start	end	text
5730	8560	Welcome back to Career Hacking Village,
8560	10880	Hacking Career Village, whatever.
10980	13200	As many of you know, I haven't had a lot of coffee yet today
13200	15260	and it just doesn't seem like a HackerCon
15260	17080	without a shot of tequila.
17080	18760	So maybe I'll go do that.
18760	22340	In the meantime, a lot of people in our community
22340	26040	are frustrated with figuring out how do they go
26040	30060	from one job that is non-tech, non-security related
30640	33040	into being a security pro.
33040	36260	And I'm so thankful that Alyssa Miller decided
36260	40120	to tackle this topic and bring to us her insight,
40120	42200	her wisdom, and her shared strategies
42200	44400	on how we could be successful.
44400	45280	Alyssa?
45460	47200	Awesome. Well, thank you, Kathleen.
47200	49940	And hey, everybody from DEF CON.
50720	54260	God, what a weird DEF CON this is this year.
54340	57880	Miss seeing all my buds, seeing all my Hacker fam,
57880	59540	but here we are.
59540	61300	And as Kathleen mentioned,
62700	67080	I think we're all kind of familiar with the struggles
67080	70680	of trying to find jobs in cybersecurity,
70680	73540	especially if you're new and trying to make that transition
74220	78640	from one industry into the security industry.
78900	82000	And it's something that's very near and dear to my heart.
82020	85040	So today I really wanted to go through
85040	86520	some strategies with you.
86520	88280	Let's talk a little bit about some of the problems
88280	90700	that are out there and how we can tackle them,
90700	93620	how people who are trying to find that first job
93620	96680	in cybersecurity can really jump in
96680	98580	and overcome some of those obstacles
98580	101360	that unfortunately exist in the industry today.
101700	103480	So to get things started,
103480	105320	let me just share a little bit about myself.
105400	107520	First of all, for those of you that don't know me,
107520	108540	my name is Alyssa Miller,
108540	111080	and I'm a hacker and a researcher first and foremost.
111120	112880	I've been hacking all my life,
112880	115880	bought my first computer when I was 12,
115880	119440	did some things of questionable legality
119440	121660	with some online services.
121940	124180	And it's kind of been that way ever since.
124180	125560	You know, I taught myself how to program.
125560	127160	I taught myself about modem communications
127160	129220	and sort of dug in.
129220	132000	And later on in life became a developer
132000	135260	and finally jumped into the security industry
135260	136660	as a pen tester.
136720	138840	So I've been doing this pretty much my whole life.
138840	141700	It's really my mindset is that of,
141700	144940	I love tearing things apart, figure out how they work.
144940	147940	I like to break stuff and I like to make it work better.
148240	151680	So that career of mine has led me to where I'm at right now,
151680	154820	which is a security advocate for a company called Snyk.
154980	158520	Just means basically that my job is to get out
158520	161280	in the security community and talk about topics
161280	163900	that are important to us in security
163900	166820	and how that ties in organizationally
166820	168880	like DevSecOps and things like that.
168880	173060	But part of my career journey has really centered
173060	175660	on the fact that I've been a security leader.
175660	177860	In other words, a manager, a hiring manager
178360	182200	for 12 of the 15 years that I've been in security.
182260	183840	It didn't take long after I took over
183840	185440	that first penetration testing role
185440	187080	that was leading that whole team
187080	189080	and the vulnerability management program
189080	191540	for a huge, huge organization.
191920	195720	And so this is a space that I've worked in a lot.
195720	198560	I have built a number of different consulting teams
198560	202020	from the ground up where there was nothing that existed
202020	206880	or a very skeleton crew and it needed to be grown quickly.
206880	208340	And I've had a lot of success with that,
208340	211400	but it's enabled me to see a lot of the struggles
211400	217340	that people deal with from a job search perspective.
217380	220000	And indeed, it's given me the perspective too
220000	222660	of what are hiring managers looking for?
222660	226180	A lot of times hiring managers have their own frustrations.
226180	228720	I've had to work with recruiters and headhunters
229260	232000	and job search systems and so forth.
232000	233300	And so I'm excited to talk about all of that.
233300	235680	And then finally, about me,
235680	238100	I'm also the co-host of a podcast
238100	239640	called The Uncommon Journey.
239640	242040	And I bring this up because it's on this podcast
242040	244340	that we focus on something that's really important
244340	246140	to understand in cybersecurity.
246360	250440	And that is that every one of us has a very unique
250440	253560	and very different story about how we got here.
253560	257400	I always tell the story, I started off as a pre-med major.
257700	261100	I know other people in this industry who were wrestlers.
261100	265940	I know people who worked in sanitation.
265940	268940	I know people who were actors and did drama.
269080	272280	And all of these people somehow ended up in the same place
272280	276000	because they had an interest and a passion for security.
276180	278420	So it's a great podcast, check it out,
278420	280420	but more importantly, understand that concept
280420	283020	that no matter where you're coming from,
283020	284760	there's a place for you here.
285600	288460	So I wanna start off a little bit of a story.
288980	291480	And the story goes back to the title of this talk
291480	294200	being about from a barista to a security pro.
294320	297680	So some time ago, I was having a conversation
297680	302100	with one of my colleagues and he was lamenting the fact
302100	304860	that he was hiring for some positions
304860	309640	and he was having trouble getting qualified candidates.
309640	313760	And these were entry-level positions in the SOC.
313760	315480	So he was in the security operations center.
315880	319760	And along this conversation at one point,
319760	322080	he brought up the fact that he had somebody
322080	325120	who was a seven-year barista,
325120	327940	had been working for Starbucks for the last seven years.
328180	330140	And he was frustrated,
330140	333600	didn't think that they had any place applying
333600	335180	for a cybersecurity role
335180	337160	because they hadn't worked in tech before.
337160	338520	And so I started to question him about that.
338520	341780	And I asked, okay, well, what qualifications do they have?
341780	343160	Well, they had gone and they had gotten
343280	344400	a computer science degree
344880	349080	and they had achieved their security plus certification.
349080	351320	I think he might've mentioned they were also working
351320	353720	on a CEH or something like that.
353980	356520	And so I started to ask him, I said,
357360	361360	did you think about what it is that a barista does
361940	364400	on a daily basis and how some of those skills
364400	368740	might be really valuable to you in a SOC environment?
369360	370420	And I started to go through them.
370420	371920	And we're gonna talk about that more
372080	374620	a little bit down the ways in this talk today.
375320	377720	But I really started to, we dug into this.
377720	379320	And by the end of it, he started to realize
379320	380360	that, you know what?
380360	384960	This barista might actually have some really good skills
384960	388940	and might be the kind of person that they can build.
389260	393700	So the point of this being, there's always that path in,
393700	395620	sometimes it's not so obvious.
395620	398700	And since hiring managers, recruiters,
398700	401740	job search systems may not always see those connections.
401740	406400	It's up to us as job seekers to help people see
406400	408600	what those connections are and justify why it is
408600	412180	that we're coming to this industry to start a career
412540	416520	and why it is that you want us to be your next hire.
416520	418720	So we're gonna talk all about that.
418720	421260	But first, let's just start off with the state
421260	423180	of where the industry is today.
