BSidesNCL (Newcastle) 2022 - Main Stage

things you learn at b-sides newcastle yesterday we found out that dan card is an avid golfer hey dan [Laughter] so make sure you mention that to him when you see him oh yeah my gmail's there not a very good lawyer but i haven't got much money announcements you know about canteen being closed i don't know what's happening later by the way apparently brian welton's organizing everything so um there may be not mistake again and newcastle are playing crystal palace today so town's going to be quite busy tonight i feel so um good time to have a fight that's what chris and i did last time we didn't actually have a fight we stopped to fight and then the guy got knocked out after we left which was deserved i think he was a dick and my second screen should be here he tried to to uh he kicked the taxi we were in and then tried to fight a very small taxi driver at the taxi rank where the other taxi drivers were yeah this is a really good video we might play that video later [Laughter] anyway he got knocked out not by us because we don't break the law we make the law are we good yeah it's yours right big big big round of applause for rose please [Applause] he's gonna help us get jobs i've not spoken for a long time in public so this might be a little bit rusty i'll just put out there now um so who am i i don't know how to use this so i think i'll give up in a minute no no give me one second i'm suddenly at the end i'm gonna present via memes uh i can't get this can i have a oh i told you it's gonna be rusty how do i get so i can move my slides i've just gone straight to the end oh have you all right okay perfect right okay sorry who am i i'm rosie anderson i do not work in tech i work in recruitment and i've been doing that for two decades despite my slightly hungover babyface um the last seven years i've worked in cyber security recruitment so over the past two decades i've helped hundreds of people get jobs in either tech or cyber i'm head of industry mentoring for capstock which i volunteer to do uh caps locks a boot camp i'll talk about that a bit more in a bit i'm a working parent i've got two kids um so i'm an advocate for advocate for flexible working for people not just parents but for everybody and i'm a retired party girl so last night i might have been a party girl but not today um so i'm to do this talk in two half i'm going to talk about hacking your career for 10 minutes and ask you can then ask questions and then i'm going to talk about how to hire how to hack that recruitment process um so feel free to ask me questions so you want to work in cyber so i'm going to aim this at people who are new to the industry so saying you want to work in cyber is like saying you want to work in science the field is so broad so if that's what you want to do you think right i do want to find out what this sexy cyber security is all about you need to start thinking about what areas of cyber you want to work in and there's what's your motivations what you kind of enjoy so you can find the right path there's so much free resources out there if you go onto youtube and watch the crest day in a life you can watch the day in life of a pentester the day in the life of a red teamer and you can get some insights as to all the different types of roles in cyber so before you kind of go out networking with people have a bit of an idea so you can really help people pinpoint the advice that they give to you there's so much more to life than just being a pentester or being a stock analyst there's so many roles in cyber security if risk is your space there's so like so many different opportunities and paths that can go down um there really is a role for everybody so there's devsecops there's risk management there's identity access management there's building secure systems we need so many different people in cyber you can bring transferable skills from anywhere so like i said it's really broad this is just i'm sure it's probably some more stems since then so if you're trying to start out in a career and you think okay there's a lot of people trying to get into cyber security if you look at something like identity access management or cloud security it's somewhere that you can um really sort of it's not as competitive or there's not as many people saying i want to work in that area so i'm going to have a drink okay so you've decided what you want to do and where you want to work or you've narrowed it down a little bit so now we're going to build some technical skills if you're coming in from a starting point of zero in terms of technology like me you're going to have to start building some technical skills to prove your interests shall we say there's so many different opportunities here i've mentioned security plus network plus these are you can do some of the professor messer training for free um to kind of start building that knowledge and it is something we see on job specs for entry-level candidates you can go on to try hack me and then as you get a little bit more technical you can go on to hack the box and build out those kind of technical skills there are boot camps so capslock is a boot camp and there's fantastic opportunities to learn in that environment if you want a training obviously you couldn't go and get a degree for me i would look at a bootcamp um you can do so with capslot you can do it as a student loan so you don't actually pay anything back and still you're earning more than x amount there's discord channels and places where you can start to meet other techies like yourself so digital overdose capture the talent these are discords for rookies with experienced people in as well i've put simply cyber there they've got a really good um entry master risk analyst where you pay what you can and it's really really good content to start building upon that knowledge the advantage with all of these sort of labs that you can do on rangeforce and you get a shiny certificate and with that shiny certificate that's something that you can put on your cv so when you're applying for a job they can see that you are actually doing some self-study on your own and you like to learn so we've built some technical skills and then we're going to build some professional skills so what i would recommend doing um so is i'm going to start again any good pen tester knows that you can phone the box and get domain admin but actually now you've got to write a report so these are the professional skills that everybody's sort of going to need so if you want to be a pen tester when you've hacked the box or whatever you've phoned you then need to do a write-up