1
00:00:05,730 --> 00:00:10,880
Welcome back to Career Hacking Village, Hacking Career Village, whatever.

2
00:00:10,980 --> 00:00:17,080
As many of you know, I haven't had a lot of coffee yet today and it just doesn't seem like a HackerCon without a shot of tequila.

3
00:00:17,080 --> 00:00:18,760
So maybe I'll go do that.

4
00:00:18,760 --> 00:00:33,040
In the meantime, a lot of people in our community are frustrated with figuring out how do they go from one job that is non-tech, non-security related into being a security pro.

5
00:00:33,040 --> 00:00:44,400
And I'm so thankful that Alyssa Miller decided to tackle this topic and bring to us her insight, her wisdom, and her shared strategies on how we could be successful.

6
00:00:44,400 --> 00:00:45,280
Alyssa?

7
00:00:45,460 --> 00:00:46,220
Awesome.

8
00:00:46,220 --> 00:00:47,200
Well, thank you, Kathleen.

9
00:00:47,200 --> 00:00:49,940
And hey, everybody from DEF CON.

10
00:00:50,720 --> 00:00:54,260
God, what a weird DEF CON this is this year.

11
00:00:54,340 --> 00:00:59,540
Miss seeing all my buds, seeing all my Hacker fam, but here we are.

12
00:00:59,540 --> 00:01:18,640
And as Kathleen mentioned, I think we're all kind of familiar with the struggles of trying to find jobs in cybersecurity, especially if you're new and trying to make that transition from one industry into the security industry.

13
00:01:18,900 --> 00:01:22,000
And it's something that's very near and dear to my heart.

14
00:01:22,020 --> 00:01:26,520
So today I really wanted to go through some strategies with you.

15
00:01:26,520 --> 00:01:41,360
Let's talk a little bit about some of the problems that are out there and how we can tackle them, how people who are trying to find that first job in cybersecurity can really jump in and overcome some of those obstacles that unfortunately exist in the industry today.

16
00:01:41,700 --> 00:01:45,320
So to get things started, let me just share a little bit about myself.

17
00:01:45,400 --> 00:01:51,080
First of all, for those of you that don't know me, my name is Alyssa Miller, and I'm a hacker and a researcher first and foremost.

18
00:01:51,120 --> 00:02:01,660
I've been hacking all my life, bought my first computer when I was 12, did some things of questionable legality with some online services.

19
00:02:01,940 --> 00:02:04,180
And it's kind of been that way ever since.

20
00:02:04,180 --> 00:02:05,560
You know, I taught myself how to program.

21
00:02:05,560 --> 00:02:09,220
I taught myself about modem communications and sort of dug in.

22
00:02:09,220 --> 00:02:16,660
And later on in life became a developer and finally jumped into the security industry as a pen tester.

23
00:02:16,720 --> 00:02:18,840
So I've been doing this pretty much my whole life.

24
00:02:18,840 --> 00:02:24,940
It's really my mindset is that of, I love tearing things apart, figure out how they work.

25
00:02:24,940 --> 00:02:27,940
I like to break stuff and I like to make it work better.

26
00:02:28,240 --> 00:02:34,820
So that career of mine has led me to where I'm at right now, which is a security advocate for a company called Snyk.

27
00:02:34,980 --> 00:02:48,880
Just means basically that my job is to get out in the security community and talk about topics that are important to us in security and how that ties in organizationally like DevSecOps and things like that.

28
00:02:48,880 --> 00:02:55,660
But part of my career journey has really centered on the fact that I've been a security leader.

29
00:02:55,660 --> 00:03:02,200
In other words, a manager, a hiring manager for 12 of the 15 years that I've been in security.

30
00:03:02,260 --> 00:03:11,540
It didn't take long after I took over that first penetration testing role that was leading that whole team and the vulnerability management program for a huge, huge organization.

31
00:03:11,920 --> 00:03:15,720
And so this is a space that I've worked in a lot.

32
00:03:15,720 --> 00:03:26,880
I have built a number of different consulting teams from the ground up where there was nothing that existed or a very skeleton crew and it needed to be grown quickly.

33
00:03:26,880 --> 00:03:37,340
And I've had a lot of success with that, but it's enabled me to see a lot of the struggles that people deal with from a job search perspective.

34
00:03:37,380 --> 00:03:42,660
And indeed, it's given me the perspective too of what are hiring managers looking for?

35
00:03:42,660 --> 00:03:46,180
A lot of times hiring managers have their own frustrations.

36
00:03:46,180 --> 00:03:52,000
I've had to work with recruiters and headhunters and job search systems and so forth.

37
00:03:52,000 --> 00:03:53,300
And so I'm excited to talk about all of that.

38
00:03:53,300 --> 00:03:59,640
And then finally, about me, I'm also the co-host of a podcast called The Uncommon Journey.

39
00:03:59,640 --> 00:04:06,140
And I bring this up because it's on this podcast that we focus on something that's really important to understand in cybersecurity.

40
00:04:06,360 --> 00:04:13,560
And that is that every one of us has a very unique and very different story about how we got here.

41
00:04:13,560 --> 00:04:17,400
I always tell the story, I started off as a pre-med major.

42
00:04:17,700 --> 00:04:21,100
I know other people in this industry who were wrestlers.

43
00:04:21,100 --> 00:04:25,940
I know people who worked in sanitation.

44
00:04:25,940 --> 00:04:28,940
I know people who were actors and did drama.

45
00:04:29,080 --> 00:04:36,000
And all of these people somehow ended up in the same place because they had an interest and a passion for security.

46
00:04:36,180 --> 00:04:44,760
So it's a great podcast, check it out, but more importantly, understand that concept that no matter where you're coming from, there's a place for you here.

47
00:04:45,600 --> 00:04:48,460
So I wanna start off a little bit of a story.

48
00:04:48,980 --> 00:04:54,200
And the story goes back to the title of this talk being about from a barista to a security pro.

49
00:04:54,320 --> 00:05:09,640
So some time ago, I was having a conversation with one of my colleagues and he was lamenting the fact that he was hiring for some positions and he was having trouble getting qualified candidates.

50
00:05:09,640 --> 00:05:13,760
And these were entry-level positions in the SOC.

51
00:05:13,760 --> 00:05:15,480
So he was in the security operations center.

52
00:05:15,880 --> 00:05:27,940
And along this conversation at one point, he brought up the fact that he had somebody who was a seven-year barista, had been working for Starbucks for the last seven years.

53
00:05:28,180 --> 00:05:37,160
And he was frustrated, didn't think that they had any place applying for a cybersecurity role because they hadn't worked in tech before.

54
00:05:37,160 --> 00:05:38,520
And so I started to question him about that.

55
00:05:38,520 --> 00:05:41,780
And I asked, okay, well, what qualifications do they have?

56
00:05:41,780 --> 00:05:49,080
Well, they had gone and they had gotten a computer science degree and they had achieved their security plus certification.

57
00:05:49,080 --> 00:05:53,720
I think he might've mentioned they were also working on a CEH or something like that.

58
00:05:53,980 --> 00:06:08,740
And so I started to ask him, I said, did you think about what it is that a barista does on a daily basis and how some of those skills might be really valuable to you in a SOC environment?

59
00:06:09,360 --> 00:06:10,420
And I started to go through them.

60
00:06:10,420 --> 00:06:14,620
And we're gonna talk about that more a little bit down the ways in this talk today.

61
00:06:15,320 --> 00:06:17,720
But I really started to, we dug into this.

62
00:06:17,720 --> 00:06:20,360
And by the end of it, he started to realize that, you know what?

63
00:06:20,360 --> 00:06:28,940
This barista might actually have some really good skills and might be the kind of person that they can build.

64
00:06:29,260 --> 00:06:35,620
So the point of this being, there's always that path in, sometimes it's not so obvious.

65
00:06:35,620 --> 00:06:41,740
And since hiring managers, recruiters, job search systems may not always see those connections.

66
00:06:41,740 --> 00:06:56,520
It's up to us as job seekers to help people see what those connections are and justify why it is that we're coming to this industry to start a career and why it is that you want us to be your next hire.

67
00:06:56,520 --> 00:06:58,720
So we're gonna talk all about that.