423180	425660	If you're looking to get into cybersecurity,
425660	430580	chances are you've once or twice before heard this mantra
430580	433920	that there's a talent shortage in security.
433920	436760	There are studies, there are surveys,
436760	439600	there are articles galore that speak to this
439600	441720	every single day.
441720	445520	If you go through any news sites related to cybersecurity
445520	448980	or related to tech, chances are somewhere over the past year
448980	450680	you're gonna find that they had some article
450680	452580	that talked about the challenges
452580	455320	of this so-called talent shortage
455320	457600	that exists in cybersecurity.
458560	460700	Now you see some things up here, for instance,
460700	464100	the great cybersecurity talent shortage continues.
464100	466680	And it's blown up really big,
466680	469180	but the question always comes back to me.
469180	472320	I start to wonder, I hear from a lot of people
472320	474880	who are trying to find roles in cybersecurity
474880	477060	and are unable to find them.
477960	480400	And I hear from people who are experienced
480400	484580	and who are trying to find new jobs and are having trouble.
484880	487920	So you're telling me there's a talent shortage
487920	489660	yet I'm hearing from all these people
489660	493200	who are having trouble finding jobs.
493260	495940	So what's the reality?
496140	497820	And that's something that was,
497820	501680	I really wanted to start to try to find some answers to.
501680	505420	So at the very beginning of this year,
506220	508600	I made the decision to do some research.
508600	511080	And it's related to a book that I'm also writing.
511080	512460	In fact, a lot of the stuff you're going to see
512460	514400	in this talk today comes from this book
514400	516140	that I'm currently working on.
516140	519960	But one of the things I did was I launched a pair of surveys.
520200	522080	One survey was targeted at people
522080	524260	who had never worked in cybersecurity before
524260	527140	and wanted to get that first job in security.
527240	530340	The other survey was targeted at people
530340	532120	who are working in security
532120	534480	and already have some experience.
535180	538160	I got over 1500 responses.
538160	539960	So it was a very successful survey.
540760	543200	But one of the questions I asked people,
543200	544740	because I wanted to really understand
544740	546660	this talent shortage in particular,
546660	549060	I simply asked those entry-level folks,
549060	552440	people who had never had a job in security before,
552440	554080	if you're searching for a job,
554080	555520	how long have you been searching?
556080	557360	Simple question.
557920	562160	And the results are what surprised me.
562940	564880	We're talking about a talent shortage
564880	567940	where employers are desperate to find people
567940	570160	to fill these jobs they have open.
570160	572160	Yet as we look at these numbers,
572160	575660	I can see close to three quarters of these people
576180	578880	have been searching for three months or longer
578880	580600	to find a job.
582220	584780	Over 32% of them have been searching
584780	586920	for seven months or more.
587220	589740	That's a long time to be out on the job market
589740	592020	when you're looking for that first job.
592020	594900	So if we have such a talent shortage,
595760	598160	how come all these people are having
598160	600540	such a hard time finding jobs?
600540	603160	This is something I really wanna get to the bottom of.
603300	605020	So you might look at this and you might say,
605020	608080	well, yeah, that's probably because they're entry-level
608080	610760	and they don't have any experience.
611140	613380	And a lot of these jobs in security,
613380	615980	well, they're looking for experienced people.
615980	617320	And you're not wrong about that.
617320	619000	You wouldn't be wrong to think that.
619000	622060	And in fact, when I asked the same exact question
622060	625920	of experienced people who said they were already looking,
625920	628400	said they were currently looking for a job,
628840	630820	the numbers changed a little bit,
630820	633300	but they still didn't change a lot.
633300	638900	We see, yeah, it went up to 46% that are less than two months
638900	640880	in the job market, and that's pretty good.
641100	642760	And that's what we'd expect to see.
642760	645840	People with experience, there's high demand,
645840	647500	they're finding jobs quickly.
648180	652160	But what about the other 54% or 53 and a half percent?
652540	654780	They're still taking three months or longer
654780	656820	to find a new job.
657440	659280	That's a long time.
659440	662900	In almost a quarter of them, it's taking over seven months.
664140	666380	So we see the same issues here,
666380	668960	whether you're entry-level or whether you're experienced.
669460	672200	So if there's this talent shortage,
672200	674380	we have this high demand, 4 million jobs
674380	677260	is one of the quotes you'll see mentioned recently.
677260	680700	Over 4 million jobs are gonna be left unfilled this year.
680700	682880	Of course, some of those numbers came up before COVID,
682880	684160	so we'll see how that adjusts
684160	686540	as people have adjusted their hiring practices.
686700	690320	But that's a significant number to say
690320	692640	that we've got these 4 million positions,
692640	695060	but these experienced people can sit in the job market
695060	696560	for seven months or more.
697600	700940	So, all right, is it a problem maybe with the applicants?
701720	703980	So in that same survey,
703980	706420	I asked the people who were hiring managers,
706420	708080	I asked them, hey, are you trying to hire
708080	710180	for a cybersecurity position?
710380	713400	And there were a good number of them that came back
713400	714520	and said, yes, indeed,
714520	718700	they were trying to hire for cybersecurity as well.
718700	720820	And so I asked them, all right,
720820	724400	well, what's the biggest challenge that you're encountering
724400	727180	when hiring cybersecurity candidates?
728180	731660	The number one was unqualified applicants.
732120	734100	And this gets me thinking.
734760	737000	That works maybe when we're talking about
737000	738120	entry level people,
738120	741280	but we're seeing all of these people with experience,
741280	745000	with degrees, with certifications, everything else.
745420	748840	How are we finding so many that are unqualified
748840	751340	for the positions they're applying for?
751920	754520	The second one is kind of telling.
755040	757480	And this is where we're gonna start to dive in more.
758400	760160	The second most common answer
760160	762720	was struggles with job descriptions.
763280	767140	Hiring managers, recruiters,
767800	771240	they work together to put together these job descriptions,
771650	773800	but it's not an easy job.
774480	777360	And indeed, figuring out a way
777360	778900	that we can word a job description
778900	781800	that accurately captures the things
781800	784560	that are important to us as a hiring manager,
785180	788200	also are compliant with all the employment laws
788200	790700	and everything else that we have to worry about.
790760	792540	This is actually a lot of heavy lifting.
792540	794460	And it's not easy to do.
795040	797640	And so it's not really a surprise to me
797640	799300	that I see this up there.
799700	802200	Then we see lack of applicants as number three.
802200	804100	And now I'm scratching my head again.
805700	809160	Because how are we running into so many people
809160	810580	who say they're in the job market
811280	813300	for this extended period of time,
813300	815060	but you're telling me you have a lack of applicants
815060	816280	to your role?
816880	818380	Well, how's that happening?
818580	819940	So we're gonna explore those
819940	822340	because I think those latter two in particular,
822340	824760	job descriptions and the lack of applicants,
824760	827800	they're actually really tightly related.
828220	832060	So let's look at job descriptions for a minute.
832060	833580	Because what I'm gonna tell you
833580	837020	is that one of the core problems,
837020	838860	when I look at why we're struggling
838860	841300	to fill roles in cybersecurity,
841300	845380	it comes down to that job description.
846940	849460	So as a new security person,
849460	851800	looking to start that career in cybersecurity,
851800	852840	you might be thinking,
852840	854880	hey, I wanna start my job as an intern.
