Do you work in Cyber Security? Tell me about it.

[Patricio Swayze 17058]

So, I am getting close to a year of unemployment and as you may imagine, it is a shitty feeling.  Applied to so many jobs, nothing.  Talked to several recruiters who seemed to be sold on me, only to have nothing come of it.  Frankly, before all this shit happened, I would have loved to get out of Engineering/Oil & Gas.  At first I hoped to get into renewables, but nothing is happening.  So now, it is time to really start considering contingency plans. 

This would be my first career change after 13 or so years (before this career, I worked in music for about 7 years).  So I am a bit nervous, especially about a cut in pay.  I totally accept that I will have to take a cut, but I obviously am trying to limit that cut as much as possible. A friend of me said that the company he works for is currently hiring a ton of Cyber Security Analysts and suggested I look into getting a couple of certifications.  I know that UT, Rice and others have these bootcamps.  So a few questions for folks that do this or have intimate knowledge of this field:

Can you give me a brief description of what a typical day is like?

I have zero coding experience, would I still be able to find work with a couple of certifications in the cyber security area?

Having no experience in this, and the no coding experience, assuming I found work, what kind of salary could be expected (in Houston)?

Thanks for any input.

[Handcruser 2805]

PM me if you want to chat.

Short response: those certs don’t mean shit. You’ll get asked some really hard questions in interviews that you won’t be able to answer.

Application security and ssd are of the table for you and that’s where the money is.

[Patricio Swayze 17058]

Going to be traveling most of today. Will DM you tonight.

[Dbeasy 15052]

8 hours ago, Handcruser said:

PM me if you want to chat.

Short response: those certs don’t mean shit. You’ll get asked some really hard questions in interviews that you won’t be able to answer.

Application security and ssd are of the table for you and that’s where the money is.
 

Can you expand on this a bit? What are you referring to?

[Handcruser 2805]

Can you expand on this a bit? What are you referring to?

Application security and secure software development require a mastery of multiple programming languages.

You have teams that just do black box stuff and run ots tools and submit reports and recommended mitigation’s.

Then you have teams that do white box stuff and do a deep dive into the application itself, the environment it’s deployed in, the technology stack, etc. Everything gets analyzed, automated tools are run, code is manually reviewed, interviews with design teams are had, interviews with network teams, interviews with c-suite (most people miss this), interviews with 3rd party vendors, etc. Reports are developed, remediation plans shared, and we would work together to fix the problems, then test again, and rinse and repeat quarterly.

Secure software development requires the same mastery, only better. Where I worked, we actually built the software a very large security firm sold. They didn’t have the expertise. The talent in that space is very small.

I’ve got a lot of good stories of you need/want to chat. Not sure what business you’re in.

[gurt 748]

IMO it would be very ambitious to try and break into this niche from step 1.  Trying to become a software developer first would be a better path.  I don't have any experience with this directly, but knowing the people internally who do it, they are some very seasoned and accomplished folks.

[Irish Wrist Watch 1359]

Maybe look into software implementation for an AI s/w co. It looks to be on the periphery of advanced analytics. Might be a foot in the door to both fields.

[TXSG8R 3362]

There’s plenty of cyber security work outside of software development, especially on the government side. Risk Management Framework is a substantial amount of work for most organizations, and there’s plenty to do at multiple levels. Policy, network, physical security, lifecycle management, hosts, management, stig application, scans and testing, POA&Ms, etc. I did ISSM work for a small government program and it took us 18 months to jump through all the hurdles to get our ATO. That’s DoD, which is super rigid, so things should be better at the state or private sector because you get more wiggle room to tailor controls and mitigate. 

Trying to jump straight into a CISSP would be painful. I would suggest doing a net+ or security+ first. They are easier certs to get and it’s the minimum requirement to work on most gov’t networks or hosts.  That should give you an entry path into CyberSec work.

[Patricio Swayze 17058]

There’s plenty of cyber security work outside of software development, especially on the government side. Risk Management Framework is a substantial amount of work for most organizations, and there’s plenty to do at multiple levels. Policy, network, physical security, lifecycle management, hosts, management, stig application, scans and testing, POA&Ms, etc. I did ISSM work for a small government program and it took us 18 months to jump through all the hurdles to get our ATO. That’s DoD, which is super rigid, so things should be better at the state or private sector because you get more wiggle room to tailor controls and mitigate. 
Trying to jump straight into a CISSP would be painful. I would suggest doing a net+ or security+ first. They are easier certs to get and it’s the minimum requirement to work on most gov’t networks or hosts.  That should give you an entry path into CyberSec work.

Thanks for your input. Those two certa (CISSP and Security +) are the ones my friend’s coworker suggested. He actually suggested them in that order but maybe he didn’t mean to imply that to my buddy.

So assuming I got those two, and I know this is a very broad question), could I find work even without any previous experience or coding knowledge? And if yes, what kind of salaries are we talking?

[TXSG8R 3362]

Unless things have changed, I don’t even think you can start a CISSP without a number of years within the field, plus you have to have a sponsor letter showing your job encompasses CyberSec. Sec+ is the crawl phase, CISSP is more of the run phase.  
 

