HG - Brute Force Your Job Application

okay everyone hear me okay yeah cool um well thank you for being here during I think lunchtime so really appreciate that so really hope you get some value out of this this talk um so I'm Ricky Burke and we're here to talk about brute force your job application so just to sort of kick things off I'm from Australia uh at least the last 10 years living in Australia um yesterday I was outside um doing my present ation document and someone saw a bsides t-shirt that I was wearing and said oh which bsid is that from and I said bsides Brisbane and then they looked at me like I said Mars so Brisbane it's Australia it's a far place

um we're famous for sharks famous for winning medals in the swimming Olympics surfing kangaroos Bluey which I believe is pretty popular over here and s gets over a billion uh minutes played per week in the us alone which is amazing uh drop bears we're famous for bin chickens also known as Ibis and we're a pretty big country um so we're about 78% the size of the US in terms of land mass but we're a tiny country in terms of population so we're about 7 8% the size of the us but we love cyber security we've got a very vibrant cyber security community so I'm very proud to be here today CU I've been here for three years in a row

uh doing resumé reviews I love doing community stuff and um honestly very happy to to participate hopefully again offer some value and again this is BAS Las Vegas the original um in Australia we've got six this year um one of which I think competes sizewise we've got one of 3,000 people so if you ever want a technical conference in Australia besid cra is a pretty good one to go to although outside of that there's may be not much to do in camra so I'm Ricky Burke um I run a cyber security recruitment company um yes as as kirston said recruiters can be evil um I try not to be one of those um so I've been running a cyber security

cyber security recruitment business for over seven years uh recently soft launched a cyber security careers platform to try and help help people get into this space cuz quite frankly a lot of people need help and I love to do the community stuff so I'm very lucky and fortunate to run career Villages back in Australia um so bsid cra Melbourne and a bunch of other things this year I'm speaking here I'm speaking at black hat tomorrow and as a recruiter I can't help every person find a job directly but we can help in other ways and that's what we're about so today is about empowering you with information with tactics with strategies with information not just hear some

resume tips and do these three things and you'll get a job cuz it's way beyond that um but if we can help you with the tools the strategies techniques not just today but for the rest of your career hopefully that will help you stand out whenever you're applying for a job and hopefully jobs will come to you as well so talking of jobs because it's a pretty important topic um job hunting can we raise a hand if job hunting sucks okay I think nearly everyone so that's we're on the same page so the agenda today we're going to go through a few different things first is what I call the foundational building so we'll talk about essentially

identifying what you want to do in your career what's the next step and having a deeper think about really what you bring to the table for employers building a brand I hate hate hate that term um if anybody has a better term please let me know cuz it sucks it sounds really cheesy but essentially I want to talk about building brand resumés also suck but they are important because realistically without them you won't get most jobs proactive job hunting is something I'm very passionate about again this goes to you can't we I can't help every single person apply to for a job but if I can teach you how to apply in different techniques then you can help yourself

interview interview preparation is really important and then navigating job offers so we'll go through this life cycle of basically job well looking for a job to in a job and hopefully jobs coming to you in the future so identifying career goals is important um just to out of Interest i' curious I guess our audience stage in your career who is either looking for their first job or near looking for their first job or or at the early stage of their career in cyber security okay and who's already in the industry and may be looking for progression in the near future okay that's that's really helpful so that helps me narrow what I talk about and expand what I talk about so

for some of you folks you're already in the industry you know what you're doing and maybe you know what you want to do next for those early in their career I tend to find there a very similar conversation people coming to me with I want to get into cyber they don't realize that cyber security is made up of lots of different jobs that it requires lots of different skill sets so it's really important that if you know the job you want to work in then you can work backwards in terms of what skills you need to acquire to basically be useful in a job also understand the job market so again I can reflect my experience in

Australia but I'm sure there'll be similarities here as well is as an example I'll speak to someone and I've had this conversation last few months they want to be a malware analyst it's their passion they love going deep diving into malware but then there's no jobs for a malware analyst unless you want to work in government Australia is a really low maturity level for certain types of Niche roles out there and this is one of those and the same goes wherever you may live in your town city or state that you may want a certain type of role but if that job isn't out there then you have to be realistic of what else is out

there as well um so there might be jobs but maybe not the jobs that you actually want to work in and then we'll go through developing the skills to help you stand out so this goes that first question is what do you want to do that's really for the people trying to break into this industry of understanding do you want to be a pent tester do you want to be an application security engineer do you want to be an architect all different skill sets that essentially require different type of skills you can't just I just want to get my foot in the door and make that work you need to bring something to the table ultimately it's

about solving problems and the quicker you can identify the ability to solve certain types of problems because you bring experience or skills to the table the more chance you have of actually Landing a job so this is the big thing again I know we've got some experienced folks here but just for the more Junior people out there is you can't rely on I just want to get into cyber because it is is a Big Field Big Industry lots of jobs we don't help ourselves with job titles either um because you can work in a consultancy in Professional Services as a security consultant but there'll be people that are pentesters and GRC Consultants they could be further from

