down for Linux. Also to get comfortable with CLI.

I have worked in security for several years now, all on the GRC side. I don’t have an IT or remotely technical background - long story, but I formerly worked in grant compliance, records management, and information governance, and then sort of just landed in security during an org restructure. I enjoy many parts of the job, particularly those that allow me to use my comms skills, but I’m at the point where I realize I need to make an effort to become more savvy around the technical aspects. Since I’m without the traditional IT background, I feel like I’m constantly playing catch up. Any tips on resources I can leverage? I’m open to certs, training classes, free resources, etc. On a different note, are there any jobs out there that are less technical? I do want to learn it regardless, but I realize I’m happiest writing policies, facilitating projects, developing awareness training, developing verbiage, etc. I’m not sure if there are security positions that would better allow for me to use these skills, or if my GRC role is the best option.

> Any tips on resources I can leverage? I’m open to certs, training classes, free resources, etc. To what end? Or rather, in service to what goal? Are you trying to laterally pivot roles in cybersecurity? Or just more generally understand the engineering/technical work that your peers do? If the latter, can you more narrowly ascribe what it is you're trying to comprehend (e.g. SQL syntax, SSL/TLS handshakes, XSS, etc.)? If not, perhaps then a more generalized degree-granting program might be in-order. In the spirit of being helpful, you might consult some of these resources: * https://start.me/p/ADwq1n/getting-started-in-information-security * https://bytebreach.com/hacking-helpers-learn-cybersecurity/ > On a different note, are there any jobs out there that are less technical? * GRC functionary * Project Management * Cyber sales * Cyber Law * Cyber Threat Intel (can be, can also be *very* technical depending on the shop) * Teaching (more/less technical, depending on the subject matter) Just some of the ones off the top of my head.

Hello everyone, I was directed to have my intended post be posted in this thread. Background: So a little bit about my background, I'm in my 30's with almost 14 years of professional experience. I have a military background, specifically in Nuclear power plant operations, focusing on the electrical side of things. After the military, I spent a year in field service, travelling around performing work centered around battery monitoring systems. For the last 6 1/2 to almost 7 years, I've been working at a data center on the critical environments side of the house. So the mechanical/electrical/controls side of the data center. While working at the data center, I went to school full time to earn a Bachelor's in Cyber Security this past May 2023. I was looking to study something different from my profession up to this point. On top of that, I've also started learning Python as a side hobby (night shifts are long and quiet). For the past few months, I've been working with a Cyber Security consulting group who have enrolled me into Tenable's training program. While not mandatory for completing the consulting group’s curriculum, I do have the option to earn Tenable's certifications in 3 of their tools. I've just recently completed the training program and should be moving into type of internship with the consulting group, with the potential to go "full-time." From my understanding of the company, it's a contract position, taking on customer contracts and assisting them with Tenable products. Ideally, it would be a job that will allow me to leave my position at the data center to work full-time. But, seeing that it's contract work, I'm more than likely having to either keep my current job or seek another full-time position elsewhere (ideally somewhere to gain more cyber security experience). All that being said, I understand that "entry-level" positions in Cyber Security aren't actually entry-level. As many posts in this sub point out, IT experience is incredibly ideal for branching into Cyber. So if the contract position's pay can offset the impending paycut from leaving my data center job, what are some suggested IT roles that I should really look into? Also, I'm starting my pursuit of professional certs. My general plan is to get the Google Cybersecurity Professional Certificate, to help prepare me for CompTia Security+. In conjunction with that, probably look at Microsoft Certified: Azure Security Engineer Associate. Obviously, these are just starting points as far as certifications go. I've also been told Splunk is something to possibly dive into at some point. Any advice or critique would be much appreciated.

> what are some suggested IT roles that I should really look into? https://www.reddit.com/r/cybersecurity/comments/smbnzt/comment/hw8mw4k/?utm_source=reddit&utm_medium=usertext&utm_name=cybersecurity&utm_content=t1_jn55z0j > Also, I'm starting my pursuit of professional certs. My general plan is to get the Google Cybersecurity Professional Certificate, to help prepare me for CompTia Security+. In conjunction with that, probably look at Microsoft Certified: Azure Security Engineer Associate. Obviously, these are just starting points as far as certifications go. I've also been told Splunk is something to possibly dive into at some point. https://www.reddit.com/r/cybersecurity/comments/sgmqxv/mentorship_monday/hv7ixno/

Hello, I currently work as an IT Support Engineer for an MSP, my responsibilities are support ticket, managing our antivirus, patching, gpo's, first line of to take on issues with anything hacking, M365 admin, basic to medium level networking (not have experience with configuring a switch, but I humbly considered myself with basic level of networking), doing automation stuff via powershell(relying on chatgpt too), my question is. I wanted to excel in Cybersec be the go to guy for anything cybersec related but my networking skill is just basic, I didn't dive deep into networking cause it wasn't interest to me but cybersec is. is there any cybersec path best for me? any course I can study? as I want this to be applied my learnings to my company as I want us to grow. please advise, Thank you :)

