WEBVTT 00:05.730 --> 00:10.880 Welcome back to Career Hacking Village, Hacking Career Village, whatever. 00:10.980 --> 00:17.080 As many of you know, I haven't had a lot of coffee yet today and it just doesn't seem like a HackerCon without a shot of tequila. 00:17.080 --> 00:18.760 So maybe I'll go do that. 00:18.760 --> 00:33.040 In the meantime, a lot of people in our community are frustrated with figuring out how do they go from one job that is non-tech, non-security related into being a security pro. 00:33.040 --> 00:44.400 And I'm so thankful that Alyssa Miller decided to tackle this topic and bring to us her insight, her wisdom, and her shared strategies on how we could be successful. 00:44.400 --> 00:45.280 Alyssa? 00:45.460 --> 00:46.220 Awesome. 00:46.220 --> 00:47.200 Well, thank you, Kathleen. 00:47.200 --> 00:49.940 And hey, everybody from DEF CON. 00:50.720 --> 00:54.260 God, what a weird DEF CON this is this year. 00:54.340 --> 00:59.540 Miss seeing all my buds, seeing all my Hacker fam, but here we are. 00:59.540 --> 01:18.640 And as Kathleen mentioned, I think we're all kind of familiar with the struggles of trying to find jobs in cybersecurity, especially if you're new and trying to make that transition from one industry into the security industry. 01:18.900 --> 01:22.000 And it's something that's very near and dear to my heart. 01:22.020 --> 01:26.520 So today I really wanted to go through some strategies with you. 01:26.520 --> 01:41.360 Let's talk a little bit about some of the problems that are out there and how we can tackle them, how people who are trying to find that first job in cybersecurity can really jump in and overcome some of those obstacles that unfortunately exist in the industry today. 01:41.700 --> 01:45.320 So to get things started, let me just share a little bit about myself. 01:45.400 --> 01:51.080 First of all, for those of you that don't know me, my name is Alyssa Miller, and I'm a hacker and a researcher first and foremost. 01:51.120 --> 02:01.660 I've been hacking all my life, bought my first computer when I was 12, did some things of questionable legality with some online services. 02:01.940 --> 02:04.180 And it's kind of been that way ever since. 02:04.180 --> 02:05.560 You know, I taught myself how to program. 02:05.560 --> 02:09.220 I taught myself about modem communications and sort of dug in. 02:09.220 --> 02:16.660 And later on in life became a developer and finally jumped into the security industry as a pen tester. 02:16.720 --> 02:18.840 So I've been doing this pretty much my whole life. 02:18.840 --> 02:24.940 It's really my mindset is that of, I love tearing things apart, figure out how they work. 02:24.940 --> 02:27.940 I like to break stuff and I like to make it work better. 02:28.240 --> 02:34.820 So that career of mine has led me to where I'm at right now, which is a security advocate for a company called Snyk. 02:34.980 --> 02:48.880 Just means basically that my job is to get out in the security community and talk about topics that are important to us in security and how that ties in organizationally like DevSecOps and things like that. 02:48.880 --> 02:55.660 But part of my career journey has really centered on the fact that I've been a security leader. 02:55.660 --> 03:02.200 In other words, a manager, a hiring manager for 12 of the 15 years that I've been in security. 03:02.260 --> 03:11.540 It didn't take long after I took over that first penetration testing role that was leading that whole team and the vulnerability management program for a huge, huge organization. 03:11.920 --> 03:15.720 And so this is a space that I've worked in a lot. 03:15.720 --> 03:26.880 I have built a number of different consulting teams from the ground up where there was nothing that existed or a very skeleton crew and it needed to be grown quickly. 03:26.880 --> 03:37.340 And I've had a lot of success with that, but it's enabled me to see a lot of the struggles that people deal with from a job search perspective. 03:37.380 --> 03:42.660 And indeed, it's given me the perspective too of what are hiring managers looking for? 03:42.660 --> 03:46.180 A lot of times hiring managers have their own frustrations. 03:46.180 --> 03:52.000 I've had to work with recruiters and headhunters and job search systems and so forth. 03:52.000 --> 03:53.300 And so I'm excited to talk about all of that. 03:53.300 --> 03:59.640 And then finally, about me, I'm also the co-host of a podcast called The Uncommon Journey. 03:59.640 --> 04:06.140 And I bring this up because it's on this podcast that we focus on something that's really important to understand in cybersecurity. 04:06.360 --> 04:13.560 And that is that every one of us has a very unique and very different story about how we got here. 04:13.560 --> 04:17.400 I always tell the story, I started off as a pre-med major. 04:17.700 --> 04:21.100 I know other people in this industry who were wrestlers. 04:21.100 --> 04:25.940 I know people who worked in sanitation. 04:25.940 --> 04:28.940 I know people who were actors and did drama. 04:29.080 --> 04:36.000 And all of these people somehow ended up in the same place because they had an interest and a passion for security. 04:36.180 --> 04:44.760 So it's a great podcast, check it out, but more importantly, understand that concept that no matter where you're coming from, there's a place for you here. 04:45.600 --> 04:48.460 So I wanna start off a little bit of a story. 04:48.980 --> 04:54.200 And the story goes back to the title of this talk being about from a barista to a security pro. 04:54.320 --> 05:09.640 So some time ago, I was having a conversation with one of my colleagues and he was lamenting the fact that he was hiring for some positions and he was having trouble getting qualified candidates. 05:09.640 --> 05:13.760 And these were entry-level positions in the SOC. 05:13.760 --> 05:15.480 So he was in the security operations center. 05:15.880 --> 05:27.940 And along this conversation at one point, he brought up the fact that he had somebody who was a seven-year barista, had been working for Starbucks for the last seven years. 05:28.180 --> 05:37.160 And he was frustrated, didn't think that they had any place applying for a cybersecurity role because they hadn't worked in tech before. 05:37.160 --> 05:38.520 And so I started to question him about that. 05:38.520 --> 05:41.780 And I asked, okay, well, what qualifications do they have? 05:41.780 --> 05:49.080 Well, they had gone and they had gotten a computer science degree and they had achieved their security plus certification. 05:49.080 --> 05:53.720 I think he might've mentioned they were also working on a CEH or something like that. 05:53.980 --> 06:08.740 And so I started to ask him, I said, did you think about what it is that a barista does on a daily basis and how some of those skills might be really valuable to you in a SOC environment? 06:09.360 --> 06:10.420 And I started to go through them. 06:10.420 --> 06:14.620 And we're gonna talk about that more a little bit down the ways in this talk today. 06:15.320 --> 06:17.720 But I really started to, we dug into this. 06:17.720 --> 06:20.360 And by the end of it, he started to realize that, you know what? 06:20.360 --> 06:28.940 This barista might actually have some really good skills and might be the kind of person that they can build. 06:29.260 --> 06:35.620 So the point of this being, there's always that path in, sometimes it's not so obvious. 06:35.620 --> 06:41.740 And since hiring managers, recruiters, job search systems may not always see those connections. 