Career Hacking Village - From Barista to Cyber Security Pro, Breaking the Entry Level Barrier
Miller, Alyssa
If you're a barista that has never worked in a tech job, how do you land a role in security? What if I told you there are skills you have that apply directly to roles in security. In this session we're going to get into some real talk about landing your first security gig. We will analyze the challenges that aspiring security professionals need to overcome in order to find their way into an entry level position. We'll look at the issues of job descriptions, certifications, degrees, and other job search related challenges. We'll analyze data from a recent primary research to better understand how education, certifications, mentoring, and other characteristics impact the job search. Finally we'll use that information to share tangible real strategies you can use to overcome those hiring obstacles.
 Welcome back to Career Hacking Village, Hacking Career Village, whatever as many of you know I haven't had a lot of coffee yet today and it just doesn't seem like a hacker con without a shot at tequila so maybe I'll go do that. In the meantime, a lot of people in our community are frustrated with figuring out how do they go from one job that is non-tech, non-security related into being a security pro. And I'm so thankful that Alyssa Miller decided to tackle this topic and bring to us her insight, her wisdom and her shared strategies on how we could be successful. Alyssa? Awesome. Well thank you Kathleen and hey everybody from Def Con. God, what a weird Def Con this is this year. Just seeing all my buds, seeing all my hacker fam but here we are. And as Kathleen mentioned, you know I think we're all kind of familiar with the struggles of trying to find jobs in cybersecurity especially if you're new and trying to make that transition from one industry into the security industry and it's something that's very near and dear to my heart. So today I really wanted to go through some strategies with you. Let's talk a little bit about some of the problems that are out there and how we can tackle them. How people who are trying to find that first job in cybersecurity can really jump in and overcome some of those obstacles that unfortunately exist in the industry today. So to get things started, let me just share a little bit about myself first of all for those of you that don't know me. My name is Alyssa Miller and I'm a hacker and a researcher first and foremost. I've been hacking all my life, bought my first computer when I was 12, did some things of questionable legality with some online services and it's kind of been that way ever since. You know I taught myself how to program, I taught myself about modem communications and sort of dug in and later on in life became a developer and finally jumped into the security industry as a pentester. So I've been doing this pretty much my whole life. It's really my mindset is that I love tearing things apart, figuring out how they work, I like to break stuff and I like to make it work better. So that career of mine has led me to where I'm at right now which is a security advocate for a company called Sneak. Just means basically that my job is to get out in the security community and talk about topics that are important to us in security and how that ties in organizationally like DevSecOps and things like that. But part of my career journey has really centered on the fact that I've been a security leader, in other words a manager, a hiring manager for 12 of the 15 years that I've been in security. It didn't take long after I took over that first penetration testing role that was leading that whole team and the vulnerability management program for a huge, huge organization. And so this is a space that I've worked in a lot. I have built a number of different consulting teams from the ground up where there was nothing that existed or a very skeleton crew and it needed to be grown quickly. And I've had a lot of success with that but it's enabled me to see a lot of the struggles that people deal with from a job search perspective. And indeed it's given me the perspective too of what are hiring managers looking for. A lot of times hiring managers have their own frustrations. I've had to work with recruiters and headhunters and job search systems and so forth and we'll talk about all of that. And finally about me, I'm also the co-host of a podcast called The Uncommon Journey. And I bring this up because it's on this podcast that we focus on something that's really important to understand in cybersecurity. And that is that every one of us has a very unique and very different story about how we got here. I always tell this story. I started off as a pre-med major. I know other people in this industry who were wrestlers. I know people who worked in sanitation. I know people who were actors and did drama. And all of these people somehow ended up in the same place because they had an interest in a passion for security. So it's a great podcast. Check it out. And I can't importantly understand that concept that no matter where you're coming from, there's a place for you here. So I want to start off a little bit of a story. And the story goes back to the title of this talk being about from a barista to a security pro. So some time ago I was having a conversation with one of my colleagues. And he was lamenting the fact that he was hiring for some positions and he was having trouble getting qualified candidates. And these were entry level positions in the SOC, so the Security Operations Center. And along this conversation at one point, he brought up the fact that he had somebody who was a seven year barista. Had been working for Starbucks for the last seven years. And he was frustrated. Didn't think that they had any place applying for a cybersecurity role because they hadn't worked in tech before. So I started to question him about that. And I asked, okay, you know, well, what qualifications do they have? Well, they had gone and they had gotten a computer science degree and they had achieved their security plus certification. I think he might have mentioned they were also working on a CEH or something like that. And so I started to ask him. I said, did you think about what it is that a barista does on a daily basis and how some of those skills might be really valuable to you in a SOC environment? And I started to go through them. And we're going to talk about that more a little bit down the ways in this talk today. But I really started to, we dug into this and by the end of it, he started to realize that you know what? This barista might actually have some really good skills and might be the kind of person that they can build. So the point of this being, there's always that path in. Sometimes it's not so obvious. And since hiring managers, recruiters, job search systems may not always see those connections, it's up to us as job seekers to help people see what those connections are and justify why it is that we're coming to this industry to start a career and why it is that you want us to be your next hire. So we're going to talk all about that. But first, let's just start off with the state of where the industry is today. If you're looking to get into cybersecurity, chances are you've once or twice before heard this mantra that there's a talent shortage in security. There are studies. There are surveys. There are articles galore that speak to this every single day. If you go through any news sites related to cybersecurity or related to tech, chances are somewhere over the past year, you're going to find that they had some article that talked about the challenges of this so-called talent shortage that exists in cybersecurity. Now you see some things up here. For instance, the great cybersecurity talent shortage continues. And it's blown up really big, but the question always comes back to me. I start to wonder, I hear from a lot of people who are trying to find roles in cybersecurity and are unable to find them. And I hear from people who are experienced and who are trying to find new jobs and are having trouble. So you're telling me there's a talent shortage yet I'm hearing from all these people who are having trouble finding jobs. So what's the reality? And that's something that was, I really wanted to start to try to find some answers to. So at the very beginning of this year, I made the decision to do some research. And it's related to a book that I'm also writing. In fact, a lot of the stuff you're going to see in this talk today comes from this book that I'm currently working on. But one of the things I did was I launched a pair of surveys. One survey was targeted at people who had never worked in cybersecurity before and wanted to get that first job in security. The other survey was targeted at people who are working in security and already have some experience. I got over 1,500 responses. It was a very successful survey. But one of the questions I asked people, because I wanted to really understand this talent shortage in particular, I simply asked those entry-level folks, people who had never had a job in security before. If you're searching for a job, how long have you been searching? Simple question. And the results are what surprised me. We're talking about a talent shortage where employers are desperate to find people to fill these jobs they have open. Yet as we look at these numbers, I can see close to three quarters of these people have been searching for three months or longer to find a job. Over 32% of them have been searching for seven months or more. That's a long time to be out on the job market when you're looking for that first job. So if we have such a talent shortage, how come all these people are having such a hard time finding jobs? This is something I really want to get to the bottom of. So you might look at this and you might say, well, yeah, that's probably because they're entry-level and they don't have any experience. And a lot of these jobs in security, well, they're looking for experienced people. And you're not wrong about that. You wouldn't be wrong to think that. And in fact, when I asked the same exact question of experienced people who said they were already looking or said they were currently looking for a job, the numbers changed a little bit. But they still didn't change a lot. You see, yeah, I went up to 46% that are less than two months in the job market. And that's pretty good. And that's what we'd expect to see, people with experience, there's high demand, they're finding jobs quickly. But what about the other 54% or 53.5%? They're still taking three months or longer to find a new job? That's a long time. In almost a quarter of them, it's taking over seven months. So we see the same issues here, whether you're entry-level or whether you're experienced. So if there's this talent shortage, we have this high demand, four million jobs is one of the quotes you'll see mentioned recently. Over four million jobs are going to be left unfilled this year. Of course, some of those numbers came up before COVID. So we'll see how that adjusts as people have adjusted their hiring practices. But that's a significant number to say that we've got these four million positions, but these experienced people can sit in the job market for seven months or more. So all right, is it a problem maybe with the applicants? So in that same survey, I asked the people who were hiring managers, I asked them, hey, are you trying to hire for a cybersecurity position? And there were a good number of them that came back and said, yes, indeed, they were trying to hire for cybersecurity as well. And so I asked them, all right, well, what's the biggest challenge that you're encountering when hiring cybersecurity candidates? The number one was unqualified applicants. And this gets me thinking. That works maybe when we're talking about entry-level people, but we're seeing all of these people with experience, with degrees, with certifications, everything else, how are we finding so many that are unqualified for the positions they're applying for? The second one is kind of telling. And this is where we're going to start to dive in more. The second most common answer was struggles with job descriptions. Hiring managers, recruiters, they work together to put together these job descriptions. But it's not an easy job. And indeed, figuring out a way that we can word a job description that accurately captures the things that are important to us as a hiring manager, also are compliant with all of the employment laws and everything else that we have to worry about. This is actually a lot of heavy lifting, and it's not easy to do. And so it's not really a surprise to me that I see this up there. Then we see lack of applicants as number three. And now I'm scratching my head again. Because how are we running into so many people who say they're in the job market for this extended period of time, but you're telling me you have a lack of applicants to your role? Well, how's that happening? So we're going to explore those, because I think those latter two in particular job descriptions and the lack of applicants, they're actually really tightly related. So let's look at job descriptions for a minute. Because what I'm going to tell you is that one of the core problems, when I look at why we're struggling to fill roles in cybersecurity, it comes down to that job description. So as a new security person, a new person looking to start that career in cybersecurity, you might be thinking, hey, I want to start my job as an intern. I want to look for an intern role, especially if you're coming out of college, or maybe you're wrapping up your degree, and you're thinking in terms of intern positions. Now if any of you follow me on Twitter, you've seen me throw out from time to time examples of bad job descriptions. Well, here's the job description from this information security intern position that was posted just a few weeks ago, right off the top, a bachelor's degree in information technology or a technical discipline. So this is an internship that immediately want you to have your, they want you to have a degree already. So there's no flexibility here to say, you know, have other experience that maybe plays in instead and can replace that particular role. The next one is what really trips me out. This is something that you see is really common, certified in one or more of the following. You're talking about an intern and yet they're expecting them to have a certification. And if you look, you see CISSP is the first one. Anyone who knows anything about the CISSP knows that there's a minimum number of years of job experience that you have to have to get a CISSP. So how can any organization expect an intern to have a CISSP? This is simply not realistic. And then the last circle there, this is the one that set me off and resulted in a really long Twitter thread that ended up really kind of blowing up on Twitter for a few days, a minimum of seven years experience working in information technology security. We're talking about an intern, an intern role. These are the ones that you use to bring people out of college and into the workforce and they want you to have seven years of experience. This is the landscape you all are trying to conquer. So if you think you've got some, some key obstacles in your way, clearly you do, but it gets worse. Now here's one for, remember I talked about these experienced people. Here's one for an information security architect. And yes, I've, I've protected the guilty here. I'm not going to name and shame who this is. But take a look at this job description. So they start off with all the usual stuff, talking about their company and their great culture and how wonderful they are. And then they start to describe the role. And you can see here's three bullet points. Okay, that's great. It doesn't end there. This continues. This is the job role. This is what they're telling you, you're going to do day to day. Now I've cut it off here. There's actually four more bullets that follow this yet. Who is this magic unicorn who's going to fill all of these responsibilities? And if you look at them, I know they're hard to read because it's really, really, really small because it was the only way I could fit it on the screen. They're talking about everything from configuring ISPs and WAFs to working in DevSecOps. This runs the gamut of everything that's in cybersecurity. But it doesn't end there. Let's go and look at their requirements for this job. So that's all of what you were going to be doing if you get the job. Here's what they expect you to have. And these aren't preferred qualifications. These are listed as requirements, required that you have every single bullet here. You wonder why this job didn't get filled. It's no surprise. So we're going to dive into this deeper. But before we do, I also want to share one more element of that survey. The last element of that survey was I asked job seekers, experienced job seekers, because I wanted to know people who've been around the block a couple of times. What do you see as your biggest struggle? And no surprise in light of everything we just saw, they come back and they say, predominantly, it's bad job descriptions. So when you have bad job descriptions like this that float throughout the industry, how can you expect people to even want to apply? And indeed, this is what happens. You have these job descriptions. Sure, some people may apply and they might be under qualified because they can't even figure out what this company is really looking for. On the other side of it, you've got people who then just don't apply. So that percentage that said that they're having trouble finding job applicants, well, yeah, no kidding. Because when you have bad job descriptions, people don't apply. So enough of talking about the problems. I didn't come here today to tell you about how bad things are. We know that. You know that if you're looking for a job. You know it's a struggle. So let's talk about how we start to overcome some of these problems. And let's start by just looking at the typical hiring process. Because especially for some of you coming in as first time job seekers, this might