855080	856800	I wanna look for an intern role,
856800	858100	especially if you're coming out of college
858100	859780	or maybe you're wrapping up your degree
859780	863000	and you're thinking in terms of intern positions.
863480	865700	Now, if any of you follow me on Twitter,
865700	868120	you've seen me throw out from time to time
868120	871220	examples of bad job descriptions.
871440	872720	Well, here's the job description
872720	875680	from this information security intern position
875680	877800	that was posted just a few weeks ago.
878090	879520	Right off the top,
879700	882600	a bachelor's degree in information technology
882600	884190	or a technical discipline.
885060	886340	So this is an internship
886340	890480	they immediately want you to have your...
890480	893200	They want you to have a degree already.
893200	897280	So there's no flexibility here to say,
897280	900920	have other experience that maybe plays in instead
901600	905030	and can replace that particular role.
906490	908950	The next one is what really trips me out.
908950	911070	And this is something you're gonna see is really common.
911910	914910	Certified in one or more of the following.
915130	916590	You're talking about an intern
916590	919550	and yet they're expecting them to have a certification.
920690	922970	And if you look, you see CISSP is the first one.
922970	924870	Anyone who knows anything about the CISSP knows
924870	930090	that there's a minimum number of years of job experience
930090	932170	that you have to have to get a CISSP.
932170	935550	So how can any organization expect an intern
936490	938690	to have a CISSP?
938690	940590	This is simply not realistic.
940850	942690	And then the last circle there.
942690	945450	This is the one that set me off
945450	948150	and resulted in a really long Twitter thread
948150	951310	that ended up really kind of blowing up on Twitter
951310	952770	for a few days.
952890	956110	Minimum of seven years experience
956110	959430	working in information technology security.
960990	962810	We're talking about an intern.
963570	965010	An intern role.
965330	967130	These are the ones that you use to bring people
967130	968730	out of college and into the workforce.
968730	971970	And they want you to have seven years of experience.
971970	975010	This is the landscape y'all are trying to conquer.
975070	979190	So if you think you've got some key obstacles in your way,
979190	980470	clearly you do.
981290	982870	But it gets worse.
983930	985090	Now here's one for,
985090	987510	remember I talked about these experienced people.
987510	990290	Here's one for an information security architect.
990490	994110	And yes, I've protected the guilty here.
994110	996790	I'm not gonna name and shame who this is.
997050	999190	But take a look at this job description.
999190	1000650	So they start off with all the usual stuff
1000650	1002310	talking about their company and their great culture
1002310	1003530	and how wonderful they are.
1003530	1005430	And then they start to describe the role.
1005430	1007890	And you can see here's three bullet points.
1007890	1009210	Okay, that's great.
1009490	1011010	But it doesn't end there.
1011870	1012970	This continues.
1012970	1014470	This is the job role.
1014470	1015350	This is what they're telling you
1015350	1016810	and you're gonna do day to day.
1016810	1017970	Now I've cut it off here.
1017970	1020930	There's actually four more bullets that follow this yet.
1021210	1022750	Who is this magic unicorn
1022750	1026210	who's gonna fill all of these responsibilities?
1027090	1027990	And if you look at them,
1027990	1028830	I know they're hard to read
1028830	1030430	because it's really, really, really small
1030430	1032310	because it was the only way I could fit it on the screen.
1032310	1033370	They're talking about everything
1033370	1036030	from configuring ISPs and WAFs
1036030	1038830	to working in DevSecOps.
1038870	1041330	This like runs the gamut of everything
1041330	1042610	that's in cybersecurity.
1042990	1044710	But it doesn't end there.
1045570	1049310	Let's go and look at their requirements for this job.
1049510	1051150	So that's all of what you were gonna be doing
1051150	1052330	if you get the job.
1052330	1054950	Here's what they expect you to have.
1054950	1058450	And these aren't preferred qualifications.
1058450	1060630	These are listed as requirements.
1060970	1065170	Required that you have every single bullet here.
1066850	1069870	You wonder why this job didn't get filled.
1071110	1072750	It's no surprise.
1072750	1075430	So we're gonna dive into this deeper.
1075430	1076650	But before we do,
1076650	1079770	I also wanna share one more element of that survey.
1080050	1084930	The last element of that survey was I asked job seekers,
1084930	1085990	experienced job seekers,
1085990	1087010	because I wanted to know people
1087010	1088950	who've been around the block a couple of times.
1088950	1093050	What do you see as your biggest struggle?
1093310	1096230	And no surprise in light of everything we just saw,
1096230	1099490	they come back and they say predominantly
1099490	1101390	it's bad job descriptions.
1101390	1104010	So when you have bad job descriptions like this
1104570	1107350	that float throughout the industry,
1108150	1110870	how can you expect people to even wanna apply?
1110870	1112390	And indeed, this is what happens.
1112390	1113910	You have these job descriptions.
1113910	1116450	Sure, some people may apply and they might be underqualified
1116450	1117910	because they can't even figure out
1117910	1120030	what this company is really looking for.
1120030	1121550	On the other side of it,
1121550	1124150	you've got people who then just don't apply.
1124510	1127430	So that percentage that said
1127430	1130810	that they're having trouble finding job applicants,
1130810	1133150	well, yeah, no kidding.
1133170	1135370	Because when you have bad job descriptions,
1135370	1136650	people don't apply.
1138350	1140330	So enough of talking about the problems.
1140330	1141570	I didn't come here today
1141570	1143810	to tell you about how bad things are.
1143810	1144450	We know that.
1144450	1145950	You know that if you're looking for a job.
1145950	1147630	You know it's a struggle.
1148130	1149430	So let's talk about how we start
1149430	1151290	to overcome some of these problems.
1151310	1152830	And let's start by just looking
1152830	1154990	at the typical hiring process.
1154990	1156890	Because especially for some of you coming in
1156890	1158990	as first-time job seekers,
1158990	1161070	this might not just be your first time security job.
1161070	1163010	This might be your first time really looking
1163010	1166430	for a corporate level professional job overall.
1166430	1168490	So let's just talk about this for a minute.
1168490	1170710	The way it works in most organizations
1170710	1173750	is really similar to what you see on this image here
1173750	1175050	that I pulled from Jobscan.
1175050	1177790	Now Jobscan is a company that produces
1177790	1181250	one of what we call these application tracking systems
1181250	1183930	or applicant tracking systems or ATS.
1184050	1186870	So that's that automated system
1186870	1188350	that collects all your information
1188350	1189830	when you apply for a job.
1189830	1192770	So usually what happens is they'll go in,
1192770	1194750	they will create a job in that system.
1194750	1196310	Now there's usually some stuff with approvals
1196310	1197710	and things that happen before that,
1197710	1198990	but a recruiter from the company
1198990	1200970	is gonna go in and create this job.
1201070	1203190	And they're going to attach to it a job description
1203190	1205550	that the recruiter has likely worked
1205550	1206830	with the hiring manager on.
1206830	1208890	They probably have some standard job descriptions
1208890	1211870	already laid out and they might work
1211870	1213890	with the hiring manager to make sure that that's accurate
1213890	1215390	for what they're trying to hire for.
1215390	1217690	And then of course they publish it to the world.
1217690	1218990	They put it out on LinkedIn.