the truth or further from each other but they're working in s different jobs but same job title and security engineer as well you need to look at a job title that says security engineer but really understand what are they trying to achieve here because is it a cloud security engineer role is it application security is it network security in some of the tech companies some of the red teamers or pentesters have security engineer as their title as well so we're really bad in this industry with job titles so I think really important is understand the underlying context of that now question and I appreciate um kon's going to be a runner here um it might sound really simple and

basic but why do companies hire people in the first place if anyone has an answer please raise your hands if you're not shy yeah like you said earlier to solve a problem I gave it away didn't I um spot on um it's to solve a problem and we get caught up I think when applying for jobs of we'll cover resumés later on because most people's rums are garbage um but essentially companies don't if we just focus on cyber security they're not spending millions of dollars in cyber because they want to but no no business spends money because they want to they spend it because they either have to or there's rules and regulations in place and essentially it's to solve

certain types of problems and if you understand the underlying context of the problem you're trying to solve because even if we look at say an application security engineer the role isn't just to do certain types of activities in terms of securing the sdlc pipelines and um threat modeling and things like that but if you take a step back understand what what are we trying to achieve here is about essentially helping developers do secure code and there's lots of different activities then to work towards that but there's different skill sets that you need and this is this is the issue with cyber people look at it I know it's more mature now but it's still a niche industry I know for us folk here

in there thousands here and there's going to be even more at Defcon and black hat um it's still a niche industry by other standards but then within that there's so many niches in this space that ultimately it's about what you bring to the table what problems can you solve and then during this application process when you're applying for jobs it's your ability to communicate how can you solve certain types of problems this is the issue for a lot of people is you'll be one side the job is the other side and often there is a skills knowledge or experience Gap the sooner you can identify to an employer or potential employer what you bring to

the table so what skills what knowledge what experience what problems you can solve you stand out so easy and when we talk about solving problems for me it's it's understanding business context and coming to the table with again understanding the underlying foundations of why the role exists and then demonstrating to them what outcomes you can do and when you can convert that into metrics numbers outcomes you show that you're thinking on a very different wavelength to a lot of other people out there um so where possible is you try and convert things into metrics into numbers into percentages saving money saving time the two biggest assets out there but also it helps you identify so

you might be here today the job that you want is over here do you know what the skills Gap is so as an example let's pretend you could be someone who's early in your career or you're looking to go from one level to another so it doesn't really matter whether you're looking for your first job in cyber or whether you're a seeso looking for the next executive leadership role there might be a gap there and your job is to understand what is that Gap and what do you need to do to bridge that Gap so if I simplify things a bit more let's pretend I'm an application security engineer and I want to be the

engineering manager now that's my next step you don't have the experience yet so that's your Gap but what can you bring to the table that helps validate that you can do that so if you don't know that the easiest thing you can do is then having a network having relationships having people out there that you can talk talk to so LinkedIn is a very powerful thing to use and I think people admittedly LinkedIn is just a glorified recruitment platform and then it masquerades as social uh business networking but it is just a recruitment platform but you can network with people out there so if you basically reach out to a whole bunch of people that work in

the job that you want to work in connect with them start ask them questions there are so many amazing people in this industry that will help you so if you're reach out to 20 people not maybe not every single one of them but the vast majority of them will respond to you and will offer you help CU essentially people love helping each other in this space so if you're asking someone what skills do you use how did you get in that position you'll find common themes in terms of the skill sets the experiences what that person did and now you know what you need to work towards to bridge that Gap and make your job a

lot easier Landing that that next job again I this word brand um does anyone have a better phrase no profile I did have profile on there but I deleted it reput rep oh I like that okay I might use that next time thank you so this is what I think of when I think about brand it's like Tik Tok influencers and just just to be honest with you um this is how I feel inside every time I hear the word brand um so I will start using reputation so building a reputation I love it why okay so here's an example I I got a really nice intro so thank you for that earlier um I'm here from Australia why

the hell is someone from Australia traveling 30 hours door Todo to come and speak to folks in the US um I'm pretty lucky that I've managed to build a reputation um that sounds wanky um so on on LinkedIn I'm pretty active I've got 40,000 followers which is okay there's plenty more people out people out there with bigger following than me um but ultimately I think I do pretty well on LinkedIn I'm very lucky where I've built a business that essentially know we generate seven figure revenues every year and we're not a traditional recruitment company we're not doing the usual sales crap that a lot of recruiters do we're not which we're not doing those same tactics

a lot of things come to us because of reputation so in terms of the things we give back to the industry in terms of the help that we give people in terms of just consistently delivering those things matter and again just reflecting back on the original slide here is all of this stuff is because seven eight years ago I just and if I'm honest with you I never intended to build a brand or reputation I just wanted to get involved in the industry cuz it seemed fun and I'm very lucky that I got to speak at something then got to speak at another thing and things keep growing now I'm running career Villages at conferences and doing different stuff so