06:41.740 --> 06:56.520 It's up to us as job seekers to help people see what those connections are and justify why it is that we're coming to this industry to start a career and why it is that you want us to be your next hire. 06:56.520 --> 06:58.720 So we're gonna talk all about that. 06:58.720 --> 07:03.180 But first, let's just start off with the state of where the industry is today. 07:03.180 --> 07:13.920 If you're looking to get into cybersecurity, chances are you've once or twice before heard this mantra that there's a talent shortage in security. 07:13.920 --> 07:21.720 There are studies, there are surveys, there are articles galore that speak to this every single day. 07:21.720 --> 07:37.600 If you go through any news sites related to cybersecurity or related to tech, chances are somewhere over the past year you're gonna find that they had some article that talked about the challenges of this so-called talent shortage that exists in cybersecurity. 07:38.560 --> 07:44.100 Now you see some things up here, for instance, the great cybersecurity talent shortage continues. 07:44.100 --> 07:49.180 And it's blown up really big, but the question always comes back to me. 07:49.180 --> 07:57.060 I start to wonder, I hear from a lot of people who are trying to find roles in cybersecurity and are unable to find them. 07:57.960 --> 08:04.580 And I hear from people who are experienced and who are trying to find new jobs and are having trouble. 08:04.880 --> 08:13.200 So you're telling me there's a talent shortage yet I'm hearing from all these people who are having trouble finding jobs. 08:13.260 --> 08:15.940 So what's the reality? 08:16.140 --> 08:21.680 And that's something that was, I really wanted to start to try to find some answers to. 08:21.680 --> 08:28.600 So at the very beginning of this year, I made the decision to do some research. 08:28.600 --> 08:31.080 And it's related to a book that I'm also writing. 08:31.080 --> 08:36.140 In fact, a lot of the stuff you're going to see in this talk today comes from this book that I'm currently working on. 08:36.140 --> 08:39.960 But one of the things I did was I launched a pair of surveys. 08:40.200 --> 08:47.140 One survey was targeted at people who had never worked in cybersecurity before and wanted to get that first job in security. 08:47.240 --> 08:54.480 The other survey was targeted at people who are working in security and already have some experience. 08:55.180 --> 08:58.160 I got over 1500 responses. 08:58.160 --> 08:59.960 So it was a very successful survey. 09:00.760 --> 09:15.520 But one of the questions I asked people, because I wanted to really understand this talent shortage in particular, I simply asked those entry-level folks, people who had never had a job in security before, if you're searching for a job, how long have you been searching? 09:16.080 --> 09:17.360 Simple question. 09:17.920 --> 09:22.160 And the results are what surprised me. 09:22.940 --> 09:30.160 We're talking about a talent shortage where employers are desperate to find people to fill these jobs they have open. 09:30.160 --> 09:40.600 Yet as we look at these numbers, I can see close to three quarters of these people have been searching for three months or longer to find a job. 09:42.220 --> 09:46.920 Over 32% of them have been searching for seven months or more. 09:47.220 --> 09:52.020 That's a long time to be out on the job market when you're looking for that first job. 09:52.020 --> 10:00.540 So if we have such a talent shortage, how come all these people are having such a hard time finding jobs? 10:00.540 --> 10:03.160 This is something I really wanna get to the bottom of. 10:03.300 --> 10:10.760 So you might look at this and you might say, well, yeah, that's probably because they're entry-level and they don't have any experience. 10:11.140 --> 10:15.980 And a lot of these jobs in security, well, they're looking for experienced people. 10:15.980 --> 10:17.320 And you're not wrong about that. 10:17.320 --> 10:19.000 You wouldn't be wrong to think that. 10:19.000 --> 10:33.300 And in fact, when I asked the same exact question of experienced people who said they were already looking, said they were currently looking for a job, the numbers changed a little bit, but they still didn't change a lot. 10:33.300 --> 10:40.880 We see, yeah, it went up to 46% that are less than two months in the job market, and that's pretty good. 10:41.100 --> 10:42.760 And that's what we'd expect to see. 10:42.760 --> 10:47.500 People with experience, there's high demand, they're finding jobs quickly. 10:48.180 --> 10:52.160 But what about the other 54% or 53 and a half percent? 10:52.540 --> 10:56.820 They're still taking three months or longer to find a new job. 10:57.440 --> 10:59.280 That's a long time. 10:59.440 --> 11:02.900 In almost a quarter of them, it's taking over seven months. 11:04.140 --> 11:08.960 So we see the same issues here, whether you're entry-level or whether you're experienced. 11:09.460 --> 11:17.260 So if there's this talent shortage, we have this high demand, 4 million jobs is one of the quotes you'll see mentioned recently. 11:17.260 --> 11:20.700 Over 4 million jobs are gonna be left unfilled this year. 11:20.700 --> 11:26.540 Of course, some of those numbers came up before COVID, so we'll see how that adjusts as people have adjusted their hiring practices. 11:26.700 --> 11:36.560 But that's a significant number to say that we've got these 4 million positions, but these experienced people can sit in the job market for seven months or more. 11:37.600 --> 11:40.940 So, all right, is it a problem maybe with the applicants? 11:41.720 --> 11:50.180 So in that same survey, I asked the people who were hiring managers, I asked them, hey, are you trying to hire for a cybersecurity position? 11:50.380 --> 11:58.700 And there were a good number of them that came back and said, yes, indeed, they were trying to hire for cybersecurity as well. 11:58.700 --> 12:07.180 And so I asked them, all right, well, what's the biggest challenge that you're encountering when hiring cybersecurity candidates? 12:08.180 --> 12:11.660 The number one was unqualified applicants. 12:12.120 --> 12:14.100 And this gets me thinking. 12:14.760 --> 12:25.000 That works maybe when we're talking about entry level people, but we're seeing all of these people with experience, with degrees, with certifications, everything else. 12:25.420 --> 12:31.340 How are we finding so many that are unqualified for the positions they're applying for? 12:31.920 --> 12:34.520 The second one is kind of telling. 12:35.040 --> 12:37.480 And this is where we're gonna start to dive in more. 12:38.400 --> 12:42.720 The second most common answer was struggles with job descriptions. 12:43.280 --> 12:53.800 Hiring managers, recruiters, they work together to put together these job descriptions, but it's not an easy job. 12:54.480 --> 13:10.700 And indeed, figuring out a way that we can word a job description that accurately captures the things that are important to us as a hiring manager, also are compliant with all the employment laws and everything else that we have to worry about. 13:10.760 --> 13:12.540 This is actually a lot of heavy lifting. 13:12.540 --> 13:14.460 And it's not easy to do. 13:15.040 --> 13:19.300 And so it's not really a surprise to me that I see this up there. 13:19.700 --> 13:22.200 Then we see lack of applicants as number three. 13:22.200 --> 13:24.100 And now I'm scratching my head again. 