not just be your first time security job. This might be your first time really looking for a corporate level professional job overall. So let's just talk about this for a minute. The way it works in most organizations is really similar to what you see on this image here that I pulled from JobScan. JobScan is a company that produces one of what we call these application tracking systems or applicant tracking systems or ATS. So that's that automated system that collects all your information when you apply for a job. So usually what happens is they'll go in, they will create a job in that system. Now there's usually some stuff with approvals and things that happen before that, but a recruiter from the company is going to go and create this job. And they're going to attach to it a job description that the recruiter has likely worked with the hiring manager on. They probably have some standard job descriptions already laid out and they might work with the hiring manager to make sure that's accurate for what they're trying to hire for. And then of course they publish it to the world. They put it out on LinkedIn, they put it out on job sites, they put it on their own job career board on their website, and they hopefully start getting applicants. And they start screening and they start screening each of these applicants and over stages they eliminate them. And then finally you get to the point where they select some and they interview them and then hopefully they find the one they want to hire and they hire them. What I want to focus on here is this lower left where we see the applicant screening process. Because when I talk about how people fail to get into a cybersecurity job and how jobs fail to get filled from the hiring side, this is where the things fall apart. More than anything else, it's when we get into that screening process. So let's talk a little bit more about that process for a minute and what that looks like. In organizations where they're using an applicant tracking system, that is your first layer of filter. A lot of these systems have built in rules that immediately look at your resume and are going to identify very objective, tangible things that they can identify. And a lot of times there are algorithms built in there that will immediately, they may not actually delete you from consideration, but they rank you. They provide scoring that now the recruiters in the hiring manager are going to look at to say, hey, let's prioritize these and look at who is most qualified. So it's important that we understand that that system is a crucial aspect in how we get considered for a job when we apply. Now it goes from there and typically a recruiter or someone in human resources is going to look at that next. They're going to get the ones that are receiving that and it's their job to screen further. So they're going to look at your resume and your qualifications and if you meet at least some of them, they're probably going to get in touch with you because their job is to get in touch, talk to you and screen you and make sure that you do meet some of the just the bare qualifications for that job. They're going to make sure that some of the legal aspects of it are considered. So if you need to be, for instance, here in the US, if it requires that you're able to legally work in the US, they're going to make sure that you have whatever those legal qualifications are. They're going to talk to you about some of the base skill sets and things that they're looking for, maybe ask you a little bit about your experience. But that's their job. And what they're trying to do is they're trying to filter out those applications before they ultimately submit them to the hiring manager. So the hiring manager and potentially their team and maybe some other managers and whatnot will be involved in the last steps of that screening process. So they're the ones that are ultimately involved in some of the interviews and they're going to make that final decision on who comes in for an interview and of course who they ultimately end up hiring. So understanding this process is important because more often than not, applicants do apply for jobs. I know people who have told me they've applied for 30, 40, 50 jobs because they're just, they're not hearing back, they're not making it through. And I start to question, well, if you're applying to that many jobs, how are you not getting calls back from any of them? That seems surprising. And indeed, when you're entering this world of searching for a cybersecurity job in particular, you're on the road to frustration. For those of you coming out of school, you may have had schools that told you, hey, just get that cybersecurity degree and you're going to be all set. Or maybe you went and you got that certification and boy, they promised all these great things. Hey, if you just get this certification, everybody's going to want to hire you because 35, 40, 50% of people working in security have this certification. So if you get it, you can get a job there too, right? And then you go and you hit the job market and it doesn't happen. So let's talk about how we're going to get beyond that. How do we hack that system and make sure that you can get your next job? I'm going to tell you, it starts with you. You are the first step and you need to understand yourself. Self analysis is probably one of the most crucial aspects of getting a job in cybersecurity. I mentor a lot of people as they're searching for security jobs. And one of the first questions I'll ask them, someone will come to me, a lot of times they'll just ask, Kate, will you be my mentor? Which is a pretty vague request in general. And so I'll start to ask right away, hey, okay, what are your interests? What do you want to do in security? And the answer that I dread, but I get quite often is, well, I just want to work, I want to learn everything. I want to be in cybersecurity. Well, what do you want to do in cybersecurity? Well, I don't know. I want to learn it all. This image here is a wonderful image. I love this. Henry Jang put this together and he posted it in an article on LinkedIn. And I don't agree with all of how it's arranged. I would definitely change a lot of the aspects of it. But this gives you some idea of the amount of different opportunities, topic areas, skill sets, whatnot that exist within this thing we call cybersecurity. So to say you want to learn all of it, that's not a realistic expectation. To say to somebody, hey, I just want to learn cybersecurity, that's super broad. How do you self-analyze and get to a point where you understand what it is in cybersecurity that interests you? Now I've talked with people. Sometimes they're able to figure it out and we'll chat a little bit and we get to the root of it. Sometimes what I've encouraged people to do, go out, look at maybe five, 10 security-related blogs and news sites. Grab the first five headlines off of each one of them and put them in a list and rank them. Rank them in order of which headline seems most interesting to you. Now take the top five of those headlines and look for what's common. What are the aspects about those headlines that actually excite you? Is it because they're doing some kind of investigation, they're doing maybe digital forensics and they're investigating and you really like that idea of trying to solve a mystery? Is it because they've launched some new defense mechanism and maybe that's where you really like to sink your teeth into? Is it maybe headlines about new vulnerabilities that were discovered? And so, hey, that's certainly to tell you, I really like this idea of vulnerability research and I want to start getting into things like pen testing. This is a great way to simply narrow down your interest and actually understand what is it in security that you want to be doing because this is a huge field and it's growing every day as the digital world becomes more and more our way of life, security fits into every piece of it. Next thing you need to do is you need to be out there building your network. So you know what you want to do, start interacting with people in social media if nowhere else. If you go to conferences, I know this year it's different because we don't have the interactivity of being able to walk through hallway con like we normally do when we're at DEF CON and everywhere else and meet new people. But meet them on Twitter. Honestly, it's easier to meet them in social media first anyway and then find them at conferences later. But the key here that I see, the key mistake I see made is interact with them. Building a network isn't just going out and following a bunch of people and trying to get a bunch of people to follow you on all these different social media platforms. It's interacting with them. The wonderful thing, I love Twitter for this and there's a reason why security lives so strongly in Twitter. You can interact with anybody as long as they haven't blocked you at least so don't make them angry but you can go out there, you can find the biggest names in the industry, you can follow them and as they post things, you can respond and you can have conversations with them. Not only do you have conversations with them but you may have conversations with their other followers who've also responded. Get engaged in those active conversations, ask questions, offer your opinions, be respectful, build that community. That's how you get followers. That's how you make friends. That's how you'll start to discover not just learning opportunities but you'll start to find job opportunities. Now LinkedIn's really great if you're looking really to on a more professional level of course. Not as active from a security perspective, definitely more formalized but a great place again to start connecting with people who work for certain organizations that you want to work for. Find those people. Do a search. LinkedIn actually has a pretty decent search capability. Go look for people who work at a company that is one that you want to work for and then look for the people who are in those security roles. Yeah, it's not the greatest search in the world. It does take some learning but when you learn how to use it, you can actually effectively find these people. Add them. Add them as connections. A lot of people on LinkedIn are more than happy to add connections all the time. Unless there's something red flagged about you, I'm going to add you if you add me. Create those connections and again, now you can start interacting with those people when they post stuff. They'll start to see what you're posting as well. So post good topics, concepts, things. Be out there, be active. But this is what I mean about being interactive and building that network because now as you start to engage with these people and you build relationships, those are people that can help you find opportunities and help you land those opportunities. But now let's talk about the hiring process. So we've worked on you. We've got you ready. But now you're going to go and you're going to start putting your resume out there to the world. Let's talk about how you beat the ATS. Those applicant tracking systems, they're used to varying degrees. Different recruiters use them differently. Different companies use them differently. But there's a few things you need to remember with the ATS. Most importantly, remember, this is a machine. It's software. It might be AI based. It might use machine learning and all these buzzwords that the vendors talk about that their products do. But at the end of the day, you're talking to a machine. So let's think about some of the things that are really important there. First and foremost, when it comes to your resume, simple formatting. And there's a lot of aspects here. Use common fonts. Believe it or not, this can be an issue. Don't use wild, crazy fonts. Use ones that are common. There's no one specific that you have to use. But use ones that are typical, Calibri, Times New Roman, the ones that you typically see in documentation, other things, things that are easy to read. These are the ones that those systems can most effectively process accurately. And that's important. But let's go beyond that. Just format your resume in a way that's easy to read. I know we like to have things that stand out. And it's okay to have a separate resume that you're going to hand to people. But the one that you upload to the ATS needs to be simply formatted. Don't put pictures in there. Don't put designs in there. Lay it out, structured use bullet points, things that it will be able to easily process. The second thing, and this to me is so crucial. I cannot believe how often people miss on this. And this, I don't care if you're looking for a cybersecurity job or what kind of job. This is something you need to be aware of if you're trying to get hired. You need to be tailoring your resume to that job that you're applying to. This means for every job that you apply to, you should have a separate file. And literally if I showed you my file system where I store my resumes when I'm applying to jobs, I've got a different one for everyone. And I name them with the date and the company of who I sent it to. Why? Because I need to be looking at key words that appear in those job descriptions. What are the things that are most important to them in those job descriptions? What ranks highly in the requirements? And how can I work those terms into my resume? Not saying I have to have experience in that term if I don't have it, and we'll talk more about that in a minute. But at least make sure that you mention that keyword somewhere. Get it in there. Look for variations on that keyword as well. So if we think about penetration testing and ethical hacking, for instance, are two different variations that you might focus on. And make sure you're ticking all of those boxes. And sometimes those boxes, they can be pretty complex. They might include certifications. So I'm going to talk to you in a second about certifications. But the last thing I'm going to tell you with checking the boxes is make sure that you look at these step by step and lay them out. And know which ones that you want to have in that resume, because you need to make sure your resume touches all of those when you upload it to this system. Don't lie. Don't over exaggerate. But make sure that you check the boxes that they're asking you to check. Now, as I said, one of those boxes is often the certification. And this is another extremely common question I get from people who are looking for cybersecurity jobs. They want to know what cert to get. I love this picture. It was put together by someone on Reddit. I've got the credit down there at the bottom. These are all the cybersecurity related certifications you can get. And I said, CISSP is very commonly asked for. In fact, I did some research. I went through five different major job boards, including LinkedIn and Monster. And I looked at what are they looking for? What is the most commonly asked for certification? Bar in a way, bar none, it's the CISSP. Now I filtered out any jobs that were from the government, because the government does have actually specific requirements around why they have to have CISSP. But more often than not, people say they want a CISSP, and here's the magic words, or equivalent. You don't have to have a CISSP to get a job. Just get a cert. Now there's very few that as an entry level person you can get, but there's a couple. The one that I recommend most often to people is look at the Security Plus, because the Security Plus certification is one of the cheapest to get. It is attainable for anybody, and it covers a wide breadth of security knowledge. It doesn't hamstring you into one specific area. If you go for like a CEH, well that's very focused on ethical hacking and penetration testing. That doesn't make a lot of sense. If you look at the GAC ones, all these, the ones from Sands, well one, they're super duper expensive, and two, they're very narrowly focused as well. So get something general, something that can apply. You're not looking to say, hey, I've got this great wonderful certification. You're looking to check that box that says CISSP or equivalent. And I will tell you that having a Security Plus more often than not will be looked at as an equivalent. So you've made it past the ATS. Congratulations. The recruiter is now looking at your resume. How do I get them? How do I get them on board? Well, you've got to inspire them. You've got to inspire that recruiter who's looking at thousands maybe of resumes in a week. You've got to inspire them to take your resume and pass it on to the hiring manager. How do you do that? Step one, be memorable. And I cannot stress this enough. And this goes beyond maybe having some unique formatting about a resume that you sent to them outside of the ATS. Again, don't use crazy formatting for ATS. Do something more. Be bold. If you don't have a blog, start writing one. That way you can link to your blog and your resume. I don't care if only five people ever read your blog. The fact that you wrote content and you put it out there immediately demonstrates, hey, I'm doing something in security. It makes you memorable. Read a YouTube channel and record videos that talk about different security concepts. One of my favorite stories, and this was actually as a hiring manager, this wasn't even at a recruiter level, I interviewed a person and then she moved on and she interviewed with some of the people on my team. And she didn't like one of the answers she gave them in this technical interview. So she immediately left that after that interview, went and recorded a YouTube video where she explained the concept in detail, talked about how to remediate it and so forth. And then she emailed that video link to not only the two people she interviewed with, to me and the recruiter as well. That makes you memorable. That's something that stands out. So what I tell people, I borrow a phrase from a colleague of mine, Phil Gerbyshak, who speaks all about personal branding. What's your weird? Figure out that thing about you that makes you unique. You may not be security related at all and highlight that in your resume. Own it. Something that makes you very