these these things do take time and I wouldn't be here today if it wasn't for all the stuff that I've done for seven plus years in the industry but ultimately it's about building trust building awareness there's a lot of charlatans out there and there'll be people out there that essentially do things for the wrong reasons I think what is good the majority of the time this community is really good at calling and people that are very um self- serving get found out not all the time but they do get found out but this is why I think building a reputation is helpful because if people trust you if they have that awareness first of all

jobs come to you and let's be honest we've said job hunting sucks applying for a job online sucks um when you go online you see a job that you like you go through the process you fill in the details of just either submitting or you fill in these horrible platforms like workday um and it just disappears into a black hole and sometimes you never hear back from the the company and it's and it's demoralizing it's not a fun process and what's a lot nicer is if jobs come to you if you're being approached for jobs and essentially you don't have to look for jobs because your brand your reputation is working for you in the

world and essentially again people trust you they like you I want to work with that person and jobs will come to you so that's really helpful opportunities like presenting at conferences the more you do things and if it goes well when people get value out of it the more you get and again the more you give the more you get but you don't do it to get back you just give and hopefully people like it and hopefully it works but essentially it's not a bad thing at all if you you give back and people get value out of that that's a nice win-win scenario for everybody when you're a manager it's a lot easier to hire people if they know

you um so there'll be hiring managers out there that essentially they have a job they post it on LinkedIn and people come to them because they know this person and they want to work for that person there'll be other hiring managers out there that have no brand no reputation no awareness and they might post a job but no one sees it because they don't have the network they don't have the credibility they don't have the trust so not just from that perspective of about jobs in the future but also potential as a hiring manager if you have people coming to you when it's a very challenging environment to hire good people then that's a lot easier as

well the bigger the network the more things come to you so there's the old saying that it's not what you know it's who you know but it's also who knows you and it's just again things are a lot easier if more people know you and then again the opportunity to give back it sounds cheesy but honestly it feels good um if you know that people get value out of essentially advice and insights that you that you basically offer it feels weird or or cheesy but honestly it feels really good to make a difference um I I've done a ton of stuff over the years and things that I even forget sometimes and I I get people

reach out to me and say hey that thing you did three years ago I followed your advice and got a job it's like cool I never knew that like I you never know how many people that you actually are impacting but to get those bit of feedback every now and again like you know that it's working and you know that people are getting value and that's that's really important also it's fun um I'm very fortunate where I can go to a conference in Australia now most conferences and I don't even need to talk to anyone because fortunately they'll come to me because LinkedIn and it helps honestly I in my job and my capacity I meant to be an extrovert I'm

not I feel so bloody uncomfortable walking around a room even worse with masks and you can't recognize each other it's really awkward I don't feel super comfortable walking around the room and just going hey I'm Ricky what do you do um some people doing fair play to them and that in itself if you can build that tolerance that skill um because it is like anything it's like a muscle um it's a very powerful thing because you'll see people out there and there'll be someone sitting on their laptops sitting on their phone it looks like they're busy basically they're lonely cuz maybe they're in the same position as you and just a really quick tip that I use

myself because I went to a conference in Switzerland recently did not know a single person and I I felt super uncomfortable so I set myself some just small goals so in the morning speak to three people and the way I would do that is I would look for other people on their own as well it wouldn't always go to plan but essentially look for someone else on their own because maybe they're like me and they don't know anyone else as well and the ideal thing is when you're in a queue for food because essentially no one's going anywhere you're you're behind each other and you say oh hey like what do you do or how's the

conference just open questions how's the conference or what have you seen today who who did you see um and then oh what do you do and it just flows from there but open questions are really really important so if if you don't know open questions who what when why how um if you ask a closed question you're temp to get a closed answer did you have a good conference today yes cool or how was the conference it was really good now you can expand the conversation and honestly you just never know where these things land I know people that have met their partner at a conference there are a ton of people that that get jobs from conferences and

maybe the goal isn't I have to land a job that's too much pressure but it's just starting small but if you can again set a small small goal a few questions then you go cool I achieved that goal then in the afternoon I'm going to try for five people and then every person you speaks to you say hey are you on LinkedIn yes I am or are you on Twitter or X um oh do you mind if I send you a connection yeah no problem if you do that every time you go to an event a Meetup a conference that compounded over a period of time really really helps CU this industry is such a

small place and you just never know where these things are going to take you and you may bump into some someone that may be able to refer you to a a job in the future or you just might meet some friends or you just may never speak to them again but ultimately the more people that know you the easier life is so building a reputation so I'm going to be really honest you know what I'm very lucky that I've you know got this thing on LinkedIn but I never did it with any intentions and I didn't follow the steps it's now that I look at what I've done or what other people do reflect on that and go right