about that you if you do that sort of write-up as though you're describing what you've done with a walk-through you're practicing those technical skills and then if you do a write-up as a executive summary of what you've done these are things that you can put in your portfolio and you can share on social media share on linkedin that shows your knowledge and your passion it's again something that's showing that although you don't necessarily have technical experience already this is what you've been doing um i think one of the really good things with the rise of discords and things like that is you can find a community like like here like at b-sides i don't know if b-sides has a discord but you can find a community of people who want to help you learn and build upon those technical skills and start writing that blog that is one of the ways that you're going to get a role um an entry level role and make yourself sort of known now i know some for some people they don't really like linkedin or they feel a bit scared about sharing your first things i would say you know you're at b-sides here now you're networking networking on linkedin is not scary it's it's way less scary than speaking to strangers in person so let's hack your career you've done all these things um you see a job advertised on linkedin or wherever don't just apply for that job that's what everybody's doing contact the hiring manager figure out who's going to be the hiring manager there figure out if you know somebody who works for that company so if company x if national grid is hiring for a stock analyst go and speak to somebody that you know at national grid ask them about the culture ask them why they're a great place to work you're socially engineering your way into speaking to that person who's potentially the hiring manager network with people at all levels network with people who are doing the job that you want to do and ask them you know how how did you start how what would you do if you were back in that position um these are the sorts of things like i say if you don't if you're networking on linkedin before that job's advertised and you're doing all these posts of what you're learning and the journey that you're on you should then get notified about opportunities before you even um before they go live to market this is how i would get my first job if i was in that situation i am obviously a recruiter chances are you're not going to get your first job through a recruiter like me um because a business won't necessarily want to pay a fee because they pay fees to recruitment agencies for firemen talon now the only thing i will say is if you want to be a sock analyst go and speak with renee and tarzo that's all he does that's all he recruits for and he helps lots of businesses build socks um any questions sorry it's very hot up here oh sorry yes there's a level four apprenticeship i think in cyber so one of the people um that i placed without a degree in a consultancy actually she'd done that apprenticeship and i think apprenticeships yeah we do see it they don't necessarily come to recruitment agency and it's one of the things i recommend to customers and say when you're hiring talent it shouldn't just be experience talent it should be all these different routes what we also find is i think we're the thing with apprenticeships even apprenticeships are heavily competitive so i'm pretty sure there was a guy at an automotive finance company shared they wanted to hire an apprentice but even people coming out of uni school or university they're not get being given this advice they're just applying for jobs and i think even at that sort of level you need to be doing something to make yourself stand out and not necessarily you don't have to have technical experience but even apprenticeships are really heavily competed i think what companies is that the word in cyber any other questions because i fixed the mate nope um you always get the best teams when you get a diverse workforce how do we encourage people from non-traditional backgrounds to apply for for jobs in cyber oh tough one um pizza yeah yeah i think a lot of companies will allow or should be allowing their staff to go out and do stem outreach so there's plenty of stem events i actually think we are getting more diversity in terms of diagrams degrees i think that's starting to turn the corner but actually going out and hunting for that talent where if you want to hire apprentices going out to the colleges and saying hey we're hiring or going out on on linkedin you know so many jobs are found on linkedin and saying does anybody have a teenager or child or can anybody recommend and normally it is those sort of networks i think what besides do fantastic as they have careers tracks for kids and they have you know it's a friendly environment steelcon does the same don't they but it shouldn't just be about kids it should be about everybody and there's a big push to reskill the workforce so capstock again um they're re-skilling people in cyber and that's what we need but if you're hiring if you're company x sorry i'm going to use national good again because you're there if you're national good you should be going out to people within your business to say the itv team is crying out or the cyber teams crying out for people is anybody interested doing meetups um like meetups i know ladies hacking society is fantastic to get with meetups and things like that but just sharing the knowledge like that again this is why b-sides are fantastic sharing the knowledge of what we're doing and it's not just you know i.t network room and it's not cyber with the hoodie um sort of bringing the people alive of what we're doing i hope that answered it i'm regretting drinking last night just one comment on the last one sponsor a table at a b sites and have your team there saying that they're recruiting i've done it at two events yeah really good candidates from diverse backgrounds yeah and it doesn't cost a lot and i'm sure b-sides definitely always need more sponsors indeed all conferences not just b-sides but yes uh yeah lots of people need extra bodies and this is a nice way to meet people so remember introduce yourself to the people sitting next to you yeah and it's easier it's easier on linkedin right i'm gonna do the second half now so this is for people who are hiring and my advice and what i've learned so again i've been hiring for two decades i've been here for a long time doing this um yeah i'll just start that let's start with your job description the job description should be what you want from the candidate and what they need to do what they're going