13:25.700 --> 13:36.280 Because how are we running into so many people who say they're in the job market for this extended period of time, but you're telling me you have a lack of applicants to your role? 13:36.880 --> 13:38.380 Well, how's that happening? 13:38.580 --> 13:47.800 So we're gonna explore those because I think those latter two in particular, job descriptions and the lack of applicants, they're actually really tightly related. 13:48.220 --> 13:52.060 So let's look at job descriptions for a minute. 13:52.060 --> 14:05.380 Because what I'm gonna tell you is that one of the core problems, when I look at why we're struggling to fill roles in cybersecurity, it comes down to that job description. 14:06.940 --> 14:14.880 So as a new security person, looking to start that career in cybersecurity, you might be thinking, hey, I wanna start my job as an intern. 14:15.080 --> 14:23.000 I wanna look for an intern role, especially if you're coming out of college or maybe you're wrapping up your degree and you're thinking in terms of intern positions. 14:23.480 --> 14:31.220 Now, if any of you follow me on Twitter, you've seen me throw out from time to time examples of bad job descriptions. 14:31.440 --> 14:37.800 Well, here's the job description from this information security intern position that was posted just a few weeks ago. 14:38.090 --> 14:44.190 Right off the top, a bachelor's degree in information technology or a technical discipline. 14:45.060 --> 14:50.480 So this is an internship they immediately want you to have your... 14:50.480 --> 14:53.200 They want you to have a degree already. 14:53.200 --> 15:05.030 So there's no flexibility here to say, have other experience that maybe plays in instead and can replace that particular role. 15:06.490 --> 15:08.950 The next one is what really trips me out. 15:08.950 --> 15:11.070 And this is something you're gonna see is really common. 15:11.910 --> 15:14.910 Certified in one or more of the following. 15:15.130 --> 15:19.550 You're talking about an intern and yet they're expecting them to have a certification. 15:20.690 --> 15:22.970 And if you look, you see CISSP is the first one. 15:22.970 --> 15:32.170 Anyone who knows anything about the CISSP knows that there's a minimum number of years of job experience that you have to have to get a CISSP. 15:32.170 --> 15:38.690 So how can any organization expect an intern to have a CISSP? 15:38.690 --> 15:40.590 This is simply not realistic. 15:40.850 --> 15:42.690 And then the last circle there. 15:42.690 --> 15:52.770 This is the one that set me off and resulted in a really long Twitter thread that ended up really kind of blowing up on Twitter for a few days. 15:52.890 --> 15:59.430 Minimum of seven years experience working in information technology security. 16:00.990 --> 16:02.810 We're talking about an intern. 16:03.570 --> 16:05.010 An intern role. 16:05.330 --> 16:08.730 These are the ones that you use to bring people out of college and into the workforce. 16:08.730 --> 16:11.970 And they want you to have seven years of experience. 16:11.970 --> 16:15.010 This is the landscape y'all are trying to conquer. 16:15.070 --> 16:20.470 So if you think you've got some key obstacles in your way, clearly you do. 16:21.290 --> 16:22.870 But it gets worse. 16:23.930 --> 16:27.510 Now here's one for, remember I talked about these experienced people. 16:27.510 --> 16:30.290 Here's one for an information security architect. 16:30.490 --> 16:34.110 And yes, I've protected the guilty here. 16:34.110 --> 16:36.790 I'm not gonna name and shame who this is. 16:37.050 --> 16:39.190 But take a look at this job description. 16:39.190 --> 16:43.530 So they start off with all the usual stuff talking about their company and their great culture and how wonderful they are. 16:43.530 --> 16:45.430 And then they start to describe the role. 16:45.430 --> 16:47.890 And you can see here's three bullet points. 16:47.890 --> 16:49.210 Okay, that's great. 16:49.490 --> 16:51.010 But it doesn't end there. 16:51.870 --> 16:52.970 This continues. 16:52.970 --> 16:54.470 This is the job role. 16:54.470 --> 16:56.810 This is what they're telling you and you're gonna do day to day. 16:56.810 --> 16:57.970 Now I've cut it off here. 16:57.970 --> 17:00.930 There's actually four more bullets that follow this yet. 17:01.210 --> 17:06.210 Who is this magic unicorn who's gonna fill all of these responsibilities? 17:07.090 --> 17:12.310 And if you look at them, I know they're hard to read because it's really, really, really small because it was the only way I could fit it on the screen. 17:12.310 --> 17:18.830 They're talking about everything from configuring ISPs and WAFs to working in DevSecOps. 17:18.870 --> 17:22.610 This like runs the gamut of everything that's in cybersecurity. 17:22.990 --> 17:24.710 But it doesn't end there. 17:25.570 --> 17:29.310 Let's go and look at their requirements for this job. 17:29.510 --> 17:32.330 So that's all of what you were gonna be doing if you get the job. 17:32.330 --> 17:34.950 Here's what they expect you to have. 17:34.950 --> 17:38.450 And these aren't preferred qualifications. 17:38.450 --> 17:40.630 These are listed as requirements. 17:40.970 --> 17:45.170 Required that you have every single bullet here. 17:46.850 --> 17:49.870 You wonder why this job didn't get filled. 17:51.110 --> 17:52.750 It's no surprise. 17:52.750 --> 17:55.430 So we're gonna dive into this deeper. 17:55.430 --> 17:59.770 But before we do, I also wanna share one more element of that survey. 18:00.050 --> 18:08.950 The last element of that survey was I asked job seekers, experienced job seekers, because I wanted to know people who've been around the block a couple of times. 18:08.950 --> 18:13.050 What do you see as your biggest struggle? 18:13.310 --> 18:21.390 And no surprise in light of everything we just saw, they come back and they say predominantly it's bad job descriptions. 18:21.390 --> 18:30.870 So when you have bad job descriptions like this that float throughout the industry, how can you expect people to even wanna apply? 18:30.870 --> 18:32.390 And indeed, this is what happens. 18:32.390 --> 18:33.910 You have these job descriptions. 18:33.910 --> 18:40.030 Sure, some people may apply and they might be underqualified because they can't even figure out what this company is really looking for. 18:40.030 --> 18:44.150 On the other side of it, you've got people who then just don't apply. 18:44.510 --> 18:53.150 So that percentage that said that they're having trouble finding job applicants, well, yeah, no kidding. 18:53.170 --> 18:56.650 Because when you have bad job descriptions, people don't apply. 18:58.350 --> 19:00.330 So enough of talking about the problems. 19:00.330 --> 19:03.810 I didn't come here today to tell you about how bad things are. 19:03.810 --> 19:04.450 We know that. 19:04.450 --> 19:05.950 You know that if you're looking for a job. 19:05.950 --> 19:07.630 You know it's a struggle. 19:08.130 --> 19:11.290 So let's talk about how we start to overcome some of these problems. 19:11.310 --> 19:14.990 And let's start by just looking at the typical hiring process. 19:14.990 --> 19:21.070 Because especially for some of you coming in as first-time job seekers, this might not just be your first time security job. 19:21.070 --> 19:26.430 This might be your first time really looking for a corporate level professional job overall. 19:26.430 --> 19:28.490 So let's just talk about this for a minute. 19:28.490 --> 19:35.050 The way it works in most organizations is really similar to what you see on this image here that I pulled from Jobscan. 