1218990	1220350	They put it out on job sites.
1220350	1223770	They put it on their own job career board on their website.
1223850	1227050	And they hopefully start getting applicants.
1228230	1229950	Then they start screening.
1230450	1232350	And they start screening each of these applicants
1232350	1233990	and over stages they eliminate them.
1233990	1235770	And then finally you get to the point
1235770	1238290	where they select some and they interview them.
1238290	1240330	And then hopefully they find the one they wanna hire
1240330	1241490	and they hire them.
1241930	1244890	What I wanna focus on here is this lower left
1244890	1248110	where we see the applicant screening process.
1248110	1250810	Because when I talk about how people fail
1250810	1253190	to get into a cybersecurity job
1253190	1258090	and how jobs fail to get filled from the hiring side,
1258090	1261190	this is where the things fall apart.
1261390	1263310	More than anything else,
1263310	1266750	it's when we get into that screening process.
1266870	1268690	So let's talk a little bit more about that process
1268690	1269850	for a minute and what that looks like.
1269850	1271510	In organizations where they're using
1271510	1273270	an applicant tracking system,
1273270	1276930	that is your first layer of filter.
1276990	1279450	A lot of these systems have built in rules
1279450	1281170	that immediately look at your resume
1281170	1285390	and are going to identify very objective,
1285390	1287010	tangible things that they can identify.
1287010	1289730	And a lot of times there are algorithms built in there
1289730	1291050	that will immediately,
1291050	1294570	they may not actually delete you from consideration,
1294570	1295970	but they rank you.
1295970	1298090	They provide scoring that now the recruiters
1298090	1300230	and the hiring manager are gonna look at to say,
1300230	1301850	hey, let's prioritize these
1301850	1303990	and look at who is most qualified.
1304210	1305510	So it's important that we understand
1305510	1309030	that that system is a crucial aspect
1309030	1312630	in how we get considered for a job when we apply.
1313030	1315970	Now it goes from there and typically a recruiter
1315970	1319330	or someone in human resources is gonna look at that next.
1319410	1321070	They're gonna get the ones that are receiving that
1321070	1323230	and it's their job to screen further.
1323230	1324510	So they're gonna look at your resume
1324510	1326070	and your qualifications.
1326070	1330530	And if you meet at least some of them,
1330530	1332610	they're probably gonna get in touch with you
1332610	1334930	because their job is to get in touch,
1334930	1336350	talk to you and screen you and make sure
1336350	1337670	that you do meet some of the,
1337670	1340010	just the bare qualifications for that job.
1340010	1340810	They're gonna make sure
1340810	1345890	that some of the legal aspects of it are considered.
1345890	1348210	So if you need to be, for instance, here in the US,
1348210	1351430	if it's requires that you're able to legally work in the US,
1351430	1352690	they're gonna make sure that you have
1352690	1355490	whatever those legal qualifications are.
1355870	1359470	They're gonna talk to you about some of the base skill sets
1359470	1360850	and things that they're looking for,
1360850	1363850	maybe ask you a little bit about your experience,
1364910	1366450	but that's their job.
1366450	1367230	And what they're trying to do
1367230	1368950	is they're trying to filter out those applications
1368950	1373830	before they ultimately submit them to the hiring manager.
1373830	1376010	So the hiring manager and potentially their team
1376010	1378450	and maybe some other managers and whatnot
1378450	1381330	will be involved in the last steps
1381330	1383550	of that screening process.
1383550	1385810	So they're the ones that are ultimately involved
1385810	1387250	in some of the interviews,
1387250	1389550	and they're gonna make that final decision
1389550	1390930	on who comes in for an interview,
1390930	1393850	and of course, who they ultimately end up hiring.
1395310	1398070	So understanding this process is important
1398070	1402850	because more often than not, applicants do apply for jobs.
1402850	1404710	I know people who have told me
1404710	1408150	they've applied for 30, 40, 50 jobs
1408820	1411770	because they're not hearing back,
1411770	1412690	they're not making it through.
1412690	1413510	And I start to question,
1413510	1414730	well, if you're applying to that many jobs,
1414730	1417530	how are you not getting calls back from any of them?
1417530	1418990	That seems surprising.
1419630	1422990	And indeed, when you're entering this world
1422990	1426210	of searching for a cybersecurity job in particular,
1426210	1427970	you're on the road to frustration.
1428610	1430130	For those of you coming out of school,
1430130	1431770	you may have had schools that told you,
1431770	1433330	hey, just get that cybersecurity degree
1433330	1434610	and you're gonna be all set.
1434610	1437250	Or maybe you went and you got that certification
1437250	1439710	and boy, they promise all these great things.
1439710	1442210	Hey, if you just get this certification,
1442570	1443770	everybody's gonna wanna hire you
1443770	1448190	because 35, 40, 50% of people working in security
1448190	1449410	have this certification.
1449410	1451610	So if you get it, you can get a job there too, right?
1451610	1453190	And then you go and you hit the job mark
1453190	1454390	and it doesn't happen.
1454770	1457030	So let's talk about how we're gonna get beyond that.
1457030	1459470	How do we hack that system
1460210	1462990	and make sure that you can get your next job?
1464230	1467610	I'm gonna tell you, it starts with you.
1467730	1469210	You are the first step
1469210	1472550	and you need to understand yourself.
1472610	1476030	Self-analysis is probably one of the most crucial aspects
1476030	1478710	of getting a job in cybersecurity.
1479210	1480770	I mentor a lot of people
1480770	1483010	as they're searching for security jobs.
1483290	1485790	And one of the first questions I'll ask them,
1485790	1486610	someone will come to me,
1486690	1487570	a lot of times they'll just ask,
1487570	1488810	Kate, will you be my mentor?
1488810	1491930	Which is a pretty vague request in general.
1492250	1494210	And so I'll start to ask right away,
1494210	1495490	hey, okay, what are your interests?
1495490	1497270	What do you wanna do in security?
1497730	1502150	And the answer that I dread, but I get quite often is,
1502150	1502930	well, I just wanna work.
1502930	1503790	I wanna learn everything.
1503790	1505150	I wanna be in cybersecurity.
1505610	1507250	Well, what do you wanna do in cybersecurity?
1507250	1507910	Well, I don't know.
1507910	1509130	I wanna learn it all.
1510890	1513310	This image here is a wonderful image.
1513310	1514650	I love this.
1515150	1516630	Henry Jang put this together
1516630	1519090	and he posted it in an article on LinkedIn.
1519330	1521590	And I don't agree with all of how it's arranged.
1521590	1524530	I would definitely change a lot of the aspects of it.
1524710	1526450	But this gives you some idea
1526450	1529590	of the amount of different opportunities,
1529590	1532730	topic areas, skill sets, whatnot,
1532730	1536590	that exist within this thing we call cybersecurity.
1537350	1540010	So to say you wanna learn all of it,
1540010	1543170	that's not a realistic expectation.
1543170	1544590	To say to somebody, hey,
1544590	1547950	I just wanna learn cybersecurity, that's super broad.
1548130	1550690	How do you self-analyze and get to a point
1550690	1552530	where you understand what it is in cybersecurity
1552530	1554350	that interests you?
1554650	1556110	Now, I've talked with people.