68
00:06:58,720 --> 00:07:03,180
But first, let's just start off with the state of where the industry is today.

69
00:07:03,180 --> 00:07:13,920
If you're looking to get into cybersecurity, chances are you've once or twice before heard this mantra that there's a talent shortage in security.

70
00:07:13,920 --> 00:07:21,720
There are studies, there are surveys, there are articles galore that speak to this every single day.

71
00:07:21,720 --> 00:07:37,600
If you go through any news sites related to cybersecurity or related to tech, chances are somewhere over the past year you're gonna find that they had some article that talked about the challenges of this so-called talent shortage that exists in cybersecurity.

72
00:07:38,560 --> 00:07:44,100
Now you see some things up here, for instance, the great cybersecurity talent shortage continues.

73
00:07:44,100 --> 00:07:49,180
And it's blown up really big, but the question always comes back to me.

74
00:07:49,180 --> 00:07:57,060
I start to wonder, I hear from a lot of people who are trying to find roles in cybersecurity and are unable to find them.

75
00:07:57,960 --> 00:08:04,580
And I hear from people who are experienced and who are trying to find new jobs and are having trouble.

76
00:08:04,880 --> 00:08:13,200
So you're telling me there's a talent shortage yet I'm hearing from all these people who are having trouble finding jobs.

77
00:08:13,260 --> 00:08:15,940
So what's the reality?

78
00:08:16,140 --> 00:08:21,680
And that's something that was, I really wanted to start to try to find some answers to.

79
00:08:21,680 --> 00:08:28,600
So at the very beginning of this year, I made the decision to do some research.

80
00:08:28,600 --> 00:08:31,080
And it's related to a book that I'm also writing.

81
00:08:31,080 --> 00:08:36,140
In fact, a lot of the stuff you're going to see in this talk today comes from this book that I'm currently working on.

82
00:08:36,140 --> 00:08:39,960
But one of the things I did was I launched a pair of surveys.

83
00:08:40,200 --> 00:08:47,140
One survey was targeted at people who had never worked in cybersecurity before and wanted to get that first job in security.

84
00:08:47,240 --> 00:08:54,480
The other survey was targeted at people who are working in security and already have some experience.

85
00:08:55,180 --> 00:08:58,160
I got over 1500 responses.

86
00:08:58,160 --> 00:08:59,960
So it was a very successful survey.

87
00:09:00,760 --> 00:09:15,520
But one of the questions I asked people, because I wanted to really understand this talent shortage in particular, I simply asked those entry-level folks, people who had never had a job in security before, if you're searching for a job, how long have you been searching?

88
00:09:16,080 --> 00:09:17,360
Simple question.

89
00:09:17,920 --> 00:09:22,160
And the results are what surprised me.

90
00:09:22,940 --> 00:09:30,160
We're talking about a talent shortage where employers are desperate to find people to fill these jobs they have open.

91
00:09:30,160 --> 00:09:40,600
Yet as we look at these numbers, I can see close to three quarters of these people have been searching for three months or longer to find a job.

92
00:09:42,220 --> 00:09:46,920
Over 32% of them have been searching for seven months or more.

93
00:09:47,220 --> 00:09:52,020
That's a long time to be out on the job market when you're looking for that first job.

94
00:09:52,020 --> 00:10:00,540
So if we have such a talent shortage, how come all these people are having such a hard time finding jobs?

95
00:10:00,540 --> 00:10:03,160
This is something I really wanna get to the bottom of.

96
00:10:03,300 --> 00:10:10,760
So you might look at this and you might say, well, yeah, that's probably because they're entry-level and they don't have any experience.

97
00:10:11,140 --> 00:10:15,980
And a lot of these jobs in security, well, they're looking for experienced people.

98
00:10:15,980 --> 00:10:17,320
And you're not wrong about that.

99
00:10:17,320 --> 00:10:19,000
You wouldn't be wrong to think that.

100
00:10:19,000 --> 00:10:33,300
And in fact, when I asked the same exact question of experienced people who said they were already looking, said they were currently looking for a job, the numbers changed a little bit, but they still didn't change a lot.

101
00:10:33,300 --> 00:10:40,880
We see, yeah, it went up to 46% that are less than two months in the job market, and that's pretty good.

102
00:10:41,100 --> 00:10:42,760
And that's what we'd expect to see.

103
00:10:42,760 --> 00:10:47,500
People with experience, there's high demand, they're finding jobs quickly.

104
00:10:48,180 --> 00:10:52,160
But what about the other 54% or 53 and a half percent?

105
00:10:52,540 --> 00:10:56,820
They're still taking three months or longer to find a new job.

106
00:10:57,440 --> 00:10:59,280
That's a long time.

107
00:10:59,440 --> 00:11:02,900
In almost a quarter of them, it's taking over seven months.

108
00:11:04,140 --> 00:11:08,960
So we see the same issues here, whether you're entry-level or whether you're experienced.

109
00:11:09,460 --> 00:11:17,260
So if there's this talent shortage, we have this high demand, 4 million jobs is one of the quotes you'll see mentioned recently.

110
00:11:17,260 --> 00:11:20,700
Over 4 million jobs are gonna be left unfilled this year.

111
00:11:20,700 --> 00:11:26,540
Of course, some of those numbers came up before COVID, so we'll see how that adjusts as people have adjusted their hiring practices.

112
00:11:26,700 --> 00:11:36,560
But that's a significant number to say that we've got these 4 million positions, but these experienced people can sit in the job market for seven months or more.

113
00:11:37,600 --> 00:11:40,940
So, all right, is it a problem maybe with the applicants?

114
00:11:41,720 --> 00:11:50,180
So in that same survey, I asked the people who were hiring managers, I asked them, hey, are you trying to hire for a cybersecurity position?

115
00:11:50,380 --> 00:11:58,700
And there were a good number of them that came back and said, yes, indeed, they were trying to hire for cybersecurity as well.

116
00:11:58,700 --> 00:12:07,180
And so I asked them, all right, well, what's the biggest challenge that you're encountering when hiring cybersecurity candidates?

117
00:12:08,180 --> 00:12:11,660
The number one was unqualified applicants.

118
00:12:12,120 --> 00:12:14,100
And this gets me thinking.

119
00:12:14,760 --> 00:12:25,000
That works maybe when we're talking about entry level people, but we're seeing all of these people with experience, with degrees, with certifications, everything else.

120
00:12:25,420 --> 00:12:31,340
How are we finding so many that are unqualified for the positions they're applying for?

121
00:12:31,920 --> 00:12:34,520
The second one is kind of telling.

122
00:12:35,040 --> 00:12:37,480
And this is where we're gonna start to dive in more.

123
00:12:38,400 --> 00:12:42,720
The second most common answer was struggles with job descriptions.

124
00:12:43,280 --> 00:12:53,800
Hiring managers, recruiters, they work together to put together these job descriptions, but it's not an easy job.

125
00:12:54,480 --> 00:13:10,700
And indeed, figuring out a way that we can word a job description that accurately captures the things that are important to us as a hiring manager, also are compliant with all the employment laws and everything else that we have to worry about.

126
00:13:10,760 --> 00:13:12,540
This is actually a lot of heavy lifting.

127
00:13:12,540 --> 00:13:14,460
And it's not easy to do.

128
00:13:15,040 --> 00:13:19,300
And so it's not really a surprise to me that I see this up there.

129
00:13:19,700 --> 00:13:22,200
Then we see lack of applicants as number three.

130
00:13:22,200 --> 00:13:24,100
And now I'm scratching my head again.

131
00:13:25,700 --> 00:13:36,280
Because how are we running into so many people who say they're in the job market for this extended period of time, but you're telling me you have a lack of applicants to your role?

132
00:13:36,880 --> 00:13:38,380
Well, how's that happening?

133
00:13:38,580 --> 00:13:47,800
So we're gonna explore those because I think those latter two in particular, job descriptions and the lack of applicants, they're actually really tightly related.

134
00:13:48,220 --> 00:13:52,060
So let's look at job descriptions for a minute.

135
00:13:52,060 --> 00:14:05,380
Because what I'm gonna tell you is that one of the core problems, when I look at why we're struggling to fill roles in cybersecurity, it comes down to that job description.