19:35.050 --> 19:43.930 Now Jobscan is a company that produces one of what we call these application tracking systems or applicant tracking systems or ATS. 19:44.050 --> 19:49.830 So that's that automated system that collects all your information when you apply for a job. 19:49.830 --> 19:54.750 So usually what happens is they'll go in, they will create a job in that system. 19:54.750 --> 20:00.970 Now there's usually some stuff with approvals and things that happen before that, but a recruiter from the company is gonna go in and create this job. 20:01.070 --> 20:06.830 And they're going to attach to it a job description that the recruiter has likely worked with the hiring manager on. 20:06.830 --> 20:15.390 They probably have some standard job descriptions already laid out and they might work with the hiring manager to make sure that that's accurate for what they're trying to hire for. 20:15.390 --> 20:17.690 And then of course they publish it to the world. 20:17.690 --> 20:18.990 They put it out on LinkedIn. 20:18.990 --> 20:20.350 They put it out on job sites. 20:20.350 --> 20:23.770 They put it on their own job career board on their website. 20:23.850 --> 20:27.050 And they hopefully start getting applicants. 20:28.230 --> 20:29.950 Then they start screening. 20:30.450 --> 20:33.990 And they start screening each of these applicants and over stages they eliminate them. 20:33.990 --> 20:38.290 And then finally you get to the point where they select some and they interview them. 20:38.290 --> 20:41.490 And then hopefully they find the one they wanna hire and they hire them. 20:41.930 --> 20:48.110 What I wanna focus on here is this lower left where we see the applicant screening process. 20:48.110 --> 21:01.190 Because when I talk about how people fail to get into a cybersecurity job and how jobs fail to get filled from the hiring side, this is where the things fall apart. 21:01.390 --> 21:06.750 More than anything else, it's when we get into that screening process. 21:06.870 --> 21:09.850 So let's talk a little bit more about that process for a minute and what that looks like. 21:09.850 --> 21:16.930 In organizations where they're using an applicant tracking system, that is your first layer of filter. 21:16.990 --> 21:27.010 A lot of these systems have built in rules that immediately look at your resume and are going to identify very objective, tangible things that they can identify. 21:27.010 --> 21:35.970 And a lot of times there are algorithms built in there that will immediately, they may not actually delete you from consideration, but they rank you. 21:35.970 --> 21:43.990 They provide scoring that now the recruiters and the hiring manager are gonna look at to say, hey, let's prioritize these and look at who is most qualified. 21:44.210 --> 21:52.630 So it's important that we understand that that system is a crucial aspect in how we get considered for a job when we apply. 21:53.030 --> 21:59.330 Now it goes from there and typically a recruiter or someone in human resources is gonna look at that next. 21:59.410 --> 22:03.230 They're gonna get the ones that are receiving that and it's their job to screen further. 22:03.230 --> 22:06.070 So they're gonna look at your resume and your qualifications. 22:06.070 --> 22:20.010 And if you meet at least some of them, they're probably gonna get in touch with you because their job is to get in touch, talk to you and screen you and make sure that you do meet some of the, just the bare qualifications for that job. 22:20.010 --> 22:25.890 They're gonna make sure that some of the legal aspects of it are considered. 22:25.890 --> 22:35.490 So if you need to be, for instance, here in the US, if it's requires that you're able to legally work in the US, they're gonna make sure that you have whatever those legal qualifications are. 22:35.870 --> 22:46.450 They're gonna talk to you about some of the base skill sets and things that they're looking for, maybe ask you a little bit about your experience, but that's their job. 22:46.450 --> 22:53.830 And what they're trying to do is they're trying to filter out those applications before they ultimately submit them to the hiring manager. 22:53.830 --> 23:03.550 So the hiring manager and potentially their team and maybe some other managers and whatnot will be involved in the last steps of that screening process. 23:03.550 --> 23:13.850 So they're the ones that are ultimately involved in some of the interviews, and they're gonna make that final decision on who comes in for an interview, and of course, who they ultimately end up hiring. 23:15.310 --> 23:22.850 So understanding this process is important because more often than not, applicants do apply for jobs. 23:22.850 --> 23:32.690 I know people who have told me they've applied for 30, 40, 50 jobs because they're not hearing back, they're not making it through. 23:32.690 --> 23:37.530 And I start to question, well, if you're applying to that many jobs, how are you not getting calls back from any of them? 23:37.530 --> 23:38.990 That seems surprising. 23:39.630 --> 23:47.970 And indeed, when you're entering this world of searching for a cybersecurity job in particular, you're on the road to frustration. 23:48.610 --> 23:54.610 For those of you coming out of school, you may have had schools that told you, hey, just get that cybersecurity degree and you're gonna be all set. 23:54.610 --> 23:59.710 Or maybe you went and you got that certification and boy, they promise all these great things. 23:59.710 --> 24:09.410 Hey, if you just get this certification, everybody's gonna wanna hire you because 35, 40, 50% of people working in security have this certification. 24:09.410 --> 24:11.610 So if you get it, you can get a job there too, right? 24:11.610 --> 24:14.390 And then you go and you hit the job mark and it doesn't happen. 24:14.770 --> 24:17.030 So let's talk about how we're gonna get beyond that. 24:17.030 --> 24:22.990 How do we hack that system and make sure that you can get your next job? 24:24.230 --> 24:27.610 I'm gonna tell you, it starts with you. 24:27.730 --> 24:32.550 You are the first step and you need to understand yourself. 24:32.610 --> 24:38.710 Self-analysis is probably one of the most crucial aspects of getting a job in cybersecurity. 24:39.210 --> 24:43.010 I mentor a lot of people as they're searching for security jobs. 24:43.290 --> 24:48.810 And one of the first questions I'll ask them, someone will come to me, a lot of times they'll just ask, Kate, will you be my mentor? 24:48.810 --> 24:51.930 Which is a pretty vague request in general. 24:52.250 --> 24:55.490 And so I'll start to ask right away, hey, okay, what are your interests? 24:55.490 --> 24:57.270 What do you wanna do in security? 24:57.730 --> 25:02.930 And the answer that I dread, but I get quite often is, well, I just wanna work. 25:02.930 --> 25:03.790 I wanna learn everything. 25:03.790 --> 25:05.150 I wanna be in cybersecurity. 25:05.610 --> 25:07.250 Well, what do you wanna do in cybersecurity? 25:07.250 --> 25:07.910 Well, I don't know. 25:07.910 --> 25:09.130 I wanna learn it all. 25:10.890 --> 25:13.310 This image here is a wonderful image. 25:13.310 --> 25:14.650 I love this. 25:15.150 --> 25:19.090 Henry Jang put this together and he posted it in an article on LinkedIn. 25:19.330 --> 25:21.590 And I don't agree with all of how it's arranged. 