There’s a pretty broad range of positions within CyberSec. Ground floor is probably application of controls/STIGs or scanning/testing/auditing. Most of those jobs fall within IT admin for network, hosts, etc. Sec+ won’t really get you any increase in salary as much as qualify you for those positions.  On the gov’t side that usually includes a 4 year degree, and some positions will require an IT specific degree, but that’s usually flexible with other experience. Gov’t will also prefer candidates with security clearances, if an org is desperate they will fork over the money to get you one. If you’re jumping into this dry without any IT background you’ll likely have to start in an analyst position and work your way up. That starts in the 40s, but is location specific (I would guess the floor in Austin is in the 50s).
 

Management jobs are painful. Lots of policy and review work that will make you want to rip your eyes out. It’s also a daunting amount of work if you’re jumping into an org that is starting from scratch. It’s also super fun to have to argue with leadership constantly that they are doing things wrong. They really enjoy that. 

[Updawg 2266]

You need some networking knowledge as well. Sec + first. You need experience to qualify for the cissp. It’s going to be hard to get into cyber unless you have some networking or programming skills already.

But if you really want to, you might look at the policy side. (GRC). That is probably easier especially if you have an audit type background

[Celery Man 20962]

Outside of industry, what is your background? I would quickly wade out of my depth if I tried to speculate on a quick way into security, but I would love to think some more on what might be decent steps if you’re broadly interested in tech jobs. Hate that you’re going through a job search right now - it’s a beating on a lot of fronts. Was driving me crazy. 

[DonkeyCigars 143]

Easiest way is to get a sales job selling cyber security. Before you neg me for insulting you, hear me out.

You will have to be trained and learn from the inside out, bottom-up, and then maybe you can work at nights/weekends to add depth and breadth to your technical skillset. The benefit of this route is trifold: 1) you probably won't lose as much earnings on your W2-- sales people, even bad ones, generally make much more than a basic/entry level analyst 2) you can look to internally transfer/upskill from a non-technical sales job to a technical role a lot easier and 3) you get a lot of at-bats and hopefully hear from a lot of different customers and CISO's what are the real problems keeping orgs up at night, you learn a talk track and learn how to speak the language so when you interview, you can fake like you know what you are talking about and be more convincing than some O&G guy taking some stabs in the dark.

Disclaimer: I am not in the cyber security space, I don't know much about the space, and I didn't stay at a Holiday Inn last night.

Edited March 5, 2021 by DonkeyCigars

[TXSG8R 3362]

10 hours ago, DonkeyCigars said:

Easiest way is to get a sales job selling cyber security. Before you neg me for insulting you, hear me out.

You will have to be trained and learn from the inside out, bottom-up, and then maybe you can work at nights/weekends to add depth and breadth to your technical skillset. The benefit of this route is trifold: 1) you probably won't lose as much earnings on your W2-- sales people, even bad ones, generally make much more than a basic/entry level analyst 2) you can look to internally transfer/upskill from a non-technical sales job to a technical role a lot easier and 3) you get a lot of at-bats and hopefully hear from a lot of different customers and CISO's what are the real problems keeping orgs up at night, you learn a talk track and learn how to speak the language so when you interview, you can fake like you know what you are talking about and be more convincing than some O&G guy taking some stabs in the dark.

Disclaimer: I am not in the cyber security space, I don't know much about the space, and I didn't stay at a Holiday Inn last night.

What would you sell in the CyberSec field?  There aren’t a lot of tools out there that do much of the heavy lifting.  Some scanning and audit tools maybe, but I doubt the sales side would get you any usable experience on the operational side. I don’t see many ways around starting at an entry position and taking your lumps working up the ladder. 

[DonkeyCigars 143]

1 hour ago, TXSG8R said:

What would you sell in the CyberSec field?  There aren’t a lot of tools out there that do much of the heavy lifting.  Some scanning and audit tools maybe, but I doubt the sales side would get you any usable experience on the operational side. I don’t see many ways around starting at an entry position and taking your lumps working up the ladder. 

Really? Maybe the term as I’m thinking about it is overly broad, but seems like “cyber security” is a very crowded space. I’m thinking of all the software that gets sold under that heading and the subverticals that Gartner cares about: application security, IAM, DevOps security, micro services and APIM security,  Security as a Service, Network detection and response, etc.

Seems there are probably a hundred narrowly focused software companies trying to tackle specific use cases and problems and a dozen large platforms like IBM or something who are trying to sell the full solution?

 

[TXSG8R 3362]

6 hours ago, DonkeyCigars said:

Really? Maybe the term as I’m thinking about it is overly broad, but seems like “cyber security” is a very crowded space. I’m thinking of all the software that gets sold under that heading and the subverticals that Gartner cares about: application security, IAM, DevOps security, micro services and APIM security,  Security as a Service, Network detection and response, etc.

Seems there are probably a hundred narrowly focused software companies trying to tackle specific use cases and problems and a dozen large platforms like IBM or something who are trying to sell the full solution?

 

There isn’t any kind of turnkey, out of the box solution for CyberSec. Proper CyberSec encompasses all parts of an organization and its subs, vendors, supply chain, etc. that’s why it’s hard. Solarwinds is a great example. Lots of companies bought an admin tool that opened a huge hole in their posture. Buying software doesn’t fix physical access, or insider threats, etc. like I said, there are certainly tools that are useful in support of CyberSec, but if companies are advertising a full solution they are selling fool’s gold. 

[Nice Guy Eddie 13515]

I don't agree with the one opinion that "certs don't mean shit." I do agree that having certifications doesn't make you better than someone that doesn't have them. But certs can definitely help you get a job and get you more money.  Jobs can have requirements and you might be the best fit for the job but if you can't meet the requirements, see ya. 