this if I was going to start from zero this is how I would do it today so Define your target audience so I had a really good conversation with a ciso last week we were talking about the same sort of thing and his agenda or his target audience would look very different from someone who's maybe looking for their first job in cyber now from his perspective he he's not looking right now but he's thinking 6 months 12 months 24 months he's thinking about his next uh next role in the future ultimately the more people he has at the level that essentially would hire him the better it is for him so for him he needs more

people like CTO CEOs um c-level people he needs to be connected with those because if he connects with all these people he then shares content that is valuable for these people and they get insights and they like what he puts out there then when they have a job at that level who are they going to go to if this person's front of mind because they keep posting good stuff they go I like this person and they're sharing good info I I would like to work with them he's going to get reached out to by potentially that company as opposed to apply for a job and trust me leadership roles are really hard to attain as well so even though

these folks at the top and they're csos and they're the top of the tree in terms of cyber security roles it so challenging for the SE level people either to get that first job or even to get the next job because competition is so high a huge percentage of the industry want those jobs um so again it doesn't matter what level you are but if jobs come to you it's so much easier but then you've got the content type so you've got well some people like like writing things some people like sharing photos some people like doing different things honestly it doesn't really matter what I think just work to whatever you're comfortable and then go

from there um and it gets really tricky of like what do I post and we'll touch on that as well essentially work to a medium that you're comfortable you don't have to do something you don't want to like I do videos sometimes but then I go through phases where I do not want to put myself through it um you know sometimes in the flow and I'll do a video one take sometimes it takes me 20 and that's stressful in itself but the interesting thing is the algorithms change all the time with LinkedIn and platforms like that where if I'm honest with you I think written content with no pictures works really well at the moment

so at other times you'll get recommendations of a picture and other stuff and whatever but if you just speak to what's true to you then you're more I think mindful that it will come through as more natural rather than just trying to force something as well and then the consistency um I I'll hold my hand up I don't have a Content calendar I just make up and just do it on the fly but I'm so in a rhythm that I tend to post I looked at my stats recently and I've posted 365 posts in the last 12 months so unintentionally I posted a post a day but sometimes it was three or four four posts one day and

then nothing for four or five days um but if the average person starting out was at zero and you want to get somewhere two three posts a week would be really good and then you think well how the hell do I do that many posts what do I post about we can talk about that as well um but if you for example set time aside where it's just to take some pressure off an hour a week and you think well I'm going to do a few posts this week um and then spend some time figuring out what those posts may be you can schedule posts on LinkedIn as well so you can then go right this hour I'm

just going to work out what I'm going to do for the week schedule the posts and then you don't have to worry about anything so just set and forget and then you're good um and then the engagement is really important as well so it's not just about posting it's about connecting it's about commenting on other people's posts if you see something and don't just comment for the sake of it because you'll just sound like an idiot but if you actually see something where oh that's really interesting and just comment oh you know good post or good research or offer insights or offer more you know content apparently this is a thing I picked up recently if you comment over I think I

think it's 12 words on a comment then you're more likely to get more interactions and that's an algorithm thing on LinkedIn so again being mindful of playing the game as well of LinkedIn so the rules change but if you get an idea of how they work that's pretty helpful as well and then collaboration so if you see people that like things that you like like and share ideas you can do podcasts you can do posts um Kirsten tagged me into a photo earlier collaboration I will take that I will then take that to LinkedIn I will then do the do likewise and then we're helping each other unintentionally but that's what happens so your network

grows through other people as well you of course have to be mindful that you don't want to do that with the wrong people so did your research um but essentially you can help each other build your brand um and again that sucks saying that but it helps um but also going back to that first thing of um connections basically be very intentional about the community or the the the type of people you'll be connecting with so it could be just people you know let's pretend I'm a pentester and I just want to connect with other pentesters because why not I can learn from other people I can connect to other people we can share ideas that's really cool if your

intention is I want to land a job well you probably need to know more people at the next level or level higher that hire for the role that you do so send connection requests uh what works really well and apparently you get a higher hit rate if you send my message but if I talk about my experience I've got thousands of connection requests most of them have no uh message but if you if someone wants to send a message to me and say hey Ricky enjoyed your presentation at bsid Las Vegas or I saw you over there or I enjoyed this thing and be great to connect I'm so much more likely to connect with someone CU there

are people out there that won't connect with someone they've never met before but if you offer to say hey I read your book I saw your news article or uh I read some research that you did three years ago like that's personal the more personal you make it the more likely you'll be in terms of getting those connections which helps and this is really really important is is not try not to make it about you um a good example is let's use recruiters um if you look at look at most Recruiters on LinkedIn or Twitter Twitter's the worst when you see it it's when they just post jobs that's it like there's no advice there's no insights

there's there's nothing all it is is just posting jobs all they're looking for is people to respond basically they're just asking rather than giving so if you can share insights if you can share advice if you can share opinions people get to know you the human behind the job title and that's really really important and people may think well I'm 16 years old um we have sorry to point you out I met a you still 16 I met I won't say your name just in case you don't like public stuff 16-year-old at bsides Barcelona a few months ago and like one it's unusual to meet teenagers no offense at a conference and then to him talk about