136
00:14:06,940 --> 00:14:14,880
So as a new security person, looking to start that career in cybersecurity, you might be thinking, hey, I wanna start my job as an intern.

137
00:14:15,080 --> 00:14:23,000
I wanna look for an intern role, especially if you're coming out of college or maybe you're wrapping up your degree and you're thinking in terms of intern positions.

138
00:14:23,480 --> 00:14:31,220
Now, if any of you follow me on Twitter, you've seen me throw out from time to time examples of bad job descriptions.

139
00:14:31,440 --> 00:14:37,800
Well, here's the job description from this information security intern position that was posted just a few weeks ago.

140
00:14:38,090 --> 00:14:44,190
Right off the top, a bachelor's degree in information technology or a technical discipline.

141
00:14:45,060 --> 00:14:50,480
So this is an internship they immediately want you to have your...

142
00:14:50,480 --> 00:14:53,200
They want you to have a degree already.

143
00:14:53,200 --> 00:15:05,030
So there's no flexibility here to say, have other experience that maybe plays in instead and can replace that particular role.

144
00:15:06,490 --> 00:15:08,950
The next one is what really trips me out.

145
00:15:08,950 --> 00:15:11,070
And this is something you're gonna see is really common.

146
00:15:11,910 --> 00:15:14,910
Certified in one or more of the following.

147
00:15:15,130 --> 00:15:19,550
You're talking about an intern and yet they're expecting them to have a certification.

148
00:15:20,690 --> 00:15:22,970
And if you look, you see CISSP is the first one.

149
00:15:22,970 --> 00:15:32,170
Anyone who knows anything about the CISSP knows that there's a minimum number of years of job experience that you have to have to get a CISSP.

150
00:15:32,170 --> 00:15:38,690
So how can any organization expect an intern to have a CISSP?

151
00:15:38,690 --> 00:15:40,590
This is simply not realistic.

152
00:15:40,850 --> 00:15:42,690
And then the last circle there.

153
00:15:42,690 --> 00:15:52,770
This is the one that set me off and resulted in a really long Twitter thread that ended up really kind of blowing up on Twitter for a few days.

154
00:15:52,890 --> 00:15:59,430
Minimum of seven years experience working in information technology security.

155
00:16:00,990 --> 00:16:02,810
We're talking about an intern.

156
00:16:03,570 --> 00:16:05,010
An intern role.

157
00:16:05,330 --> 00:16:08,730
These are the ones that you use to bring people out of college and into the workforce.

158
00:16:08,730 --> 00:16:11,970
And they want you to have seven years of experience.

159
00:16:11,970 --> 00:16:15,010
This is the landscape y'all are trying to conquer.

160
00:16:15,070 --> 00:16:20,470
So if you think you've got some key obstacles in your way, clearly you do.

161
00:16:21,290 --> 00:16:22,870
But it gets worse.

162
00:16:23,930 --> 00:16:27,510
Now here's one for, remember I talked about these experienced people.

163
00:16:27,510 --> 00:16:30,290
Here's one for an information security architect.

164
00:16:30,490 --> 00:16:34,110
And yes, I've protected the guilty here.

165
00:16:34,110 --> 00:16:36,790
I'm not gonna name and shame who this is.

166
00:16:37,050 --> 00:16:39,190
But take a look at this job description.

167
00:16:39,190 --> 00:16:43,530
So they start off with all the usual stuff talking about their company and their great culture and how wonderful they are.

168
00:16:43,530 --> 00:16:45,430
And then they start to describe the role.

169
00:16:45,430 --> 00:16:47,890
And you can see here's three bullet points.

170
00:16:47,890 --> 00:16:49,210
Okay, that's great.

171
00:16:49,490 --> 00:16:51,010
But it doesn't end there.

172
00:16:51,870 --> 00:16:52,970
This continues.

173
00:16:52,970 --> 00:16:54,470
This is the job role.

174
00:16:54,470 --> 00:16:56,810
This is what they're telling you and you're gonna do day to day.

175
00:16:56,810 --> 00:16:57,970
Now I've cut it off here.

176
00:16:57,970 --> 00:17:00,930
There's actually four more bullets that follow this yet.

177
00:17:01,210 --> 00:17:06,210
Who is this magic unicorn who's gonna fill all of these responsibilities?

178
00:17:07,090 --> 00:17:12,310
And if you look at them, I know they're hard to read because it's really, really, really small because it was the only way I could fit it on the screen.

179
00:17:12,310 --> 00:17:18,830
They're talking about everything from configuring ISPs and WAFs to working in DevSecOps.

180
00:17:18,870 --> 00:17:22,610
This like runs the gamut of everything that's in cybersecurity.

181
00:17:22,990 --> 00:17:24,710
But it doesn't end there.

182
00:17:25,570 --> 00:17:29,310
Let's go and look at their requirements for this job.

183
00:17:29,510 --> 00:17:32,330
So that's all of what you were gonna be doing if you get the job.

184
00:17:32,330 --> 00:17:34,950
Here's what they expect you to have.

185
00:17:34,950 --> 00:17:38,450
And these aren't preferred qualifications.

186
00:17:38,450 --> 00:17:40,630
These are listed as requirements.

187
00:17:40,970 --> 00:17:45,170
Required that you have every single bullet here.

188
00:17:46,850 --> 00:17:49,870
You wonder why this job didn't get filled.

189
00:17:51,110 --> 00:17:52,750
It's no surprise.

190
00:17:52,750 --> 00:17:55,430
So we're gonna dive into this deeper.

191
00:17:55,430 --> 00:17:59,770
But before we do, I also wanna share one more element of that survey.

192
00:18:00,050 --> 00:18:08,950
The last element of that survey was I asked job seekers, experienced job seekers, because I wanted to know people who've been around the block a couple of times.

193
00:18:08,950 --> 00:18:13,050
What do you see as your biggest struggle?

194
00:18:13,310 --> 00:18:21,390
And no surprise in light of everything we just saw, they come back and they say predominantly it's bad job descriptions.

195
00:18:21,390 --> 00:18:30,870
So when you have bad job descriptions like this that float throughout the industry, how can you expect people to even wanna apply?

196
00:18:30,870 --> 00:18:32,390
And indeed, this is what happens.

197
00:18:32,390 --> 00:18:33,910
You have these job descriptions.

198
00:18:33,910 --> 00:18:40,030
Sure, some people may apply and they might be underqualified because they can't even figure out what this company is really looking for.

199
00:18:40,030 --> 00:18:44,150
On the other side of it, you've got people who then just don't apply.

200
00:18:44,510 --> 00:18:53,150
So that percentage that said that they're having trouble finding job applicants, well, yeah, no kidding.

201
00:18:53,170 --> 00:18:56,650
Because when you have bad job descriptions, people don't apply.

202
00:18:58,350 --> 00:19:00,330
So enough of talking about the problems.

203
00:19:00,330 --> 00:19:03,810
I didn't come here today to tell you about how bad things are.

204
00:19:03,810 --> 00:19:04,450
We know that.

205
00:19:04,450 --> 00:19:05,950
You know that if you're looking for a job.

206
00:19:05,950 --> 00:19:07,630
You know it's a struggle.

207
00:19:08,130 --> 00:19:11,290
So let's talk about how we start to overcome some of these problems.

208
00:19:11,310 --> 00:19:14,990
And let's start by just looking at the typical hiring process.

209
00:19:14,990 --> 00:19:21,070
Because especially for some of you coming in as first-time job seekers, this might not just be your first time security job.

210
00:19:21,070 --> 00:19:26,430
This might be your first time really looking for a corporate level professional job overall.

211
00:19:26,430 --> 00:19:28,490
So let's just talk about this for a minute.

212
00:19:28,490 --> 00:19:35,050
The way it works in most organizations is really similar to what you see on this image here that I pulled from Jobscan.

213
00:19:35,050 --> 00:19:43,930
Now Jobscan is a company that produces one of what we call these application tracking systems or applicant tracking systems or ATS.

214
00:19:44,050 --> 00:19:49,830
So that's that automated system that collects all your information when you apply for a job.