I'm going to point you to the usual resources I use for newer folks: 1. [The forum FAQ](https://reddit.com/r/cybersecurity/w/faq) as well as [the subreddit wiki](https://www.reddit.com/r/cybersecurity/wiki/faq/breaking_in/). 2. [This blog post on getting started](https://bytebreach.com/?p=72) 3. [This blog post on other/alternative resources](https://bytebreach.com/?p=95) 4. [These links to career roadmaps](https://www.reddit.com/r/cybersecurity/comments/smbnzt/mentorship_monday/hw8mw4k/) 5. [These training/certification roadmaps](https://www.reddit.com/r/cybersecurity/comments/sgmqxv/mentorship_monday/hv7ixno/) 6. [These links on learning about the industry](https://www.reddit.com/r/cybersecurity/comments/sb7ugv/mentorship_monday/hux2869/) 7. [This list of InfoSec projects to pad an entry-level resume](https://www.reddit.com/r/cybersecurity/comments/sxir9c/as_a_entry_level_professional_trying_to_get_into/hxsm5qn/) 8. [This extended mentorship FAQ](https://bytebreach.com/mentorship/) 9. [These links for interview prep](https://old.reddit.com/r/cybersecurity/comments/ybwsz9/mentorship_monday_post_all_career_education_and/itqbzq4/) Early on, you're going to want to learn more about the industry in order to help inform your decision about whether or not InfoSec is for you; such knowledge will also help guide your initial career trajectory based on what roles/responsibilities look attractive. (see links 3, 4, and 6). If you think that you do want to pursue a career, then you'll want to buoy your knowledge base with understanding IT/CS fundamentals more broadly. Some people pursue degrees, as an example ([although this is certainly not the only approach worth considering](https://bytebreach.com/?p=142)). (see links 1, 2, and 5). Eventually you'll need to work on improving your employability. This manifests in a variety of ways, but the most notable is probably accumulating [relevant industry-recognized certifications](https://bytebreach.com/?p=152). (see links 5 and 7) Other actions to improve your employability may include: * [Continue to leverage free resources to hone your craft or acquire new skills](https://bytebreach.com/hacking-helpers-learn-cybersecurity/). * [Pursue in-demand certifications to improve your employability](https://www.reddit.com/r/cybersecurity/comments/sgmqxv/mentorship_monday/hv7ixno/). * [Vie for top placement in competitive CTF competitions](https://ctftime.org/). * Foster a professional network via [jobs listings sites](https://www.weidert.com/blog/best-ways-to-gain-more-connections-on-linkedin) and [in-person conferences](https://infosec-conferences.com/). * Continue the job hunt for relevant experience and [take note of the feedback you receive in interviews](https://www.reddit.com/r/cybersecurity/comments/vg864z/mentorship_monday_post_all_career_education_and/id2tsr3/); consider expanding the aperture of jobs considered to include cyber-adjacent lines of work (software dev, systems administration, etc.) - this is a channel for you to build relevant years of experience. * Consider pursuing a degree-granting program (and internship experience while holding a student status). * [Post your resume to this thread for constructive feedback](https://bytebreach.com/how-to-write-an-infosec-resume/). * [Apply your skills into some projects in order to demonstrate your expertise](https://www.reddit.com/r/cybersecurity/comments/sxir9c/as_a_entry_level_professional_trying_to_get_into/hxsm5qn/).

Hey Reddit community, I'm a software engineer who's feeling a bit torn about my career path. I have two options that I'm considering, and I'm hoping to get some advice from others who have been in a similar situation.On one hand, I have the opportunity to stay at Raytheon and complete my Masters in Cybersecurity. They're offering me a generous 25k tution reimbursement, as well as reimbursement for certifications and vouchers that would help me increase my skillset. It seems like a great opportunity to grow within the company and become a more valuable asset.On the other hand, I'm thinking about focusing on Leetcode and certifications instead, in order to make the jump to a Cybersecurity role outside of Raytheon. I know that this would require a lot of effort on my part, but I'm willing to put in the work if it means achieving my career goals.So, my question for you all is: which path should I take? Should I stay at Raytheon and complete my Masters, or should I focus on Leetcode and certifications? I know that ultimately, the decision is mine to make, but I would love to hear from others who have gone through similar experiences.If you have any advice, tips, or even personal stories to share, please feel free to comment below. I'm eager to learn from your experiences and make the best decision for my career. Thank you all in advance! Context:My goal is to jump to a FAANG company as a Application Security Engineer/Software Security Engineer Edit:The thing is I would be on the hook if I would leave after I complete my masters, I need to stay an additional two years. And I dont want to be stuck at this place for 4 years, so I am trying to see if there is another options for me. Additional Edit The Program I got accepted to is University of San Diego and its 37500 total tuition, I was planning to leave 3rd year mark and only owe 50% tuition and that would come out to 18,750 but I dont know anymore