to be doing day to day what's a typical day look like what we see with job descriptions and recruitment is we get a job description and it's normally got a date stamp and it's about four years old now let's be honest the role will have changed in the last four years so the hiring manager should write the job description and fraying off then give it to hr to put whatever tools that they do to make it hrey um but then go and speak to the people in your teams and say is this right so we had this once in recruitment where people were coming in and thinking this was the previous company i worked at people were coming in thinking the job was going out and meeting people and all of this which it is the more senior you get but when you start you're on the phone speaking to people there's no face-to-face contact but it was in the job description that that's what it was so there's a misalignment um your job description try and take out all of the things you know really question do i need a degree that's my first question to a hiring manager if they put a degree on there degree or equivalent there's plenty of other equivalent experience than having a degree does it have to be x amount of years of this and i see all of the time and we place people all of the time that don't match all those things on the job spec if it's on there you're going to be putting people off now your job description is not your job adverts your job advert is why they should come and work for you so why are you a great employer why do your workforce love working for you why um you know why should somebody come and pick your job don't put on your job advert desirable skills because it will put people off as a female there's statistics that back this up i will only apply if i hit 70 percent of that criteria now i will also say apply if you hit 30 as a man you all apply if you hit 40 to 50 there's some statistics around the back of that so think about when you're advertising definitely don't advertise any desirable skills you can use that as part of your interviewing process um if you ask your current staff why do you like working here and they can't answer recruitment's going to be in your future so these are things to sort of work look at um now stop asking for x when you mean why so if we see a job spec that says um which i think of a perfect example had one i'm going to go through some good job specs in a second we see a job description this massive wish list let's just call it what it is do you really need that technical skill do you need this scene tool or can it be any seam tool let's widen out to try and make a job specs actually reflect the job so many times i see a job spec that's got well look at it it's like it's that's two jobs well that's three jobs like let's really narrow down what we're hiring for and then show the salary and if you say to me we can't advertise the salary because our current staff will get upset again i'm probably going to be speaking to them staff soon advertise your salary or put a range now i do get some people can't do this for whatever reason but you'll get 76 more applicants if you advertise the salary many a time i speak to a candidate who says oh i saw that job advert i didn't know what the salary was so i wasn't going to apply but yeah i'll apply through you rosie as a recruiter because i can advertise salaries same for benefits what are the benefits what are the real benefits don't just say you get a pension what's the percentage you get a bonus what does it look like please do this and it will help it will help you so much so some really good job adverts so what you should be doing as well with your job adverts like this guy did he he's the cso this is a live role he's hiring he's shared it to say no anybody who's interested now what i love about this we're not looking for certifications or years of experience hooray and remote or at one of our office or a mixture you choose he has massively increased his talent pool because he's put that now when i clicked on the job the salary is on the job it's not putting on his post and the benefits are there and that's actually quite a decent benefit thing he's not saying you get 20 days holiday that's the minimum you can give somebody so many different things and he's talked about maternity and paternity pay so again he's showing that a really good company that's got some decent benefits now this one is so this is glenn skybet sent me this isn't a live job but again he's got a salary banding which is quite a wide banding and he's got some really good benefits but he also talks about the team's goal is lots of decent things in there which isn't just a list of technical skills and doesn't bring it to life i also again love the flexibility it opens up your talent pool now interviewing anybody that you interview you should give feedback to if they're giving up their time to come and interview with you even if it's a no you should give some constructive feedback because that person say it is a newbie and the person you had um you did a really good interview we thought your skills in x y or z were excellent but the person we hired we felt was a better fit where i think you could develop in the future if you focus on learning more about linux or active directory then come back to me in six months time that's constructive feedback you should have taken notes during an interview anyway so you should be able to give them something or at least very least tell them it's a no and the amount of people that i speak to that don't get interview feedback that person will never come and work for you again and when they get that first job you might want to hire them in six months time so anything you can do to show that it's you you're a decent person to be honest will help you when you're coming to recruit now you've interviewed your person i told you there was some good memes you've interviewed your person and they've got a 12-week notice period which is normal uh for a senior person you need to be speaking to them really regularly because just because you've offered them doesn't mean that all the other interviews they had aren't still hounding them it doesn't mean that their current employer has not gone oh [ __ ] we're going to lose this person let's offer them 10 grand more or that promotion that they wanted and all the way through that process all the way through that onboarding period before they actually start with your company one thing you could do is get somebody within the team to start reaching out to them invite them to any socials that you do invite them to meet the team come for lunch with the team because that's a