1556110	1557330	Sometimes they're able to figure it out
1557330	1558570	and we'll chat a little bit
1558570	1560270	and when we get to the root of it,
1560270	1562750	sometimes what I've encouraged people to do,
1562750	1565150	go out, look at maybe five,
1565150	1568390	10 security-related blogs and news sites.
1568810	1571650	Grab the first five headlines off of each one of them
1571650	1574290	and put them in a list and rank them.
1574290	1576110	Rank them in order of which headline
1576110	1578450	seems most interesting to you.
1578830	1581450	Now take the top five of those headlines
1582070	1584290	and look for what's common.
1584290	1586370	What are the aspects about those headlines
1586370	1587890	that actually excite you?
1587890	1591070	Is it because they're doing some kind of investigation?
1591070	1592710	They're doing maybe digital forensics
1592710	1594770	and they're investigating
1594770	1598370	and you really like that idea of trying to solve a mystery.
1598370	1602550	Is it because they've launched some new defense mechanism
1602550	1604190	and maybe that's where you really like
1604190	1606330	to sink your teeth into?
1606330	1608550	Is it maybe headlines about new vulnerabilities
1608550	1609770	that were discovered?
1609770	1611310	And so, hey, that's starting to tell you,
1611310	1613990	I really like this idea of vulnerability research
1613990	1616810	and I want to start getting into things like pen testing.
1616930	1619890	This is a great way to simply narrow down your interest
1619890	1623050	and actually understand what is it in security
1623050	1624590	that you want to be doing?
1624590	1627890	Because this is a huge field and it's growing every day.
1627890	1632090	As the digital world becomes more and more our way of life,
1632090	1634130	security fits into every piece of it.
1634810	1635930	Next thing you need to do
1635930	1638690	is you need to be out there building your network.
1639330	1641770	So you know what you want to do.
1641770	1645970	Start interacting with people in social media,
1645970	1647190	if nowhere else.
1647190	1649370	If you go to conferences, I know this year it's different
1649370	1651250	because we don't have the interactivity
1651250	1653330	of being able to walk through hallway con
1653330	1655210	like we normally do when we're at DEF CON
1655210	1657250	and everywhere else and meet new people.
1657410	1658570	But meet them on Twitter.
1658570	1659910	Honestly, it's easier to meet them
1659910	1661290	in social media first anyway
1661290	1663430	and then find them at conferences later.
1663670	1667410	But the key mistake I see made
1669190	1671490	is interact with them.
1672050	1673750	Building a network isn't just going out
1673750	1675030	and following a bunch of people
1675030	1676790	and trying to get a bunch of people to follow you
1676790	1679070	on all these different social media platforms.
1679930	1681330	It's interacting with them.
1681330	1683090	The wonderful thing, I love Twitter for this.
1683090	1684930	And there's a reason why security lives
1684930	1686330	so strongly in Twitter.
1686610	1688910	You can interact with anybody,
1688910	1690330	as long as they haven't blocked you at least,
1690330	1691590	so don't make them angry.
1691730	1693150	But you can go out there,
1693150	1695150	you can find the biggest names in the industry,
1695150	1696450	you can follow them.
1696450	1698710	And as they post things, you can respond
1698710	1700770	and you can have conversations with them.
1700770	1702650	Not only do you have conversations with them,
1702650	1704750	but you may have conversations with their other followers
1704750	1706470	who've also responded.
1706470	1708990	Get engaged in those active conversations,
1708990	1711650	ask questions, offer your opinions,
1711650	1715270	be respectful, build that community.
1715270	1716810	That's how you get followers,
1716810	1718250	that's how you make friends,
1718250	1720230	that's how you'll start to discover
1720230	1723110	not just learning opportunities,
1723110	1725650	but you'll start to find job opportunities.
1726010	1727450	Now, LinkedIn is really great
1727450	1729550	if you're looking really to,
1729550	1731490	on a more professional level, of course.
1731650	1734830	Not as active from a security perspective,
1734830	1736570	definitely more formalized,
1736570	1737950	but a great place, again,
1737950	1740010	to start connecting with people
1740010	1741730	who work for certain organizations
1741730	1743510	that you wanna work for.
1743650	1746890	Find those people, do a search.
1747190	1749610	LinkedIn actually has a pretty decent search capability.
1749610	1751670	Go look for people who work at a job
1752310	1754870	that, or work at a company, excuse me,
1754870	1757390	that is one that you wanna work for,
1757390	1758190	and then look for the people
1758190	1760130	who are in those security roles.
1760190	1762630	Yeah, it's not the greatest search in the world,
1762630	1763810	it does take some learning,
1763810	1764810	but when you learn how to use it,
1764810	1767150	you can actually effectively find these people.
1767590	1769290	Add them, add them as connections.
1769290	1770230	A lot of people on LinkedIn
1770230	1773150	are more than happy to add connections all the time.
1773250	1775030	Unless there's something red flagged about you,
1775030	1776530	I'm gonna add you if you add me.
1776530	1778290	So, make those connections,
1778290	1779990	and again, now you can start interacting
1779990	1782010	with those people when they post stuff.
1782010	1784050	They'll start to see what you're posting as well.
1784050	1787210	So, post good topics, concepts, things.
1787750	1789210	Be out there, be active,
1789210	1791030	but this is what I mean about being interactive
1791030	1792450	and building that network,
1792450	1794850	because now as you start to engage with these people
1794850	1796530	and you build relationships,
1796530	1798770	those are people that can help you find opportunities
1798770	1801010	and help you land those opportunities.
1802090	1804110	But now let's talk about the hiring process.
1804110	1806230	So, we've worked on you, we've got you ready,
1806230	1807770	but now you're gonna go
1807770	1808930	and you're gonna start putting your resume
1808930	1810230	out there to the world.
1810230	1812410	Let's talk about how you beat the ATS.
1813050	1815150	Those applicant tracking systems,
1815150	1816630	they're used to varying degrees,
1816630	1818030	different recruiters use them differently,
1818030	1819710	different companies use them differently.
1819790	1823290	But there's a few things you need to remember with the ATS.
1823290	1827490	Most importantly, remember, this is a machine, it's software.
1827490	1830450	It might be AI based, it might use machine learning
1830450	1833390	and all these buzzwords that the vendors talk about
1833390	1834610	that their products do,
1834610	1836810	but at the end of the day, you're talking to a machine.
1836950	1838450	So, let's think about some of the things
1838450	1839670	that are really important there.
1839670	1842390	First and foremost, when it comes to your resume,
1842390	1844470	simple formatting.
1844570	1846810	And there's a lot of aspects here.
1847170	1849210	Use common fonts.
1849210	1851130	Believe it or not, this can be an issue.
1851130	1852950	Don't use wild, crazy fonts.
1852950	1853970	Use ones that are common.
1853970	1856330	There's no one specific that you have to use,
1856330	1857570	but use ones that are typical.
1857570	1860190	Colibri, Times New Roman,
1860930	1863750	the ones that you typically see in documentation,
1863750	1865870	other things, things that are easy to read.
1865870	1867290	These are the ones that those systems
1867290	1871050	can most effectively process accurately.
1871050	1874050	And that's important, but let's go beyond that.
1874310	1878150	Just format your resume in a way that's easy to read.