215
00:19:49,830 --> 00:19:54,750
So usually what happens is they'll go in, they will create a job in that system.

216
00:19:54,750 --> 00:20:00,970
Now there's usually some stuff with approvals and things that happen before that, but a recruiter from the company is gonna go in and create this job.

217
00:20:01,070 --> 00:20:06,830
And they're going to attach to it a job description that the recruiter has likely worked with the hiring manager on.

218
00:20:06,830 --> 00:20:15,390
They probably have some standard job descriptions already laid out and they might work with the hiring manager to make sure that that's accurate for what they're trying to hire for.

219
00:20:15,390 --> 00:20:17,690
And then of course they publish it to the world.

220
00:20:17,690 --> 00:20:18,990
They put it out on LinkedIn.

221
00:20:18,990 --> 00:20:20,350
They put it out on job sites.

222
00:20:20,350 --> 00:20:23,770
They put it on their own job career board on their website.

223
00:20:23,850 --> 00:20:27,050
And they hopefully start getting applicants.

224
00:20:28,230 --> 00:20:29,950
Then they start screening.

225
00:20:30,450 --> 00:20:33,990
And they start screening each of these applicants and over stages they eliminate them.

226
00:20:33,990 --> 00:20:38,290
And then finally you get to the point where they select some and they interview them.

227
00:20:38,290 --> 00:20:41,490
And then hopefully they find the one they wanna hire and they hire them.

228
00:20:41,930 --> 00:20:48,110
What I wanna focus on here is this lower left where we see the applicant screening process.

229
00:20:48,110 --> 00:21:01,190
Because when I talk about how people fail to get into a cybersecurity job and how jobs fail to get filled from the hiring side, this is where the things fall apart.

230
00:21:01,390 --> 00:21:06,750
More than anything else, it's when we get into that screening process.

231
00:21:06,870 --> 00:21:09,850
So let's talk a little bit more about that process for a minute and what that looks like.

232
00:21:09,850 --> 00:21:16,930
In organizations where they're using an applicant tracking system, that is your first layer of filter.

233
00:21:16,990 --> 00:21:27,010
A lot of these systems have built in rules that immediately look at your resume and are going to identify very objective, tangible things that they can identify.

234
00:21:27,010 --> 00:21:35,970
And a lot of times there are algorithms built in there that will immediately, they may not actually delete you from consideration, but they rank you.

235
00:21:35,970 --> 00:21:43,990
They provide scoring that now the recruiters and the hiring manager are gonna look at to say, hey, let's prioritize these and look at who is most qualified.

236
00:21:44,210 --> 00:21:52,630
So it's important that we understand that that system is a crucial aspect in how we get considered for a job when we apply.

237
00:21:53,030 --> 00:21:59,330
Now it goes from there and typically a recruiter or someone in human resources is gonna look at that next.

238
00:21:59,410 --> 00:22:03,230
They're gonna get the ones that are receiving that and it's their job to screen further.

239
00:22:03,230 --> 00:22:06,070
So they're gonna look at your resume and your qualifications.

240
00:22:06,070 --> 00:22:20,010
And if you meet at least some of them, they're probably gonna get in touch with you because their job is to get in touch, talk to you and screen you and make sure that you do meet some of the, just the bare qualifications for that job.

241
00:22:20,010 --> 00:22:25,890
They're gonna make sure that some of the legal aspects of it are considered.

242
00:22:25,890 --> 00:22:35,490
So if you need to be, for instance, here in the US, if it's requires that you're able to legally work in the US, they're gonna make sure that you have whatever those legal qualifications are.

243
00:22:35,870 --> 00:22:46,450
They're gonna talk to you about some of the base skill sets and things that they're looking for, maybe ask you a little bit about your experience, but that's their job.

244
00:22:46,450 --> 00:22:53,830
And what they're trying to do is they're trying to filter out those applications before they ultimately submit them to the hiring manager.

245
00:22:53,830 --> 00:23:03,550
So the hiring manager and potentially their team and maybe some other managers and whatnot will be involved in the last steps of that screening process.

246
00:23:03,550 --> 00:23:13,850
So they're the ones that are ultimately involved in some of the interviews, and they're gonna make that final decision on who comes in for an interview, and of course, who they ultimately end up hiring.

247
00:23:15,310 --> 00:23:22,850
So understanding this process is important because more often than not, applicants do apply for jobs.

248
00:23:22,850 --> 00:23:32,690
I know people who have told me they've applied for 30, 40, 50 jobs because they're not hearing back, they're not making it through.

249
00:23:32,690 --> 00:23:37,530
And I start to question, well, if you're applying to that many jobs, how are you not getting calls back from any of them?

250
00:23:37,530 --> 00:23:38,990
That seems surprising.

251
00:23:39,630 --> 00:23:47,970
And indeed, when you're entering this world of searching for a cybersecurity job in particular, you're on the road to frustration.

252
00:23:48,610 --> 00:23:54,610
For those of you coming out of school, you may have had schools that told you, hey, just get that cybersecurity degree and you're gonna be all set.

253
00:23:54,610 --> 00:23:59,710
Or maybe you went and you got that certification and boy, they promise all these great things.

254
00:23:59,710 --> 00:24:09,410
Hey, if you just get this certification, everybody's gonna wanna hire you because 35, 40, 50% of people working in security have this certification.

255
00:24:09,410 --> 00:24:11,610
So if you get it, you can get a job there too, right?

256
00:24:11,610 --> 00:24:14,390
And then you go and you hit the job mark and it doesn't happen.

257
00:24:14,770 --> 00:24:17,030
So let's talk about how we're gonna get beyond that.

258
00:24:17,030 --> 00:24:22,990
How do we hack that system and make sure that you can get your next job?

259
00:24:24,230 --> 00:24:27,610
I'm gonna tell you, it starts with you.

260
00:24:27,730 --> 00:24:32,550
You are the first step and you need to understand yourself.

261
00:24:32,610 --> 00:24:38,710
Self-analysis is probably one of the most crucial aspects of getting a job in cybersecurity.

262
00:24:39,210 --> 00:24:43,010
I mentor a lot of people as they're searching for security jobs.

263
00:24:43,290 --> 00:24:48,810
And one of the first questions I'll ask them, someone will come to me, a lot of times they'll just ask, Kate, will you be my mentor?

264
00:24:48,810 --> 00:24:51,930
Which is a pretty vague request in general.

265
00:24:52,250 --> 00:24:55,490
And so I'll start to ask right away, hey, okay, what are your interests?

266
00:24:55,490 --> 00:24:57,270
What do you wanna do in security?

267
00:24:57,730 --> 00:25:02,930
And the answer that I dread, but I get quite often is, well, I just wanna work.

268
00:25:02,930 --> 00:25:03,790
I wanna learn everything.

269
00:25:03,790 --> 00:25:05,150
I wanna be in cybersecurity.

270
00:25:05,610 --> 00:25:07,250
Well, what do you wanna do in cybersecurity?

271
00:25:07,250 --> 00:25:07,910
Well, I don't know.

272
00:25:07,910 --> 00:25:09,130
I wanna learn it all.

273
00:25:10,890 --> 00:25:13,310
This image here is a wonderful image.

274
00:25:13,310 --> 00:25:14,650
I love this.

275
00:25:15,150 --> 00:25:19,090
Henry Jang put this together and he posted it in an article on LinkedIn.

276
00:25:19,330 --> 00:25:21,590
And I don't agree with all of how it's arranged.

277
00:25:21,590 --> 00:25:24,530
I would definitely change a lot of the aspects of it.

278
00:25:24,710 --> 00:25:36,590
But this gives you some idea of the amount of different opportunities, topic areas, skill sets, whatnot, that exist within this thing we call cybersecurity.

279
00:25:37,350 --> 00:25:43,170
So to say you wanna learn all of it, that's not a realistic expectation.

280
00:25:43,170 --> 00:25:47,950
To say to somebody, hey, I just wanna learn cybersecurity, that's super broad.

281
00:25:48,130 --> 00:25:54,350
How do you self-analyze and get to a point where you understand what it is in cybersecurity that interests you?

282
00:25:54,650 --> 00:25:56,110
Now, I've talked with people.