In my experience if the hiring manager has a certification, then you need it to get hired. 

Consulting firms can charge more for you if you have certs, which means they pay you more. And since we all go to work for money, you can't say certs are shit.

[Handcruser 2805]

I don't agree with the one opinion that "certs don't mean shit." I do agree that having certifications doesn't make you better than someone that doesn't have them. But certs can definitely help you get a job and get you more money.  Jobs can have requirements and you might be the best fit for the job but if you can't meet the requirements, see ya. 
In my experience if the hiring manager has a certification, then you need it to get hired. 
Consulting firms can charge more for you if you have certs, which means they pay you more. And since we all go to work for money, you can't say certs are shit.

I worked for a consulting firm. Very high level. Shared talent with the NSA.

Certs don’t mean shit in that space.

We didn’t charge more because 3 of our guys had Sec+ certs. None of that is even discussed. Nobody cares. People who hired us had people on staff with certs, and they needed us because they’re guys weren’t capable.

Security assessments and consulting is a whole different beast. White box work is another level altogether.

[Nice Guy Eddie 13515]

8 hours ago, Handcruser said:

I worked for a consulting firm. Very high level. Shared talent with the NSA.

Certs don’t mean shit in that space.

We didn’t charge more because 3 of our guys had Sec+ certs. None of that is even discussed. Nobody cares. People who hired us had people on staff with certs, and they needed us because they’re guys weren’t capable.

Security assessments and consulting is a whole different beast. White box work is another level altogether.

Without meaning to, you proved my point that certs matter. 

[Dbeasy 15052]

12 hours ago, TXSG8R said:

There isn’t any kind of turnkey, out of the box solution for CyberSec. Proper CyberSec encompasses all parts of an organization and its subs, vendors, supply chain, etc. that’s why it’s hard. Solarwinds is a great example. Lots of companies bought an admin tool that opened a huge hole in their posture. Buying software doesn’t fix physical access, or insider threats, etc. like I said, there are certainly tools that are useful in support of CyberSec, but if companies are advertising a full solution they are selling fool’s gold. 

I think you might be looking at the process of Cybersecurity. He’s talking about Cybersecurity software, and there are 2,000 firms out there. He probably could get a sales role if he can use his network to get in somewhere. They will train him on the products. If he can take a few Cybersecurity classes that will show the hiring company he’s serious about the transition. I would have hired someone like that. 

[Handcruser 2805]

Without meaning to, you proved my point that certs matter. 

No I didnt.

[TXSG8R 3362]

9 hours ago, Dbeasy said:

I think you might be looking at the process of Cybersecurity. He’s talking about Cybersecurity software, and there are 2,000 firms out there. He probably could get a sales role if he can use his network to get in somewhere. They will train him on the products. If he can take a few Cybersecurity classes that will show the hiring company he’s serious about the transition. I would have hired someone like that. 

I was CyberSec management for our program, but also the lead network engineer on our technical implementation of controls on both hosts and network.  My experience is skewed by it being all DoD work, but outside of AV and a DoD specific host-based software that distributed and enforced patches and policies, we didn't use anything else on the technical side to secure anything.  We used STIGs and SCGs to harden everything manually, only allowed the necessary ports, protocols, and services, yada yada.  I don't see software solutions that can do that kind of work for you because its so specific and unique to every organization.  

We also used a DoD specific scanning tool suite, so I could see a private side equivalent being something that sells well.  That box is external to our network though, its not something thats just plug and forget.  I just don't see many software options that would solve an issue without causing other vulnerabilities.  Everything you add to a box or network is another potential vector for attack.  I'm not dismissing that there are usable CyberSec tools out there, I just don't see how going into sales would give someone a leg up on a guy that's jumping in as an analyst doing real CyberSec work out of the gate.  You may make less money, but I want the guy earning real experience, not someone that can regurgitate slick sheets from memory but not know how to use the tool outside of a carefully rehearsed demo.  

[deadshank 24653]

On 3/4/2021 at 11:19 PM, DonkeyCigars said:

Disclaimer: I am not in the cyber security space, I don't know much about the space, and I didn't stay at a Holiday Inn last night.

No shit, Mensa.  The smart guys stay at a Holiday Inn Express. 

[Dbeasy 15052]

3 hours ago, TXSG8R said:

I was CyberSec management for our program, but also the lead network engineer on our technical implementation of controls on both hosts and network.  My experience is skewed by it being all DoD work, but outside of AV and a DoD specific host-based software that distributed and enforced patches and policies, we didn't use anything else on the technical side to secure anything.  We used STIGs and SCGs to harden everything manually, only allowed the necessary ports, protocols, and services, yada yada.  I don't see software solutions that can do that kind of work for you because its so specific and unique to every organization.  

We also used a DoD specific scanning tool suite, so I could see a private side equivalent being something that sells well.  That box is external to our network though, its not something thats just plug and forget.  I just don't see many software options that would solve an issue without causing other vulnerabilities.  Everything you add to a box or network is another potential vector for attack.  I'm not dismissing that there are usable CyberSec tools out there, I just don't see how going into sales would give someone a leg up on a guy that's jumping in as an analyst doing real CyberSec work out of the gate.  You may make less money, but I want the guy earning real experience, not someone that can regurgitate slick sheets from memory but not know how to use the tool outside of a carefully rehearsed demo.  