the research that he was doing I was like this this kid kid I'm sorry but technically you still are um it's impressive genuinely impressive and then he said he was going to Defcon and bsize Las Vegas I was like who does that and that's just amazing and then you I gave you advice about building a LinkedIn sharing insights like sharing photos and sharing things and ultimately it helps build your network so again you don't make it about you but you make it about sharing giving back because there might be other people that that you're going through the same sort of things but again the point I'm getting at is you might be no offense 16

or you might be 30 or 50 or whatever and think I don't know what value I offer um I've never worked in this job before how the hell can I provide value to other people the thing is you can document your journey you can talk about going through things like starting out in bug bounties you could start talk about going through hack the box you can talk about different things just document your journey because other people will be at a different point and might find it interesting or they might learn from you or you might get other people go oh I respect that that person's trying and they might come and then give you advice

as well but essentially you never make it about you you try and just offer things for other people that hopefully again they get value out of and this can work really well like if you have no ideas what to post just use what's out there you don't have to be original you don't have to create things and be uh I'm going to be a thought leader um basically first of all just Google news I'm just going to Google some hacking stories or this company got breached last week um or you might find some interesting research topics or a blog or something like that a good well I like to think a good example is this

so um so I'm showing my whole screen here um so if I'm honest with this is what I did many years ago cuz I'll be honest I was I felt very intimidated um I went to my first security Meetup as a recruiter I went to a really technical Meetup with just a bunch of hackers and I was thinking to myself what the hell am I doing here like everyone else is like Elite hacker and then there's me I don't know but what's really weird is people can be really nice I went and spoke to the the organizer 3 years later I'm going to his wedding like this industry is weird in a good way but then in terms

of posting content again I just went looking for interesting things I thought oh that's cool and what's really cool is I know a friend of mine did a red team engagement using a tool that I found on Reddit so I posted something on LinkedIn because I just went looking for just they've changed this from from a few years ago but essentially I just went looking for something interesting I would look for the amount of comments or UPS or whatever they phrase it just to validate is it actually interesting for other people I check the comments out because in case someone's calling on something I don't want to then post something that then people then say is for me

but if people like this thing then hopefully other people find it helpful as well so grab some links share it on LinkedIn I talk about collaboration so tagging in the person who actually authored the post the research as well because it will help hopefully help them as well because more people that know them it might help and again you never know and it was really weird that my friend messaged me out the blue to say that that post you shared I used that tool and I used it on an engagement so it's really cool but essentially you can just do that Google hacking news there's just the stuff is out there you just need to

use it and then things like a conference is a really good opportunity so I spoke about a seeso that I mentioned earlier so I feel like his LinkedIn profile didn't do him justice so he had about 1,700 followers this guy is really good at what he does he work he's worked for respected businesses he does a lot of stuff in the community he doesn't put himself out there enough and essentially he wants to have more things come to him so he spoke at an AWS event in I can't remember somewhere in in Asia recently and he only had one post about it but I said to him you can do three four posts on that one thing because you could have

like leading up to it you could have a post uh really looking forward to speaking at this conference in two weeks time then a week before the conference can't wait to attend this conference and watch this presenter speak at the conference you could take a photo doesn't have to be a selfie it could be literally a photo of a room or the signage or whatever just to say basically I was at this conference and then another post after of basically sharing insights of what you learned from the conference as well so just that one event you could do three or four posts and if you go to a few conferences a year then that's suddenly a number of your posts without

even thinking about it um and blogs as well some people I find don't do themselves Justice they'll have research blogs they're doing really interesting stuff but not enough people see it so it's one thing for you to create your blog have it out there and your research blog could literally be your your journey of um doing hack the box or pentest the lab or it could be whatever it may be but you could then take those posts and then put it on LinkedIn as well or put it on Twitter so again hopefully more people see essentially the C stuff you're up to and might get some value out of it as well so in essence if you post three to five

times a week which sounds a lot if you don't post at all it can feel a lot but if you go through the sort of advice that i' said it's not hard literally dedicate an hour to Googling some news and cyber security there's two two three posts add connections so if you're consistent with building applications sorry applications building your connections and just again dedicating even half an hour or something a week to go right I want to build my I want say tget Market but essentially your target audience or your connections you just search LinkedIn for this type of person in your area even better because hopefully you may be able to meet up with some people and a really good

example of that is a friend of mine who I don't think he's here today but he's he's somewhere in Vegas he's over from Australia he's pretty senior at the company he works at about five six years ago he was told by a recruiter it's going to take him 5 years to become a pencester and he he said well I'm going to get there quicker than that so where he lived he basically went to the local meetups connected with many as many pentesters as he could and then basically started taking him for coffees for beers I'm not recommending that cuz I don't want to give you advice and then you meet the wrong person then life goes