283
00:25:56,110 --> 00:26:08,390
Sometimes they're able to figure it out and we'll chat a little bit and when we get to the root of it, sometimes what I've encouraged people to do, go out, look at maybe five, 10 security-related blogs and news sites.

284
00:26:08,810 --> 00:26:14,290
Grab the first five headlines off of each one of them and put them in a list and rank them.

285
00:26:14,290 --> 00:26:18,450
Rank them in order of which headline seems most interesting to you.

286
00:26:18,830 --> 00:26:24,290
Now take the top five of those headlines and look for what's common.

287
00:26:24,290 --> 00:26:27,890
What are the aspects about those headlines that actually excite you?

288
00:26:27,890 --> 00:26:31,070
Is it because they're doing some kind of investigation?

289
00:26:31,070 --> 00:26:38,370
They're doing maybe digital forensics and they're investigating and you really like that idea of trying to solve a mystery.

290
00:26:38,370 --> 00:26:46,330
Is it because they've launched some new defense mechanism and maybe that's where you really like to sink your teeth into?

291
00:26:46,330 --> 00:26:49,770
Is it maybe headlines about new vulnerabilities that were discovered?

292
00:26:49,770 --> 00:26:56,810
And so, hey, that's starting to tell you, I really like this idea of vulnerability research and I want to start getting into things like pen testing.

293
00:26:56,930 --> 00:27:04,590
This is a great way to simply narrow down your interest and actually understand what is it in security that you want to be doing?

294
00:27:04,590 --> 00:27:07,890
Because this is a huge field and it's growing every day.

295
00:27:07,890 --> 00:27:14,130
As the digital world becomes more and more our way of life, security fits into every piece of it.

296
00:27:14,810 --> 00:27:18,690
Next thing you need to do is you need to be out there building your network.

297
00:27:19,330 --> 00:27:21,770
So you know what you want to do.

298
00:27:21,770 --> 00:27:27,190
Start interacting with people in social media, if nowhere else.

299
00:27:27,190 --> 00:27:37,250
If you go to conferences, I know this year it's different because we don't have the interactivity of being able to walk through hallway con like we normally do when we're at DEF CON and everywhere else and meet new people.

300
00:27:37,410 --> 00:27:38,570
But meet them on Twitter.

301
00:27:38,570 --> 00:27:43,430
Honestly, it's easier to meet them in social media first anyway and then find them at conferences later.

302
00:27:43,670 --> 00:27:51,490
But the key mistake I see made is interact with them.

303
00:27:52,050 --> 00:27:59,070
Building a network isn't just going out and following a bunch of people and trying to get a bunch of people to follow you on all these different social media platforms.

304
00:27:59,930 --> 00:28:01,330
It's interacting with them.

305
00:28:01,330 --> 00:28:03,090
The wonderful thing, I love Twitter for this.

306
00:28:03,090 --> 00:28:06,330
And there's a reason why security lives so strongly in Twitter.

307
00:28:06,610 --> 00:28:11,590
You can interact with anybody, as long as they haven't blocked you at least, so don't make them angry.

308
00:28:11,730 --> 00:28:16,450
But you can go out there, you can find the biggest names in the industry, you can follow them.

309
00:28:16,450 --> 00:28:20,770
And as they post things, you can respond and you can have conversations with them.

310
00:28:20,770 --> 00:28:26,470
Not only do you have conversations with them, but you may have conversations with their other followers who've also responded.

311
00:28:26,470 --> 00:28:35,270
Get engaged in those active conversations, ask questions, offer your opinions, be respectful, build that community.

312
00:28:35,270 --> 00:28:45,650
That's how you get followers, that's how you make friends, that's how you'll start to discover not just learning opportunities, but you'll start to find job opportunities.

313
00:28:46,010 --> 00:28:51,490
Now, LinkedIn is really great if you're looking really to, on a more professional level, of course.

314
00:28:51,650 --> 00:29:03,510
Not as active from a security perspective, definitely more formalized, but a great place, again, to start connecting with people who work for certain organizations that you wanna work for.

315
00:29:03,650 --> 00:29:06,890
Find those people, do a search.

316
00:29:07,190 --> 00:29:09,610
LinkedIn actually has a pretty decent search capability.

317
00:29:09,610 --> 00:29:20,130
Go look for people who work at a job that, or work at a company, excuse me, that is one that you wanna work for, and then look for the people who are in those security roles.

318
00:29:20,190 --> 00:29:27,150
Yeah, it's not the greatest search in the world, it does take some learning, but when you learn how to use it, you can actually effectively find these people.

319
00:29:27,590 --> 00:29:29,290
Add them, add them as connections.

320
00:29:29,290 --> 00:29:33,150
A lot of people on LinkedIn are more than happy to add connections all the time.

321
00:29:33,250 --> 00:29:36,530
Unless there's something red flagged about you, I'm gonna add you if you add me.

322
00:29:36,530 --> 00:29:42,010
So, make those connections, and again, now you can start interacting with those people when they post stuff.

323
00:29:42,010 --> 00:29:44,050
They'll start to see what you're posting as well.

324
00:29:44,050 --> 00:29:47,210
So, post good topics, concepts, things.

325
00:29:47,750 --> 00:30:01,010
Be out there, be active, but this is what I mean about being interactive and building that network, because now as you start to engage with these people and you build relationships, those are people that can help you find opportunities and help you land those opportunities.

326
00:30:02,090 --> 00:30:04,110
But now let's talk about the hiring process.

327
00:30:04,110 --> 00:30:10,230
So, we've worked on you, we've got you ready, but now you're gonna go and you're gonna start putting your resume out there to the world.

328
00:30:10,230 --> 00:30:12,410
Let's talk about how you beat the ATS.

329
00:30:13,050 --> 00:30:19,710
Those applicant tracking systems, they're used to varying degrees, different recruiters use them differently, different companies use them differently.

330
00:30:19,790 --> 00:30:23,290
But there's a few things you need to remember with the ATS.

331
00:30:23,290 --> 00:30:27,490
Most importantly, remember, this is a machine, it's software.

332
00:30:27,490 --> 00:30:36,810
It might be AI based, it might use machine learning and all these buzzwords that the vendors talk about that their products do, but at the end of the day, you're talking to a machine.

333
00:30:36,950 --> 00:30:39,670
So, let's think about some of the things that are really important there.

334
00:30:39,670 --> 00:30:44,470
First and foremost, when it comes to your resume, simple formatting.

335
00:30:44,570 --> 00:30:46,810
And there's a lot of aspects here.

336
00:30:47,170 --> 00:30:49,210
Use common fonts.

337
00:30:49,210 --> 00:30:51,130
Believe it or not, this can be an issue.

338
00:30:51,130 --> 00:30:52,950
Don't use wild, crazy fonts.

339
00:30:52,950 --> 00:30:53,970
Use ones that are common.

340
00:30:53,970 --> 00:30:57,570
There's no one specific that you have to use, but use ones that are typical.

341
00:30:57,570 --> 00:31:05,870
Colibri, Times New Roman, the ones that you typically see in documentation, other things, things that are easy to read.

342
00:31:05,870 --> 00:31:11,050
These are the ones that those systems can most effectively process accurately.

343
00:31:11,050 --> 00:31:14,050
And that's important, but let's go beyond that.

344
00:31:14,310 --> 00:31:18,150
Just format your resume in a way that's easy to read.

345
00:31:18,150 --> 00:31:26,930
I know we like to have things that stand out, and it's okay to have a separate resume that you're gonna hand to people, but the one that you upload to the ATS needs to be simply formatted.

346
00:31:26,930 --> 00:31:28,210
Don't put pictures in there.

347
00:31:28,210 --> 00:31:30,010
Don't put designs in there.

348
00:31:30,230 --> 00:31:31,630
Lay it out, structured.

349
00:31:31,630 --> 00:31:35,510
Use bullet points, things that it will be able to easily process.

350
00:31:36,710 --> 00:31:39,290
The second thing, and this to me is so crucial.

351
00:31:39,290 --> 00:31:41,750
I cannot believe how often people miss on this.

352
00:31:41,750 --> 00:31:46,670
And this, I don't care if you're looking for a cybersecurity job or what kind of job, this is something you need to be aware of.