I must have missed some part of the conversation. I thought he wanted to go into the "cybersecurity" industry and I didn't think he was interested in just cyber processes. If that's the case, then working for a cybersecurity software firm may not be the right path forward. But if he wants to get out of Oil and Gas and wants to do something in cybersecurity, then there is a $248 BILLION dollar market he can be employed in that helps cybersecure organizations, commercial and government. 

[Zepol87 9188]

Security+ is boring as fuck but easy as hell.  Not sure what positions it will open up for you but it's a baseline cert. I have some shit for it if you are going to take it that can help a bit. I'll PM you. 

[EE2B 1565]

It was mentioned before, but what’s your background? We lost a process control engineer recently and we are thinking about replacing him with someone with a strong OT/IT background. We would want someone who is proficient in VMWare, Veeam, network configuration, ESXi, familiar with Nimble storage and HP server hardware. This is on the process control side of the house, so we would be looking for someone who understands the urgency when we have issues and willing to jump in and help. You would get to work directly with me everyday, so there is that bonus. Let me know if this is something that fits or if you have questions.

[Celery Man 20962]

You guys in Austin, EE2B? Not me and probably nothing but I know some people who roughly fit that description and are working at a company that is laying off people frequently, so my ear perks up. Used the FUCK out of some nimble. Man I need to catch up with my ops guru safety blanket who was getting fucking depressed at that place.

[EE2B 1565]

I wish. Northeast Texas/Southwest Arkansas. Nimble is awesome. I had to beg them to connect our servers to Infosight. I’ve gotten calls from the support folks at Infosight before I ever knew I had an issue.

[DonkeyCigars 143]

13 hours ago, Dbeasy said:

I must have missed some part of the conversation. I thought he wanted to go into the "cybersecurity" industry and I didn't think he was interested in just cyber processes. If that's the case, then working for a cybersecurity software firm may not be the right path forward. But if he wants to get out of Oil and Gas and wants to do something in cybersecurity, then there is a $248 BILLION dollar market he can be employed in that helps cybersecure organizations, commercial and government. 

You didn’t miss anything. Typical engineer with a narrow focus and in a siloed work stream who loses the forest for the trees. It’s why these guys rarely rise to C-Suite and it’s why CEO’s are rarely former CIO’s.

:-p

[TXSG8R 3362]

On 3/6/2021 at 7:50 PM, Dbeasy said:

I must have missed some part of the conversation. I thought he wanted to go into the "cybersecurity" industry and I didn't think he was interested in just cyber processes. If that's the case, then working for a cybersecurity software firm may not be the right path forward. But if he wants to get out of Oil and Gas and wants to do something in cybersecurity, then there is a $248 BILLION dollar market he can be employed in that helps cybersecure organizations, commercial and government. 

 

22 hours ago, DonkeyCigars said:

You didn’t miss anything. Typical engineer with a narrow focus and in a siloed work stream who loses the forest for the trees. It’s why these guys rarely rise to C-Suite and it’s why CEO’s are rarely former CIO’s.

😛

Any orgs handling CyberSec strictly as a software or network issue and ignoring everything else are the ones that get fucked on the regular.  Most events happen because of shitty passwords, lost data to phishing, social engineering, physical access, etc. I agree that there are software tools and approaches that are helpful, but that is such a limited scope in the CyberSec field.  I'm sure companies are spending a mint on stuff, but that 248 billion dollar market isn't riding on the backs of button pushers for that software.  Its CTO/CIOs throwing money at a solution because everyone is super serious about Cybersec all of a sudden.  If he wants to work in CyberSec beyond a lower tier IT role, the quicker he moves beyond a software suite and into more of the bigger picture the better.  

Shitty C-suite execs like to throw buzzwords around or throw money at a software solution without understanding the depth they are in.  Holistic approach is the opposite of a narrow focus chief.  Its also why RMF puts a lot more guard rails in place specifically on management, because those are the guys that usually fuck up an orgs posture the worst, purely due to the lack of personal convenience.  A lot of CyberSec software solutions are canaries.  They tell you after a problem occurs, which means you've already been compromised.  The point of CyberSec is to be ahead of those kinds of issues.  You don't want to lose the Gibson because Karen from HR uses the same password everywhere and because CEO DonkeyCigars decided to relax the policy on PW complexity and change cycle because it was totally a hassle.  That's what happens way more often than some movie script foreign hackers breaching your network.  

You admitted early on that you didn't know shit about CyberSec.  Your last hot take kind of proves it.  If your organization is handling CyberSec purely as an IT issue they are doing it wrong.  

Edited March 8, 2021 by TXSG8R

[TXSG8R 3362]

I replied before coffee.  In case it wasn’t clear, first paragraph was in response to Dbeasy, the rest is for DC. 
 

I should also add, that IT in general is rarely the issue in CyberSec in most well run organizations. A password breach isn’t usually an IT issue, it’s poor policy (PW complexity is too weak, change cycle is too infrequent, etc).  Most orgs have been locking down firewalls and ports for a long time, it’s rarely an IT configuration issue that gets breached, it’s software zero day exploits in the software external to the org running it. Going back to Solarwinds, the orgs that were running it probably followed all the proper guidance on hardening.  The problem wasn’t their IT security. It was a supply chain issue that injected a back door into all their hard work. This is why more software is rarely the right answer. Everything you add to your network is something else to be scrutinized, another product’s supply chain and internal security posture that you have to sweat.  The more popular the software, the bigger the surface area a bad actor gains by exploiting. 