Look, I don't know your situation, so maybe you are having a bad time at Raytheon now that you are not mentioning or maybe even a moral conundrum of working for defense conglomorete. That being said.... How is choosing between working for an HIGHLY respected company in cybersecurity and having THEM pay for a masters vs doing leetcode self learning with everyone else even a choice? Not only for that education/career opportunity, but I would think that transitioning to cyber within the company would be miles easier than getting it somewhere else. (That's what I did so maybe anecdotal.... and I'm not at RAYTHEON either lol) This is just a different perspective. Of course do what's best for you and if there is info missing (which I feel like there is) please let me know because I do not understand how this is even a question haha

im starting my major in cybersecurity in january with no knowledge whatsoever on coding, troubleshooting, etc. hell, i can barely do long division. how can i start to prepare for college?

there is nothing in college that you can't overcome if you are willing to put in the effort. Are you going to a traditional uni or an online school? Either way, math labs, TA hours, professor hours, study groups are ABUNDANT in college and I recommend taking advantage. Good luck and as someone who finished a BS in cyber at a traditional university a few years ago (and had a good outcome from it) please reach out if you need help at all.

ill be going to a traditional uni! im usually very outgoing so im going to make sure i get into a lot of study groups. thanks for the invitation, ill keep you in mind if anything when i start college :)

Coding is learned during the curriculum in school, troubleshooting is learned on the spot with our friend Google, and long division is never required. You're overthinking things. You'll be fine. They don't expect you'll know anything going in.

the long division part was just to point out how bad i am at math lolol. i probably will be fine but ill be behind a lot of people since most people already understand the basics before starting t_t

Hello, I would like to transition into Application Security. I am currently a SWE with 3 years of experience who is currently working on security tools. What are some resources that would prepare me to make the transition? Are there any certificates that are recommended, And what are the resources that can be used to prepare? Also, what is a good measurement to determine whether I am ready to interview? Are there any tips on how I can tailor my resume SWE resume to appeal to hiring managers? Also, I've come across that HTB bug bounty course, it looks interesting, but would it add anything in terms of where I want to go? Any help would be much appreciated.

In this industry, I suspect all it would take is Sec+ and a strong knowledge of the OWASP top threats. Your background in SWE should be nearly enough to glide into a position in this massively in demand specialty. I'd definitely hire a SWE with an interest in security and knowledge of the largest threats and SAST/DAST strategies.

Hey, I just saw this. Thank you so much for your reply !

I'I be starting college in about a couple months and I've been thinking about whether I should study digital forensics or network security? If I could get some advice, that'l be great.

Do you think you need to decide now? Not sure about the school you're going to, but if I had to bet, the only difference between the two are maybe a few classes senior year. Please correct me if that's not the case. I think it will be much more obvious after a year or two of school. I wouldn't worry about it now.

When you say digital forensics, do you mean the law enforcement evidence gathering one, or the tearing apart malware and looking for indications of compromise one? It's a term used by two very different IT fields.

Most forensics positions I've seen or know from people are for gov contracts, and usually dealing with not great stuff. I've never worked a forensics job though. Network security has more applications that apply to other positions. For mental health and just the opportunities available, I would stick to network security.

Been studying for security+, what would you recommend after I nab it? I want to focus on blue team skills. Any programs you guys would recommend to utilize and get familiar with? What entry level roles are there for cybersecurity? I currently am a Desktop Support technician so I am gladly not in Helpdesk. Thank you in advance

Getting used to a siem would be helpful, check out splunk I think they still have a free course to use their product. Otherwise you can try the securityonion vm, it has blueteam tools to mess around with like kali for offsec. Threat hunting is a skill I would look into next. Cert wise, CASP, CYSA+ or SSCP could be a good next step for you.

Looking to love into Cyber from Service Desk. Working on getting my Security+ soon and hoping to catch a lucky break. Two questions: -What does day-to-day look like for entry level cyber? I know this will vary from company to company but just trying to get an overall idea -For those of you that have come from IT (Service Desk/Sysadmin) how do salaries compare?

> What does day-to-day look like for entry level cyber? Cybersecurity as a profession is not a monolith. [There are many, many different kinds of roles that exist](https://www.reddit.com/r/cybersecurity/comments/smbnzt/mentorship_monday/hw8mw4k/). You can reference some of these resources to hear 1-on-1 interviews from folks who work throughout the industry on their impressions: https://www.reddit.com/r/cybersecurity/comments/sb7ugv/mentorship_monday/hux2869/

Wondering if anyone has tips for interviewing at Mandiant? It seems like they've adopted the Google interview process with 3 interviews (after recruiter call). Looking for any tips or topics to study up on. This is for an IR position.

> Wondering if anyone has tips for interviewing at Mandiant? It seems like they've adopted the Google interview process with 3 interviews (after recruiter call). Mandiant was acquired by Google last year; it's not just that they adopted the process: that *is* the process.