353
00:31:46,670 --> 00:31:52,550
If you're trying to get hired, you need to be tailoring your resume to that job that you're applying to.

354
00:31:52,690 --> 00:31:56,490
This means for every job that you apply to, you should have a separate file.

355
00:31:56,810 --> 00:32:06,730
And literally, if I showed you my file system where I store my resumes when I'm applying to jobs, I've got a different one for everyone, and I name them with the date and the company of who I sent it to.

356
00:32:07,280 --> 00:32:07,970
Why?

357
00:32:08,310 --> 00:32:12,830
Because I need to be looking at keywords that appear in those job descriptions.

358
00:32:12,830 --> 00:32:16,830
What are the things that are most important to them in those job descriptions?

359
00:32:16,830 --> 00:32:18,730
What ranks highly in the requirements?

360
00:32:18,730 --> 00:32:23,190
And how can I work those terms into my resume?

361
00:32:23,250 --> 00:32:31,690
Not saying I have to have experience in that term if I don't have it, and we'll talk more about that in a minute, but at least make sure that you mention that keyword somewhere.

362
00:32:31,690 --> 00:32:32,910
Get it in there.

363
00:32:33,110 --> 00:32:35,770
Look for variations on that keyword as well.

364
00:32:35,770 --> 00:32:42,270
So if we think about penetration testing and ethical hacking, for instance, are two different variations that you might focus on.

365
00:32:42,270 --> 00:32:45,650
And make sure you're ticking all of those boxes.

366
00:32:45,650 --> 00:32:50,730
And sometimes those boxes, they can be pretty complex.

367
00:32:50,730 --> 00:32:52,470
They might include certifications.

368
00:32:52,470 --> 00:32:55,130
So I'm gonna talk to you in a second about certifications.

369
00:32:55,210 --> 00:33:03,950
But the last thing I'm gonna tell you with checking the boxes is make sure that you look at these step-by-step and lay them out.

370
00:33:03,950 --> 00:33:10,410
And know which ones that you wanna have in that resume because you need to make sure your resume touches all of those when you upload it to this system.

371
00:33:10,410 --> 00:33:11,430
Don't lie.

372
00:33:11,630 --> 00:33:13,350
Don't over-exaggerate.

373
00:33:13,350 --> 00:33:17,130
But make sure that you check the boxes that they're asking you to check.

374
00:33:17,130 --> 00:33:20,090
Now, as I said, one of those boxes is often the certification.

375
00:33:20,930 --> 00:33:26,190
And this is another extremely common question I get from people who are looking for cybersecurity jobs.

376
00:33:26,190 --> 00:33:27,850
They wanna know what cert to get.

377
00:33:28,010 --> 00:33:29,130
I love this picture.

378
00:33:29,130 --> 00:33:30,850
It was put together by someone on Reddit.

379
00:33:30,850 --> 00:33:32,730
I've got the credit down there at the bottom.

380
00:33:32,730 --> 00:33:37,690
These are all the cybersecurity related certifications you can get.

381
00:33:38,110 --> 00:33:40,770
And I said, CISSP is very commonly asked for.

382
00:33:40,770 --> 00:33:42,150
In fact, I did some research.

383
00:33:42,150 --> 00:33:47,030
I went through five different major job boards including LinkedIn and Monster.

384
00:33:47,030 --> 00:33:49,370
And I looked at what are they looking for?

385
00:33:49,370 --> 00:33:52,230
What is the most commonly asked for certification?

386
00:33:52,270 --> 00:33:54,950
Far and away, bar none, it's the CISSP.

387
00:33:55,170 --> 00:34:02,750
Now, I filtered out any jobs that were from the government because the government does have actually specific requirements around why they have to have CISSP.

388
00:34:02,750 --> 00:34:08,530
But more often than not, people say they want a CISSP, and here's the magic words, or equivalent.

389
00:34:08,950 --> 00:34:11,830
You don't have to have a CISSP to get a job.

390
00:34:11,970 --> 00:34:13,890
Just get a cert.

391
00:34:13,890 --> 00:34:17,670
Now, there's very few that as an entry-level person you can get, but there's a couple.

392
00:34:17,670 --> 00:34:24,950
The one that I recommend most often to people is look at the Security Plus because the Security Plus certification is one of the cheapest to get.

393
00:34:25,350 --> 00:34:31,370
It is attainable for anybody and it covers a wide breadth of security knowledge.

394
00:34:31,370 --> 00:34:34,610
It doesn't hamstring you into one specific area.

395
00:34:34,610 --> 00:34:38,890
If you go for like a CEH, well, that's very focused on ethical hacking and penetration testing.

396
00:34:38,890 --> 00:34:40,470
That doesn't make a lot of sense.

397
00:34:40,470 --> 00:34:50,450
If you look at the GIAC ones, the ones from SANS, well, one, they're super duper duper expensive, and two, they're very narrowly focused as well.

398
00:34:50,450 --> 00:34:53,310
So get something general, something that can apply.

399
00:34:53,310 --> 00:34:58,130
You're not looking to say, hey , I've got this great, wonderful certification.

400
00:34:58,130 --> 00:35:01,510
You're looking to check that box that says CISSP or equivalent.

401
00:35:01,610 --> 00:35:06,590
And I will tell you that having a Security Plus more often than not will be looked at as an equivalent.

402
00:35:08,570 --> 00:35:11,350
So you've made it past the ATS, congratulations.

403
00:35:11,430 --> 00:35:14,170
The recruiter is now looking at your resume.

404
00:35:14,170 --> 00:35:16,630
What do you, how do I get them?

405
00:35:17,050 --> 00:35:18,810
How do I get them on board?

406
00:35:18,950 --> 00:35:20,470
Well, you gotta inspire them.

407
00:35:20,570 --> 00:35:25,990
You gotta inspire that recruiter who's looking at thousands maybe of resumes in a week.

408
00:35:26,030 --> 00:35:33,430
You gotta inspire them to take your resume and pass it on to the hiring manager.

409
00:35:33,430 --> 00:35:34,810
How do you do that?

410
00:35:34,810 --> 00:35:38,050
Step one, be memorable.

411
00:35:38,390 --> 00:35:40,970
And I cannot stress this enough.

412
00:35:40,970 --> 00:35:46,710
And this goes beyond maybe having some unique formatting about a resume that you sent to them outside of the ATS.

413
00:35:46,710 --> 00:35:49,130
Again, don't use crazy formatting for ATS.

414
00:35:49,850 --> 00:35:51,590
Do something more.

415
00:35:51,590 --> 00:35:52,650
Be bold.

416
00:35:53,010 --> 00:35:55,890
If you don't have a blog, start writing one.

417
00:35:56,030 --> 00:35:58,530
That way you can link to your blog in your resume.

418
00:35:58,530 --> 00:36:01,590
I don't care if only five people ever read your blog.

419
00:36:01,590 --> 00:36:07,490
The fact that you wrote content and you put it out there immediately demonstrates, hey, I'm doing something in security.

420
00:36:07,490 --> 00:36:08,830
It makes you memorable.

421
00:36:09,430 --> 00:36:13,850
Create a YouTube channel and record videos that talk about different security concepts.

422
00:36:14,610 --> 00:36:19,110
One of my favorite stories, and this was actually as a hiring manager, this wasn't even at a recruiter level.

423
00:36:19,110 --> 00:36:24,770
I interviewed a person and then she moved on and she interviewed with some of the people on my team.

424
00:36:24,770 --> 00:36:28,210
And she didn't like one of the answers she gave them in this technical interview.

425
00:36:28,410 --> 00:36:41,550
So she immediately left that after that interview, went and recorded a YouTube video where she explained the concept in detail, talked about how to remediate it and so forth.

426
00:36:41,550 --> 00:36:47,690
And then she emailed that video link to not only the two people she interviewed with, but to me and the recruiter as well.

427
00:36:48,190 --> 00:36:49,670
That makes you memorable.

428
00:36:49,670 --> 00:36:51,610
That's something that stands out.

429
00:36:51,610 --> 00:36:57,030
So what I tell people, I borrow a phrase from a colleague of mine, Phil Gerboshek, who speaks all about personal branding.