wrong but I'll just say this is what he did um he met lots of pentesters and he basically found out what do you do in your job what skills do you use he went basically understood what was that skills Gap then he realized that not just the skills Gap but he also realized what value he could bring as well so there is a a typical thing um unfortunately for maybe a lot of technical roles that sometimes the communication skills or customer facing or saleside sort of balances the other way and he realized that from his experience working as a developer working as an architect he had lots of customer facing experience he could talk to customers engage customers he could

do scoping he could do things that a lot of pentesters basically just didn't want to do so when he landed his first job it wasn't entry level he got a first job as as a senior consultant because essentially he could demonstrate to the organization the value he could bring and this is really important for everyone to try and bear in mind especially for those early in their career often you're not starting at zero you have something to offer you just need to work out what it is so where is what is the thing this goes back to problem solving he identified that in his capacity as a pentester the other pentesters couldn't scope couldn't manage the customer couldn't manage the

engagement they just wanted to hack but he could do that and because he could offer that the company saw value so he got the senior role he got a decent salary now he's put in a position where he's moved on from that business working for a billion doll tech company uh managed over 50 people and is on a really decent career directory and it was only five six years ago was told by a recruiter it would take him 5 years to become a pentester so one don't believe recruiters which negates this whole topic um because most recruiters don't know but there's a lot of things you can do so please remember that you have something to offer you just need to work

out what it is and this goes for folks that have never worked in it before so things to bear in mind is in cyber security yes it's basically a technical industry but you don't things don't happen if you can't communicate if you can't influence and it doesn't matter if you're a pentester who's basically hacking because if your report is garbage and that doesn't influence change in your customer or your company then you could be the best hacker in the world but if you're if you can't write a report that influences change that has actually impact in the business then you're no good you could be an average pentester but fantastic at writing reports you actually make a difference

so there's lots of things out there where there's people that come from Hospitality backgrounds working in retail your customer facing skills working under pressure like there are some really good people out there for example that have worked in the kitchens working as a chef working as a cook like if you work in a sock you know that's very transferable there yes it's not technical but you can work Under Pressure so again it's knowing how to extract this role here and the similarities um so again I've gone off topic a little bit here but I think it's really important that you for most people you have something to offer you just need to work out what it is but essentially you

need to build out those connections in the first place to understand what is what is the skills Gap what is the experience Gap but also what you can bring to the table as well and then repeat so I'm just going to show you an example I'm desperate to try and get that to 41337 so if anyone wants to follow me you're very welcome to um so just like resumés this is an this is an opinion so what I say is not fact it's just my opinion that works for me and works with some other people too first of all is LinkedIn recommends that you complete these I think seven steps or nine steps whatever is for an Allstar

profile follow the advice don't follow the advice about giving your passport details to verify your profile like no I'm not giving that company that information but essentially just fill in the gaps of the other stuff so here I've got a a headline they call it so when someone searches something on LinkedIn um essentially they'll see like my profile they see the headline so straight away people hopefully understand that I recruit in cyber security and I'm involved in the community like that's I'm happy people knowing that and if they're interested they'll look at my profile then you've got the about section this is think of LinkedIn as your online CV I know people that put put more effort into their resume than

their LinkedIn profile the reality is there are way more people that are going to see your LinkedIn profile that will ever see your resume so either transport trans F the information over or just put more effort into your LinkedIn profile so quickly if someone just looks at my profile they'll see that I run cyberset people we're a recruitment business um they'll see that I've done a bunch of Industry stuff and that I'm passionate about neurodiversity those are the key highlights so if they like it they'll they'll continue then you've got your posts um I said recently like again I'm a bit sporadic with my posts I've posted I think three times in the last week but

here's a post on this conference i' like to mix it up I love memes and just creating them sometimes they work sometimes they don't but um I just try and add a bit of humor um no offence to students out there I'm sorry um and then I post the odd job post as well um but I'm not a recruiter that's just posting job post job post job posts I'm trying to offer value you might Rec recognize that um so there's my sort of two three posts about the conference and then upcoming stuff but again I'm a recruiter we we're working jobs of customers but hardly any of my posts or one in five one in seven are

actually about jobs so again I like to share insights I like to share advice um because if I'm honest with you people get more value out of that stuff than the odd job placement and then you've got your job stuff so I'll hold my hand up here I haven't done a great job of it mine's pretty nothing like that is literally the description of my my job I've been running this business for over seven years now but it's quite self-explanatory but you can do this in your job again think of it like your CV you would write what you do in your job um because ultimately the more information you have the more people going to find you and just to sort of

reiterate what I said earlier about connection requests I can't accept any more connections I've I've nearly Tapped Out CU Link in I think it's 30,000 connections they allow you to have um and I'm sorry for any people here that I'm sort of sharing names and stuff but if I just scan through this they'll see one thing here but the rest like it's I'd say less than 5% of people actually write anything and normally when I could accept LinkedIn requests I was lck my in clients to accept the ones with messages um so again if I were you I'd be adding a just a simple message um essentially to connect with people and and why you'd