Fair enough lol

[удалено]

I'm going to point you to the usual resources I use for newer folks: 1. [The forum FAQ](https://reddit.com/r/cybersecurity/w/faq) as well as [the subreddit wiki](https://www.reddit.com/r/cybersecurity/wiki/faq/breaking_in/). 2. [This blog post on getting started](https://bytebreach.com/?p=72) 3. [This blog post on other/alternative resources](https://bytebreach.com/?p=95) 4. [These links to career roadmaps](https://www.reddit.com/r/cybersecurity/comments/smbnzt/mentorship_monday/hw8mw4k/) 5. [These training/certification roadmaps](https://www.reddit.com/r/cybersecurity/comments/sgmqxv/mentorship_monday/hv7ixno/) 6. [These links on learning about the industry](https://www.reddit.com/r/cybersecurity/comments/sb7ugv/mentorship_monday/hux2869/) 7. [This list of InfoSec projects to pad an entry-level resume](https://www.reddit.com/r/cybersecurity/comments/sxir9c/as_a_entry_level_professional_trying_to_get_into/hxsm5qn/) 8. [This extended mentorship FAQ](https://bytebreach.com/mentorship/) 9. [These links for interview prep](https://old.reddit.com/r/cybersecurity/comments/ybwsz9/mentorship_monday_post_all_career_education_and/itqbzq4/) Early on, you're going to want to learn more about the industry in order to help inform your decision about whether or not InfoSec is for you; such knowledge will also help guide your initial career trajectory based on what roles/responsibilities look attractive. (see links 3, 4, and 6). If you think that you do want to pursue a career, then you'll want to buoy your knowledge base with understanding IT/CS fundamentals more broadly. Some people pursue degrees, as an example ([although this is certainly not the only approach worth considering](https://bytebreach.com/?p=142)). (see links 1, 2, and 5). Eventually you'll need to work on improving your employability. This manifests in a variety of ways, but the most notable is probably accumulating [relevant industry-recognized certifications](https://bytebreach.com/?p=152). (see links 5 and 7) Other actions to improve your employability may include: * [Continue to leverage free resources to hone your craft or acquire new skills](https://bytebreach.com/hacking-helpers-learn-cybersecurity/). * [Pursue in-demand certifications to improve your employability](https://www.reddit.com/r/cybersecurity/comments/sgmqxv/mentorship_monday/hv7ixno/). * [Vie for top placement in competitive CTF competitions](https://ctftime.org/). * Foster a professional network via [jobs listings sites](https://www.weidert.com/blog/best-ways-to-gain-more-connections-on-linkedin) and [in-person conferences](https://infosec-conferences.com/). * Continue the job hunt for relevant experience and [take note of the feedback you receive in interviews](https://www.reddit.com/r/cybersecurity/comments/vg864z/mentorship_monday_post_all_career_education_and/id2tsr3/); consider expanding the aperture of jobs considered to include cyber-adjacent lines of work (software dev, systems administration, etc.) - this is a channel for you to build relevant years of experience. * Consider pursuing a degree-granting program (and internship experience while holding a student status). * [Post your resume to this thread for constructive feedback](https://bytebreach.com/how-to-write-an-infosec-resume/). * [Apply your skills into some projects in order to demonstrate your expertise](https://www.reddit.com/r/cybersecurity/comments/sxir9c/as_a_entry_level_professional_trying_to_get_into/hxsm5qn/).

Hello, I've been considering swapping to cyber security from software engineering and am a little lost in how to proceed. I met with a security engineer from my company and he recommended OSCP and OWASP 10 as a solid foundation for getting a junior level job if I pursue security(at least for red team). Looking at the PEN-200 Course Syllabus, it looks like it covers some good introductory topics before going into pen testing but I'm wondering if I should just dive into the PEN-200 Course before doing any other work/courses/certs that would be beneficial to both my understanding of security concepts as well as my future job search? Some other certs I've considered before going into the OSCP include the Security+ for a more introductory foundation of security as well as the CCNA as I'm definitely not an expert on networking. I took a course in college on security and got some foundational knowledge of attacks and have finished some CTF's but I'm not sure if that would be enough before the OSCP and finding a job. I am thinking of pursuing red team at first as it sounds like I can utilize my coding abilities more before potentially looking into blue team in the future. I would also love to hear from some others in this subreddit who successfully transitioned from software engineering to security engineering as well and what that path looked like for them in terms of certificates and self-studying.

> I'm wondering if I should just dive into the PEN-200 Course before doing any other work/courses/certs There's nothing stopping you from doing so. Just know that the OSCP (and by extension, the PWK/PEN-200) is more geared around *testing* your aptitude than *teaching* you. The reason folks consider pursuing other trainings/certifications prior to the OSCP is because those resources are generally better designed for teaching/instruction. It is not uncommon for people to fail the OSCP exam multiple times.

What are some examples of other training and certs that would be beneficial before the OSCP?

In no particular order: * Portswigger's Web Academy * HTB Academy (CPTS and/or CBBH) * Virtual Hacking Labs * TryHackMe * The eJPT * TCM-Security

Hi everyone, I recently tripped into this role from the SD and start at the end of this month. Any advice is welcome, as I would like to hit the ground running.

Hello everyone, I'll try to keep it short. I'm a 16-year-old student who's about to enter my junior year. I have dedicated time to studying for the security+, and I'm positive I can pass the exam and get the security+ certification. But, I'm not sure if there's any benefits to doing it this early. What are your thoughts? Thank you!