unique from everybody else that, hey, for me, it's the fact that I bought my first computer when I was 12 years old. I was 12 years old. I saved up money with a paper out and I bought a computer. How many people do you know that did that, especially back in the late 80s when I grew up? Yes, I'm that old. So put those unique stories out there. That's the thing that when recruiters read through that, they see that and they're like, hey, this is memorable. That's something that sticks in their head and they're like, this is someone I want to know more about and they'll get in touch with you. Link everything to those requirements. Now we talked about tailoring your resume already. This is that same thing. If you're talking to them, do the same. So you've gotten past maybe that resume. You've gotten that initial HR screening call now. Talk to them, but make sure everything that you're talking about that you somehow link it back to their requirements. And then finally, this one, I can't believe I have to tell you this, but unfortunately, as I talk to recruiters all the time, they tell me this is one of the biggest problems. Be responsive. If a recruiter contacts you and says, hey, I'd like to schedule a screening interview, respond back. Respond back as quick as you can. Now sometimes we're out on vacation. We're not checking emails. Great. But make sure you're using an email that you check often and respond to them quickly. Nothing is more frustrating for a recruiter than when they see a candidate who they really like and they want to bring them in and they try to get in touch with them and they can't get that person to return their calls or return their emails. And this is a huge problem that stands in people's way. So we can do better. Then finally, all right, so we did all that. We got through the recruiter, passed us on to the hiring manager. The hiring manager wants to know more about us. How do I win over the hiring manager? This is where things are crucial. First and foremost, this first of all is where you've got the opportunity. We're no longer talking about resume. At the point they call you in for an interview, it's not about your resume anymore. It's about you and what do you do? And in that survey, when I talked to hiring managers and the last question I asked them on the survey, the last question I asked was, what's one piece of advice you would give to people looking to get their first job in security? These single most common themes throughout all the thousand answers that I got, they all related back to passion, the vast majority. And you see some of the direct quotes here. How do you share your passion? Be excited about the things that you're talking about. If you built that blog, like I suggested, talk about it. That shows you have passion. That's something that's completely voluntary that you chose to do on your own. Or if you created a bunch of videos, that's something you chose to do on your own. If you engaged in labs and other things, that's all stuff that shows you have a passion for security. Make sure you share that when you're talking with the hiring manager. And then I'm going to share this with you. So I told you I host this podcast and one of the people we had on was Malware Jake, Jake Williams. And he shared with us something that I thought was absolutely incredible advice. Here's how you refine your resume to sell yourself. First write up a resume. Take what I've told you so far, create a resume. Then I want you to completely separately prepare a one to two minute elevator pitch. Just how are you going to sell yourself in two minutes? Tell somebody why they should hire you. What it is that you're going to do to make their business better. What it is that you're going to do to make their department stronger. Now go and find those things in your resume. If you can't find those elements in your resume, get revising. Figure out how you're going to add those elements to your resume to hit those things that are a part of what you said were most important because that's what you squeezed into that two minute elevator pitch. This is such a great idea. If you can do this with your resume, your resume is going to be so much stronger. And then now you can carry through that narrative that you told in that one to two minute elevator pitch. That becomes the theme for every interview that you have after that. Make them know why it is that they want to hire you. So let's go back to our barista then. We're going to tie things all together here now. So how do I revise that resume? Say I'm entry level. I don't have a lot of experience. Well let's understand first technical capabilities. And when I say technical capabilities, I'm talking about those things that ultimately show up as requirements. There's kind of three levels that you can have here. You can have knowledge. And knowledge is just, hey, I read a book. I did some training. I investigated research, studied this somehow. Here it is. I have knowledge of this area. Sometimes for certain things that might be all you need. But more often than not, people want you to have skill. And when I say skill, what we're referring to in skills is that you've actually taken that knowledge and applied it in some way. Maybe you did a lab. Maybe you worked in a CTF or you went to a village or some other hands-on training somewhere where you actually got to do application of that knowledge into the actual technology. You got to apply it somehow. That is a skill. That's what kind of, as you see, going from good, better, best here. So you've got knowledge and skill. The last one is experience. And this is the coup de gras. This is what employers tell us they want all the time. They want to know that you have experience. And when they say experience, they're talking about that you have some kind of formal document and examples of applying that skill in a real life, most often business scenario. So understanding, making an inventory of your capabilities technically and understanding are they knowledge? Are they skills? And are they experience and to what level of each is so crucial? This is back to working on you again and talking about how you can be better. And then finally, I want to talk about this idea of core skills. So now that you know what those capabilities are, your core skills are the transferable elements of those that you can take from one capability and apply it to any capability in any technology anywhere. So if I look at my barista, they start off with, well, they make coffee beverages. Well, really, if I break that down, here's a lot of the steps they did. They received orders. They prepared according to recipes. They delivered on the customers and they had to clean the equipment. But that's still shades of a barista. So how do I take it further? They processed multiple inputs. They translated inputs into tasks and prioritized them for maximum efficiency. And they were always focused on efficient delivery to the customer. And throughout all that, they had to plan and execute maintenance activities. These are general words that can apply to any job anywhere. And when you can now take and view your skills in that light, you can take those requirements that they're asking for, understand the core skills behind those, take your own core skills, tie them together. And now you can see how you can easily word your resume to highlight the skills and experiences that you have from your job to fit into that job that you are applying for. And this is where the rubber really meets the road. How do you take that simple role as a barista where it seems so completely unconnected? And this is literally what I told that manager when he was complaining to me. I said, didn't they absorb all of this input from all these different areas and process it? Didn't they have to focus on how they were going to arrange those and do it in an efficient manner so they could be most effective? Were they always focused on customers? And the customer was what was most important. And yet throughout all of that, they had to plan and execute maintenance activities. And you started to look at me. I said, isn't that exactly what you want your SOC analysts to be able to do? That barista would be perfectly qualified to be a SOC analyst in light of the fact that they have the other knowledge that you asked for. They may not have the experience, but they have the knowledge. So look to highlight these on your resume, in your discussions, in those interviews. As you're blogging, as you're making videos, tie these things together. And then last, I'm going to leave you with this quote from Ella Fitzgerald. Just don't give up. Whatever it is, don't give up. This is tough. I'm not going to say the security industry is perfect. We've got a lot of work to do from the industry side to make things better for those that we're trying to bring into the industry. Keep working. Use your network. Find mentors who can help you. Leverage your connections and foster those relationships because they're going to help you get there. So finally, I can be one of those people for you and I'm always happy to. Find me on social media. You've got my Twitter handle, my LinkedIn address there. You've also got the link to my website, which includes my blog and lots of other information. So please continue. Reach out to me. Reach out to others. If I can't help you, I will find somebody to connect you with or I will put the call out to the world and to my network and find you somebody who can help you with what you need. So with that, I want to say thank you so much to everybody who's attended today. Thank you, Sneak, my employer for allowing me to be here today. Thank you to DefCon and the DefCon Career Hacking Village. I'm so excited to be a part of the inaugural version of this. That is so cool. And I hope you all enjoy the rest of the conference. I know it's a weird world out there. We'll get back to the real thing soon enough, but enjoy this virtual experience and make the most of it. This is where you're going to learn so many things and I hope to see you soon. That was just absolutely, excuse me, absolutely awesome. I hope you saw me doing thumbs up and being excited. Yes, you hit so many points, 20 years in the recruitment industry and I am so glad you pointed everything out, listed some of the key things, listed a lot of the key things that job seekers really need and sort of gave a little bit of a back slap to those employers who really need to change their jobs descriptions. That's something I've been trying to do for 20 years and I think it will take all of us to do that. So, Alyssa, thank you so much for all of your great input for doing the great survey and I know that you've also made yourself available for career coaching through the village and we really appreciate that. So definitely connect with Alyssa and we will be back with another session shortly. Bye-bye. Bye. That was a blast. And.
 Welcome back to Career Hacking Village, Hacking Career Village, whatever as many of you know  I haven't had a lot of coffee yet today and it just doesn't seem like a hacker con without  a shot at tequila so maybe I'll go do that.  In the meantime, a lot of people in our community are frustrated with figuring out how do they  go from one job that is non-tech, non-security related into being a security pro.  And I'm so thankful that Alyssa Miller decided to tackle this topic and bring to us her insight,  her wisdom and her shared strategies on how we could be successful.  Alyssa?  Awesome.  Well thank you Kathleen and hey everybody from Def Con.  God, what a weird Def Con this is this year.  Just seeing all my buds, seeing all my hacker fam but here we are.  And as Kathleen mentioned, you know I think we're all kind of familiar with the struggles  of trying to find jobs in cybersecurity especially if you're new and trying to make that transition  from one industry into the security industry and it's something that's very near and dear  to my heart.  So today I really wanted to go through some strategies with you.  Let's talk a little bit about some of the problems that are out there and how we can  tackle them.  How people who are trying to find that first job in cybersecurity can really jump in and  overcome some of those obstacles that unfortunately exist in the industry today.  So to get things started, let me just share a little bit about myself first of all for  those of you that don't know me.  My name is Alyssa Miller and I'm a hacker and a researcher first and foremost.  I've been hacking all my life, bought my first computer when I was 12, did some things of  questionable legality with some online services and it's kind of been that way ever since.  You know I taught myself how to program, I taught myself about modem communications and  sort of dug in and later on in life became a developer and finally jumped into the security  industry as a pentester.  So I've been doing this pretty much my whole life.  It's really my mindset is that I love tearing things apart, figuring out how they work, I  like to break stuff and I like to make it work better.  So that career of mine has led me to where I'm at right now which is a security advocate  for a company called Sneak.  Just means basically that my job is to get out in the security community and talk about  topics that are important to us in security and how that ties in organizationally like  DevSecOps and things like that.  But part of my career journey has really centered on the fact that I've been a security leader,  in other words a manager, a hiring manager for 12 of the 15 years that I've been in security.  It didn't take long after I took over that first penetration testing role that was leading  that whole team and the vulnerability management program for a huge, huge organization.  And so this is a space that I've worked in a lot.  I have built a number of different consulting teams from the ground up where there was nothing  that existed or a very skeleton crew and it needed to be grown quickly.  And I've had a lot of success with that but it's enabled me to see a lot of the struggles  that people deal with from a job search perspective.  And indeed it's given me the perspective too of what are hiring managers looking for.  A lot of times hiring managers have their own frustrations.  I've had to work with recruiters and headhunters and job search systems and so forth and we'll  talk about all of that.  And finally about me, I'm also the co-host of a podcast called The Uncommon Journey.  And I bring this up because it's on this podcast that we focus on something that's really important  to understand in cybersecurity.  And that is that every one of us has a very unique and very different story about how  we got here.  I always tell this story.  I started off as a pre-med major.  I know other people in this industry who were wrestlers.  I know people who worked in sanitation.  I know people who were actors and did drama.  And all of these people somehow ended up in the same place because they had an interest  in a passion for security.  So it's a great podcast.  Check it out.  And I can't importantly understand that concept that no matter where you're coming from, there's  a place for you here.  So I want to start off a little bit of a story.  And the story goes back to the title of this talk being about from a barista to a security  pro.  So some time ago I was having a conversation with one of my colleagues.  And he was lamenting the fact that he was hiring for some positions and he was having  trouble getting qualified candidates.  And these were entry level positions in the SOC, so the Security Operations Center.  And along this conversation at one point, he brought up the fact that he had somebody  who was a seven year barista.  Had been working for Starbucks for the last seven years.  And he was frustrated.  Didn't think that they had any place applying for a cybersecurity role because they hadn't  worked in tech before.  So I started to question him about that.  And I asked, okay, you know, well, what qualifications do they have?  Well, they had gone and they had gotten a computer science degree and they had achieved  their security plus certification.  I think he might have mentioned they were also working on a CEH or something like that.  And so I started to ask him.  I said, did you think about what it is that a barista does on a daily basis and how some  of those skills might be really valuable to you in a SOC environment?  And I started to go through them.  And we're going to talk about that more a little bit down the ways in this talk today.  But I really started to, we dug into this and by the end of it, he started to realize  that you know what?  This barista might actually have some really good skills and might be the kind of person  that they can build.  So the point of this being, there's always that path in.  Sometimes it's not so obvious.  And since hiring managers, recruiters, job search systems may not always see those connections,  it's up to us as job seekers to help people see what those connections are and justify  why it is that we're coming to this industry to start a career and why it is that you want  us to be your next hire.  So we're going to talk all about that.  But first, let's just start off with the state of where the industry is today.  If you're looking to get into cybersecurity, chances are you've once or twice before heard  this mantra that there's a talent shortage in security.  There are studies.  There are surveys.  There are articles galore that speak to this every single day.  If you go through any news sites related to cybersecurity or related to tech, chances  are somewhere over the past year, you're going to find that they had some article that talked  about the challenges of this so-called talent shortage that exists in cybersecurity.  Now you see some things up here.  For instance, the great cybersecurity talent shortage continues.  And it's blown up really big, but the question always comes back to me.  I start to wonder, I hear from a lot of people who are trying to find roles in cybersecurity  and are unable to find them.  And I hear from people who are experienced and who are trying to find new jobs and are  having trouble.  