Edited March 8, 2021 by TXSG8R

[Nice Guy Eddie 13515]

? for the security people here. 

In my experience with my personal finance websites, two factor authentication is the norm.  One crypto exchange I use even has 3 (password, authenticators apps and email responses.) I know these can all have flaws.  My question is why don't more corp apps have higher security? The skeptical side of me thinks that more login security will lead to more calls to the IT and they can't have that.

Another problem I'm seeing with security is that each dept in my company seems to add more and more 3rd party websites that utilize single sign-on. IT warns me of phishing sites that ask for my login/password, but in the meantime they add more single sign-on apps weekly. I could easily be phished because I don't keep up with every software partner we have. HR is the worst in that they outsource almost every function to a different company/website.

[TXSG8R 3362]

That is the struggle, ease of use/efficiency versus security. DoD makes things easier on the security side by always defaulting to the security side of the argument, even at the expense of production. My guess is the private sector does the exact opposite. 

MFA is better than simple PW.  Biometric/physical multi factor is better than text/email just because of the ease of exploitation there. Yubikey is probably the best solution out there for MFA. The answer to your question is always money. 

SSO isn’t inherently bad. Ideally each service would have unique authentication, but that’s stretching the limit for most users that struggle with one complex password change every 90 days. SSO should always be coupled with MFA.  My guess is most of those third party sites offer a plug in to whatever SSO you’re using. You are correct though, by going that route you are giving attackers more surface area to work with, which is never a good thing.  

One thing that should always be separated is OWA/mail services from the rest of your SSO stuff. Those should require unique authentication because of the amount of info/linkage of user data and MFA via email. Most attackers want to exploit email first because that puts them in the drivers seat for getting into everything else. Once I have your email account, I can just request a password reset on everything else and where does that usually go?  

Edit: if you’re using a password for your email, work or personal, that is shared with anything else you’re definitely doing it wrong.  Companies get breached all the time, and you don’t want that password you used for Etsy to wind up being how some script kiddie drains your bank account. 

The other thing that’s extremely critical is the separation of duties and privileges. How many orgs have that one IT guy that fixes everything?  How many execs have permissions to view things that aren’t part of their workload?  Network sec, host sec, audit teams, backups, etc should all have very explicit divisions in their permissions to avoid an exploit of one guy giving an attacker all the keys. For a small org with literally a one man IT staff, he should still be separating those duties with unique authentication to reduce surface area.  Yes, it’s more of a pain day to day, but it also reduces the pain of a breach.  Your mentality for security should always be when, not if, you’ll get breached. You make them earn every inch. 

Edited March 8, 2021 by TXSG8R

[Dbeasy 15052]

2 hours ago, TXSG8R said:

 

Any orgs handling CyberSec strictly as a software or network issue and ignoring everything else are the ones that get fucked on the regular.  Most events happen because of shitty passwords, lost data to phishing, social engineering, physical access, etc. I agree that there are software tools and approaches that are helpful, but that is such a limited scope in the CyberSec field.  I'm sure companies are spending a mint on stuff, but that 248 billion dollar market isn't riding on the backs of button pushers for that software.  Its CTO/CIOs throwing money at a solution because everyone is super serious about Cybersec all of a sudden.  If he wants to work in CyberSec beyond a lower tier IT role, the quicker he moves beyond a software suite and into more of the bigger picture the better.  

Shitty C-suite execs like to throw buzzwords around or throw money at a software solution without understanding the depth they are in.  Holistic approach is the opposite of a narrow focus chief.  Its also why RMF puts a lot more guard rails in place specifically on management, because those are the guys that usually fuck up an orgs posture the worst, purely due to the lack of personal convenience.  A lot of CyberSec software solutions are canaries.  They tell you after a problem occurs, which means you've already been compromised.  The point of CyberSec is to be ahead of those kinds of issues.  You don't want to lose the Gibson because Karen from HR uses the same password everywhere and because CEO DonkeyCigars decided to relax the policy on PW complexity and change cycle because it was totally a hassle.  That's what happens way more often than some movie script foreign hackers breaching your network.  

This thread is not about the best way to cybersecure networks, or your misguided viewpoint of the value of cybersecurity software.  This thread is about a poor soul who wants a job in the cybersecurity industry.  Your dismissal of a multi-hundred billion dollar industry that provides clear value to companies around the world is a viewpoint that makes no sense whatsover. Seriously. No sense at all. You would do well to quit while you are behind before digging yourself into a deeper hole. And for the OP, there are tremendous opportunities in cybersecurity software if you are interested. I should know. I've run a cybersecurity software company for the past few years. 

And as to your viewpoint that human error is a big issue, but cybersecurity software has no value, there are thousands of products out there, including my company's, that monitor and alert for human errors made, providing a great tool for companies to quickly identify cyber vulnerabilities created via human error. Some of the biggest government agencies in the country use it for that purpose, as to commerical enterprises. So seriously, stop providing bad advice to this guy.