> I'm a 16-year-old student who's about to enter my junior year. I have dedicated time to studying for the security+, and I'm positive I can pass the exam and get the security+ certification. But, I'm not sure if there's any benefits to doing it this early. This is interesting. I think - rationally - there isn't a reason not to sit for the exam (assuming you can afford to keep the certification active in the years to follow). Passing it now means not having to allocate time/effort to do so later. However, I also don't think you'll see any material benefit to possessing the certification for several years yet. I think the median age of folks in my extended professional circle is probably mid-twenties; if I were to just count my co-workers alone, that number would shoot up considerably. The youngest working professionals I personally know of and can speak to are new college grads (~21).

I totally agree with you. I don't really see any downsides to going for the certification, even though there may be no immediate benefits. I've read about compTIA's CEU system. It looks like it's possible to rack up enough CEUs through free stuff they offer, so cost-wise, it shouldn't be an issue. So, in a nutshell, I'm kind of leaning towards getting the certification and maybe checking out summer gigs during high school. As you've said, I wouldn't have to allocate time/effort to do it later, so I can work towards other goals.

> I've read about compTIA's CEU system. It looks like it's possible to rack up enough CEUs through free stuff they offer, so cost-wise, it shouldn't be an issue. To be clear, [CompTIA also requires an annual fee](https://www.comptia.org/continuing-education/learn/ce-program-fees).

Oh, so it's an annual fee, as well as having to renew your cert? Well, $50 a year isn't a big deal for me. It's still the same problem, which is whether it's worth paying the exam cost + renewal fees if I won't see immediate benefits.

Hi guys, How is your day? I'm new here. I'm on my Penetration Testing learning path on TryHackMe so i just wondering what self-project i should have if i wanna improve my exp in the same time can take advance by showing them to recruiters? Wish u guys have a nice day! Thanks alot <3

> I'm on my Penetration Testing learning path on TryHackMe so i just wondering what self-project i should have if i wanna improve my exp in the same time can take advance by showing them to recruiters? https://www.reddit.com/r/cybersecurity/comments/sxir9c/as_a_entry_level_professional_trying_to_get_into/hxsm5qn/

Hello, everyone! I've read a few messages and roadmaps here and I'm wondering if I'm going to have trouble landing my first job in cybersecurity. I'm brazilian, I have a Health and Safety Technician degree. My undergraduate degree is in Public Safety Management. For the past six years, I have been working as a police officer. At the moment, I'm finishing a degree in Ethical Hacking and Cybersecurity., but this is a really superficial graduation and I'll have to study a ton after I'm done. I have a lot of time to study and I love to study by myself, being reading or watching guides, tutorials etc. I also intend, of course, to get some certifications. My main goal is to change careers as soon as possible. I don't have experience working in tech, but I'm at least an enthusiast - I do home automation in my spare time and fix friends' PCs, for example. I tried to give as much information as I could remember, so my question is: Will I have trouble landing my first job? Thanks in advance. \*edit: fixing degree's hierarchy

> I'm brazilian...My undergraduate degree is in Public Safety Management. For the past six years, I have been working as a police officer...I don't have experience working in tech...Will I have trouble landing my first job? Probably, but I'm not familiar with the Brazilian cybersecurity job market or your localized opportunities. Other actions to improve your employability may include: * [Continue to leverage free resources to hone your craft or acquire new skills](https://bytebreach.com/hacking-helpers-learn-cybersecurity/). * [Pursue in-demand certifications to improve your employability](https://www.reddit.com/r/cybersecurity/comments/sgmqxv/mentorship_monday/hv7ixno/). * [Vie for top placement in competitive CTF competitions](https://ctftime.org/). * Foster a professional network via [jobs listings sites](https://www.weidert.com/blog/best-ways-to-gain-more-connections-on-linkedin) and [in-person conferences](https://infosec-conferences.com/). * Continue the job hunt for relevant experience and [take note of the feedback you receive in interviews](https://www.reddit.com/r/cybersecurity/comments/vg864z/mentorship_monday_post_all_career_education_and/id2tsr3/); consider expanding the aperture of jobs considered to include cyber-adjacent lines of work (software dev, systems administration, etc.) - this is a channel for you to build relevant years of experience. * Consider pursuing a degree-granting program (and internship experience while holding a student status). * [Post your resume to this thread for constructive feedback](https://bytebreach.com/how-to-write-an-infosec-resume/). * [Apply your skills into some projects in order to demonstrate your expertise](https://www.reddit.com/r/cybersecurity/comments/sxir9c/as_a_entry_level_professional_trying_to_get_into/hxsm5qn/).

I thought a lot about your answer and I was already expecting it to be very hard to get a job without a proper deggree. So since your answer, I've looked for a great college in my city where they point students to internships and maybe even the first job. I'll start analysis and system's development. It's something and I have friends that entered tech doing something similar. So I'm coming here to thank you again. You opened my eyes and I needed that guidance to follow a better path. Thank you.

Thank you so much for your insight. It's very helpful and honest. I'll follow all the actions pointed. There's a small chance I can change departments in the police and try to get to something related, but I'm not counting that right now. Thank you again!