430
00:36:58,850 --> 00:37:00,150
What's your weird?

431
00:37:00,830 --> 00:37:03,350
Figure out that thing about you that makes you unique.

432
00:37:03,350 --> 00:37:08,410
It may not be security related at all and highlight that in your resume.

433
00:37:08,410 --> 00:37:09,110
Own it.

434
00:37:09,110 --> 00:37:16,330
Something that makes you very unique from everybody else that, hey, I mean, for me, it's the fact that I bought my first computer when I was 12 years old.

435
00:37:16,330 --> 00:37:17,090
I was 12 years old.

436
00:37:17,090 --> 00:37:19,430
I saved up money with a paper out and I bought a computer.

437
00:37:19,730 --> 00:37:23,550
How many people do you know who did that, especially back in the late 80s when I grew up?

438
00:37:23,550 --> 00:37:24,630
Yes, I'm that old.

439
00:37:24,910 --> 00:37:29,150
So put those unique stories out there.

440
00:37:29,150 --> 00:37:33,570
That's the thing that when recruiters read through that, they see that and they're like, oh, hey, this is memorable.

441
00:37:33,630 --> 00:37:35,030
That's something that sticks in their head.

442
00:37:35,030 --> 00:37:37,850
And they're like, this is someone I want to know more about.

443
00:37:37,850 --> 00:37:39,550
And they'll get in touch with you.

444
00:37:41,390 --> 00:37:43,410
Link everything to those requirements.

445
00:37:43,610 --> 00:37:45,810
Now we talked about tailoring your resume already.

446
00:37:45,810 --> 00:37:47,270
This is that same thing.

447
00:37:47,470 --> 00:37:50,670
If you're talking to them, do the same.

448
00:37:50,670 --> 00:37:52,310
So you've gotten past maybe that resume.

449
00:37:52,310 --> 00:37:55,490
You've gotten that initial HR screening call now.

450
00:37:56,170 --> 00:38:00,710
Talk to them, but make sure everything that you're talking about that you somehow link it back to their requirements.

451
00:38:01,370 --> 00:38:07,790
And then finally, this one, I can't believe I have to tell you this, but unfortunately, as I talk to recruiters all the time, they tell me this is one of the biggest problems.

452
00:38:07,830 --> 00:38:08,970
Be responsive.

453
00:38:09,230 --> 00:38:18,790
If a recruiter contacts you and says, hey, I'd like to schedule a screening interview, respond back, respond back as quick as you can.

454
00:38:18,790 --> 00:38:26,710
Now, sometimes we're out on vacation, we're not checking emails, great, but make sure you're using an email that you check often and respond to them quickly.

455
00:38:26,850 --> 00:38:35,750
Nothing is more frustrating for a recruiter than when they see a candidate who they really like and they want to bring them in, and they try to get in touch with them and they can't get that person to return their calls or return their emails.

456
00:38:36,190 --> 00:38:39,210
And this is a huge problem that stands in people's way.

457
00:38:39,650 --> 00:38:41,210
So we can do better.

458
00:38:41,910 --> 00:38:44,310
Then finally, all right, so we did all that.

459
00:38:44,310 --> 00:38:47,070
The recruiter passed us on to the hiring manager.

460
00:38:47,070 --> 00:38:49,530
The hiring manager wants to know more about us.

461
00:38:49,530 --> 00:38:52,290
How do I win over the hiring manager?

462
00:38:52,610 --> 00:38:54,610
This is where things are crucial.

463
00:38:55,450 --> 00:38:59,270
First and foremost, this first of all is where you've got the opportunity.

464
00:38:59,270 --> 00:39:00,970
We're no longer talking about resume.

465
00:39:00,970 --> 00:39:04,590
At the point they call you in for an interview, it's not about your resume anymore.

466
00:39:04,590 --> 00:39:06,710
It's about you and what do you do.

467
00:39:06,890 --> 00:39:19,610
And in that survey, when I talked to hiring managers and the last question I asked them on the survey, the last question I asked was, what's one piece of advice you would give to people looking to get their first job in security?

468
00:39:19,690 --> 00:39:29,550
The single most common theme throughout all the thousand answers that I got, they all related back to passion, the vast majority.

469
00:39:29,610 --> 00:39:32,510
And you see some of the direct quotes here.

470
00:39:32,650 --> 00:39:34,670
How do you share your passion?

471
00:39:34,830 --> 00:39:37,410
Be excited about the things that you're talking about.

472
00:39:37,410 --> 00:39:42,510
If you built that blog, like I suggested, talk about it.

473
00:39:42,510 --> 00:39:44,010
That shows you have passion.

474
00:39:44,010 --> 00:39:48,530
That's something that's completely voluntary that you chose to do on your own.

475
00:39:48,530 --> 00:39:51,710
Or if you created a bunch of videos, that's something you chose to do on your own.

476
00:39:51,710 --> 00:39:58,070
If you engaged in labs and other things, that's all stuff that shows you have a passion for security.

477
00:39:58,230 --> 00:40:03,070
Make sure you share that when you're talking with the hiring manager.

478
00:40:04,270 --> 00:40:05,910
And then I'm gonna share this with you.

479
00:40:05,910 --> 00:40:12,230
So I told you I host this podcast and one of the people we had on was Malware Jake, Jake Williams.

480
00:40:12,230 --> 00:40:18,010
And he shared with us something that I thought was absolutely incredible advice.

481
00:40:18,490 --> 00:40:21,750
Here's how you refine your resume to sell yourself.

482
00:40:21,930 --> 00:40:23,490
First, write up a resume.

483
00:40:23,490 --> 00:40:25,690
Take what I've told you so far, create a resume.

484
00:40:26,770 --> 00:40:32,230
Then I want you to completely separately prepare a one to two minute elevator pitch.

485
00:40:33,270 --> 00:40:35,450
Just how are you gonna sell yourself in two minutes?

486
00:40:35,450 --> 00:40:42,170
Tell somebody why they should hire you, what it is that you're gonna do to make their business better, what it is that you're gonna do to make their department stronger.

487
00:40:42,170 --> 00:40:45,230
Now go and find those things in your resume.

488
00:40:45,430 --> 00:41:02,530
If you can't find those elements in your resume, get revising, figure out how you're going to add those elements to your resume to hit those things that are a part of what you said were most important because that's what you squeezed into that two minute elevator pitch.

489
00:41:02,530 --> 00:41:04,210
This is such a great idea.

490
00:41:04,210 --> 00:41:08,070
If you can do this with your resume, your resume is gonna be so much stronger.

491
00:41:08,070 --> 00:41:17,930
And then now you can carry through that narrative that you told in that one to two minute elevator pitch, that becomes the theme for every interview that you have after that.

492
00:41:18,390 --> 00:41:21,810
Make them know why it is that they wanna hire you.

493
00:41:22,430 --> 00:41:25,050
So let's go back to our barista then.

494
00:41:25,050 --> 00:41:27,210
We're gonna tie things all together here now.

495
00:41:27,210 --> 00:41:30,050
So how do I revise that resume?

496
00:41:30,110 --> 00:41:33,730
Say I'm entry level, I don't have a lot of experience.

497
00:41:34,230 --> 00:41:37,990
Well, let's understand first technical capabilities.

498
00:41:37,990 --> 00:41:42,470
And when I say technical capabilities, I'm talking about those things that ultimately show up as requirements.

499
00:41:42,470 --> 00:41:45,510
There's kind of three levels that you can have here.

500
00:41:45,510 --> 00:41:46,790
You can have knowledge.

501
00:41:46,790 --> 00:41:55,390
And knowledge is just, hey, I read a book, I did some training, I investigated research, studied this somehow, here it is.

502
00:41:55,390 --> 00:41:58,250
I have knowledge of this area.

503
00:41:58,250 --> 00:42:01,250
Sometimes for certain things, that might be all you need.

504
00:42:01,330 --> 00:42:04,430
But more often than not, people want you to have skill.

505
00:42:04,650 --> 00:42:11,370
And when I say skill, what we're referring to in skills is that you've actually taken that knowledge and applied it in some way.