So you're telling me there's a talent shortage yet I'm hearing from all these people who  are having trouble finding jobs.  So what's the reality?  And that's something that was, I really wanted to start to try to find some answers to.  So at the very beginning of this year, I made the decision to do some research.  And it's related to a book that I'm also writing.  In fact, a lot of the stuff you're going to see in this talk today comes from this book  that I'm currently working on.  But one of the things I did was I launched a pair of surveys.  One survey was targeted at people who had never worked in cybersecurity before and wanted  to get that first job in security.  The other survey was targeted at people who are working in security and already have some  experience.  I got over 1,500 responses.  It was a very successful survey.  But one of the questions I asked people, because I wanted to really understand this talent  shortage in particular, I simply asked those entry-level folks, people who had never had  a job in security before.  If you're searching for a job, how long have you been searching?  Simple question.  And the results are what surprised me.  We're talking about a talent shortage where employers are desperate to find people to  fill these jobs they have open.  Yet as we look at these numbers, I can see close to three quarters of these people have  been searching for three months or longer to find a job.  Over 32% of them have been searching for seven months or more.  That's a long time to be out on the job market when you're looking for that first job.  So if we have such a talent shortage, how come all these people are having such a hard time  finding jobs?  This is something I really want to get to the bottom of.  So you might look at this and you might say, well, yeah, that's probably because they're  entry-level and they don't have any experience.  And a lot of these jobs in security, well, they're looking for experienced people.  And you're not wrong about that.  You wouldn't be wrong to think that.  And in fact, when I asked the same exact question of experienced people who said they were already  looking or said they were currently looking for a job, the numbers changed a little bit.  But they still didn't change a lot.  You see, yeah, I went up to 46% that are less than two months in the job market.  And that's pretty good.  And that's what we'd expect to see, people with experience, there's high demand, they're  finding jobs quickly.  But what about the other 54% or 53.5%?  They're still taking three months or longer to find a new job?  That's a long time.  In almost a quarter of them, it's taking over seven months.  So we see the same issues here, whether you're entry-level or whether you're experienced.  So if there's this talent shortage, we have this high demand, four million jobs is one  of the quotes you'll see mentioned recently.  Over four million jobs are going to be left unfilled this year.  Of course, some of those numbers came up before COVID.  So we'll see how that adjusts as people have adjusted their hiring practices.  But that's a significant number to say that we've got these four million positions, but  these experienced people can sit in the job market for seven months or more.  So all right, is it a problem maybe with the applicants?  So in that same survey, I asked the people who were hiring managers, I asked them, hey,  are you trying to hire for a cybersecurity position?  And there were a good number of them that came back and said, yes, indeed, they were  trying to hire for cybersecurity as well.  And so I asked them, all right, well, what's the biggest challenge that you're encountering  when hiring cybersecurity candidates?  The number one was unqualified applicants.  And this gets me thinking.  That works maybe when we're talking about entry-level people, but we're seeing all of  these people with experience, with degrees, with certifications, everything else, how  are we finding so many that are unqualified for the positions they're applying for?  The second one is kind of telling.  And this is where we're going to start to dive in more.  The second most common answer was struggles with job descriptions.  Hiring managers, recruiters, they work together to put together these job descriptions.  But it's not an easy job.  And indeed, figuring out a way that we can word a job description that accurately captures  the things that are important to us as a hiring manager, also are compliant with all of the  employment laws and everything else that we have to worry about.  This is actually a lot of heavy lifting, and it's not easy to do.  And so it's not really a surprise to me that I see this up there.  Then we see lack of applicants as number three.  And now I'm scratching my head again.  Because how are we running into so many people who say they're in the job market for this  extended period of time, but you're telling me you have a lack of applicants to your role?  Well, how's that happening?  So we're going to explore those, because I think those latter two in particular job descriptions  and the lack of applicants, they're actually really tightly related.  So let's look at job descriptions for a minute.  Because what I'm going to tell you is that one of the core problems, when I look at why  we're struggling to fill roles in cybersecurity, it comes down to that job description.  So as a new security person, a new person looking to start that career in cybersecurity,  you might be thinking, hey, I want to start my job as an intern.  I want to look for an intern role, especially if you're coming out of college, or maybe  you're wrapping up your degree, and you're thinking in terms of intern positions.  Now if any of you follow me on Twitter, you've seen me throw out from time to time examples  of bad job descriptions.  Well, here's the job description from this information security intern position that  was posted just a few weeks ago, right off the top, a bachelor's degree in information  technology or a technical discipline.  So this is an internship that immediately want you to have your, they want you to have  a degree already.  So there's no flexibility here to say, you know, have other experience that maybe plays  in instead and can replace that particular role.  The next one is what really trips me out.  This is something that you see is really common, certified in one or more of the following.  You're talking about an intern and yet they're expecting them to have a certification.  And if you look, you see CISSP is the first one.  Anyone who knows anything about the CISSP knows that there's a minimum number of years  of job experience that you have to have to get a CISSP.  So how can any organization expect an intern to have a CISSP?  This is simply not realistic.  And then the last circle there, this is the one that set me off and resulted in a really  long Twitter thread that ended up really kind of blowing up on Twitter for a few days,  a minimum of seven years experience working in information technology security.  We're talking about an intern, an intern role.  These are the ones that you use to bring people out of college and into the workforce  and they want you to have seven years of experience.  This is the landscape you all are trying to conquer.  So if you think you've got some, some key obstacles in your way, clearly you do, but  it gets worse.  Now here's one for, remember I talked about these experienced people.  Here's one for an information security architect.  And yes, I've, I've protected the guilty here.  I'm not going to name and shame who this is.  But take a look at this job description.  So they start off with all the usual stuff, talking about their company and their great  culture and how wonderful they are.  And then they start to describe the role.  And you can see here's three bullet points.  Okay, that's great.  It doesn't end there.  This continues.  This is the job role.  This is what they're telling you, you're going to do day to day.  Now I've cut it off here.  There's actually four more bullets that follow this yet.  Who is this magic unicorn who's going to fill all of these responsibilities?  And if you look at them, I know they're hard to read because it's really, really, really  small because it was the only way I could fit it on the screen.  They're talking about everything from configuring ISPs and WAFs to working in DevSecOps.  This runs the gamut of everything that's in cybersecurity.  But it doesn't end there.  Let's go and look at their requirements for this job.  So that's all of what you were going to be doing if you get the job.  Here's what they expect you to have.  And these aren't preferred qualifications.  These are listed as requirements, required that you have every single bullet here.  You wonder why this job didn't get filled.  It's no surprise.  So we're going to dive into this deeper.  But before we do, I also want to share one more element of that survey.  The last element of that survey was I asked job seekers, experienced job seekers, because  I wanted to know people who've been around the block a couple of times.  What do you see as your biggest struggle?  And no surprise in light of everything we just saw, they come back and they say, predominantly,  it's bad job descriptions.  So when you have bad job descriptions like this that float throughout the industry, how  can you expect people to even want to apply?  And indeed, this is what happens.  You have these job descriptions.  Sure, some people may apply and they might be under qualified because they can't even  figure out what this company is really looking for.  On the other side of it, you've got people who then just don't apply.  So that percentage that said that they're having trouble finding job applicants, well,  yeah, no kidding.  Because when you have bad job descriptions, people don't apply.  So enough of talking about the problems.  I didn't come here today to tell you about how bad things are.  We know that.  You know that if you're looking for a job.  You know it's a struggle.  So let's talk about how we start to overcome some of these problems.  And let's start by just looking at the typical hiring process.  Because especially for some of you coming in as first time job seekers, this might not  just be your first time security job.  This might be your first time really looking for a corporate level professional job overall.  So let's just talk about this for a minute.  The way it works in most organizations is really similar to what you see on this image  here that I pulled from JobScan.  JobScan is a company that produces one of what we call these application tracking systems  or applicant tracking systems or ATS.  So that's that automated system that collects all your information when you apply for a job.  So usually what happens is they'll go in, they will create a job in that system.  Now there's usually some stuff with approvals and things that happen before that, but a  recruiter from the company is going to go and create this job.  And they're going to attach to it a job description that the recruiter has likely worked with the  hiring manager on.  They probably have some standard job descriptions already laid out and they might work with  the hiring manager to make sure that's accurate for what they're trying to hire for.  And then of course they publish it to the world.  They put it out on LinkedIn, they put it out on job sites, they put it on their own job  career board on their website, and they hopefully start getting applicants.  And they start screening and they start screening each of these applicants and over stages they  eliminate them.  And then finally you get to the point where they select some and they interview them and  then hopefully they find the one they want to hire and they hire them.  What I want to focus on here is this lower left where we see the applicant screening  process.  Because when I talk about how people fail to get into a cybersecurity job and how jobs  fail to get filled from the hiring side, this is where the things fall apart.  More than anything else, it's when we get into that screening process.  So let's talk a little bit more about that process for a minute and what that looks like.  In organizations where they're using an applicant tracking system, that is your first layer of  filter.  A lot of these systems have built in rules that immediately look at your resume and are  going to identify very objective, tangible things that they can identify.  And a lot of times there are algorithms built in there that will immediately, they may not  actually delete you from consideration, but they rank you.  They provide scoring that now the recruiters in the hiring manager are going to look at  to say, hey, let's prioritize these and look at who is most qualified.  So it's important that we understand that that system is a crucial aspect in how we  get considered for a job when we apply.  Now it goes from there and typically a recruiter or someone in human resources is going to  look at that next.  They're going to get the ones that are receiving that and it's their job to screen further.  So they're going to look at your resume and your qualifications and if you meet at least  some of them, they're probably going to get in touch with you because their job is to  get in touch, talk to you and screen you and make sure that you do meet some of the just  the bare qualifications for that job.  They're going to make sure that some of the legal aspects of it are considered.  So if you need to be, for instance, here in the US, if it requires that you're able to  legally work in the US, they're going to make sure that you have whatever those legal qualifications  are.  They're going to talk to you about some of the base skill sets and things that they're  looking for, maybe ask you a little bit about your experience.  But that's their job.  And what they're trying to do is they're trying to filter out those applications before they  ultimately submit them to the hiring manager.  So the hiring manager and potentially their team and maybe some other managers and whatnot  will be involved in the last steps of that screening process.  So they're the ones that are ultimately involved in some of the interviews and they're going  to make that final decision on who comes in for an interview and of course who they ultimately  end up hiring.  So understanding this process is important because more often than not, applicants do  apply for jobs.  I know people who have told me they've applied for 30, 40, 50 jobs because they're just,  they're not hearing back, they're not making it through.  And I start to question, well, if you're applying to that many jobs, how are you not getting  calls back from any of them?  That seems surprising.  And indeed, when you're entering this world of searching for a cybersecurity job in particular,  you're on the road to frustration.  For those of you coming out of school, you may have had schools that told you, hey, just  get that cybersecurity degree and you're going to be all set.  Or maybe you went and you got that certification and boy, they promised all these great things.  Hey, if you just get this certification, everybody's going to want to hire you because  35, 40, 50% of people working in security have this certification.  So if you get it, you can get a job there too, right?  And then you go and you hit the job market and it doesn't happen.  So let's talk about how we're going to get beyond that.  How do we hack that system and make sure that you can get your next job?  I'm going to tell you, it starts with you.  You are the first step and you need to understand yourself.  Self analysis is probably one of the most crucial aspects of getting a job in cybersecurity.  I mentor a lot of people as they're searching for security jobs.  And one of the first questions I'll ask them, someone will come to me, a lot of times they'll  just ask, Kate, will you be my mentor?  Which is a pretty vague request in general.  And so I'll start to ask right away, hey, okay, what are your interests?  What do you want to do in security?  And the answer that I dread, but I get quite often is, well, I just want to work, I want  to learn everything.  I want to be in cybersecurity.  Well, what do you want to do in cybersecurity?  Well, I don't know.  I want to learn it all.  This image here is a wonderful image.  I love this.  Henry Jang put this together and he posted it in an article on LinkedIn.  And I don't agree with all of how it's arranged.  I would definitely change a lot of the aspects of it.  But this gives you some idea of the amount of different opportunities, topic areas, skill  sets, whatnot that exist within this thing we call cybersecurity.  So to say you want to learn all of it, that's not a realistic expectation.  To say to somebody, hey, I just want to learn cybersecurity, that's super broad.  How do you self-analyze and get to a point where you understand what it is in cybersecurity  that interests you?  Now I've talked with people.  Sometimes they're able to figure it out and we'll chat a little bit and we get to the  root of it.  Sometimes what I've encouraged people to do, go out, look at maybe five, 10 security-related  blogs and news sites.  Grab the first five headlines off of each one of them and put them in a list and rank  them.  Rank them in order of which headline seems most interesting to you.  Now take the top five of those headlines and look for what's common.  What are the aspects about those headlines that actually excite you?  Is it because they're doing some kind of investigation, they're doing maybe digital forensics and  they're investigating and you really like that idea of trying to solve a mystery?  Is it because they've launched some new defense mechanism and maybe that's where you really  like to sink your teeth into?  Is it maybe headlines about new vulnerabilities that were discovered?  And so, hey, that's certainly to tell you, I really like this idea of vulnerability research  and I want to start getting into things like pen testing.  