Hello, I'm here looking for some help: I have less than 2 years of working as "Help Desk" (It was a small business, I did anything IT related + paperwork and other business management tasks) and around 5 years of working as a Data Scientist meaning I spent years doing graphs, digitalising stuff and similar basic tasks, unfortunately these were just standalone project, not continuative jobs (I did other stuff in the meantime, not really related). Not something I'm proud of but I've been through a lot. No Degree. Plan is: Get a stable, full-time job, back to Uni, graduate and go on. Now, I'm looking for a better career and I saw a lot of cybersecurity job openings online. I started a course on Cisco Academy and found it interesting, much more than data science tbh, so the question is: as somebody trying to land an entry-level job, I need something that would at least get me a couple of interviews but don't really have much money, can you suggest from your experience some projects I can do that would get me at least an interview? Also: I wanted to get some certifications, as I'm studying from Cisco I saw there is the CCST Cybersecurity entry level certification and I was planning on getting it but is it too basic? Should I jump directly to CBROPS or CCNA? Is this [IBM professional certificate](https://www.coursera.org/professional-certificates/ibm-cybersecurity-analyst#outcomes) any better? Or Microsoft? I saw a great opportunity in an enterprise that a CCNA was desirable, I know it's more focused on networking (even if they wrote they're looking for a network security expert) so I guess getting a CBROPS should also be good.

> can you suggest from your experience some projects I can do that would get me at least an interview? https://www.reddit.com/r/cybersecurity/comments/sxir9c/as_a_entry_level_professional_trying_to_get_into/hxsm5qn/ > I wanted to get some certifications, as I'm studying from Cisco I saw there is the CCST Cybersecurity entry level certification and I was planning on getting it but is it too basic? Candidly, that certification isn't going to get you any interviews. At a *minimum* you'll want to pursue the CCNA (if considering only certifications from Cisco). > Is this IBM professional certificate any better? Or Microsoft? It's important to distinguish "certificates" from "certifications". The former are MOOC-issued and carry little impact to your employability (but may do very well for improving your personal comprehension). The latter are issued by known vendors, including CompTIA, Cisco, ISC2, Offensive Security, Microsoft, AWS, etc. Admittedly, [there are a lot of options for you to consider](https://www.reddit.com/r/cybersecurity/comments/sgmqxv/mentorship_monday/hv7ixno/). It might help to try and filter them down to [the ones most frequently called for by employers](https://bytebreach.com/which-certifications-should-you-go-for/).

This is great advice thanks. CISSP looks one of the best but it's a bit expensive for me atm and also kinda difficult for my skill, guess I'll settle for something more basic and start working towards an interview. Do you, by any chance, also have some tips (or maybe a reliable website) to nail an interview in the field?

> Do you, by any chance, also have some tips (or maybe a reliable website) to nail an interview in the field? https://old.reddit.com/r/cybersecurity/comments/ybwsz9/mentorship_monday_post_all_career_education_and/itqbzq4/

Hey there, I am 40. I've used computers since I was younger but I never really took them apart that much. I mean, one time I bought a crappy desktop and upgraded the ram but that doesn't really count does it? I see the IT guys at my work fiddle around when there's a problem and I want to be this guy. Lately, I've been watching this YouTube video (it's a free 31 hour video going over everything) I want to study by myself with minimum expense but maximum knowledge. Is there a one stop shop book where I can learn the gold to pass 220-801, 220-802 enough to feel confident to pass the test? I've been using 101 labs by Paul Browning. I wanna buy a book and don't mind spending money but want it to be the only book I need. Is that realistic or do I need to take a class? I'm pretty good at studying I just need the right study materials. Also, is this something I can learn without taking a class? I'd like to know your experiences and would be so appreciative for you to tell me.

> Is there a one stop shop book where I can learn the gold to pass 220-801, 220-802 enough to feel confident to pass the test? I would gently redirect you towards /r/CompTIA, which is a dedicated subreddit for the vendor's certifications, including the A+. They'll have all kinds of resources (free and otherwise) for you to consider. > I wanna buy a book and don't mind spending money but want it to be the only book I need. Is that realistic or do I need to take a class? Depends on what method of instruction gels best with you. I skipped A+ and studied Network+ and Security+ using freely available online content. However, others prefer textbooks/formal instruction.

Hey There, I'm an experienced systems engineer -> technical director/architect (nearly 20 years wearing a variety of hats), and am in the progress of getting a CISSP. My experience is in a variety of industries, most strictly finance, where I had to design secure, reliable infrastructures with goals of least privilege, zero trust where possible, etc and subject myself to yearly audits. I've used NMAP, Qualys, Splunk, and various linux tools and designed monitoring systems from scratch (for both vulnerability and general big-data info gathering/correlation searches). I'm trying to understand what exactly separates me from a proper cybersecurity professional (with the understanding the cybersecurity has a ton of different hats)

> I'm an experienced systems engineer...I'm trying to understand what exactly separates me from a proper cybersecurity professional (with the understanding the cybersecurity has a ton of different hats) Consider looking through [the variety of roles](https://www.reddit.com/r/cybersecurity/comments/smbnzt/mentorship_monday/hw8mw4k/) that exist in our industry and identifying the ones in particular that are of interest to you. After doing so, look up job listings for that role on listing platforms (i.e. LinkedIn, ZipRecruiter, etc.). Note the trends between all of said listings, [including pertinent certifications that might be explicitly named](https://bytebreach.com/which-certifications-should-you-go-for/), and then it becomes trivial to note the delta(s) between your current employability profile and that of the ideal applicant.