25:21.590 --> 25:24.530 I would definitely change a lot of the aspects of it. 25:24.710 --> 25:36.590 But this gives you some idea of the amount of different opportunities, topic areas, skill sets, whatnot, that exist within this thing we call cybersecurity. 25:37.350 --> 25:43.170 So to say you wanna learn all of it, that's not a realistic expectation. 25:43.170 --> 25:47.950 To say to somebody, hey, I just wanna learn cybersecurity, that's super broad. 25:48.130 --> 25:54.350 How do you self-analyze and get to a point where you understand what it is in cybersecurity that interests you? 25:54.650 --> 25:56.110 Now, I've talked with people. 25:56.110 --> 26:08.390 Sometimes they're able to figure it out and we'll chat a little bit and when we get to the root of it, sometimes what I've encouraged people to do, go out, look at maybe five, 10 security-related blogs and news sites. 26:08.810 --> 26:14.290 Grab the first five headlines off of each one of them and put them in a list and rank them. 26:14.290 --> 26:18.450 Rank them in order of which headline seems most interesting to you. 26:18.830 --> 26:24.290 Now take the top five of those headlines and look for what's common. 26:24.290 --> 26:27.890 What are the aspects about those headlines that actually excite you? 26:27.890 --> 26:31.070 Is it because they're doing some kind of investigation? 26:31.070 --> 26:38.370 They're doing maybe digital forensics and they're investigating and you really like that idea of trying to solve a mystery. 26:38.370 --> 26:46.330 Is it because they've launched some new defense mechanism and maybe that's where you really like to sink your teeth into? 26:46.330 --> 26:49.770 Is it maybe headlines about new vulnerabilities that were discovered? 26:49.770 --> 26:56.810 And so, hey, that's starting to tell you, I really like this idea of vulnerability research and I want to start getting into things like pen testing. 26:56.930 --> 27:04.590 This is a great way to simply narrow down your interest and actually understand what is it in security that you want to be doing? 27:04.590 --> 27:07.890 Because this is a huge field and it's growing every day. 27:07.890 --> 27:14.130 As the digital world becomes more and more our way of life, security fits into every piece of it. 27:14.810 --> 27:18.690 Next thing you need to do is you need to be out there building your network. 27:19.330 --> 27:21.770 So you know what you want to do. 27:21.770 --> 27:27.190 Start interacting with people in social media, if nowhere else. 27:27.190 --> 27:37.250 If you go to conferences, I know this year it's different because we don't have the interactivity of being able to walk through hallway con like we normally do when we're at DEF CON and everywhere else and meet new people. 27:37.410 --> 27:38.570 But meet them on Twitter. 27:38.570 --> 27:43.430 Honestly, it's easier to meet them in social media first anyway and then find them at conferences later. 27:43.670 --> 27:51.490 But the key mistake I see made is interact with them. 27:52.050 --> 27:59.070 Building a network isn't just going out and following a bunch of people and trying to get a bunch of people to follow you on all these different social media platforms. 27:59.930 --> 28:01.330 It's interacting with them. 28:01.330 --> 28:03.090 The wonderful thing, I love Twitter for this. 28:03.090 --> 28:06.330 And there's a reason why security lives so strongly in Twitter. 28:06.610 --> 28:11.590 You can interact with anybody, as long as they haven't blocked you at least, so don't make them angry. 28:11.730 --> 28:16.450 But you can go out there, you can find the biggest names in the industry, you can follow them. 28:16.450 --> 28:20.770 And as they post things, you can respond and you can have conversations with them. 28:20.770 --> 28:26.470 Not only do you have conversations with them, but you may have conversations with their other followers who've also responded. 28:26.470 --> 28:35.270 Get engaged in those active conversations, ask questions, offer your opinions, be respectful, build that community. 28:35.270 --> 28:45.650 That's how you get followers, that's how you make friends, that's how you'll start to discover not just learning opportunities, but you'll start to find job opportunities. 28:46.010 --> 28:51.490 Now, LinkedIn is really great if you're looking really to, on a more professional level, of course. 28:51.650 --> 29:03.510 Not as active from a security perspective, definitely more formalized, but a great place, again, to start connecting with people who work for certain organizations that you wanna work for. 29:03.650 --> 29:06.890 Find those people, do a search. 29:07.190 --> 29:09.610 LinkedIn actually has a pretty decent search capability. 29:09.610 --> 29:20.130 Go look for people who work at a job that, or work at a company, excuse me, that is one that you wanna work for, and then look for the people who are in those security roles. 29:20.190 --> 29:27.150 Yeah, it's not the greatest search in the world, it does take some learning, but when you learn how to use it, you can actually effectively find these people. 29:27.590 --> 29:29.290 Add them, add them as connections. 29:29.290 --> 29:33.150 A lot of people on LinkedIn are more than happy to add connections all the time. 29:33.250 --> 29:36.530 Unless there's something red flagged about you, I'm gonna add you if you add me. 29:36.530 --> 29:42.010 So, make those connections, and again, now you can start interacting with those people when they post stuff. 29:42.010 --> 29:44.050 They'll start to see what you're posting as well. 29:44.050 --> 29:47.210 So, post good topics, concepts, things. 29:47.750 --> 30:01.010 Be out there, be active, but this is what I mean about being interactive and building that network, because now as you start to engage with these people and you build relationships, those are people that can help you find opportunities and help you land those opportunities. 30:02.090 --> 30:04.110 But now let's talk about the hiring process. 30:04.110 --> 30:10.230 So, we've worked on you, we've got you ready, but now you're gonna go and you're gonna start putting your resume out there to the world. 30:10.230 --> 30:12.410 Let's talk about how you beat the ATS. 30:13.050 --> 30:19.710 Those applicant tracking systems, they're used to varying degrees, different recruiters use them differently, different companies use them differently. 30:19.790 --> 30:23.290 But there's a few things you need to remember with the ATS. 30:23.290 --> 30:27.490 Most importantly, remember, this is a machine, it's software. 30:27.490 --> 30:36.810 It might be AI based, it might use machine learning and all these buzzwords that the vendors talk about that their products do, but at the end of the day, you're talking to a machine. 30:36.950 --> 30:39.670 So, let's think about some of the things that are really important there. 30:39.670 --> 30:44.470 First and foremost, when it comes to your resume, simple formatting. 30:44.570 --> 30:46.810 And there's a lot of aspects here. 30:47.170 --> 30:49.210 Use common fonts. 30:49.210 --> 30:51.130 Believe it or not, this can be an issue. 30:51.130 --> 30:52.950 Don't use wild, crazy fonts. 30:52.950 --> 30:53.970 Use ones that are common. 30:53.970 --> 30:57.570 There's no one specific that you have to use, but use ones that are typical. 30:57.570 --> 31:05.870 Colibri, Times New Roman, the ones that you typically see in documentation, other things, things that are easy to read. 31:05.870 --> 31:11.050 These are the ones that those systems can most effectively process accurately. 