This is a great way to simply narrow down your interest and actually understand what  is it in security that you want to be doing because this is a huge field and it's growing  every day as the digital world becomes more and more our way of life, security fits into  every piece of it.  Next thing you need to do is you need to be out there building your network.  So you know what you want to do, start interacting with people in social media if nowhere else.  If you go to conferences, I know this year it's different because we don't have the  interactivity of being able to walk through hallway con like we normally do when we're  at DEF CON and everywhere else and meet new people.  But meet them on Twitter.  Honestly, it's easier to meet them in social media first anyway and then find them at conferences  later.  But the key here that I see, the key mistake I see made is interact with them.  Building a network isn't just going out and following a bunch of people and trying to  get a bunch of people to follow you on all these different social media platforms.  It's interacting with them.  The wonderful thing, I love Twitter for this and there's a reason why security lives so  strongly in Twitter.  You can interact with anybody as long as they haven't blocked you at least so don't make  them angry but you can go out there, you can find the biggest names in the industry, you  can follow them and as they post things, you can respond and you can have conversations  with them.  Not only do you have conversations with them but you may have conversations with their  other followers who've also responded.  Get engaged in those active conversations, ask questions, offer your opinions, be respectful,  build that community.  That's how you get followers.  That's how you make friends.  That's how you'll start to discover not just learning opportunities but you'll start to  find job opportunities.  Now LinkedIn's really great if you're looking really to on a more professional level of  course.  Not as active from a security perspective, definitely more formalized but a great place  again to start connecting with people who work for certain organizations that you want  to work for.  Find those people.  Do a search.  LinkedIn actually has a pretty decent search capability.  Go look for people who work at a company that is one that you want to work for and then  look for the people who are in those security roles.  Yeah, it's not the greatest search in the world.  It does take some learning but when you learn how to use it, you can actually effectively  find these people.  Add them.  Add them as connections.  A lot of people on LinkedIn are more than happy to add connections all the time.  Unless there's something red flagged about you, I'm going to add you if you add me.  Create those connections and again, now you can start interacting with those people when  they post stuff.  They'll start to see what you're posting as well.  So post good topics, concepts, things.  Be out there, be active.  But this is what I mean about being interactive and building that network because now as you  start to engage with these people and you build relationships, those are people that  can help you find opportunities and help you land those opportunities.  But now let's talk about the hiring process.  So we've worked on you.  We've got you ready.  But now you're going to go and you're going to start putting your resume out there to  the world.  Let's talk about how you beat the ATS.  Those applicant tracking systems, they're used to varying degrees.  Different recruiters use them differently.  Different companies use them differently.  But there's a few things you need to remember with the ATS.  Most importantly, remember, this is a machine.  It's software.  It might be AI based.  It might use machine learning and all these buzzwords that the vendors talk about that their  products do.  But at the end of the day, you're talking to a machine.  So let's think about some of the things that are really important there.  First and foremost, when it comes to your resume, simple formatting.  And there's a lot of aspects here.  Use common fonts.  Believe it or not, this can be an issue.  Don't use wild, crazy fonts.  Use ones that are common.  There's no one specific that you have to use.  But use ones that are typical, Calibri, Times New Roman, the ones that you typically see  in documentation, other things, things that are easy to read.  These are the ones that those systems can most effectively process accurately.  And that's important.  But let's go beyond that.  Just format your resume in a way that's easy to read.  I know we like to have things that stand out.  And it's okay to have a separate resume that you're going to hand to people.  But the one that you upload to the ATS needs to be simply formatted.  Don't put pictures in there.  Don't put designs in there.  Lay it out, structured use bullet points, things that it will be able to easily process.  The second thing, and this to me is so crucial.  I cannot believe how often people miss on this.  And this, I don't care if you're looking for a cybersecurity job or what kind of job.  This is something you need to be aware of if you're trying to get hired.  You need to be tailoring your resume to that job that you're applying to.  This means for every job that you apply to, you should have a separate file.  And literally if I showed you my file system where I store my resumes when I'm applying  to jobs, I've got a different one for everyone.  And I name them with the date and the company of who I sent it to.  Why?  Because I need to be looking at key words that appear in those job descriptions.  What are the things that are most important to them in those job descriptions?  What ranks highly in the requirements?  And how can I work those terms into my resume?  Not saying I have to have experience in that term if I don't have it, and we'll talk more  about that in a minute.  But at least make sure that you mention that keyword somewhere.  Get it in there.  Look for variations on that keyword as well.  So if we think about penetration testing and ethical hacking, for instance, are two different  variations that you might focus on.  And make sure you're ticking all of those boxes.  And sometimes those boxes, they can be pretty complex.  They might include certifications.  So I'm going to talk to you in a second about certifications.  But the last thing I'm going to tell you with checking the boxes is make sure that you look  at these step by step and lay them out.  And know which ones that you want to have in that resume, because you need to make sure  your resume touches all of those when you upload it to this system.  Don't lie.  Don't over exaggerate.  But make sure that you check the boxes that they're asking you to check.  Now, as I said, one of those boxes is often the certification.  And this is another extremely common question I get from people who are looking for cybersecurity  jobs.  They want to know what cert to get.  I love this picture.  It was put together by someone on Reddit.  I've got the credit down there at the bottom.  These are all the cybersecurity related certifications you can get.  And I said, CISSP is very commonly asked for.  In fact, I did some research.  I went through five different major job boards, including LinkedIn and Monster.  And I looked at what are they looking for?  What is the most commonly asked for certification?  Bar in a way, bar none, it's the CISSP.  Now I filtered out any jobs that were from the government, because the government does  have actually specific requirements around why they have to have CISSP.  But more often than not, people say they want a CISSP, and here's the magic words, or equivalent.  You don't have to have a CISSP to get a job.  Just get a cert.  Now there's very few that as an entry level person you can get, but there's a couple.  The one that I recommend most often to people is look at the Security Plus, because the  Security Plus certification is one of the cheapest to get.  It is attainable for anybody, and it covers a wide breadth of security knowledge.  It doesn't hamstring you into one specific area.  If you go for like a CEH, well that's very focused on ethical hacking and penetration  testing.  That doesn't make a lot of sense.  If you look at the GAC ones, all these, the ones from Sands, well one, they're super  duper expensive, and two, they're very narrowly focused as well.  So get something general, something that can apply.  You're not looking to say, hey, I've got this great wonderful certification.  You're looking to check that box that says CISSP or equivalent.  And I will tell you that having a Security Plus more often than not will be looked at  as an equivalent.  So you've made it past the ATS.  Congratulations.  The recruiter is now looking at your resume.  How do I get them?  How do I get them on board?  Well, you've got to inspire them.  You've got to inspire that recruiter who's looking at thousands maybe of resumes in a  week.  You've got to inspire them to take your resume and pass it on to the hiring manager.  How do you do that?  Step one, be memorable.  And I cannot stress this enough.  And this goes beyond maybe having some unique formatting about a resume that you sent to  them outside of the ATS.  Again, don't use crazy formatting for ATS.  Do something more.  Be bold.  If you don't have a blog, start writing one.  That way you can link to your blog and your resume.  I don't care if only five people ever read your blog.  The fact that you wrote content and you put it out there immediately demonstrates, hey,  I'm doing something in security.  It makes you memorable.  Read a YouTube channel and record videos that talk about different security concepts.  One of my favorite stories, and this was actually as a hiring manager, this wasn't even at a  recruiter level, I interviewed a person and then she moved on and she interviewed with  some of the people on my team.  And she didn't like one of the answers she gave them in this technical interview.  So she immediately left that after that interview, went and recorded a YouTube video where she  explained the concept in detail, talked about how to remediate it and so forth.  And then she emailed that video link to not only the two people she interviewed with,  to me and the recruiter as well.  That makes you memorable.  That's something that stands out.  So what I tell people, I borrow a phrase from a colleague of mine, Phil Gerbyshak, who speaks  all about personal branding.  What's your weird?  Figure out that thing about you that makes you unique.  You may not be security related at all and highlight that in your resume.  Own it.  Something that makes you very unique from everybody else that, hey, for me, it's the  fact that I bought my first computer when I was 12 years old.  I was 12 years old.  I saved up money with a paper out and I bought a computer.  How many people do you know that did that, especially back in the late 80s when I grew  up?  Yes, I'm that old.  So put those unique stories out there.  That's the thing that when recruiters read through that, they see that and they're like,  hey, this is memorable.  That's something that sticks in their head and they're like, this is someone I want to  know more about and they'll get in touch with you.  Link everything to those requirements.  Now we talked about tailoring your resume already.  This is that same thing.  If you're talking to them, do the same.  So you've gotten past maybe that resume.  You've gotten that initial HR screening call now.  Talk to them, but make sure everything that you're talking about that you somehow link  it back to their requirements.  And then finally, this one, I can't believe I have to tell you this, but unfortunately,  as I talk to recruiters all the time, they tell me this is one of the biggest problems.  Be responsive.  If a recruiter contacts you and says, hey, I'd like to schedule a screening interview,  respond back.  Respond back as quick as you can.  Now sometimes we're out on vacation.  We're not checking emails.  Great.  But make sure you're using an email that you check often and respond to them quickly.  Nothing is more frustrating for a recruiter than when they see a candidate who they really  like and they want to bring them in and they try to get in touch with them and they can't  get that person to return their calls or return their emails.  And this is a huge problem that stands in people's way.  So we can do better.  Then finally, all right, so we did all that.  We got through the recruiter, passed us on to the hiring manager.  The hiring manager wants to know more about us.  How do I win over the hiring manager?  This is where things are crucial.  First and foremost, this first of all is where you've got the opportunity.  We're no longer talking about resume.  At the point they call you in for an interview, it's not about your resume anymore.  It's about you and what do you do?  And in that survey, when I talked to hiring managers and the last question I asked them  on the survey, the last question I asked was, what's one piece of advice you would give  to people looking to get their first job in security?  These single most common themes throughout all the thousand answers that I got, they all  related back to passion, the vast majority.  And you see some of the direct quotes here.  How do you share your passion?  Be excited about the things that you're talking about.  If you built that blog, like I suggested, talk about it.  That shows you have passion.  That's something that's completely voluntary that you chose to do on your own.  Or if you created a bunch of videos, that's something you chose to do on your own.  If you engaged in labs and other things, that's all stuff that shows you have a passion for  security.  Make sure you share that when you're talking with the hiring manager.  And then I'm going to share this with you.  So I told you I host this podcast and one of the people we had on was Malware Jake, Jake  Williams.  And he shared with us something that I thought was absolutely incredible advice.  Here's how you refine your resume to sell yourself.  First write up a resume.  Take what I've told you so far, create a resume.  Then I want you to completely separately prepare a one to two minute elevator pitch.  Just how are you going to sell yourself in two minutes?  Tell somebody why they should hire you.  What it is that you're going to do to make their business better.  What it is that you're going to do to make their department stronger.  Now go and find those things in your resume.  If you can't find those elements in your resume, get revising.  Figure out how you're going to add those elements to your resume to hit those things that are  a part of what you said were most important because that's what you squeezed into that  two minute elevator pitch.  This is such a great idea.  If you can do this with your resume, your resume is going to be so much stronger.  And then now you can carry through that narrative that you told in that one to two minute elevator  pitch.  That becomes the theme for every interview that you have after that.  Make them know why it is that they want to hire you.  So let's go back to our barista then.  We're going to tie things all together here now.  So how do I revise that resume?  Say I'm entry level.  I don't have a lot of experience.  Well let's understand first technical capabilities.  And when I say technical capabilities, I'm talking about those things that ultimately  show up as requirements.  There's kind of three levels that you can have here.  You can have knowledge.  And knowledge is just, hey, I read a book.  I did some training.  I investigated research, studied this somehow.  Here it is.  I have knowledge of this area.  Sometimes for certain things that might be all you need.  But more often than not, people want you to have skill.  And when I say skill, what we're referring to in skills is that you've actually taken  that knowledge and applied it in some way.  Maybe you did a lab.  Maybe you worked in a CTF or you went to a village or some other hands-on training somewhere  where you actually got to do application of that knowledge into the actual technology.  You got to apply it somehow.  That is a skill.  That's what kind of, as you see, going from good, better, best here.  So you've got knowledge and skill.  The last one is experience.  And this is the coup de gras.  This is what employers tell us they want all the time.  They want to know that you have experience.  And when they say experience, they're talking about that you have some kind of formal document  and examples of applying that skill in a real life, most often business scenario.  So understanding, making an inventory of your capabilities technically and understanding  are they knowledge?  Are they skills?  And are they experience and to what level of each is so crucial?  This is back to working on you again and talking about how you can be better.  And then finally, I want to talk about this idea of core skills.  So now that you know what those capabilities are, your core skills are the transferable  elements of those that you can take from one capability and apply it to any capability  in any technology anywhere.  So if I look at my barista, they start off with, well, they make coffee beverages.  Well, really, if I break that down, here's a lot of the steps they did.  They received orders.  They prepared according to recipes.  They delivered on the customers and they had to clean the equipment.  But that's still shades of a barista.  So how do I take it further?  They processed multiple inputs.  They translated inputs into tasks and prioritized them for maximum efficiency.  And they were always focused on efficient delivery to the customer.  And throughout all that, they had to plan and execute maintenance activities.  These are general words that can apply to any job anywhere.  And when you can now take and view your skills in that light, you can take those requirements  that they're asking for, understand the core skills behind those, take your own core skills,  tie them together.  And now you can see how you can easily word your resume to highlight the skills and experiences  that you have from your job to fit into that job that you are applying for.  