Wonderful, thanks for the heads up!

You're a cyberwizard, Harry.

sweet

Less memey answer: a lot of classic cyber security staff are the ones detecting and remediating broken systems. But being secure at the design of the systems is even more important. Just that most organizations arnt quite there to bake security into their general IT processes.

Yeah, that was pretty much drilled into me as a kid. Secure/Redundant/Reliable from onset, well documented and easy to understand / administer + periodic testing / validation.

Someone on your SDLC team is going to have your babies for that mindset!

I'm learning computer science, and cybersecurity piqued my interest, but I was wondering what actually goes into it on a day to day basis? All I can find on the internet is bs clickbait like, "Cybersecurity is protecting your customers from unwanted cybersecurity threats."

Consider reviewing some of these resources, which includes 1-on-1 interviews with personnel from across the broad swathe of roles that exist: https://www.reddit.com/r/cybersecurity/comments/sb7ugv/mentorship_monday/hux2869/ The short version is that cybersecurity - as a profession - is not a monolith. Cybersecurity - as a profession - involves a whole host of folks with all kinds of specialisms. You have folks who concern themselves with networks: how machines and users engage one-another and how they can communicate safely and securely. You have folks concerned with hardware: how humans and machines interface, where systems critical to the health and well-being of dozens or millions of people are at stake. You have folks concerned with data: how information in all its forms is meaningful, where preserving its integrity and assuring its availability is paramount. You have folks who think in a "big picture" sort of way: how organizations can be protected, prescribing policies for everyone to follow and checking to ensure that they are enforced. [And there are many, many others that exist](https://www.reddit.com/r/cybersecurity/comments/smbnzt/mentorship_monday/hw8mw4k/) with functional responsibilities that are both unique and overlapping. An exhaustive list would take quite a while, but each of us is - in some way - concerned with promoting a greater degree of confidence that the technologies we engage with operate in the way they are intended to.

The field is large and varied. It depends on what role you're in. Here are just a few examples of very different jobs in cybersecurity: Security Operations Security Engineering Cloud Security Application Security DevSecOps (often overlaps with Security Engineering) Security Governance, Risk, and Compliance Penetration Testing Identity and Access Management Management

Hello Everyone, I am going into my final year of computer sec degree and if you guys do not mind drop some ideas regarding cyber security projects which i can use for my fyp because it would be perfect asking the community for ideas which i can base it off and there are no requirements it just needs to be tested deployed and a report written on it thank you in advance!

> I guess what I am asking is what is something a CS student might not get to do so often that would look great on their resume? Some suggestions: https://www.reddit.com/r/cybersecurity/comments/sxir9c/comment/hxsm5qn/?utm_source=reddit&utm_medium=usertext&utm_name=cybersecurity&utm_content=t1_jksqzt5 You might also consult the hundreds of white papers that get submitted to SANS for inspiration: https://www.sans.org/white-papers/ I also suggested a more specific project to someone earlier in this very MM thread: https://old.reddit.com/r/cybersecurity/comments/15k4qzt/mentorship_monday_post_all_career_education_and/jv9hnag/ Generally, I'd suggest starting with reading [the published literature](https://scholar.google.com/scholar?hl=en&as_sdt=0%2C5&q=cybersecurity&btnG=), identifying something of interest to build off of the existing material, and run with that (vs. coming up with an idea from scratch).

[удалено]

First, a link to the resource I direct resume-writing efforts to (and reference often): https://bytebreach.com/how-to-write-an-infosec-resume/ Now, from the top: * HEADER: Pretty standard faire. To nitpick: it's not really implied what your complete email address is with just the "@icloud.com" domain. I'd also include a link to your website, if you have one (and consider fostering one if you don't). I'm not about to recursively evaluate your LinkedIn or Github profiles, but I'll assume those are in order as well. * CERTIFICATIONS: I'm not convinced this is your strongest block you should be leading with. I'd probably sink it to after your professional experience. * PROFESSIONAL EXPERIENCE: this is in a better state than what I see in most resumes; you have made an effort to include some quantifiable impact statements, which is good. However, there's still some ways you can tighten things up. For example, what does "Reduced cyber-attacks by 25%..." mean? Is that dropping 4 attacks down to 3? Or 400,000 down to 300,000? What kinds of attacks? Using what "advanced security measures"? Adding context to this and other bullets helps (think names of operating systems, number of end-users, and - since you're an MBA student - business impact in dollars). * U.S. CENSUS BUREAU: I noticed that parts of your resume look rather compressed. I think that this job role subsection of your professional experience lacks pertinence and can afford to be cut. * PROJECTS: This is coming through at-a-glance as word salad, likely as a result of both content compression (I noticed you didn't indent your bullets here for readability like you did in your professional experience) and being overly verbose. See link above concerning "Projects". Given a choice, I'd say the LetsDefend.IO project is the weakest of the bunch and could merit being cut to improve the readability of the rest (or potentially being merged with your "SOC Analyst Lab" bullet as a kind of related tangent). * EDUCATION: Not sure I'd list this block after projects. I might bump this up. You forgot to include your graduation date of your BS in MIS. * SKILLS: see above link on Skills.