1878150	1880310	I know we like to have things that stand out,
1880310	1881750	and it's okay to have a separate resume
1881750	1883230	that you're gonna hand to people,
1883230	1885110	but the one that you upload to the ATS
1885110	1886930	needs to be simply formatted.
1886930	1888210	Don't put pictures in there.
1888210	1890010	Don't put designs in there.
1890230	1891630	Lay it out, structured.
1891630	1892570	Use bullet points,
1892570	1895510	things that it will be able to easily process.
1896710	1899290	The second thing, and this to me is so crucial.
1899290	1901750	I cannot believe how often people miss on this.
1901750	1902870	And this, I don't care if you're looking
1902870	1905330	for a cybersecurity job or what kind of job,
1905330	1906670	this is something you need to be aware of.
1906670	1908210	If you're trying to get hired,
1908210	1910390	you need to be tailoring your resume
1910390	1912550	to that job that you're applying to.
1912690	1914990	This means for every job that you apply to,
1914990	1916490	you should have a separate file.
1916810	1919130	And literally, if I showed you my file system
1919130	1921810	where I store my resumes when I'm applying to jobs,
1921810	1923650	I've got a different one for everyone,
1923650	1924870	and I name them with the date
1924870	1926730	and the company of who I sent it to.
1927280	1927970	Why?
1928310	1930690	Because I need to be looking at keywords
1930690	1932830	that appear in those job descriptions.
1932830	1935330	What are the things that are most important to them
1935330	1936830	in those job descriptions?
1936830	1938730	What ranks highly in the requirements?
1938730	1943190	And how can I work those terms into my resume?
1943250	1945910	Not saying I have to have experience in that term
1945910	1946710	if I don't have it,
1946710	1948490	and we'll talk more about that in a minute,
1948960	1949930	but at least make sure
1949930	1951690	that you mention that keyword somewhere.
1951690	1952910	Get it in there.
1953110	1955770	Look for variations on that keyword as well.
1955770	1957370	So if we think about penetration testing
1957370	1958850	and ethical hacking, for instance,
1958850	1962270	are two different variations that you might focus on.
1962270	1965650	And make sure you're ticking all of those boxes.
1965650	1967570	And sometimes those boxes,
1967570	1970730	they can be pretty complex.
1970730	1972470	They might include certifications.
1972470	1975130	So I'm gonna talk to you in a second about certifications.
1975210	1977130	But the last thing I'm gonna tell you
1977130	1978070	with checking the boxes
1978650	1982450	is make sure that you look at these step-by-step
1982450	1983950	and lay them out.
1983950	1986530	And know which ones that you wanna have in that resume
1986530	1988250	because you need to make sure your resume touches
1988250	1990410	all of those when you upload it to this system.
1990410	1991430	Don't lie.
1991630	1993350	Don't over-exaggerate.
1993350	1995450	But make sure that you check the boxes
1995450	1997130	that they're asking you to check.
1997130	1997730	Now, as I said,
1997730	2000090	one of those boxes is often the certification.
2000930	2003770	And this is another extremely common question
2003770	2006190	I get from people who are looking for cybersecurity jobs.
2006190	2007850	They wanna know what cert to get.
2008010	2009130	I love this picture.
2009130	2010850	It was put together by someone on Reddit.
2010850	2012730	I've got the credit down there at the bottom.
2012730	2014750	These are all the cybersecurity related
2016090	2017690	certifications you can get.
2018110	2020770	And I said, CISSP is very commonly asked for.
2020770	2022150	In fact, I did some research.
2022150	2024970	I went through five different major job boards
2024970	2027030	including LinkedIn and Monster.
2027030	2029370	And I looked at what are they looking for?
2029370	2032230	What is the most commonly asked for certification?
2032270	2034950	Far and away, bar none, it's the CISSP.
2035170	2038430	Now, I filtered out any jobs that were from the government
2038430	2039670	because the government does have
2039670	2040990	actually specific requirements
2040990	2042750	around why they have to have CISSP.
2042750	2045810	But more often than not, people say they want a CISSP,
2045810	2048530	and here's the magic words, or equivalent.
2048950	2051830	You don't have to have a CISSP to get a job.
2051970	2053890	Just get a cert.
2053890	2056250	Now, there's very few that as an entry-level person
2056250	2057670	you can get, but there's a couple.
2057670	2059610	The one that I recommend most often to people
2059610	2060670	is look at the Security Plus
2061270	2062910	because the Security Plus certification
2062910	2064950	is one of the cheapest to get.
2065350	2067450	It is attainable for anybody
2067820	2071370	and it covers a wide breadth of security knowledge.
2071370	2074610	It doesn't hamstring you into one specific area.
2074610	2076670	If you go for like a CEH, well, that's very focused
2076670	2078890	on ethical hacking and penetration testing.
2078890	2080470	That doesn't make a lot of sense.
2080470	2084070	If you look at the GIAC ones, the ones from SANS,
2084070	2086670	well, one, they're super duper duper expensive,
2086670	2090450	and two, they're very narrowly focused as well.
2090450	2093310	So get something general, something that can apply.
2093310	2094630	You're not looking to say,
2094630	2098130	hey, I've got this great, wonderful certification.
2098130	2100430	You're looking to check that box that says CISSP
2100430	2101510	or equivalent.
2101610	2103730	And I will tell you that having a Security Plus
2103730	2106590	more often than not will be looked at as an equivalent.
2108570	2111350	So you've made it past the ATS, congratulations.
2111430	2114170	The recruiter is now looking at your resume.
2114170	2116630	What do you, how do I get them?
2117050	2118810	How do I get them on board?
2118950	2120470	Well, you gotta inspire them.
2120570	2121910	You gotta inspire that recruiter
2121910	2125990	who's looking at thousands maybe of resumes in a week.
2126030	2130370	You gotta inspire them to take your resume
2130890	2133430	and pass it on to the hiring manager.
2133430	2134810	How do you do that?
2134810	2138050	Step one, be memorable.
2138390	2140970	And I cannot stress this enough.
2140970	2143890	And this goes beyond maybe having some unique formatting
2143890	2146710	about a resume that you sent to them outside of the ATS.
2146710	2149130	Again, don't use crazy formatting for ATS.
2149850	2151590	Do something more.
2151590	2152650	Be bold.
2153010	2155890	If you don't have a blog, start writing one.
2156030	2158530	That way you can link to your blog in your resume.
2158530	2161590	I don't care if only five people ever read your blog.
2161590	2163690	The fact that you wrote content and you put it out there
2163690	2165570	immediately demonstrates, hey,
2165570	2167490	I'm doing something in security.
2167490	2168830	It makes you memorable.
2169430	2171350	Create a YouTube channel and record videos
2171350	2173850	that talk about different security concepts.
2174610	2175990	One of my favorite stories,
2175990	2177430	and this was actually as a hiring manager,
2177430	2179110	this wasn't even at a recruiter level.
2179110	2182110	I interviewed a person and then she moved on
2182110	2184770	and she interviewed with some of the people on my team.
2184770	2186770	And she didn't like one of the answers she gave them
2186770	2188210	in this technical interview.
2188410	2191990	So she immediately left that after that interview,
2191990	2194410	went and recorded a YouTube video
2194410	2198450	where she explained the concept in detail,
2198450	2201550	talked about how to remediate it and so forth.