31:11.050 --> 31:14.050 And that's important, but let's go beyond that. 31:14.310 --> 31:18.150 Just format your resume in a way that's easy to read. 31:18.150 --> 31:26.930 I know we like to have things that stand out, and it's okay to have a separate resume that you're gonna hand to people, but the one that you upload to the ATS needs to be simply formatted. 31:26.930 --> 31:28.210 Don't put pictures in there. 31:28.210 --> 31:30.010 Don't put designs in there. 31:30.230 --> 31:31.630 Lay it out, structured. 31:31.630 --> 31:35.510 Use bullet points, things that it will be able to easily process. 31:36.710 --> 31:39.290 The second thing, and this to me is so crucial. 31:39.290 --> 31:41.750 I cannot believe how often people miss on this. 31:41.750 --> 31:46.670 And this, I don't care if you're looking for a cybersecurity job or what kind of job, this is something you need to be aware of. 31:46.670 --> 31:52.550 If you're trying to get hired, you need to be tailoring your resume to that job that you're applying to. 31:52.690 --> 31:56.490 This means for every job that you apply to, you should have a separate file. 31:56.810 --> 32:06.730 And literally, if I showed you my file system where I store my resumes when I'm applying to jobs, I've got a different one for everyone, and I name them with the date and the company of who I sent it to. 32:07.280 --> 32:07.970 Why? 32:08.310 --> 32:12.830 Because I need to be looking at keywords that appear in those job descriptions. 32:12.830 --> 32:16.830 What are the things that are most important to them in those job descriptions? 32:16.830 --> 32:18.730 What ranks highly in the requirements? 32:18.730 --> 32:23.190 And how can I work those terms into my resume? 32:23.250 --> 32:31.690 Not saying I have to have experience in that term if I don't have it, and we'll talk more about that in a minute, but at least make sure that you mention that keyword somewhere. 32:31.690 --> 32:32.910 Get it in there. 32:33.110 --> 32:35.770 Look for variations on that keyword as well. 32:35.770 --> 32:42.270 So if we think about penetration testing and ethical hacking, for instance, are two different variations that you might focus on. 32:42.270 --> 32:45.650 And make sure you're ticking all of those boxes. 32:45.650 --> 32:50.730 And sometimes those boxes, they can be pretty complex. 32:50.730 --> 32:52.470 They might include certifications. 32:52.470 --> 32:55.130 So I'm gonna talk to you in a second about certifications. 32:55.210 --> 33:03.950 But the last thing I'm gonna tell you with checking the boxes is make sure that you look at these step-by-step and lay them out. 33:03.950 --> 33:10.410 And know which ones that you wanna have in that resume because you need to make sure your resume touches all of those when you upload it to this system. 33:10.410 --> 33:11.430 Don't lie. 33:11.630 --> 33:13.350 Don't over-exaggerate. 33:13.350 --> 33:17.130 But make sure that you check the boxes that they're asking you to check. 33:17.130 --> 33:20.090 Now, as I said, one of those boxes is often the certification. 33:20.930 --> 33:26.190 And this is another extremely common question I get from people who are looking for cybersecurity jobs. 33:26.190 --> 33:27.850 They wanna know what cert to get. 33:28.010 --> 33:29.130 I love this picture. 33:29.130 --> 33:30.850 It was put together by someone on Reddit. 33:30.850 --> 33:32.730 I've got the credit down there at the bottom. 33:32.730 --> 33:37.690 These are all the cybersecurity related certifications you can get. 33:38.110 --> 33:40.770 And I said, CISSP is very commonly asked for. 33:40.770 --> 33:42.150 In fact, I did some research. 33:42.150 --> 33:47.030 I went through five different major job boards including LinkedIn and Monster. 33:47.030 --> 33:49.370 And I looked at what are they looking for? 33:49.370 --> 33:52.230 What is the most commonly asked for certification? 33:52.270 --> 33:54.950 Far and away, bar none, it's the CISSP. 33:55.170 --> 34:02.750 Now, I filtered out any jobs that were from the government because the government does have actually specific requirements around why they have to have CISSP. 34:02.750 --> 34:08.530 But more often than not, people say they want a CISSP, and here's the magic words, or equivalent. 34:08.950 --> 34:11.830 You don't have to have a CISSP to get a job. 34:11.970 --> 34:13.890 Just get a cert. 34:13.890 --> 34:17.670 Now, there's very few that as an entry-level person you can get, but there's a couple. 34:17.670 --> 34:24.950 The one that I recommend most often to people is look at the Security Plus because the Security Plus certification is one of the cheapest to get. 34:25.350 --> 34:31.370 It is attainable for anybody and it covers a wide breadth of security knowledge. 34:31.370 --> 34:34.610 It doesn't hamstring you into one specific area. 34:34.610 --> 34:38.890 If you go for like a CEH, well, that's very focused on ethical hacking and penetration testing. 34:38.890 --> 34:40.470 That doesn't make a lot of sense. 34:40.470 --> 34:50.450 If you look at the GIAC ones, the ones from SANS, well, one, they're super duper duper expensive, and two, they're very narrowly focused as well. 34:50.450 --> 34:53.310 So get something general, something that can apply. 34:53.310 --> 34:58.130 You're not looking to say, hey , I've got this great, wonderful certification. 34:58.130 --> 35:01.510 You're looking to check that box that says CISSP or equivalent. 35:01.610 --> 35:06.590 And I will tell you that having a Security Plus more often than not will be looked at as an equivalent. 35:08.570 --> 35:11.350 So you've made it past the ATS, congratulations. 35:11.430 --> 35:14.170 The recruiter is now looking at your resume. 35:14.170 --> 35:16.630 What do you, how do I get them? 35:17.050 --> 35:18.810 How do I get them on board? 35:18.950 --> 35:20.470 Well, you gotta inspire them. 35:20.570 --> 35:25.990 You gotta inspire that recruiter who's looking at thousands maybe of resumes in a week. 35:26.030 --> 35:33.430 You gotta inspire them to take your resume and pass it on to the hiring manager. 35:33.430 --> 35:34.810 How do you do that? 35:34.810 --> 35:38.050 Step one, be memorable. 35:38.390 --> 35:40.970 And I cannot stress this enough. 35:40.970 --> 35:46.710 And this goes beyond maybe having some unique formatting about a resume that you sent to them outside of the ATS. 35:46.710 --> 35:49.130 Again, don't use crazy formatting for ATS. 35:49.850 --> 35:51.590 Do something more. 35:51.590 --> 35:52.650 Be bold. 35:53.010 --> 35:55.890 If you don't have a blog, start writing one. 35:56.030 --> 35:58.530 That way you can link to your blog in your resume. 35:58.530 --> 36:01.590 I don't care if only five people ever read your blog. 36:01.590 --> 36:07.490 The fact that you wrote content and you put it out there immediately demonstrates, hey, I'm doing something in security. 36:07.490 --> 36:08.830 It makes you memorable. 36:09.430 --> 36:13.850 Create a YouTube channel and record videos that talk about different security concepts. 36:14.610 --> 36:19.110 One of my favorite stories, and this was actually as a hiring manager, this wasn't even at a recruiter level. 36:19.110 --> 36:24.770 I interviewed a person and then she moved on and she interviewed with some of the people on my team. 36:24.770 --> 36:28.210 And she didn't like one of the answers she gave them in this technical interview. 36:28.410 --> 36:41.550 So she immediately left that after that interview, went and recorded a YouTube video where she explained the concept in detail, talked about how to remediate it and so forth. 