like to connect and talking of connecting I'd like this to connect there we go so resumés um like honestly resumés no one likes them no one likes to read them um we're in this this holding pattern until some something changes if I'm honest this where I think linkedin's pretty helpful because ultimately I I actually don't disagree with this stat and it's a really horrible thing to say out loud um but I don't read CVS um I no offense but I'm not interested um what I am interested in is scanning your CV for certain data points so I want to see your job titles I want to see where you've worked I want to see the how long

you've worked in organizations hopefully you've got some stuff in there on what you actually did not the activities but what problems you solved what what difference you made to a business and then maybe some sort of technical stuff if you have technical skills in the profile that's enough ultimately most people are not very good at selling themselves we're not taught how to sell ourselves but this can be really helpful where again I'm just scanning something because I'm more interested in getting to know the human behind the resume so no hiring manager if a com if a company advertises a job and someone showed me yesterday today they had 3 approximately 370 applications for a job no one's reading that like if it

takes Let's Pretend two three minutes to go through that like you're talking close to a th minutes 7 800,000 minutes to go through the resumés then get back to every single person like it's challenging and recruiters get a bad rep and if I'm honest I think that's right most of the time um you can still respond to people say they're not successful because at least it gives people closure But ultimately looking at LinkedIn looking at a resume I'm just scanning for data points so again it's about the right information um so I talk about this then I talk about the importance of what information to actually put on there but essentially we don't like writing them people don't

like reading them and it's it it sucks um the truth is keywords do matter um there's certain things on a resume and again this is just opinions because I I shared and I'll share with you as well an example resume um how we doing for time by the way how we doing for time that's okay um so keywords do matter and it's about the right information so I'm just realizing I got 13 minutes and a bit more to get through so I'll rush but essentially there is no excus excuses for certain things things poor formatting on a CV in terms of like grammar and stuff like that there's just no excuse with the tools that we have

out there spell check and grammarly and whatever like what really makes me laugh is when you see attention to detail on as a skill on someone's TV and then they've not spelled certain words correct um interesting um being too vague generic um people don't this is a tough one tailoring your application to a job but essentially if you can see what they're hiring for then you can tailor it but you tailor only small parts like you only need to do a few little bits um you don't have the important information in there and too many pages is a real bug there so some people say one page some people two pages I won't pretends there's like a magic number I only say

there's there's just too much is the wrong thing so what happens with most people is they don't start from scratch they'll have a resume they've had for years then they either need a new job or they want to get a new job so then they update their resume so they've already got this four or five page resume now they add their new or the latest job on there and they just keep adding adding adding and now now we've got six seven eight page resumés and the truth is no one's reading that so resume writing is a skill personally I I don't think you need to pay someone to do it I know I know there are people out there that do

it and if there's anyone in this room no offense but maybe you are good at what you do but there's too many times where I've seen resumés from people that have paid a lot of money and it's um they could have saved money and just done it themselves with just advice in my opinion um these are some of the most nauseous creating words I see on TVs like it's different if you can back up things but if you just put um you know terms of your soft skills or skills that you're a team player you are passionate you're Innovative will validate that back it up with examples but essentially they're just they're just words and you need to be really

careful again resume writing is a skill and if you can demonstrate the ability to articulate very concisely you're showing another skill set as well again which is really important in an industry where you're trying to communicate you're trying to influence other people to make decisions so if possible I'd say like take some of this stuff off because it just it's just words it mean it means nothing in my opinion some of the most important things you can do is outcomes so a lot of people their resume will look like they've just copied and pasted a job description of just list of responsibilities the reality is a job jobs in different businesses look the same if you're a

level two sock analyst in one company chance desire level two socker analyst bar a couple of things is very similar same as pentest over here pentest over here but if you talk about the actual outcomes you delivered the difference that you made it's a weird analogy but if you imagine you have a twin you both go through the same education you then go and work at different places but you're both working the same job you have different experiences depending on way you work and it's the difference that you personally made the impact that you made and when you can convert that into metrics again you're showing yourself up here to compare to most people so also on a CV for someone who

like who was working in a sock managed to responded to security incidents well yeah no that's the job but what did you actually do and when you can basically break it down to something like this where you reduced downtime or you reduced different things or you show saving money you're shown that you have a real impact on the business itself this is what most pentesters resumés look like is it will say pentester company the time they work there and they will just list web apps mobile apps and code review or something like that and again no that's the job you you hacked stuff well done but what did you actually do what difference did you make for your for your customer

or or other organizations and and again if you can show Saving Time saving money reducing things again you're showing real impact to the organization itself a takeaway really about resumés if going through all of that for me trying to condense it down if you can demonstrate these things then you're doing a better job than most people in my opinion you focus on the like if your resume is three four pages it doesn't matter it's fine um but if you can just again demonstrate outcomes achievements making a difference that you made that's it that's that's you honestly above 95% of most people because most people don't do that here's an example CV some people might not like this and that's perfectly