[TXSG8R 3362]

3 minutes ago, Dbeasy said:

This thread is not about the best way to cybersecure networks, or your misguided viewpoint of the value of cybersecurity software.  This thread is about a poor soul who wants a job in the cybersecurity industry.  Your dismissal of a multi-hundred billion dollar industry that provides clear value to companies around the world is a viewpoint that makes no sense whatsover. Seriously. No sense at all. You would do well to quit while you are behind before digging yourself into a deeper hole. And for the OP, there are tremendous opportunities in cybersecurity software if you are interested. I should know. I've run a cybersecurity software company for the past few years. 

And as to your viewpoint that human error is a big issue, but cybersecurity software has no value, there are thousands of products out there, including my company's, that monitor and alert for human errors made, providing a great tool for companies to quickly identify cyber vulnerabilities created via human error. Some of the biggest government agencies in the country use it for that purpose, as to commerical enterprises. So seriously, stop providing bad advice to this guy.

Quote

like I said, there are certainly tools that are useful in support of CyberSec

Quote

I'm not dismissing that there are usable CyberSec tools out there, I just don't see how going into sales would give someone a leg up on a guy that's jumping in as an analyst doing real CyberSec work out of the gate

Quote

I agree that there are software tools and approaches that are helpful, but that is such a limited scope in the CyberSec field.

Not sure if you are struggling with bias about security software or reading comprehension, so Ill highlight some of my quotes for you.  I have never said software has no value in CyberSec.  To the larger point, OP asked about work in the Cyber Security field, not Cyber Security software.  His friend is hiring Cyber Security Analysts, not software developers.  I think his lack of knowledge and experience led him to asking questions about coding, because a lot of people assume that IT work somehow involves code.  He asked about certs like Sec+ and CISSP specifically.  I'm not dismissive of software, but if he wants to work CyberSec as a career, IMO, he is going to be limited by going into sales for a specific software product and then jumping into full fledged CyberSec work for an organization.  That was the route that DC threw out there with admittedly zero experience on the CyberSec side of the house.  That's what you somehow jumped on instead of all of the other discussion.  

And nothing you just said counters what I said about a lot of CyberSec software.  Your software monitors and alerts for errors in a production environment?  Congrats, your software is a canary.  Its still helpful, alerts are always great, but you're now in post-incident mode regardless.   Cyber Security, as a career path in a non-CyberSec software company, uses software as a tool, its not a panacea.  Go back and read some of my first responses.  None of it was intended to shit on software, it was offering the full scope of CyberSec as a career outside of software, because OP has no software experience and his buddy is hiring analysts.  

[TXSG8R 3362]

Back to the OP, this article is great.  Also supports Handcruser's stance on certs.  They can open doors, but they aren't going to get you much in the way of usable experience for the job, especially if you just run through a bootcamp and shotgun test answers into your brain.  

 

https://krebsonsecurity.com/2020/07/thinking-of-a-cybersecurity-career-read-this/

Quote

Rarely am I asked which practical skills they should seek to make themselves more appealing candidates for a future job. And while I always preface any response with the caveat that I don’t hold any computer-related certifications or degrees myself, I do speak with C-level executives in cybersecurity and recruiters on a regular basis and frequently ask them for their impressions of today’s cybersecurity job candidates.

A common theme in these C-level executive responses is that a great many candidates simply lack hands-on experience with the more practical concerns of operating, maintaining and defending the information systems which drive their businesses.

Granted, most people who have just graduated with a degree lack practical experience. But happily, a somewhat unique aspect of cybersecurity is that one can gain a fair degree of mastery of hands-on skills and foundational knowledge through self-directed study and old fashioned trial-and-error.

One key piece of advice I nearly always include in my response to readers involves learning the core components of how computers and other devices communicate with one another. I say this because a mastery of networking is a fundamental skill that so many other areas of learning build upon. Trying to get a job in security without a deep understanding of how data packets work is a bit like trying to become a chemical engineer without first mastering the periodic table of elements.

Quote

But please don’t take my word for it. The SANS Institute, a Bethesda, Md. based security research and training firm, recently conducted a survey of more than 500 cybersecurity practitioners at 284 different companies in an effort to suss out which skills they find most useful in job candidates, and which are most frequently lacking.

The survey asked respondents to rank various skills from “critical” to “not needed.” Fully 85 percent ranked networking as a critical or “very important” skill, followed by a mastery of the Linux operating system (77 percent), Windows (73 percent), common exploitation techniques (73 percent), computer architectures and virtualization (67 percent) and data and cryptography (58 percent). Perhaps surprisingly, only 39 percent ranked programming as a critical or very important skill (I’ll come back to this in a moment).

How did the cybersecurity practitioners surveyed grade their pool of potential job candidates on these critical and very important skills? The results may be eye-opening:

Quote

The truth is, some of the smartest, most insightful and talented computer security professionals I know today don’t have any computer-related certifications under their belts. In fact, many of them never even went to college or completed a university-level degree program.

Rather, they got into security because they were passionately and intensely curious about the subject, and that curiosity led them to learn as much as they could — mainly by reading, doing, and making mistakes (lots of them).

I mention this not to dissuade readers from pursuing degrees or certifications in the field (which may be a basic requirement for many corporate HR departments) but to emphasize that these should not be viewed as some kind of golden ticket to a rewarding, stable and relatively high-paying career.

 

[dirtonia 269]

Clearly an industry to avoid, as it appears to be filled with d bags like the last two posters.

/boomroasted

[William_Cannon 86]

I worked for a consulting firm. Very high level. Shared talent with the NSA.

Certs don’t mean shit in that space.