36:41.550 --> 36:47.690 And then she emailed that video link to not only the two people she interviewed with, but to me and the recruiter as well. 36:48.190 --> 36:49.670 That makes you memorable. 36:49.670 --> 36:51.610 That's something that stands out. 36:51.610 --> 36:57.030 So what I tell people, I borrow a phrase from a colleague of mine, Phil Gerboshek, who speaks all about personal branding. 36:58.850 --> 37:00.150 What's your weird? 37:00.830 --> 37:03.350 Figure out that thing about you that makes you unique. 37:03.350 --> 37:08.410 It may not be security related at all and highlight that in your resume. 37:08.410 --> 37:09.110 Own it. 37:09.110 --> 37:16.330 Something that makes you very unique from everybody else that, hey, I mean, for me, it's the fact that I bought my first computer when I was 12 years old. 37:16.330 --> 37:17.090 I was 12 years old. 37:17.090 --> 37:19.430 I saved up money with a paper out and I bought a computer. 37:19.730 --> 37:23.550 How many people do you know who did that, especially back in the late 80s when I grew up? 37:23.550 --> 37:24.630 Yes, I'm that old. 37:24.910 --> 37:29.150 So put those unique stories out there. 37:29.150 --> 37:33.570 That's the thing that when recruiters read through that, they see that and they're like, oh, hey, this is memorable. 37:33.630 --> 37:35.030 That's something that sticks in their head. 37:35.030 --> 37:37.850 And they're like, this is someone I want to know more about. 37:37.850 --> 37:39.550 And they'll get in touch with you. 37:41.390 --> 37:43.410 Link everything to those requirements. 37:43.610 --> 37:45.810 Now we talked about tailoring your resume already. 37:45.810 --> 37:47.270 This is that same thing. 37:47.470 --> 37:50.670 If you're talking to them, do the same. 37:50.670 --> 37:52.310 So you've gotten past maybe that resume. 37:52.310 --> 37:55.490 You've gotten that initial HR screening call now. 37:56.170 --> 38:00.710 Talk to them, but make sure everything that you're talking about that you somehow link it back to their requirements. 38:01.370 --> 38:07.790 And then finally, this one, I can't believe I have to tell you this, but unfortunately, as I talk to recruiters all the time, they tell me this is one of the biggest problems. 38:07.830 --> 38:08.970 Be responsive. 38:09.230 --> 38:18.790 If a recruiter contacts you and says, hey, I'd like to schedule a screening interview, respond back, respond back as quick as you can. 38:18.790 --> 38:26.710 Now, sometimes we're out on vacation, we're not checking emails, great, but make sure you're using an email that you check often and respond to them quickly. 38:26.850 --> 38:35.750 Nothing is more frustrating for a recruiter than when they see a candidate who they really like and they want to bring them in, and they try to get in touch with them and they can't get that person to return their calls or return their emails. 38:36.190 --> 38:39.210 And this is a huge problem that stands in people's way. 38:39.650 --> 38:41.210 So we can do better. 38:41.910 --> 38:44.310 Then finally, all right, so we did all that. 38:44.310 --> 38:47.070 The recruiter passed us on to the hiring manager. 38:47.070 --> 38:49.530 The hiring manager wants to know more about us. 38:49.530 --> 38:52.290 How do I win over the hiring manager? 38:52.610 --> 38:54.610 This is where things are crucial. 38:55.450 --> 38:59.270 First and foremost, this first of all is where you've got the opportunity. 38:59.270 --> 39:00.970 We're no longer talking about resume. 39:00.970 --> 39:04.590 At the point they call you in for an interview, it's not about your resume anymore. 39:04.590 --> 39:06.710 It's about you and what do you do. 39:06.890 --> 39:19.610 And in that survey, when I talked to hiring managers and the last question I asked them on the survey, the last question I asked was, what's one piece of advice you would give to people looking to get their first job in security? 39:19.690 --> 39:29.550 The single most common theme throughout all the thousand answers that I got, they all related back to passion, the vast majority. 39:29.610 --> 39:32.510 And you see some of the direct quotes here. 39:32.650 --> 39:34.670 How do you share your passion? 39:34.830 --> 39:37.410 Be excited about the things that you're talking about. 39:37.410 --> 39:42.510 If you built that blog, like I suggested, talk about it. 39:42.510 --> 39:44.010 That shows you have passion. 39:44.010 --> 39:48.530 That's something that's completely voluntary that you chose to do on your own. 39:48.530 --> 39:51.710 Or if you created a bunch of videos, that's something you chose to do on your own. 39:51.710 --> 39:58.070 If you engaged in labs and other things, that's all stuff that shows you have a passion for security. 39:58.230 --> 40:03.070 Make sure you share that when you're talking with the hiring manager. 40:04.270 --> 40:05.910 And then I'm gonna share this with you. 40:05.910 --> 40:12.230 So I told you I host this podcast and one of the people we had on was Malware Jake, Jake Williams. 40:12.230 --> 40:18.010 And he shared with us something that I thought was absolutely incredible advice. 40:18.490 --> 40:21.750 Here's how you refine your resume to sell yourself. 40:21.930 --> 40:23.490 First, write up a resume. 40:23.490 --> 40:25.690 Take what I've told you so far, create a resume. 40:26.770 --> 40:32.230 Then I want you to completely separately prepare a one to two minute elevator pitch. 40:33.270 --> 40:35.450 Just how are you gonna sell yourself in two minutes? 40:35.450 --> 40:42.170 Tell somebody why they should hire you, what it is that you're gonna do to make their business better, what it is that you're gonna do to make their department stronger. 40:42.170 --> 40:45.230 Now go and find those things in your resume. 40:45.430 --> 41:02.530 If you can't find those elements in your resume, get revising, figure out how you're going to add those elements to your resume to hit those things that are a part of what you said were most important because that's what you squeezed into that two minute elevator pitch. 41:02.530 --> 41:04.210 This is such a great idea. 41:04.210 --> 41:08.070 If you can do this with your resume, your resume is gonna be so much stronger. 41:08.070 --> 41:17.930 And then now you can carry through that narrative that you told in that one to two minute elevator pitch, that becomes the theme for every interview that you have after that. 41:18.390 --> 41:21.810 Make them know why it is that they wanna hire you. 41:22.430 --> 41:25.050 So let's go back to our barista then. 41:25.050 --> 41:27.210 We're gonna tie things all together here now. 41:27.210 --> 41:30.050 So how do I revise that resume? 41:30.110 --> 41:33.730 Say I'm entry level, I don't have a lot of experience. 41:34.230 --> 41:37.990 Well, let's understand first technical capabilities. 41:37.990 --> 41:42.470 And when I say technical capabilities, I'm talking about those things that ultimately show up as requirements. 41:42.470 --> 41:45.510 There's kind of three levels that you can have here. 41:45.510 --> 41:46.790 You can have knowledge. 41:46.790 --> 41:55.390 And knowledge is just, hey, I read a book, I did some training, I investigated research, studied this somehow, here it is. 41:55.390 --> 41:58.250 I have knowledge of this area. 41:58.250 --> 42:01.250 Sometimes for certain things, that might be all you need. 42:01.330 --> 42:04.430 But more often than not, people want you to have skill. 