2201550	2203490	And then she emailed that video link
2203490	2205830	to not only the two people she interviewed with,
2205830	2207690	but to me and the recruiter as well.
2208190	2209670	That makes you memorable.
2209670	2211610	That's something that stands out.
2211610	2212530	So what I tell people,
2212530	2214410	I borrow a phrase from a colleague of mine,
2214410	2217030	Phil Gerboshek, who speaks all about personal branding.
2218850	2220150	What's your weird?
2220830	2223350	Figure out that thing about you that makes you unique.
2223350	2225390	It may not be security related at all
2226050	2228410	and highlight that in your resume.
2228410	2229110	Own it.
2229110	2231770	Something that makes you very unique from everybody else
2231770	2233450	that, hey, I mean, for me,
2233450	2235310	it's the fact that I bought my first computer
2235310	2236330	when I was 12 years old.
2236330	2237090	I was 12 years old.
2237090	2239430	I saved up money with a paper out and I bought a computer.
2239730	2241450	How many people do you know who did that,
2241450	2243550	especially back in the late 80s when I grew up?
2243550	2244630	Yes, I'm that old.
2244910	2249150	So put those unique stories out there.
2249150	2251210	That's the thing that when recruiters read through that,
2251210	2253570	they see that and they're like, oh, hey, this is memorable.
2253630	2255030	That's something that sticks in their head.
2255030	2257850	And they're like, this is someone I want to know more about.
2257850	2259550	And they'll get in touch with you.
2261390	2263410	Link everything to those requirements.
2263610	2265810	Now we talked about tailoring your resume already.
2265810	2267270	This is that same thing.
2267470	2270670	If you're talking to them, do the same.
2270670	2272310	So you've gotten past maybe that resume.
2272310	2275490	You've gotten that initial HR screening call now.
2276170	2277570	Talk to them, but make sure everything
2277570	2278450	that you're talking about
2278450	2280710	that you somehow link it back to their requirements.
2281370	2282430	And then finally, this one,
2282430	2283950	I can't believe I have to tell you this,
2283950	2286070	but unfortunately, as I talk to recruiters all the time,
2286070	2287790	they tell me this is one of the biggest problems.
2287830	2288970	Be responsive.
2289230	2291890	If a recruiter contacts you and says,
2291890	2294510	hey, I'd like to schedule a screening interview,
2295990	2298790	respond back, respond back as quick as you can.
2298790	2300210	Now, sometimes we're out on vacation,
2300210	2301910	we're not checking emails, great,
2301910	2304530	but make sure you're using an email that you check often
2304530	2306710	and respond to them quickly.
2306850	2308530	Nothing is more frustrating for a recruiter
2308530	2310310	than when they see a candidate who they really like
2310310	2311470	and they want to bring them in,
2311470	2312490	and they try to get in touch with them
2312490	2314470	and they can't get that person to return their calls
2314470	2315750	or return their emails.
2316190	2319210	And this is a huge problem that stands in people's way.
2319650	2321210	So we can do better.
2321910	2324310	Then finally, all right, so we did all that.
2324310	2327070	The recruiter passed us on to the hiring manager.
2327070	2329530	The hiring manager wants to know more about us.
2329530	2332290	How do I win over the hiring manager?
2332610	2334610	This is where things are crucial.
2335450	2336490	First and foremost,
2336490	2339270	this first of all is where you've got the opportunity.
2339270	2340970	We're no longer talking about resume.
2340970	2342890	At the point they call you in for an interview,
2342890	2344590	it's not about your resume anymore.
2344590	2346710	It's about you and what do you do.
2346890	2349990	And in that survey, when I talked to hiring managers
2349990	2353410	and the last question I asked them on the survey,
2353410	2354670	the last question I asked was,
2354670	2356330	what's one piece of advice you would give
2356330	2359610	to people looking to get their first job in security?
2359690	2361490	The single most common theme
2361490	2365290	throughout all the thousand answers that I got,
2365290	2369550	they all related back to passion, the vast majority.
2369610	2372510	And you see some of the direct quotes here.
2372650	2374670	How do you share your passion?
2374830	2377410	Be excited about the things that you're talking about.
2377410	2382510	If you built that blog, like I suggested, talk about it.
2382510	2384010	That shows you have passion.
2384010	2386690	That's something that's completely voluntary
2386690	2388530	that you chose to do on your own.
2388530	2389810	Or if you created a bunch of videos,
2389810	2391710	that's something you chose to do on your own.
2391710	2394510	If you engaged in labs and other things,
2394510	2398070	that's all stuff that shows you have a passion for security.
2398230	2400790	Make sure you share that when you're talking
2400790	2403070	with the hiring manager.
2404270	2405910	And then I'm gonna share this with you.
2405910	2408090	So I told you I host this podcast
2408090	2411290	and one of the people we had on was Malware Jake,
2411290	2412230	Jake Williams.
2412230	2414670	And he shared with us something
2415080	2418010	that I thought was absolutely incredible advice.
2418490	2421750	Here's how you refine your resume to sell yourself.
2421930	2423490	First, write up a resume.
2423490	2425690	Take what I've told you so far, create a resume.
2426770	2429310	Then I want you to completely separately
2429310	2432230	prepare a one to two minute elevator pitch.
2433270	2435450	Just how are you gonna sell yourself in two minutes?
2435450	2437550	Tell somebody why they should hire you,
2437550	2438530	what it is that you're gonna do
2438530	2439650	to make their business better,
2439650	2440430	what it is that you're gonna do
2440430	2442170	to make their department stronger.
2442170	2445230	Now go and find those things in your resume.
2445430	2449510	If you can't find those elements in your resume,
2449510	2453170	get revising, figure out how you're going
2453170	2455670	to add those elements to your resume
2455670	2457270	to hit those things that are a part
2457270	2459290	of what you said were most important
2459290	2460290	because that's what you squeezed
2460290	2462530	into that two minute elevator pitch.
2462530	2464210	This is such a great idea.
2464210	2466010	If you can do this with your resume,
2466010	2468070	your resume is gonna be so much stronger.
2468070	2469810	And then now you can carry through
2469810	2471270	that narrative that you told
2471270	2473290	in that one to two minute elevator pitch,
2473290	2476130	that becomes the theme for every interview
2476130	2477930	that you have after that.
2478390	2481810	Make them know why it is that they wanna hire you.
2482430	2485050	So let's go back to our barista then.
2485050	2487210	We're gonna tie things all together here now.
2487210	2490050	So how do I revise that resume?
2490110	2493730	Say I'm entry level, I don't have a lot of experience.
2494230	2497990	Well, let's understand first technical capabilities.
2497990	2499410	And when I say technical capabilities,
2499410	2500490	I'm talking about those things
2500490	2502470	that ultimately show up as requirements.
2502470	2505510	There's kind of three levels that you can have here.
2505510	2506790	You can have knowledge.
2506790	2508650	And knowledge is just, hey, I read a book,
2508650	2512570	I did some training, I investigated research,
2512570	2515390	studied this somehow, here it is.
2515390	2518250	I have knowledge of this area.
2518250	2521250	Sometimes for certain things, that might be all you need.
2521330	2524430	But more often than not, people want you to have skill.