We didn’t charge more because 3 of our guys had Sec+ certs. None of that is even discussed. Nobody cares. People who hired us had people on staff with certs, and they needed us because they’re guys weren’t capable.

Security assessments and consulting is a whole different beast. White box work is another level altogether.

I agree the field is 100% what you can do. You don’t need a particular degree, certification, etc. however, you have to start somewhere before you’re part of the cream of the crop talent who doesn’t need some sort of cred stack to get hired.

The OP won’t fall into that bucket for years, if ever. Think about the entry level and run of the mill, SOC guy, cyber engineer, risk and compliance guy. Where do they get started?

OP, what adjacent fields have you worked in? You likely have to start somewhere adjacent and work your way in. One typically does not just get some certs and get hired. Without some sort of background, the education you get from your certs won’t have context so you get as much out of it.

[Patricio Swayze 17058]

1 hour ago, William_Cannon said:

I agree the field is 100% what you can do. You don’t need a particular degree, certification, etc. however, you have to start somewhere before you’re part of the cream of the crop talent who doesn’t need some sort of cred stack to get hired.

The OP won’t fall into that bucket for years, if ever. Think about the entry level and run of the mill, SOC guy, cyber engineer, risk and compliance guy. Where do they get started?

OP, what adjacent fields have you worked in? You likely have to start somewhere adjacent and work your way in. One typically does not just get some certs and get hired. Without some sort of background, the education you get from your certs won’t have context so you get as much out of it.

Absolutely no experience in an adjacent field.  Maybe I didn't explain in the OP, but I basically started to explore the idea because a friend who works for a company in Austin said they are looking to hire nearly 100 analysts.  He went to a guy in the department and he suggested those two certs.  I wasn't part of the conversation, so I am not sure if the right questions were even asked.  That is why I came to y'all, I knew people here wouldn't sugar coat anything.

Taking a 20% cut in pay was attractive, as was the idea of getting out of oil and gas.  But obviously, that was wishful thinking.  At 44 I feel like I am basically stuck in this industry, or something adjacent.

[Handcruser 2805]

Absolutely no experience in an adjacent field.  Maybe I didn't explain in the OP, but I basically started to explore the idea because a friend who works for a company in Austin said they are looking to hire nearly 100 analysts.  He went to a guy in the department and he suggested those two certs.  I wasn't part of the conversation, so I am not sure if the right questions were even asked.  That is why I came to y'all, I knew people here wouldn't sugar coat anything.
Taking a 20% cut in pay was attractive, as was the idea of getting out of oil and gas.  But obviously, that was wishful thinking.  At 44 I feel like I am basically stuck in this industry, or something adjacent.

What did you do in oil and gas? Specifically.

[Patricio Swayze 17058]

What did you do in oil and gas? Specifically.

I’m a project planner. That is one of three disciplines within Project Controls. Day in and day out working in Primavera building, maintaining, updating schedules and creating reports for upper management. Real rocket surgery.

[Updawg 2266]

Can you get a PMP cert? That would be very flexible

[Both Tacos 1806]

I’m a project planner. That is one of three disciplines within Project Controls. Day in and day out working in Primavera building, maintaining, updating schedules and creating reports for upper management. Real rocket surgery.

I would think project planner could move into many industries under operations.

[Patricio Swayze 17058]

Can you get a PMP cert? That would be very flexible

I can. Just never seemed to need it before. Then their was personal bias, most people I know with PMPs are incompetent. Not all, but definitely a majority.

But your suggestion is well founded.

[Updawg 2266]

I can. Just never seemed to need it before. Then their was personal bias, most people I know with PMPs are incompetent. Not all, but definitely a majority.

But your suggestion is well founded.

Do that instead of trying to go straight into cyber.

[Nice Guy Eddie 13515]

8 hours ago, Patricio Swayze said:

I can. Just never seemed to need it before. Then their was personal bias, most people I know with PMPs are incompetent. Not all, but definitely a majority.

But your suggestion is well founded.

Like discussed with other certs, having it doesn't make you good or bad at your job. But when you run across a hiring manager with a cert, they will want you to have it. At a minimum, I've never seen someone with a cert denied a job because they had the cert. Having a PMP got me a well paying job in Big Oil. Or at least it got me an interview with the hiring manager, and I took it from there.

Do I use my PMP cert? Nope. Does my current job care that I have it? Nope. But previous ones did.

 

[Celery Man 20962]

Realizing that we're off topic and getting into the "providing information that nobody asked for", on the PMP and cert topic, a CSM cert is very quick and easy. It's been a minute since I've had to do defensive driving, but it was like that - a couple days in front of a computer as someone goes through materials, some break out sessions talking about vanilla concepts, and then an open book test that everyone actually just took together on a zoom call. IIRC a PMP you're supposed to be able to demonstrate that you have however many hundred hours working in that capacity. The only hurdle for CSM is coughing up however much dough for the course and being able to fog a mirror. I went and paid for that cert just before I got laid off in May - as someone who has worked as an IT ops lacky, scrum master, devops engineering manager, product owner, and technical program manager, the course was somewhat useful as a "here's the vanilla version of this stuff rather than how it has been done in my org" recalibration. If I was new to agile/scrum, it would be a useful introduction and from there you can go down a youtube rabbit hole to fill your head with things that can make you sound competent and thoughtful in interviews.