42:04.650 --> 42:11.370 And when I say skill, what we're referring to in skills is that you've actually taken that knowledge and applied it in some way. 42:11.490 --> 42:24.770 Maybe you did a lab, maybe you worked in a CTF, or you went to a village or some other hands-on training somewhere where you actually got to do application of that knowledge into the actual technology. 42:24.770 --> 42:26.530 You got to apply it somehow. 42:26.530 --> 42:28.030 That is a skill. 42:28.390 --> 42:31.210 That's, we're kind of, as you see, going from good, better, best here. 42:31.210 --> 42:32.610 So you've got knowledge and skill. 42:32.610 --> 42:35.410 The last one is experience. 42:35.550 --> 42:37.270 And this is the coup de gras, right? 42:37.270 --> 42:40.410 This is what employers tell us they want all the time. 42:40.410 --> 42:42.570 They want to know that you have experience. 42:42.630 --> 42:54.110 And when they say experience, they're talking about that you have some kind of formal documented examples of applying that skill in a real life, most often business scenario. 42:55.350 --> 43:07.310 So understanding, making an inventory of your capabilities technically, and understanding are they knowledge, are they skills, and are they experience, and to what level of each is so crucial. 43:07.310 --> 43:11.150 This is back to working on you again and talking about how you can be better. 43:12.170 --> 43:14.770 And then finally, I want to talk about this idea of core skills. 43:14.770 --> 43:26.450 So now that you know what those capabilities are, your core skills are the transferable elements of those that you can take from one capability and apply it to any capability in any technology anywhere. 43:26.610 --> 43:29.930 So if I look at my barista, they start off with, well, they make coffee beverages. 43:30.790 --> 43:34.910 Well, really, if I break that down, here's a lot of the steps they did. 43:34.910 --> 43:40.850 They received orders, they prepared according to recipes, they delivered on the customers and they had to clean the equipment. 43:40.930 --> 43:43.090 But that's still shades of a barista. 43:43.090 --> 43:44.690 So how do I take it further? 43:45.130 --> 43:46.990 They processed multiple inputs. 43:46.990 --> 43:52.030 They translated inputs into tasks and prioritize them for maximum efficiency. 43:52.210 --> 43:55.990 And they were always focused on efficient delivery to the customer. 43:55.990 --> 43:59.130 And throughout all that, they had to plan and execute maintenance activities. 43:59.150 --> 44:03.030 These are general words that can apply to any job anywhere. 44:03.030 --> 44:17.150 And when you can now take and view your skills in that light, you can take those requirements that they're asking for, understand the core skills behind those, take your own core skills, tie them together. 44:17.150 --> 44:30.550 And now you can see how you can easily word your resume to highlight the skills and experiences that you have from your job to fit into that job that you are applying for. 44:30.550 --> 44:34.690 And this is where the rubber really meets the road. 44:34.790 --> 44:44.630 How do you take that simple role as a barista where it seems so completely unconnected? 44:44.630 --> 44:48.370 And this is literally what I told that manager when he was complaining to me. 44:48.370 --> 44:54.450 I said, didn't they absorb all of this input from all these different areas and process it? 44:54.630 --> 44:59.490 Didn't they have to focus on how they were going to arrange those? 45:00.150 --> 45:03.670 And do it in an efficient manner so they could be most effective? 45:03.770 --> 45:08.590 Weren't they always focused on customers and the customer was what was most important? 45:08.590 --> 45:13.130 And yet throughout all of that, they had to plan and execute maintenance activities. 45:13.570 --> 45:14.810 And he started to look at me. 45:14.810 --> 45:19.790 I said, isn't that exactly what you want your SOC analysts to be able to do? 45:20.370 --> 45:28.030 That barista would be perfectly qualified to be a SOC analyst in light of the fact that they have the other knowledge that you asked for. 45:28.030 --> 45:31.330 They may not have the experience, but they have the knowledge. 45:31.450 --> 45:43.070 So look to highlight these on your resume, in your discussions, in those interviews, as you're blogging, as you're making videos, tie these things together. 45:43.130 --> 45:46.570 And then last, I'm going to leave you with this quote from Ella Fitzgerald. 45:47.310 --> 45:48.970 Just don't give up. 45:48.970 --> 45:51.570 Whatever it is, don't give up. 45:51.690 --> 45:52.810 This is tough. 45:52.810 --> 45:55.330 I'm not going to say the security industry is perfect. 45:55.330 --> 46:02.970 We've got a lot of work to do from the industry side to make things better for those that we're trying to bring into the industry. 46:03.170 --> 46:12.510 Keep working, use your network, find mentors who can help you, leverage your connections and foster those relationships because they're going to help you get there. 46:13.230 --> 46:16.230 So finally, I can be one of those people for you. 46:16.230 --> 46:17.270 And I'm always happy to. 46:17.270 --> 46:19.090 Find me on social media. 46:19.090 --> 46:21.970 You've got my Twitter handle, my LinkedIn address there. 46:21.970 --> 46:26.670 You've also got the link to my website, which includes my blog and lots of other information. 46:26.670 --> 46:30.750 So please continue, reach out to me, reach out to others. 46:30.750 --> 46:40.110 If I can't help you, I will find somebody to connect you with, or I will put the call out to the world and to my network and find you somebody who can help you with what you need. 46:41.030 --> 46:45.650 So with that, I want to say thank you so much to everybody who's attended today. 46:45.650 --> 46:48.750 Thank you, Sneak, my employer, for allowing me to be here today. 46:48.750 --> 46:51.890 Thank you to DEF CON and the DEF CON Career Hacking Village. 46:51.890 --> 46:55.230 I'm so excited to be a part of the inaugural version of this. 46:55.230 --> 46:56.790 That is so cool. 46:56.790 --> 47:00.250 And I hope you all enjoy the rest of the conference. 47:00.250 --> 47:02.070 I know it's a weird world out there. 47:02.070 --> 47:04.270 We'll get back to the real thing soon enough. 47:04.270 --> 47:06.850 But enjoy this virtual experience and make the most of it. 47:06.850 --> 47:09.810 This is where you're going to learn so many things. 47:09.810 --> 47:11.530 And I hope to see you soon. 47:12.830 --> 47:17.210 That was just absolutely, excuse me, absolutely awesome. 47:17.210 --> 47:21.890 I hope you saw me doing thumbs up and being excited. 47:22.090 --> 47:24.610 And yes, you hit so many points. 47:24.610 --> 47:27.310 20 years in the recruitment industry. 47:27.310 --> 47:42.710 And I am so glad you pointed everything out, listed some of the key things, listed a lot of the key things that job seekers really need, and sort of gave a little bit of a backslap to those employers who really need to change their jobs descriptions. 47:42.710 --> 47:45.430 That's something I've been trying to do for 20 years. 47:45.430 --> 47:48.070 And I think it will take all of us to do that. 47:48.070 --> 47:52.850 Alyssa, thank you so much for all of your great input, for doing the great survey. 47:52.850 --> 47:59.590 I know that you've also made yourself available for career coaching through The Village, and we really appreciate that. 47:59.590 --> 48:02.850 So definitely connect with Alyssa. 48:02.910 --> 48:06.090 And we will be back with another session shortly. 48:06.090 --> 48:06.890 Bye-bye.