BSidesCharm 2024 - From Aspire to Hire: Navigating Your First Cyber Job

[Music] good morning everyone um this is my presentation called from aspire to hire navigating your first cyber job my name is Sully Vickers I'm a cyber researcher and developer at Lidos and a cyber security and information assurance student at WGU so first off we're going to go over our agenda today um we're first going to discuss who I am um my career trajectory so far as well as what I'm actually doing in my job second we're going to go over potential education paths for you as well as other resources we're going to go through ideas for staying upto-date on emerging Technologies techniques for marketing yourself networking strategies and how to land your first job as well as Ace your job

interview so my career trajectory first off I started my cyber security studies in June of 2022 I'm completely self-taught and my primary resource was try hackme as well as other CTF resources in July of 2022 I started um competing in various CTF challeng Alles most notably us cyber challenge which I highly recommend you guys check out I'm actually a teacher assistant for that as well as in charge of organizing our quarterly webinars in January of 2023 I started my first part-time job at metf I was in charge of auditing their cyber range as well as reconstructing their privacy policy to comply with gdpr and California privacy standards in April of 2023 so last year I spoke at

bid charm um for the first time I talked I talked about n um my experiences of entering the cyber security field as a 17-year-old and in May of 2023 um I spoke at the Sans AI Summit where I gave a lightning talk on the impact of emerging Technologies on education such as Ai and other things of that sort and in June I actually graduated school and I also started a summer internship in application security at Markel in October I started my bachelor's degree at WGU and in November where I'm at now um I started my job as a cyber researcher and developer full-time at lios so what am I doing in my job my primary responsibility is working on the

Cyber spear program spear stands for simulated production environment for adversarial response resp so what is cyers spear cyers spear is a fully functional cyber range in which which it goes through the full chain of attack I'm in charge of maintaining this as well as giving trainings to government agencies and other lios customers I was also on the proposal team for the tech approach to the to the Department of Homeland Securities Network cyber and cloud services request for proposal so let's go over um educ ational options I mean obviously we have our traditional option of pursuing a bachelor's degree going to an on-site College just your general four-year program and recently colleges have started started introducing fully online

programs in which they're self-paced similar to the one I'm in um I find this extremely beneficial as I get kind of frustrated in a general classroom setting I tend to learn at different Paces than other people um some examples of these colleges are WGU University of Maryland Global C campus and Purdue you can also pursue certifications such as those provided by CompTIA and Sands you can also often find free resources in free vouchers depending on if you're looking in the right places there's also free online materials something I strongly suggest as being self-taught myself I I would recommend try hack me as well as hack the box for those that are more advanced there's also as We Know YouTube that has

thousands of online resources of people just going through and demonstrating how to how to troubleshoot basic cyber issues as well as penetration testing and other jobs there also is the military route this is a more unique route I guess um you get to do the infamous gray hat hacking in which you can do things that normal civilians can't do such as attack other countries and you'll honestly get a more Superior education um rather than just pursuing your basic private sector job there also is um something called cyber corpse which is a scholarship for service program in which they completely pay your college tuition they give you a full stipend so that way you can support

yourself you know while you're in college because you have other expenses um and then in addition to that you repay them by working for the dod for x amount of years and you're actually paid while you're working for the dod so in addition to getting pre college you get a full-time job straight out guaranteed full-time job and you get paid for it so you get that necessary experience you need straight out of college I am not a part of this program however I I definitely recommend it I mean it's kind of seems like a no-brainer to me so for veterans in US Government um there's a program called fedvte which is a virtual training environment it's

provided by seesaw this is open to um it's open to all all veterans and other government uh Personnel there's also Syracuse universities onward to opportunity program it's free for transitioning service members current military personnel as well as veterans and Military spouses they offer certification training and I believe they will pay for one of your certifications something I just learned about yesterday is vetc they're actually upstairs if you want to check them out they offer education employment services and allow you to network with other veterans ideas for staying up toate on Tech obviously as new technologies are being created new vulnerabilities will be introduced you want to stay up-to-date on Tech so that way you can

stand out within your field for example Microsoft offers free Quantum Computing learning in which you can learn Q sharp and they give you free credits for Azure Quantum so you can run your own Quantum programs there are also Al many Google in Amazon generative AI courses they're they're just with a quick Google search you can find thousands of these courses and you can also create personal generative AI prog uh projects running off of a GPU or using a cloud service provider with free credits that are available there are also different programs in which you can run it off of your CPU something that's extremely important in cyber security and people often miss is marketing yourself something I

suggest you do is create a brand and make yourself Stand Out find something unique about yourself that that the differentiates you from the rest of the crowd for example something I often Leverage is my age um there aren't many 18year olds that have a full-time job in cyber security but for example you could be a career switcher and and you may have an interesting uh an an interesting career path you may have been an ex- teer and something in addition to that you can do is produce content such as speaking at conferences or being on podcasts and you can actually talk about what your career transition was coming into cyber security this may be a good