506
00:42:11,490 --> 00:42:24,770
Maybe you did a lab, maybe you worked in a CTF, or you went to a village or some other hands-on training somewhere where you actually got to do application of that knowledge into the actual technology.

507
00:42:24,770 --> 00:42:26,530
You got to apply it somehow.

508
00:42:26,530 --> 00:42:28,030
That is a skill.

509
00:42:28,390 --> 00:42:31,210
That's, we're kind of, as you see, going from good, better, best here.

510
00:42:31,210 --> 00:42:32,610
So you've got knowledge and skill.

511
00:42:32,610 --> 00:42:35,410
The last one is experience.

512
00:42:35,550 --> 00:42:37,270
And this is the coup de gras, right?

513
00:42:37,270 --> 00:42:40,410
This is what employers tell us they want all the time.

514
00:42:40,410 --> 00:42:42,570
They want to know that you have experience.

515
00:42:42,630 --> 00:42:54,110
And when they say experience, they're talking about that you have some kind of formal documented examples of applying that skill in a real life, most often business scenario.

516
00:42:55,350 --> 00:43:07,310
So understanding, making an inventory of your capabilities technically, and understanding are they knowledge, are they skills, and are they experience, and to what level of each is so crucial.

517
00:43:07,310 --> 00:43:11,150
This is back to working on you again and talking about how you can be better.

518
00:43:12,170 --> 00:43:14,770
And then finally, I want to talk about this idea of core skills.

519
00:43:14,770 --> 00:43:26,450
So now that you know what those capabilities are, your core skills are the transferable elements of those that you can take from one capability and apply it to any capability in any technology anywhere.

520
00:43:26,610 --> 00:43:29,930
So if I look at my barista, they start off with, well, they make coffee beverages.

521
00:43:30,790 --> 00:43:34,910
Well, really, if I break that down, here's a lot of the steps they did.

522
00:43:34,910 --> 00:43:40,850
They received orders, they prepared according to recipes, they delivered on the customers and they had to clean the equipment.

523
00:43:40,930 --> 00:43:43,090
But that's still shades of a barista.

524
00:43:43,090 --> 00:43:44,690
So how do I take it further?

525
00:43:45,130 --> 00:43:46,990
They processed multiple inputs.

526
00:43:46,990 --> 00:43:52,030
They translated inputs into tasks and prioritize them for maximum efficiency.

527
00:43:52,210 --> 00:43:55,990
And they were always focused on efficient delivery to the customer.

528
00:43:55,990 --> 00:43:59,130
And throughout all that, they had to plan and execute maintenance activities.

529
00:43:59,150 --> 00:44:03,030
These are general words that can apply to any job anywhere.

530
00:44:03,030 --> 00:44:17,150
And when you can now take and view your skills in that light, you can take those requirements that they're asking for, understand the core skills behind those, take your own core skills, tie them together.

531
00:44:17,150 --> 00:44:30,550
And now you can see how you can easily word your resume to highlight the skills and experiences that you have from your job to fit into that job that you are applying for.

532
00:44:30,550 --> 00:44:34,690
And this is where the rubber really meets the road.

533
00:44:34,790 --> 00:44:44,630
How do you take that simple role as a barista where it seems so completely unconnected?

534
00:44:44,630 --> 00:44:48,370
And this is literally what I told that manager when he was complaining to me.

535
00:44:48,370 --> 00:44:54,450
I said, didn't they absorb all of this input from all these different areas and process it?

536
00:44:54,630 --> 00:44:59,490
Didn't they have to focus on how they were going to arrange those?

537
00:45:00,150 --> 00:45:03,670
And do it in an efficient manner so they could be most effective?

538
00:45:03,770 --> 00:45:08,590
Weren't they always focused on customers and the customer was what was most important?

539
00:45:08,590 --> 00:45:13,130
And yet throughout all of that, they had to plan and execute maintenance activities.

540
00:45:13,570 --> 00:45:14,810
And he started to look at me.

541
00:45:14,810 --> 00:45:19,790
I said, isn't that exactly what you want your SOC analysts to be able to do?

542
00:45:20,370 --> 00:45:28,030
That barista would be perfectly qualified to be a SOC analyst in light of the fact that they have the other knowledge that you asked for.

543
00:45:28,030 --> 00:45:31,330
They may not have the experience, but they have the knowledge.

544
00:45:31,450 --> 00:45:43,070
So look to highlight these on your resume, in your discussions, in those interviews, as you're blogging, as you're making videos, tie these things together.

545
00:45:43,130 --> 00:45:46,570
And then last, I'm going to leave you with this quote from Ella Fitzgerald.

546
00:45:47,310 --> 00:45:48,970
Just don't give up.

547
00:45:48,970 --> 00:45:51,570
Whatever it is, don't give up.

548
00:45:51,690 --> 00:45:52,810
This is tough.

549
00:45:52,810 --> 00:45:55,330
I'm not going to say the security industry is perfect.

550
00:45:55,330 --> 00:46:02,970
We've got a lot of work to do from the industry side to make things better for those that we're trying to bring into the industry.

551
00:46:03,170 --> 00:46:12,510
Keep working, use your network, find mentors who can help you, leverage your connections and foster those relationships because they're going to help you get there.

552
00:46:13,230 --> 00:46:16,230
So finally, I can be one of those people for you.

553
00:46:16,230 --> 00:46:17,270
And I'm always happy to.

554
00:46:17,270 --> 00:46:19,090
Find me on social media.

555
00:46:19,090 --> 00:46:21,970
You've got my Twitter handle, my LinkedIn address there.

556
00:46:21,970 --> 00:46:26,670
You've also got the link to my website, which includes my blog and lots of other information.

557
00:46:26,670 --> 00:46:30,750
So please continue, reach out to me, reach out to others.

558
00:46:30,750 --> 00:46:40,110
If I can't help you, I will find somebody to connect you with, or I will put the call out to the world and to my network and find you somebody who can help you with what you need.

559
00:46:41,030 --> 00:46:45,650
So with that, I want to say thank you so much to everybody who's attended today.

560
00:46:45,650 --> 00:46:48,750
Thank you, Sneak, my employer, for allowing me to be here today.

561
00:46:48,750 --> 00:46:51,890
Thank you to DEF CON and the DEF CON Career Hacking Village.

562
00:46:51,890 --> 00:46:55,230
I'm so excited to be a part of the inaugural version of this.

563
00:46:55,230 --> 00:46:56,790
That is so cool.

564
00:46:56,790 --> 00:47:00,250
And I hope you all enjoy the rest of the conference.

565
00:47:00,250 --> 00:47:02,070
I know it's a weird world out there.

566
00:47:02,070 --> 00:47:04,270
We'll get back to the real thing soon enough.

567
00:47:04,270 --> 00:47:06,850
But enjoy this virtual experience and make the most of it.

568
00:47:06,850 --> 00:47:09,810
This is where you're going to learn so many things.

569
00:47:09,810 --> 00:47:11,530
And I hope to see you soon.

570
00:47:12,830 --> 00:47:17,210
That was just absolutely, excuse me, absolutely awesome.

571
00:47:17,210 --> 00:47:21,890
I hope you saw me doing thumbs up and being excited.

572
00:47:22,090 --> 00:47:24,610
And yes, you hit so many points.

573
00:47:24,610 --> 00:47:27,310
20 years in the recruitment industry.

574
00:47:27,310 --> 00:47:42,710
And I am so glad you pointed everything out, listed some of the key things, listed a lot of the key things that job seekers really need, and sort of gave a little bit of a backslap to those employers who really need to change their jobs descriptions.

575
00:47:42,710 --> 00:47:45,430
That's something I've been trying to do for 20 years.

576
00:47:45,430 --> 00:47:48,070
And I think it will take all of us to do that.

577
00:47:48,070 --> 00:47:52,850
Alyssa, thank you so much for all of your great input, for doing the great survey.

578
00:47:52,850 --> 00:47:59,590
I know that you've also made yourself available for career coaching through The Village, and we really appreciate that.

579
00:47:59,590 --> 00:48:02,850
So definitely connect with Alyssa.

580
00:48:02,910 --> 00:48:06,090
And we will be back with another session shortly.

581
00:48:06,090 --> 00:48:06,890
Bye-bye.