And this is where the rubber really meets the road.  How do you take that simple role as a barista where it seems so completely unconnected?  And this is literally what I told that manager when he was complaining to me.  I said, didn't they absorb all of this input from all these different areas and process  it?  Didn't they have to focus on how they were going to arrange those and do it in an efficient  manner so they could be most effective?  Were they always focused on customers?  And the customer was what was most important.  And yet throughout all of that, they had to plan and execute maintenance activities.  And you started to look at me.  I said, isn't that exactly what you want your SOC analysts to be able to do?  That barista would be perfectly qualified to be a SOC analyst in light of the fact that  they have the other knowledge that you asked for.  They may not have the experience, but they have the knowledge.  So look to highlight these on your resume, in your discussions, in those interviews.  As you're blogging, as you're making videos, tie these things together.  And then last, I'm going to leave you with this quote from Ella Fitzgerald.  Just don't give up.  Whatever it is, don't give up.  This is tough.  I'm not going to say the security industry is perfect.  We've got a lot of work to do from the industry side to make things better for those that  we're trying to bring into the industry.  Keep working.  Use your network.  Find mentors who can help you.  Leverage your connections and foster those relationships because they're going to help  you get there.  So finally, I can be one of those people for you and I'm always happy to.  Find me on social media.  You've got my Twitter handle, my LinkedIn address there.  You've also got the link to my website, which includes my blog and lots of other information.  So please continue.  Reach out to me.  Reach out to others.  If I can't help you, I will find somebody to connect you with or I will put the call  out to the world and to my network and find you somebody who can help you with what you  need.  So with that, I want to say thank you so much to everybody who's attended today.  Thank you, Sneak, my employer for allowing me to be here today.  Thank you to DefCon and the DefCon Career Hacking Village.  I'm so excited to be a part of the inaugural version of this.  That is so cool.  And I hope you all enjoy the rest of the conference.  I know it's a weird world out there.  We'll get back to the real thing soon enough, but enjoy this virtual experience and make  the most of it.  This is where you're going to learn so many things and I hope to see you soon.  That was just absolutely, excuse me, absolutely awesome.  I hope you saw me doing thumbs up and being excited.  Yes, you hit so many points, 20 years in the recruitment industry and I am so glad you  pointed everything out, listed some of the key things, listed a lot of the key things  that job seekers really need and sort of gave a little bit of a back slap to those employers  who really need to change their jobs descriptions.  That's something I've been trying to do for 20 years and I think it will take all of us  to do that.  So, Alyssa, thank you so much for all of your great input for doing the great survey and  I know that you've also made yourself available for career coaching through the village and  we really appreciate that.  So definitely connect with Alyssa and we will be back with another session shortly.  Bye-bye.  Bye.  That was a blast.  And.
DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_0_95.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_96_2615.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_2616_3719.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_3720_3839.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_3840_5507.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_5508_5639.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_5640_7127.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_7128_10535.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_10536_13739.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_13740_18011.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_18012_21131.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_21132_21251.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_21252_21791.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_21792_24563.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_24564_25523.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_25524_26183.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_26184_26903.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_26904_28799.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_28800_31583.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_31584_35507.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_35508_36743.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_36744_40847.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_40848_40895.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_40896_45023.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_45024_45575.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_45576_46079.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_46080_47615.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_47616_48623.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_48624_49979.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_49980_52691.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_52692_52871.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_52872_53255.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_53256_53507.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_53508_54287.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_54288_54395.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_54396_55007.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_55008_55067.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_55068_55127.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_55128_55175.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_55176_55499.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_55500_56843.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_56844_56975.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_56976_57023.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_57024_58031.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_58032_58355.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_58356_58403.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_58404_60047.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_60048_60431.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_60432_62015.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_62016_62075.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_62076_64763.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_64764_65027.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_65028_65159.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_65160_65423.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_65424_65543.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_65544_68567.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_68568_69311.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_69312_70019.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_70020_72287.png DEF_CON_Safe_Mode_Career_Hacking_Village_-_Alyssa__dGpHdExqu0k_72288_72365.png
Welcome back to Career Hacking Village, Hacking Career Village, whatever as many of you know I haven't had a lot of coffee yet today and it just doesn't seem like a hacker con without a shot at tequila so maybe I'll go do that. In the meantime, a lot of people in our community are frustrated with figuring out how do they go from one job that is non-tech, non-security related into being a security pro. And I'm so thankful that Alyssa Miller decided to tackle this topic and bring to us her insight, her wisdom and her shared strategies on how we could be successful. Alyssa? Awesome. Well thank you Kathleen and hey everybody from Def Con. God, what a weird Def Con this is this year. Just seeing all my buds, seeing all my hacker fam but here we are. And as Kathleen mentioned, you know I think we're all kind of familiar with the struggles of trying to find jobs in cybersecurity especially if you're new and trying to make that transition from one industry into the security industry and it's something that's very near and dear to my heart. So today I really wanted to go through some strategies with you. Let's talk a little bit about some of the problems that are out there and how we can tackle them. How people who are trying to find that first job in cybersecurity can really jump in and overcome some of those obstacles that unfortunately exist in the industry today. So to get things started, let me just share a little bit about myself first of all for those of you that don't know me. My name is Alyssa Miller and I'm a hacker and a researcher first and foremost. I've been hacking all my life, bought my first computer when I was 12, did some things of questionable legality with some online services and it's kind of been that way ever since. You know I taught myself how to program, I taught myself about modem communications and sort of dug in and later on in life became a developer and finally jumped into the security industry as a pentester. So I've been doing this pretty much my whole life. It's really my mindset is that I love tearing things apart, figuring out how they work, I like to break stuff and I like to make it work better. So that career of mine has led me to where I'm at right now which is a security advocate for a company called Sneak. Just means basically that my job is to get out in the security community and talk about topics that are important to us in security and how that ties in organizationally like DevSecOps and things like that. But part of my career journey has really centered on the fact that I've been a security leader, in other words a manager, a hiring manager for 12 of the 15 years that I've been in security. It didn't take long after I took over that first penetration testing role that was leading that whole team and the vulnerability management program for a huge, huge organization. And so this is a space that I've worked in a lot. I have built a number of different consulting teams from the ground up where there was nothing that existed or a very skeleton crew and it needed to be grown quickly. And I've had a lot of success with that but it's enabled me to see a lot of the struggles that people deal with from a job search perspective. And indeed it's given me the perspective too of what are hiring managers looking for. A lot of times hiring managers have their own frustrations. I've had to work with recruiters and headhunters and job search systems and so forth and we'll talk about all of that. And finally about me, I'm also the co-host of a podcast called The Uncommon Journey. And I bring this up because it's on this podcast that we focus on something that's really important to understand in cybersecurity. And that is that every one of us has a very unique and very different story about how we got here. I always tell this story. I started off as a pre-med major. I know other people in this industry who were wrestlers. I know people who worked in sanitation. I know people who were actors and did drama. And all of these people somehow ended up in the same place because they had an interest in a passion for security. So it's a great podcast. Check it out. And I can't importantly understand that concept that no matter where you're coming from, there's a place for you here. So I want to start off a little bit of a story. And the story goes back to the title of this talk being about from a barista to a security pro. So some time ago I was having a conversation with one of my colleagues. And he was lamenting the fact that he was hiring for some positions and he was having trouble getting qualified candidates. And these were entry level positions in the SOC, so the Security Operations Center. And along this conversation at one point, he brought up the fact that he had somebody who was a seven year barista. Had been working for Starbucks for the last seven years. And he was frustrated. Didn't think that they had any place applying for a cybersecurity role because they hadn't worked in tech before. So I started to question him about that. And I asked, okay, you know, well, what qualifications do they have? Well, they had gone and they had gotten a computer science degree and they had achieved their security plus certification. I think he might have mentioned they were also working on a CEH or something like that. And so I started to ask him. I said, did you think about what it is that a barista does on a daily basis and how some of those skills might be really valuable to you in a SOC environment? And I started to go through them. And we're going to talk about that more a little bit down the ways in this talk today. But I really started to, we dug into this and by the end of it, he started to realize that you know what? This barista might actually have some really good skills and might be the kind of person that they can build. So the point of this being, there's always that path in. Sometimes it's not so obvious. And since hiring managers, recruiters, job search systems may not always see those connections, it's up to us as job seekers to help people see what those connections are and justify why it is that we're coming to this industry to start a career and why it is that you want us to be your next hire. So we're going to talk all about that. But first, let's just start off with the state of where the industry is today. If you're looking to get into cybersecurity, chances are you've once or twice before heard this mantra that there's a talent shortage in security. There are studies. There are surveys. There are articles galore that speak to this every single day. If you go through any news sites related to cybersecurity or related to tech, chances are somewhere over the past year, you're going to find that they had some article that talked about the challenges of this so-called talent shortage that exists in cybersecurity. Now you see some things up here. For instance, the great cybersecurity talent shortage continues. And it's blown up really big, but the question always comes back to me. I start to wonder, I hear from a lot of people who are trying to find roles in cybersecurity and are unable to find them. And I hear from people who are experienced and who are trying to find new jobs and are having trouble. So you're telling me there's a talent shortage yet I'm hearing from all these people who are having trouble finding jobs. So what's the reality? And that's something that was, I really wanted to start to try to find some answers to. So at the very beginning of this year, I made the decision to do some research. And it's related to a book that I'm also writing. In fact, a lot of the stuff you're going to see in this talk today comes from this book that I'm currently working on. But one of the things I did was I launched a pair of surveys. One survey was targeted at people who had never worked in cybersecurity before and wanted to get that first job in security. The other survey was targeted at people who are working in security and already have some experience. I got over 1,500 responses. It was a very successful survey. But one of the questions I asked people, because I wanted to really understand this talent shortage in particular, I simply asked those entry-level folks, people who had never had a job in security before. If you're searching for a job, how long have you been searching? Simple question. And the results are what surprised me. We're talking about a talent shortage where employers are desperate to find people to fill these jobs they have open. Yet as we look at these numbers, I can see close to three quarters of these people have been searching for three months or longer to find a job. Over 32% of them have been searching for seven months or more. That's a long time to be out on the job market when you're looking for that first job. So if we have such a talent shortage, how come all these people are having such a hard time finding jobs? This is something I really want to get to the bottom of. So you might look at this and you might say, well, yeah, that's probably because they're entry-level and they don't have any experience. And a lot of these jobs in security, well, they're looking for experienced people. And you're not wrong about that. You wouldn't be wrong to think that. And in fact, when I asked the same exact question of experienced people who said they were already looking or said they were currently looking for a job, the numbers changed a little bit. But they still didn't change a lot. You see, yeah, I went up to 46% that are less than two months in the job market. And that's pretty good. And that's what we'd expect to see, people with experience, there's high demand, they're finding jobs quickly. But what about the other 54% or 53.5%? They're still taking three months or longer to find a new job? That's a long time. In almost a quarter of them, it's taking over seven months. So we see the same issues here, whether you're entry-level or whether you're experienced. So if there's this talent shortage, we have this high demand, four million jobs is one of the quotes you'll see mentioned recently. Over four million jobs are going to be left unfilled this year. Of course, some of those numbers came up before COVID. So we'll see how that adjusts as people have adjusted their hiring practices. But that's a significant number to say that we've got these four million positions, but these experienced people can sit in the job market for seven months or more. So all right, is it a problem maybe with the applicants? So in that same survey, I asked the people who were hiring managers, I asked them, hey, are you trying to hire for a cybersecurity position? And there were a good number of them that came back and said, yes, indeed, they were trying to hire for cybersecurity as well. And so I asked them, all right, well, what's the biggest challenge that you're encountering when