2524650	2527470	And when I say skill, what we're referring to in skills
2527470	2529610	is that you've actually taken that knowledge
2529610	2531370	and applied it in some way.
2531490	2534610	Maybe you did a lab, maybe you worked in a CTF,
2534610	2537750	or you went to a village or some other hands-on training
2537750	2540150	somewhere where you actually got to do application
2540150	2544770	of that knowledge into the actual technology.
2544770	2546530	You got to apply it somehow.
2546530	2548030	That is a skill.
2548390	2550010	That's, we're kind of, as you see,
2550010	2551210	going from good, better, best here.
2551210	2552610	So you've got knowledge and skill.
2552610	2555410	The last one is experience.
2555550	2557270	And this is the coup de gras, right?
2557270	2560410	This is what employers tell us they want all the time.
2560410	2562570	They want to know that you have experience.
2562630	2564310	And when they say experience, they're talking about
2564310	2567330	that you have some kind of formal documented examples
2568090	2571730	of applying that skill in a real life,
2571730	2574110	most often business scenario.
2575350	2577570	So understanding, making an inventory
2577570	2580230	of your capabilities technically,
2580230	2583410	and understanding are they knowledge, are they skills,
2583410	2585990	and are they experience, and to what level of each
2585990	2587310	is so crucial.
2587310	2588990	This is back to working on you again
2588990	2591150	and talking about how you can be better.
2592170	2593850	And then finally, I want to talk about this idea
2593850	2594770	of core skills.
2594770	2597010	So now that you know what those capabilities are,
2597010	2599690	your core skills are the transferable elements
2599690	2602710	of those that you can take from one capability
2602710	2606450	and apply it to any capability in any technology anywhere.
2606610	2608470	So if I look at my barista, they start off with,
2608470	2609930	well, they make coffee beverages.
2610790	2613530	Well, really, if I break that down,
2613530	2614910	here's a lot of the steps they did.
2614910	2617990	They received orders, they prepared according to recipes,
2617990	2619210	they delivered on the customers
2619210	2620850	and they had to clean the equipment.
2620930	2623090	But that's still shades of a barista.
2623090	2624690	So how do I take it further?
2625130	2626990	They processed multiple inputs.
2626990	2629090	They translated inputs into tasks
2629090	2632030	and prioritize them for maximum efficiency.
2632210	2634870	And they were always focused on efficient delivery
2634870	2635990	to the customer.
2635990	2636790	And throughout all that,
2636790	2639130	they had to plan and execute maintenance activities.
2639150	2643030	These are general words that can apply to any job anywhere.
2643030	2647230	And when you can now take and view your skills in that light,
2647230	2649950	you can take those requirements that they're asking for,
2649950	2653390	understand the core skills behind those,
2653390	2657150	take your own core skills, tie them together.
2657150	2660830	And now you can see how you can easily word your resume
2660830	2663050	to highlight the skills and experiences
2663050	2664730	that you have from your job
2665150	2670550	to fit into that job that you are applying for.
2670550	2674690	And this is where the rubber really meets the road.
2674790	2679350	How do you take that simple role as a barista
2680530	2684630	where it seems so completely unconnected?
2684630	2687010	And this is literally what I told that manager
2687010	2688370	when he was complaining to me.
2688370	2691770	I said, didn't they absorb all of this input
2691770	2694450	from all these different areas and process it?
2694630	2696350	Didn't they have to focus
2696870	2699490	on how they were going to arrange those?
2700150	2701850	And do it in an efficient manner
2701850	2703670	so they could be most effective?
2703770	2705670	Weren't they always focused on customers
2705670	2708590	and the customer was what was most important?
2708590	2710070	And yet throughout all of that,
2710070	2713130	they had to plan and execute maintenance activities.
2713570	2714810	And he started to look at me.
2714810	2717310	I said, isn't that exactly what you want
2717310	2719790	your SOC analysts to be able to do?
2720370	2722470	That barista would be perfectly qualified
2722470	2724450	to be a SOC analyst in light of the fact
2724450	2728030	that they have the other knowledge that you asked for.
2728030	2729670	They may not have the experience,
2729670	2731330	but they have the knowledge.
2731450	2734310	So look to highlight these on your resume,
2734310	2737330	in your discussions, in those interviews,
2737330	2741110	as you're blogging, as you're making videos,
2741110	2743070	tie these things together.
2743130	2744470	And then last, I'm going to leave you
2744470	2746570	with this quote from Ella Fitzgerald.
2747310	2748970	Just don't give up.
2748970	2751570	Whatever it is, don't give up.
2751690	2752810	This is tough.
2752810	2755330	I'm not going to say the security industry is perfect.
2755330	2757730	We've got a lot of work to do
2757730	2760150	from the industry side to make things better
2760150	2762970	for those that we're trying to bring into the industry.
2763170	2765510	Keep working, use your network,
2765510	2767290	find mentors who can help you,
2767290	2770390	leverage your connections and foster those relationships
2770390	2772510	because they're going to help you get there.
2773230	2776230	So finally, I can be one of those people for you.
2776230	2777270	And I'm always happy to.
2777270	2779090	Find me on social media.
2779090	2781970	You've got my Twitter handle, my LinkedIn address there.
2781970	2783330	You've also got the link to my website,
2783330	2786670	which includes my blog and lots of other information.
2786670	2790750	So please continue, reach out to me, reach out to others.
2790750	2793990	If I can't help you, I will find somebody to connect you with,
2793990	2797150	or I will put the call out to the world and to my network
2797150	2800110	and find you somebody who can help you with what you need.
2801030	2803590	So with that, I want to say thank you so much
2803590	2805650	to everybody who's attended today.
2805650	2808750	Thank you, Sneak, my employer, for allowing me to be here today.
2808750	2811890	Thank you to DEF CON and the DEF CON Career Hacking Village.
2811890	2815230	I'm so excited to be a part of the inaugural version of this.
2815230	2816790	That is so cool.
2816790	2820250	And I hope you all enjoy the rest of the conference.
2820250	2822070	I know it's a weird world out there.
2822070	2824270	We'll get back to the real thing soon enough.
2824270	2826850	But enjoy this virtual experience and make the most of it.
2826850	2829810	This is where you're going to learn so many things.
2829810	2831530	And I hope to see you soon.
2832830	2837210	That was just absolutely, excuse me, absolutely awesome.
2837210	2841890	I hope you saw me doing thumbs up and being excited.
2842090	2844610	And yes, you hit so many points.
2844610	2847310	20 years in the recruitment industry.
2847310	2852110	And I am so glad you pointed everything out, listed some of the key things,
2852110	2855530	listed a lot of the key things that job seekers really need,
2855530	2859070	and sort of gave a little bit of a backslap to those
2859750	2862710	employers who really need to change their jobs descriptions.
2862710	2865430	That's something I've been trying to do for 20 years.
2865430	2868070	And I think it will take all of us to do that.
2868070	2872850	Alyssa, thank you so much for all of your great input, for doing the great survey.
2872850	2876210	I know that you've also made yourself available for career coaching
2876210	2879590	through The Village, and we really appreciate that.
2879590	2882850	So definitely connect with Alyssa.
2882910	2886090	And we will be back with another session shortly.
2886090	2886890	Bye-bye.