okay but in this scenario I'm a level two sock analyst and I want to step into more of a level three type role I'll try and zoom in so bit like LinkedIn I've got my sort of headline where I'm doing basically that's the role different scenario here but I'm putting I'm an Australian citizen what that does do that basically says to a potential employer you don't have to worry about working rights I can work here obviously that needs to be validated but essentially that stops a lot of applications because a lot of applicants don't have working rights and essentially unfortunately a lot of organizations may not be able to hire someone that needs sponsorship um location I don't put my

address I put basically the city or state that I'm in a company does not need to know your address if you think about your resume chances are at some point it's going to get leaked somewhere so think about what information you want leaked from your resume um real scary thing is I've had resumés from people from overseas and they've had their passport details they've had their their parents passport details I don't know what the thinking behind that is um but that person apparently works in security um go fig go um I'm very conscious of time so I try and uh get through this without over overdoing it essentially I've got my profile here I talk about

who I am what I do and what I'm looking to do next um I talk I have skills on there so this is I did actually share this on LinkedIn and some people gave different feedback and again that's okay but I'm thinking about my perspective as a recruiter I'm searching for keywords I'm searching for certain data points and if I see certain information in terms of the key skills um you know certain Technologies I'm interested for example if I see a level two stock analyst with good python skills and instant response I want to talk to that person it's as simple as that um again some some companies will hire very sort of um Hy people because of their certain

vendor skills um the reality is and I forget the the recent headlines but a lot of companies will look for people with crowd strike skills because they're already using in our environment and they might not need to then train that person up so that can be helpful in this job here I'm not listing my my responsibilities because ultimately I'm expecting this person this job to to be reviewed by someone who knows what they're doing it's not always the case but I'm hoping they know what they're doing they know what level two sock analyst does so I've just got a high overview there but then I'm talking about the key achievements where I've made a difference same again I'm not listing

all the stuff that I do in my job because ultimately that's just the job itself that's just the activities but again we're are making a difference um I like to put this on here what was interesting is some people didn't didn't think this makes sense in terms of conferences and meetups personally if I see someone's resume and they're going to Black uh Biz Las Vegas they've gone to Defcon I'm thinking okay well you're you're my sort of people um you invest potentially you're investing your own time and your own money for yourself that tells me you give a about your job your career and you're actually interested there'll be certain conferences that happen that are that

are more corporate and that I know this is during the week I'm on Australian time zone I forget what day it is um but there'll be some conferences that are on a Tuesday and Wednesday and it's more formal it's all suits and it's basically people are there because they have to be there a lot of community conferences tend to happen at weekends and that's where essentially people demonstrate they're there because they want to be there um you know when people give out their own time and their own money that's that tells you they care and again if you put it on a resume certain people will resonate a lot with that so so that is that part

and the question is are we going to get to finish this presentation in time here's the good news since you're the next presenter also I was thinking uh we could 120 more seconds and then if you have questions this panel includes him and you can ask him questions during the panel because it's going to be interactive does that work for every body all right no choice it works anyway this is okay I'm going to try and do this quickly this is one of the most important things I think in this presentation basically live job hunting um can someone give me a job title and a location anyone spr detection engineer Texas okay so let's pretend I want this

job I'm going to go on I don't know the best job board in the US but if we I know indeed let's just go indeed

so let's just go text this H okay yes I'm a human at least it's doing its thing all right so let's just pretend this role here it's first one so uh threat detection engineer we Quarry group in Houston so I'm going to take the company name I'm going to go on LinkedIn if I can go on LinkedIn I'm going to search the company name so we go mcui actually an Australian business um I'm going to all the employees and let's just put in threat

detection four people aren any of these the manager maybe not the job title might so the job might say who it reports into sometimes they do so our Global threat an instant Response Team uh okay so let's just go cyber threat then

right six

people okay I'm going to say it's not any of these I don't have the time to go deeper but let's just pretend it's uh Samuel but J because he's a graduate let's just pretend it's Samuel I would then I'd go through the process I would apply online for the job but I would then sends Samuel a message and say hey Samuel I'm not being demanding or anything like that I'm just saying hey Samuel um I saw the role for threat detection engineer um looks awesome I feel like I could add some value I did apply for the role let me know if you've got any questions right just really simple all you're doing is flagging that

I'm interested in the job now if you've got a good LinkedIn profile this is why you build your profile in the first place is then they look at your profile and go oh this person's really interesting they might be what we're looking for then they tell HR or tan acquisition reach out to them and organize an interview basically trying to bypass HR you could do the same thing with tan acquisition but essentially you want to go to the person with the problem because they know more what they're looking for than tan acquisition or HR um I don't have time to go deeper but um hopefully that helps and if you want any any questions or reach out

after then please do so um in the meantime thank you for being here [Applause]