option for you if you don't necessarily have a lot of experience but it will it will continue to get you out there um compete for awards you can compete in CTF competitions and other cyber security competitions to receive recognition for the hard work that you've done this will allow you to meet um several hiring managers as I know lots of CTF programs will will give you a pipeline to doing that such as us cyber challenge um you can you also need to practice your soft skills a as many of you know majority of us are nerds and we aren't inherently extroverts so something you can do is participate in Toast Masters um and practice your public speaking skills or

go to local meetups so that way you can get out of your comfort zone for example example me up here speaking is not something that I'm overly great at however I like to put myself out there and do things that I may not overly enjoy I guess if that makes sense networking strategies congratulations since you're in this room right now you're actually at a conference believe it or not and so conferences are obviously a great um tool for meeting new people something I like to do is if I show up to a talk early and I'm sitting next to someone I don't know I like to introduce myself for example I will ask them what

their current career path is like maybe they're studying and I'll ask for advice as well and maybe even ask for their uh for their LinkedIn to make a connection to expand my network something else you can do is seek mentorship more experienced individuals are an extremely valuable resource they can often times connect you with other experienced individuals and maybe even hiring managers something I like to use is Discord servers try hack me as well as hack the Box have pretty nice Discord servers with the with a large community so I will go onto those servers and ask to compete in ctfs with people or just for fun and I've actually met a fair amount of people doing this people that

are self-starters and go-getters something else you can do is post on LinkedIn asking to connect with your network often times people will reach out to you and you can have some pretty interesting conversations in doing that Landing your first job something I will emphasize again and again is networking all of my jobs that I've received are through networking because just shooting your resume out into the void on LinkedIn it's really hard to get noticed especially when there's like 500 applicants on a job there's a large competition and there's a chance that that the uh hiring manager won't even see your resume so having an in and having someone that can refer you is extremely valuable Target startups or nonprofits

for experience you can go to something like a loc local church or maybe Red Cross or something um nearby that's a very small program and asked to assess their cyber posture if possible you can ask you can do it for free maybe or or request a very low salary I do understand that lots of you guys are career switchers you may have full-time jobs you may have families um however what you can do is if you have free time that you're spending on studying maybe substitute that free time with actual with an actual job so you can build job experience for your resume I'm sure you guys have seen lots of those entry-level job postings uh

entry that are like 3 years of experience and all that in that sort of thing so you can actually build up experience prior to that acing your your job interview once you've applied to that job and you've gotten your job interview it's important to study your employer beforehand you want to actually understand what their business model is as well as what their core values are often times employers will have a page on their website discussing their mission And discussing what ethics they value um what kind of people they look for it's and it's important to study that practice common interview questions we all know the basic questions the uh what are your what are your uh strongest skills and

weakest and that sort of thing um so study those and in addition to that you can look through the job posting and actually research um common terminology within that job posting make sure you fully understand it and make sure you study it so that way in the case that they present you with any questions based around that which they likely will you want to be prepared ask thoughtful questions at the end of every interview you know they generally ask if you have any questions and you want to come prepared with questions maybe about the company maybe about something discussed in the interview because it shows that you have a high level of interest in the company

and as well that you're actually a go-getter you study beforehand and you prepare for things that you're trying out for thank you guys um do you have any questions

yeah sure so the question was um how to add ctfs to your resume something I would suggest is if you placed High obviously put that um and in addition to that let's say you didn't Place overly well um you could say what skills you learned what skills you exhibited on this CTF as well as just having the CTF that you competed on there I think is a great addition to your resume because it shows that you're going and doing things outside of work it shows that you have a passion for it and an actual interest

okay one you're probably a lot smarter than you think you are um you're actually doing cyber security within your second year of Community College where most people that are just going through a normal degree program they haven't even touched on their actually um they haven't touched on the actual purpose of their degree until like junior senior year you know um so profit you for that also I mean I think you can do lots of self-studying I assume that is that what you do now mostly or is it taught through your community college as well

okay um I would recommend again my primary resource try hack me um majority of it's free um they have lots of different courses walking you down specific job paths for example if I want to be a sock analyst they'll teach you how to use Splunk and teach you how to do maybe packet analysis and that sort of thing um yeah there's also anti-syphon training by Black Hills you know they're they're here um they're they're pretty good resource I know John strand puts out his uh sock core SK core skills whatever it's called um and I believe it's free so that may be a good option for you as well yeah yeah me too yeah

yeah yeah those are definitely great

resources yeah yep um as you can see there are lots of great resources just from those around you [Laughter] so yeah you after this talk you're going to get like

swarmed what was your question there

don't

gu

I at a lot of

bes

yep back there

all

it people

you're okay um well thank you all for coming to my talk um feel free to come up and approach me and talk to me after if you'd like thank you [Applause]