hiring cybersecurity candidates? The number one was unqualified applicants. And this gets me thinking. That works maybe when we're talking about entry-level people, but we're seeing all of these people with experience, with degrees, with certifications, everything else, how are we finding so many that are unqualified for the positions they're applying for? The second one is kind of telling. And this is where we're going to start to dive in more. The second most common answer was struggles with job descriptions. Hiring managers, recruiters, they work together to put together these job descriptions. But it's not an easy job. And indeed, figuring out a way that we can word a job description that accurately captures the things that are important to us as a hiring manager, also are compliant with all of the employment laws and everything else that we have to worry about. This is actually a lot of heavy lifting, and it's not easy to do. And so it's not really a surprise to me that I see this up there. Then we see lack of applicants as number three. And now I'm scratching my head again. Because how are we running into so many people who say they're in the job market for this extended period of time, but you're telling me you have a lack of applicants to your role? Well, how's that happening? So we're going to explore those, because I think those latter two in particular job descriptions and the lack of applicants, they're actually really tightly related. So let's look at job descriptions for a minute. Because what I'm going to tell you is that one of the core problems, when I look at why we're struggling to fill roles in cybersecurity, it comes down to that job description. So as a new security person, a new person looking to start that career in cybersecurity, you might be thinking, hey, I want to start my job as an intern. I want to look for an intern role, especially if you're coming out of college, or maybe you're wrapping up your degree, and you're thinking in terms of intern positions. Now if any of you follow me on Twitter, you've seen me throw out from time to time examples of bad job descriptions. Well, here's the job description from this information security intern position that was posted just a few weeks ago, right off the top, a bachelor's degree in information technology or a technical discipline. So this is an internship that immediately want you to have your, they want you to have a degree already. So there's no flexibility here to say, you know, have other experience that maybe plays in instead and can replace that particular role. The next one is what really trips me out. This is something that you see is really common, certified in one or more of the following. You're talking about an intern and yet they're expecting them to have a certification. And if you look, you see CISSP is the first one. Anyone who knows anything about the CISSP knows that there's a minimum number of years of job experience that you have to have to get a CISSP. So how can any organization expect an intern to have a CISSP? This is simply not realistic. And then the last circle there, this is the one that set me off and resulted in a really long Twitter thread that ended up really kind of blowing up on Twitter for a few days, a minimum of seven years experience working in information technology security. We're talking about an intern, an intern role. These are the ones that you use to bring people out of college and into the workforce and they want you to have seven years of experience. This is the landscape you all are trying to conquer. So if you think you've got some, some key obstacles in your way, clearly you do, but it gets worse. Now here's one for, remember I talked about these experienced people. Here's one for an information security architect. And yes, I've, I've protected the guilty here. I'm not going to name and shame who this is. But take a look at this job description. So they start off with all the usual stuff, talking about their company and their great culture and how wonderful they are. And then they start to describe the role. And you can see here's three bullet points. Okay, that's great. It doesn't end there. This continues. This is the job role. This is what they're telling you, you're going to do day to day. Now I've cut it off here. There's actually four more bullets that follow this yet. Who is this magic unicorn who's going to fill all of these responsibilities? And if you look at them, I know they're hard to read because it's really, really, really small because it was the only way I could fit it on the screen. They're talking about everything from configuring ISPs and WAFs to working in DevSecOps. This runs the gamut of everything that's in cybersecurity. But it doesn't end there. Let's go and look at their requirements for this job. So that's all of what you were going to be doing if you get the job. Here's what they expect you to have. And these aren't preferred qualifications. These are listed as requirements, required that you have every single bullet here. You wonder why this job didn't get filled. It's no surprise. So we're going to dive into this deeper. But before we do, I also want to share one more element of that survey. The last element of that survey was I asked job seekers, experienced job seekers, because I wanted to know people who've been around the block a couple of times. What do you see as your biggest struggle? And no surprise in light of everything we just saw, they come back and they say, predominantly, it's bad job descriptions. So when you have bad job descriptions like this that float throughout the industry, how can you expect people to even want to apply? And indeed, this is what happens. You have these job descriptions. Sure, some people may apply and they might be under qualified because they can't even figure out what this company is really looking for. On the other side of it, you've got people who then just don't apply. So that percentage that said that they're having trouble finding job applicants, well, yeah, no kidding. Because when you have bad job descriptions, people don't apply. So enough of talking about the problems. I didn't come here today to tell you about how bad things are. We know that. You know that if you're looking for a job. You know it's a struggle. So let's talk about how we start to overcome some of these problems. And let's start by just looking at the typical hiring process. Because especially for some of you coming in as first time job seekers, this might not just be your first time security job. This might be your first time really looking for a corporate level professional job overall. So let's just talk about this for a minute. The way it works in most organizations is really similar to what you see on this image here that I pulled from JobScan. JobScan is a company that produces one of what we call these application tracking systems or applicant tracking systems or ATS. So that's that automated system that collects all your information when you apply for a job. So usually what happens is they'll go in, they will create a job in that system. Now there's usually some stuff with approvals and things that happen before that, but a recruiter from the company is going to go and create this job. And they're going to attach to it a job description that the recruiter has likely worked with the hiring manager on. They probably have some standard job descriptions already laid out and they might work with the hiring manager to make sure that's accurate for what they're trying to hire for. And then of course they publish it to the world. They put it out on LinkedIn, they put it out on job sites, they put it on their own job career board on their website, and they hopefully start getting applicants. And they start screening and they start screening each of these applicants and over stages they eliminate them. And then finally you get to the point where they select some and they interview them and then hopefully they find the one they want to hire and they hire them. What I want to focus on here is this lower left where we see the applicant screening process. Because when I talk about how people fail to get into a cybersecurity job and how jobs fail to get filled from the hiring side, this is where the things fall apart. More than anything else, it's when we get into that screening process. So let's talk a little bit more about that process for a minute and what that looks like. In organizations where they're using an applicant tracking system, that is your first layer of filter. A lot of these systems have built in rules that immediately look at your resume and are going to identify very objective, tangible things that they can identify. And a lot of times there are algorithms built in there that will immediately, they may not actually delete you from consideration, but they rank you. They provide scoring that now the recruiters in the hiring manager are going to look at to say, hey, let's prioritize these and look at who is most qualified. So it's important that we understand that that system is a crucial aspect in how we get considered for a job when we apply. Now it goes from there and typically a recruiter or someone in human resources is going to look at that next. They're going to get the ones that are receiving that and it's their job to screen further. So they're going to look at your resume and your qualifications and if you meet at least some of them, they're probably going to get in touch with you because their job is to get in touch, talk to you and screen you and make sure that you do meet some of the just the bare qualifications for that job. They're going to make sure that some of the legal aspects of it are considered. So if you need to be, for instance, here in the US, if it requires that you're able to legally work in the US, they're going to make sure that you have whatever those legal qualifications are. They're going to talk to you about some of the base skill sets and things that they're looking for, maybe ask you a little bit about your experience. But that's their job. And what they're trying to do is they're trying to filter out those applications before they ultimately submit them to the hiring manager. So the hiring manager and potentially their team and maybe some other managers and whatnot will be involved in the last steps of that screening process. So they're the ones that are ultimately involved in some of the interviews and they're going to make that final decision on who comes in for an interview and of course who they ultimately end up hiring. So understanding this process is important because more often than not, applicants do apply for jobs. I know people who have told me they've applied for 30, 40, 50 jobs because they're just, they're not hearing back, they're not making it through. And I start to question, well, if you're applying to that many jobs, how are you not getting calls back from any of them? That seems surprising. And indeed, when you're entering this world of searching for a cybersecurity job in particular, you're on the road to frustration. For those of you coming out of school, you may have had schools that told you, hey, just get that cybersecurity degree and you're going to be all set. Or maybe you went and you got that certification and boy, they promised all these great things. Hey, if you just get this certification, everybody's going to want to hire you because 35, 40, 50% of people working in security have this certification. So if you get it, you can get a job there too, right? And then you go and you hit the job market and it doesn't happen. So let's talk about how we're going to get beyond that. How do we hack that system and make sure that you can get your next job? I'm going to tell you, it starts with you. You are the first step and you need to understand yourself. Self analysis is probably one of the most crucial aspects of getting a job in cybersecurity. I mentor a lot of people as they're searching for security jobs. And one of the first questions I'll ask them, someone will come to me, a lot of times they'll just ask, Kate, will you be my mentor? Which is a pretty vague request in general. And so I'll start to ask right away, hey, okay, what are your interests? What do you want to do in security? And the answer that I dread, but I get quite often is, well, I just want to work, I want to learn everything. I want to be in cybersecurity. Well, what do you want to do in cybersecurity? Well, I don't know. I want to learn it all. This image here is a wonderful image. I love this. Henry Jang put this together and he posted it in an article on LinkedIn. And I don't agree with all of how it's arranged. I would definitely change a lot of the aspects of it. But this gives you some idea of the amount of different opportunities, topic areas, skill sets, whatnot that exist within this thing we call cybersecurity. So to say you want to learn all of it, that's not a realistic expectation. To say to somebody, hey, I just want to learn cybersecurity, that's super broad. How do you self-analyze and get to a point where you understand what it is in cybersecurity that interests you? Now I've talked with people. Sometimes they're able to figure it out and we'll chat a little bit and we get to the root of it. Sometimes what I've encouraged people to do, go out, look at maybe five, 10 security-related blogs and news sites. Grab the first five headlines off of each one of them and put them in a list and rank them. Rank them in order of which headline seems most interesting to you. Now take the top five of those headlines and look for what's common. What are the aspects about those headlines that actually excite you? Is it because they're doing some kind of investigation, they're doing maybe digital forensics and they're investigating and you really like that idea of trying to solve a mystery? Is it because they've launched some new defense mechanism and maybe that's where you really like to sink your teeth into? Is it maybe headlines about new vulnerabilities that were discovered? And so, hey, that's certainly to tell you, I really like this idea of vulnerability research and I want to start getting into things like pen testing. This is a great way to simply narrow down your interest and actually understand what is it in security that you want to be doing because this is a huge field and it's growing every day as the digital world becomes more and more our way of life, security fits into every piece of it. Next thing you need to do is you need to be out there building your network. So you know what you want to do, start interacting with people in social media if nowhere else. If you go to conferences, I know this year it's different because we don't have the interactivity of being able to walk through hallway con like we normally do when we're at DEF CON and everywhere else and meet new people. But meet them on Twitter. Honestly, it's easier to meet them in social media first anyway and then find them at conferences later. But the key here that I see, the key mistake I see made is interact with them. Building a network isn't just going out and following a bunch of people and trying to get a bunch of people to follow you on all these different social media platforms. It's interacting with them. The wonderful thing, I love Twitter for this and there's a reason why security lives so strongly in Twitter. You can interact with anybody as long as they haven't blocked you at least so don't make them angry but you can go out there, you can find the biggest names in the industry, you can follow them and as they post things, you can respond and you can have conversations with them. Not only do you have conversations with them but you may have conversations with their other followers who've also responded. Get engaged in those active conversations, ask questions, offer your opinions, be respectful, build that community. That's how you get followers. That's how you make friends. That's how you'll start to discover not just learning opportunities but you'll start to find job opportunities. Now LinkedIn's really great if you're looking really to on a more professional level of course. Not as active from a security perspective, definitely more formalized but a great place again to start connecting with people who work for certain organizations that you want to work for. Find those people. Do a search. LinkedIn actually has a pretty decent search capability. Go look for people who work at a company that is one that you want to work for and then look for the people who are in those security roles. Yeah, it's not the greatest search in the world. It does take some learning but when you learn how to use it, you can actually effectively find these people. Add them. Add them as connections. A lot of people on LinkedIn are more than happy to add connections all the time. Unless there's something red flagged about you, I'm going to add you if you add me. Create those connections and again, now you can start interacting with those people when they post stuff. They'll start to see what you're posting as well. So post good topics, concepts, things. Be out there, be active. But this is what I mean about being interactive and building that network because now as you start to engage with these people and you build relationships, those are people that can help you find opportunities and help you land those opportunities. But now let's talk about the hiring process. So we've worked on you. We've got you ready. But now you're going to go and you're going to start putting your resume out there to the world. Let's talk about how you beat the ATS. Those applicant tracking systems, they're used to varying degrees. Different recruiters use them differently. Different companies use them differently. But there's a few things you need to remember with the ATS. Most importantly, remember, this is a machine. It's software. It might be AI based. It might use machine learning and all these buzzwords that the vendors talk about that their products do. But at the end of the day, you're talking to a machine. So let's think about some of the things that are really important there. First and foremost, when it comes to your resume, simple formatting. And there's a lot of aspects