If you are at all interested in tech roles and have experience in project management, both PMP and CSM would help with your resume batting average for those types of roles.  Current boss doesn't remember or care, I just confirmed with the hiring specialist who first contacted me that it was a factor in pulling mine from the stack. Also if you are employed and your employer asks you to get a cert or offers to pay for a cert, take it because it sucks ass paying for that shit to *maybe* help you replace your income. I too favor actual experience and competence to cert ownership, but I wish I had picked up those free fucking certifications.

Other things I hate are writing resumes, optimizing them for resume scanning, and doing similar shit on LinkedIn. I did find that to be maybe the most useful thing provided by the outplacement services I received post layoff, and noticed an uptick in being bugged by recruiters/maybe an uptick in interview requests when I shat buzzwords throughout my profile and resume. Please feel free to drop me a PM if I can help at all in that respect or if you want to connect or whatever.

[Nice Guy Eddie 13515]

33 minutes ago, Celery Man said:

Realizing that we're off topic and getting into the "providing information that nobody asked for", on the PMP and cert topic, a CSM cert is very quick and easy. It's been a minute since I've had to do defensive driving, but it was like that - a couple days in front of a computer as someone goes through materials, some break out sessions talking about vanilla concepts, and then an open book test that everyone actually just took together on a zoom call. IIRC a PMP you're supposed to be able to demonstrate that you have however many hundred hours working in that capacity. The only hurdle for CSM is coughing up however much dough for the course and being able to fog a mirror. I went and paid for that cert just before I got laid off in May - as someone who has worked as an IT ops lacky, scrum master, devops engineering manager, product owner, and technical program manager, the course was somewhat useful as a "here's the vanilla version of this stuff rather than how it has been done in my org" recalibration. If I was new to agile/scrum, it would be a useful introduction and from there you can go down a youtube rabbit hole to fill your head with things that can make you sound competent and thoughtful in interviews.

If you are at all interested in tech roles and have experience in project management, both PMP and CSM would help with your resume batting average for those types of roles.  Current boss doesn't remember or care, I just confirmed with the hiring specialist who first contacted me that it was a factor in pulling mine from the stack. Also if you are employed and your employer asks you to get a cert or offers to pay for a cert, take it because it sucks ass paying for that shit to *maybe* help you replace your income. I too favor actual experience and competence to cert ownership, but I wish I had picked up those free fucking certifications.

Other things I hate are writing resumes, optimizing them for resume scanning, and doing similar shit on LinkedIn. I did find that to be maybe the most useful thing provided by the outplacement services I received post layoff, and noticed an uptick in being bugged by recruiters/maybe an uptick in interview requests when I shat buzzwords throughout my profile and resume. Please feel free to drop me a PM if I can help at all in that respect or if you want to connect or whatever.

Getting the PMP was actually a difficult process. While it wasn't anywhere as long of a process, I found the PMP to be more painful than getting a master's degree.  It's a pain to document your project mgr experience (isn't it 2000-3000 hours of experience?) and hope you don't get hit with the random audit. The exam is also very theoretical in regards to being a PM and not just how to do the job. You have to put aside your experience and go by the book even if your experience says the book isn't right for your industry. 

When someone states that having a PMP doesn't mean you can do the PM job, the reply is that no one claimed it did. Going to law school doesn't mean you're ready to argue in front of the supreme court.  An MBA doesn't mean you are a good manager.  And an MD doesn't make you an experienced doctor. The pmp and other certs are just one tool or understanding that you have some knowledge. If anything, I find the on-going PMP education requirements to be the most valuable. To meet that requirement, I listen to podcasts that do make me think more about PM or just management in general.

[Celery Man 20962]

Yeah, I looked at getting a pmp but is genuinely a much bigger lift by several orders of magnitude. I think I could have justified the requirement, but it’s a whole thing.

[William_Cannon 86]

I’m a project planner. That is one of three disciplines within Project Controls. Day in and day out working in Primavera building, maintaining, updating schedules and creating reports for upper management. Real rocket surgery.

If you’re a PM and want to get into cyber, then program or project manager is a good toehold into the field. IT compliance also shares many soft skills that are required in project management, such as attention to detail. You will get the exposure and in parallel be able work on some certs. If you want to get technical, it will need to be full immersion for you. ...Books, podcasts, setting up a small lab at home to help ramp.


Most jobs within cyber are technical and that’s why several transition from programmers, network engineers, systems administrators, etc. It is an extremely steep learning curve without an applicable technical background. It’s always a very broad field too - so usually you have to specialize. If you work for a small company specializing can be a luxury and it’s trial by fire and learn as you go.

This field has a 1% unemployment rate, largely due to an extremely high burnout rate, especially in incident response. You’re always under budgeted compared to the adversary, under staffed, under tooled. If there is a breach at your company, it could mean that they clean house of all security personnel regardless of who is at fault. it’s foolish but it does happen. With that said it does have a low unemployment rate, so rebounding should be easier.

You have to constantly think like an attacker, and pay attention to all the evil shit attackers are doing. That can be disheartening at times so you have to have grit.

You have to have thick skin. You will make enemies with: new policies and capabilities you roll out, measures you take during an incident, etc. You will cause outages with deployments at some point in your career no matter how much you test because shit happens.

So you have to have passion for the work. You have to want to do good, make the world a safer place so to speak. If that sounds like you, see my first paragraph for advice. If that does not sound like it’s for you, get your PMP. You can’t go wrong with your PMP. It’s highly valued and transferable from industry to industry.