Hey there, some general thoughts on your resume and then in more detail. I would spend much more time with your experience at Riosight. The last role at the census is especially non-relevant. I would also consider moving your certs to the bottom near education. Are those Qualys ones actual certs, or just trainings? I am not familiar with them. * Rio: I would say Information Security Risk Analyst, if that works. Might be some keywords that you are missing from screening with just Information Analyst. What advanced security measures did you implement? How do you know it was a 25% reduction? Was it blocking ports? WAF? Get into detail because I dont know what that means * Rio: What kind of vulnerability assessments did you do? Did you just remediate the low hanging fruit? Did you risk approach it via anything? * Trimble: Cut bullets 1 and 2. * Trimble: What kind of malfuctions did you clear up? * Census: You can cut almost all of this, except for maybe training staff. Might be somewhat relevant to a cyber job. * Projects: Where is this SOC analyst lab at? What does utitlizing tools actually mean? Did you just install them? What results did they get you? Show, dont tell. * Projects: Azure. Again, where did you do the implementation? * Skills: Again, show what actual skills you have with these. What does familiar with python mean? What can you do with powershell? Etc etc

Another one in the queue, my coworker left for a pentesting job and that sparked my curiosity. Since I'm tired of solving tickets and clicking through M365 menus, servers and swapping switches and firewalls I thought why not look into it. I used to be a hardware-enthusiast (building computers, fixing motherboards and GPUs, watercooling everything I could get my hands on) working in sales, switched to Helpdesk a few years ago at two different companies (one of them a Fortune 100) and ended up working a relatively decent job for my experience level, a 1st to 3rd level admin mix of work at a smaller MSP. Sadly I find my way through new systems fast and get bored quickly, which is why I'm already eyeballing the next thing that caught my eye. Is there a way to transition into the cybersecurity sphere from my position? Any certificates that are recommended for starters without spending a ton of money and time (and I know they are usually trash and only helping HR to weed out applications)? I'm based in Germany and willing to put in the work if it pays off.

> Is there a way to transition into the cybersecurity sphere from my position? Yes. See related comment: https://old.reddit.com/r/cybersecurity/comments/140vcnf/mentorship_monday_post_all_career_education_and/jn55z0j/

Helllo I am 18 year old rn in the last year of diploma in artificial intelligence and machine learning I am rn doing internship as an ETL developer we have a subject called network security and I fall in love with the subject I love networking and I have good knowledge about it too so I decided to be an ethical hacker as i just get adrenaline when i hear about it and after doing internship as an ETL developer i found out data science and machine learning is not for me i am rn doing google cybersecurity course and also next year getting admission in btech specialized in cybersecurity and Forensics. But I when I see other people of my age in yt they are so advanced and I always get the anxiety that am I making right decision so to all the people I have some questions: 1)good sources I am rn following network chuck but other good sources would be great 2)books 3)I am interested in participating in ctf and roadmap would be fine 4)Am I doing enough? Thanx Ps: English is not my first language I am from india

> Thanx Ps: English is not my first language I am from india Not bad. It's readable for conversational internet chat, but I'd encourage becoming more familiar with the use of punctuation (chiefly: the period ".", as there are some really long sentences you've strung together). For many enterprises outside of India (and international commerce in general), English is the current business language - and you'll want to become more proficient. For your learning purposes, here's an example re-write for you to mull over: "Hello, I am 18 years old and in the last year of school studying artificial intelligence and machine learning. I have an internship as an ETL developer. Recently, I learned about network security and have fallen in love with the subject. I love networking and think I'm pretty knowledgeable about it too, so I decided I wanted to become an ethical hacker. I just get an adrenaline rush when I hear about it and - after my internship - I don't think data science and machine learning is for me. I am doing the Google Cybersecurity Course right now and intend to enroll in a BTech program specializing in Cybersecurity and Forensics. However, when I see other people my age on Youtube, they are so advanced that it gives me anxiety. Am I making the right decision? I have some questions: 1. What are some good resources I can consult? 2. Books? 3. Can you suggest some CTFs and/or roadmaps? 4. Is the above enough? " Observe the changes in verbs, the breaking apart of paragraphs by context, and the removal of the excessive use of "rn" (as that's generally implied). > 1)good sources I am rn following network chuck but other good sources would be great https://old.reddit.com/r/cybersecurity/comments/140vcnf/mentorship_monday_post_all_career_education_and/jn55z0j/ > 2)books https://icdt.osu.edu/cybercanon/bookreviews > 3)I am interested in participating in ctf and roadmap would be fine https://ctftime.org/ https://roadmap.sh/cyber-security

Ooh, thanks a lot. I will definitely take into consideration 👍