here. Use common fonts. Believe it or not, this can be an issue. Don't use wild, crazy fonts. Use ones that are common. There's no one specific that you have to use. But use ones that are typical, Calibri, Times New Roman, the ones that you typically see in documentation, other things, things that are easy to read. These are the ones that those systems can most effectively process accurately. And that's important. But let's go beyond that. Just format your resume in a way that's easy to read. I know we like to have things that stand out. And it's okay to have a separate resume that you're going to hand to people. But the one that you upload to the ATS needs to be simply formatted. Don't put pictures in there. Don't put designs in there. Lay it out, structured use bullet points, things that it will be able to easily process. The second thing, and this to me is so crucial. I cannot believe how often people miss on this. And this, I don't care if you're looking for a cybersecurity job or what kind of job. This is something you need to be aware of if you're trying to get hired. You need to be tailoring your resume to that job that you're applying to. This means for every job that you apply to, you should have a separate file. And literally if I showed you my file system where I store my resumes when I'm applying to jobs, I've got a different one for everyone. And I name them with the date and the company of who I sent it to. Why? Because I need to be looking at key words that appear in those job descriptions. What are the things that are most important to them in those job descriptions? What ranks highly in the requirements? And how can I work those terms into my resume? Not saying I have to have experience in that term if I don't have it, and we'll talk more about that in a minute. But at least make sure that you mention that keyword somewhere. Get it in there. Look for variations on that keyword as well. So if we think about penetration testing and ethical hacking, for instance, are two different variations that you might focus on. And make sure you're ticking all of those boxes. And sometimes those boxes, they can be pretty complex. They might include certifications. So I'm going to talk to you in a second about certifications. But the last thing I'm going to tell you with checking the boxes is make sure that you look at these step by step and lay them out. And know which ones that you want to have in that resume, because you need to make sure your resume touches all of those when you upload it to this system. Don't lie. Don't over exaggerate. But make sure that you check the boxes that they're asking you to check. Now, as I said, one of those boxes is often the certification. And this is another extremely common question I get from people who are looking for cybersecurity jobs. They want to know what cert to get. I love this picture. It was put together by someone on Reddit. I've got the credit down there at the bottom. These are all the cybersecurity related certifications you can get. And I said, CISSP is very commonly asked for. In fact, I did some research. I went through five different major job boards, including LinkedIn and Monster. And I looked at what are they looking for? What is the most commonly asked for certification? Bar in a way, bar none, it's the CISSP. Now I filtered out any jobs that were from the government, because the government does have actually specific requirements around why they have to have CISSP. But more often than not, people say they want a CISSP, and here's the magic words, or equivalent. You don't have to have a CISSP to get a job. Just get a cert. Now there's very few that as an entry level person you can get, but there's a couple. The one that I recommend most often to people is look at the Security Plus, because the Security Plus certification is one of the cheapest to get. It is attainable for anybody, and it covers a wide breadth of security knowledge. It doesn't hamstring you into one specific area. If you go for like a CEH, well that's very focused on ethical hacking and penetration testing. That doesn't make a lot of sense. If you look at the GAC ones, all these, the ones from Sands, well one, they're super duper expensive, and two, they're very narrowly focused as well. So get something general, something that can apply. You're not looking to say, hey, I've got this great wonderful certification. You're looking to check that box that says CISSP or equivalent. And I will tell you that having a Security Plus more often than not will be looked at as an equivalent. So you've made it past the ATS. Congratulations. The recruiter is now looking at your resume. How do I get them? How do I get them on board? Well, you've got to inspire them. You've got to inspire that recruiter who's looking at thousands maybe of resumes in a week. You've got to inspire them to take your resume and pass it on to the hiring manager. How do you do that? Step one, be memorable. And I cannot stress this enough. And this goes beyond maybe having some unique formatting about a resume that you sent to them outside of the ATS. Again, don't use crazy formatting for ATS. Do something more. Be bold. If you don't have a blog, start writing one. That way you can link to your blog and your resume. I don't care if only five people ever read your blog. The fact that you wrote content and you put it out there immediately demonstrates, hey, I'm doing something in security. It makes you memorable. Read a YouTube channel and record videos that talk about different security concepts. One of my favorite stories, and this was actually as a hiring manager, this wasn't even at a recruiter level, I interviewed a person and then she moved on and she interviewed with some of the people on my team. And she didn't like one of the answers she gave them in this technical interview. So she immediately left that after that interview, went and recorded a YouTube video where she explained the concept in detail, talked about how to remediate it and so forth. And then she emailed that video link to not only the two people she interviewed with, to me and the recruiter as well. That makes you memorable. That's something that stands out. So what I tell people, I borrow a phrase from a colleague of mine, Phil Gerbyshak, who speaks all about personal branding. What's your weird? Figure out that thing about you that makes you unique. You may not be security related at all and highlight that in your resume. Own it. Something that makes you very unique from everybody else that, hey, for me, it's the fact that I bought my first computer when I was 12 years old. I was 12 years old. I saved up money with a paper out and I bought a computer. How many people do you know that did that, especially back in the late 80s when I grew up? Yes, I'm that old. So put those unique stories out there. That's the thing that when recruiters read through that, they see that and they're like, hey, this is memorable. That's something that sticks in their head and they're like, this is someone I want to know more about and they'll get in touch with you. Link everything to those requirements. Now we talked about tailoring your resume already. This is that same thing. If you're talking to them, do the same. So you've gotten past maybe that resume. You've gotten that initial HR screening call now. Talk to them, but make sure everything that you're talking about that you somehow link it back to their requirements. And then finally, this one, I can't believe I have to tell you this, but unfortunately, as I talk to recruiters all the time, they tell me this is one of the biggest problems. Be responsive. If a recruiter contacts you and says, hey, I'd like to schedule a screening interview, respond back. Respond back as quick as you can. Now sometimes we're out on vacation. We're not checking emails. Great. But make sure you're using an email that you check often and respond to them quickly. Nothing is more frustrating for a recruiter than when they see a candidate who they really like and they want to bring them in and they try to get in touch with them and they can't get that person to return their calls or return their emails. And this is a huge problem that stands in people's way. So we can do better. Then finally, all right, so we did all that. We got through the recruiter, passed us on to the hiring manager. The hiring manager wants to know more about us. How do I win over the hiring manager? This is where things are crucial. First and foremost, this first of all is where you've got the opportunity. We're no longer talking about resume. At the point they call you in for an interview, it's not about your resume anymore. It's about you and what do you do? And in that survey, when I talked to hiring managers and the last question I asked them on the survey, the last question I asked was, what's one piece of advice you would give to people looking to get their first job in security? These single most common themes throughout all the thousand answers that I got, they all related back to passion, the vast majority. And you see some of the direct quotes here. How do you share your passion? Be excited about the things that you're talking about. If you built that blog, like I suggested, talk about it. That shows you have passion. That's something that's completely voluntary that you chose to do on your own. Or if you created a bunch of videos, that's something you chose to do on your own. If you engaged in labs and other things, that's all stuff that shows you have a passion for security. Make sure you share that when you're talking with the hiring manager. And then I'm going to share this with you. So I told you I host this podcast and one of the people we had on was Malware Jake, Jake Williams. And he shared with us something that I thought was absolutely incredible advice. Here's how you refine your resume to sell yourself. First write up a resume. Take what I've told you so far, create a resume. Then I want you to completely separately prepare a one to two minute elevator pitch. Just how are you going to sell yourself in two minutes? Tell somebody why they should hire you. What it is that you're going to do to make their business better. What it is that you're going to do to make their department stronger. Now go and find those things in your resume. If you can't find those elements in your resume, get revising. Figure out how you're going to add those elements to your resume to hit those things that are a part of what you said were most important because that's what you squeezed into that two minute elevator pitch. This is such a great idea. If you can do this with your resume, your resume is going to be so much stronger. And then now you can carry through that narrative that you told in that one to two minute elevator pitch. That becomes the theme for every interview that you have after that. Make them know why it is that they want to hire you. So let's go back to our barista then. We're going to tie things all together here now. So how do I revise that resume? Say I'm entry level. I don't have a lot of experience. Well let's understand first technical capabilities. And when I say technical capabilities, I'm talking about those things that ultimately show up as requirements. There's kind of three levels that you can have here. You can have knowledge. And knowledge is just, hey, I read a book. I did some training. I investigated research, studied this somehow. Here it is. I have knowledge of this area. Sometimes for certain things that might be all you need. But more often than not, people want you to have skill. And when I say skill, what we're referring to in skills is that you've actually taken that knowledge and applied it in some way. Maybe you did a lab. Maybe you worked in a CTF or you went to a village or some other hands-on training somewhere where you actually got to do application of that knowledge into the actual technology. You got to apply it somehow. That is a skill. That's what kind of, as you see, going from good, better, best here. So you've got knowledge and skill. The last one is experience. And this is the coup de gras. This is what employers tell us they want all the time. They want to know that you have experience. And when they say experience, they're talking about that you have some kind of formal document and examples of applying that skill in a real life, most often business scenario. So understanding, making an inventory of your capabilities technically and understanding are they knowledge? Are they skills? And are they experience and to what level of each is so crucial? This is back to working on you again and talking about how you can be better. And then finally, I want to talk about this idea of core skills. So now that you know what those capabilities are, your core skills are the transferable elements of those that you can take from one capability and apply it to any capability in any technology anywhere. So if I look at my barista, they start off with, well, they make coffee beverages. Well, really, if I break that down, here's a lot of the steps they did. They received orders. They prepared according to recipes. They delivered on the customers and they had to clean the equipment. But that's still shades of a barista. So how do I take it further? They processed multiple inputs. They translated inputs into tasks and prioritized them for maximum efficiency. And they were always focused on efficient delivery to the customer. And throughout all that, they had to plan and execute maintenance activities. These are general words that can apply to any job anywhere. And when you can now take and view your skills in that light, you can take those requirements that they're asking for, understand the core skills behind those, take your own core skills, tie them together. And now you can see how you can easily word your resume to highlight the skills and experiences that you have from your job to fit into that job that you are applying for. And this is where the rubber really meets the road. How do you take that simple role as a barista where it seems so completely unconnected? And this is literally what I told that manager when he was complaining to me. I said, didn't they absorb all of this input from all these different areas and process it? Didn't they have to focus on how they were going to arrange those and do it in an efficient manner so they could be most effective? Were they always focused on customers? And the customer was what was most important. And yet throughout all of that, they had to plan and execute maintenance activities. And you started to look at me. I said, isn't that exactly what you want your SOC analysts to be able to do? That barista would be perfectly qualified to be a SOC analyst in light of the fact that they have the other knowledge that you asked for. They may not have the experience, but they have the knowledge. So look to highlight these on your resume, in your discussions, in those interviews. As you're blogging, as you're making videos, tie these things together. And then last, I'm going to leave you with this quote from Ella Fitzgerald. Just don't give up. Whatever it is, don't give up. This is tough. I'm not going to say the security industry is perfect. We've got a lot of work to do from the industry side to make things better for those that we're trying to bring into the industry. Keep working. Use your network. Find mentors who can help you. Leverage your connections and foster those relationships because they're going to help you get there. So finally, I can be one of those people for you and I'm always happy to. Find me on social media. You've got my Twitter handle, my LinkedIn address there. You've also got the link to my website, which includes my blog and lots of other information. So please continue. Reach out to me. Reach out to others. If I can't help you, I will find somebody to connect you with or I will put the call out to the world and to my network and find you somebody who can help you with what you need. So with that, I want to say thank you so much to everybody who's attended today. Thank you, Sneak, my employer for allowing me to be here today. Thank you to DefCon and the DefCon Career Hacking Village. I'm so excited to be a part of the inaugural version of this. That is so cool. And I hope you all enjoy the rest of the conference. I know it's a weird world out there. We'll get back to the real thing soon enough, but enjoy this virtual experience and make the most of it. This is where you're going to learn so many things and I hope to see you soon. That was just absolutely, excuse me, absolutely awesome. I hope you saw me doing thumbs up and being excited. Yes, you hit so many points, 20 years in the recruitment industry and I am so glad you pointed everything out, listed some of the key things, listed a lot of the key things that job seekers really need and sort of gave a little bit of a back slap to those employers who really need to change their jobs descriptions. That's something I've been trying to do for 20 years and I think it will take all of us to do that. So, Alyssa, thank you so much for all of your great input for doing the great survey and I know that you've also made yourself available for career coaching through the village and we really appreciate that. So definitely connect with Alyssa and we will be back with another session shortly. Bye-bye. Bye. That was a blast. And.
from a barista to a security pro. So some time industry is today. If you're looking to get into that talked about the challenges of this trying to find roles in cybersecurity and are targeted at people who had never worked in experience, with degrees, with certifications, intern. I want to look for an intern role, from this information security intern position happen. So let's talk about how we're going to the first step and you need to understand Well, what do you want to do in cybersecurity? that appear in those job descriptions. What are in that term if I don't have it, and we'll talk doesn't make a lot of sense. If you look at the then I'm going to share this with you. So I told their business better. What it is that you're great idea. If you can do this with your resume, resume? Say I'm entry level. I don't have a lot