Hey! Hey, so this is Kathleen. We're back at the Career Hacking Village,
and I'm so excited to invite my friend Chris Rice to talk about resumes, because Chris and I have
done resume reviewing for the last six or seven years at several of the Las Vegas cons, and we
can tell you that resumes really are, one, very important to finding your next job, but two,
they can be really screwed up if you don't do them right, and three, people will tell you
to pay someone to do your resume when they really shouldn't. So I'm going to turn it over to my
friend Chris Rice, and he's going to talk to you about doing your resume. Chris, take it away.
Thank you so much, Kathleen. So I'm still getting used to presenting over video. It's
kind of one of those... I prefer talks in person, because I like a little bit of audience interaction,
and that way I can usually see if my terrible jokes are, like, getting a laugh, or like normal,
you know, just falling a bit flat. It's a good reminder of why I ended up in recruitment and
not in comedy. So let's talk about my... my talk's going to be called Owning Your Resume.
I'll tell you a little bit about me, first of all. So I've been for a bloody long time now in
tech recruitment, and the last eight years have been dedicated specifically to cybersecurity
recruitment. Eight years ago, I co-founded Tyro Security, which is a cybersecurity staffing and
professional services company based out of Los Angeles, and covering really the whole of the US.
I also co-founded a company called Commute.io, which we were looking to launch properly Q2 this
year. Much like jokes are all about timing, start-ups often are as well. Commute was focused
on retaining your staff, and doing that by looking at the horrible commutes that people had, and how
that affected their happiness. Clearly, while we're in this... this time where we're in the
crazy experiment of COVID, where everybody's working from home, and we're kind of figuring
that out, commutes aren't much of an issue right now. So who knows what's going to happen with that
one. Now, I'm also founding board member and president of the Cloud Security Alliance Southern
California chapter, and I'm an advisory board member for the National Cybersecurity Training
and Education Center. And just a little bit about me, I absolutely love diving with sharks.
Don't get to do it much anymore. I've got a little daughter, wife thinks it's too dangerous.
Yep, this is one of my pictures. And I was hanging out, I wasn't a cage, don't worry,
but I was actually hanging out of the cage with my camera like this. So I guess there's an element
of danger, that's probably why I enjoy doing it. But anyway, I'm on a band now, wife says I can't
do this anymore. But I am allowed to go to cybersecurity conferences. And the great thing
about that is there must be some cybersecurity people that are scuba divers, right? So if you
are, you need to connect with me on LinkedIn, we need to organize a conference that's on a scuba
diving boat, because I'm sure I can get the approval for that. So let's combine the two.
Totally up for that. Right, so what am I talking about? So I'm going to be talking about writing
the actual best resume for you. We're going to look at avoiding common mistakes. We're also
going to look at what most hiring managers want to read. And I say most because every person is
different. We've got to work for the majority and we've got to put together a resume that works for
the majority. And that's where my experience comes in. And hopefully this is what's going to
come out of this. And then it's going to be talking about getting your resume in front of the right
person. It's no good having an amazing resume unless you're actually having the right person
read it. What the talk's not about. Resumes, are they outdated? Well, probably. We must be able to
come up with something better than a piece of paper with this information on. But we haven't
got anything yet. Nothing that at least is accepted globally and can do everything that these
documents do while also minimising any potential bias. So, you know, we're still figuring that out.
LinkedIn and things like that. Who knows? Maybe they will end up taking over from resumes. But
right now, resumes are what we've got. We need to make the most of them. And the other thing we're
not going to cover is something I call keyword tricks. Keyword tricks are things like hidden
words, huge skills matrices. You know, when you write these things all out in white font or in
tiny fonts that aren't really readable by a person, but are aimed to be picked up by systems,
you only need these things if you're planning to send those resumes into those systems. And
that shouldn't be your goal. And I don't want that to be what comes out of this talk.
I'm a firm believer you want to get your resume in front of the right person,
not into the right system. So we're not going to be covering this.
So my goals by the end of this talk, the plan is that you will understand why resumes are still
very, very important. You can understand what the common mistakes are, how we go about avoiding
them. Also, the relationship between your social media and your resume and the actual job search
you're doing. And then the final part, as soon as we're going to come up with an amazing resume for
you, we're going to want to make sure we maximise what we do with that and maximise the opportunities
that you can get. So CV or resume. You can probably tell by the accent, I'm not originally
from the US. And the great thing about DEF CON is, you know, when I've been for the last few years,
you meet so many people from all over the world. I'm originally from London. I spent half my career
in recruitment, actually recruiting for Europe. And in Europe, we use Curriculum Vitae or CV,
which is Latin for course of life. And that's how we refer to it there. Not course of life,
of course, we call it CV. And then the other half of my recruiting experience has been over here in
the US, where we use resume, which is French to summarise. Now, there are a lot of articles that
I've read on the web, and it talks about the differences between having a CV or having a
resume. It talks about the length or maybe content. But it's the same thing. It's the same
thing, right? It's a concise written history of your work in life. And it's designed to get you
an interview. It's not designed to get you a job, it's designed to get you that interview.
Now, I've been hands off for a while now, I don't do a lot of hands on recruiting.
And I'm still seeing probably 10 resumes a day. When I was recruiting, 60 a day wouldn't be
unheard of. And if I work back and think about how long I've been doing this for,
even with half of it being in Europe with, of course, the famous European vacation time we get,
which I definitely made use of, I'd still estimate that I saw over 200,000 resumes
in my time within the recruitment industry. And almost all of that was the tech area. So
I've seen a lot of resumes, and that's what I'm building this information on off of.
So resumes are still very much important. You need to look at your resume. And some people
get frustrated when they think about resumes. Oh, I've still got to do this. They can just look at
my LinkedIn. Resumes are still very, very important. Just as communication skills are
important in every job that you go for, they will expect and want good communication skills.
And your resume, you've got to think of your resume as a test, if anything. Your resume is
there to show hiring management, recruiters, everybody in that process, how you would
communicate in writing. So you've got to bear that in mind. When you're doing this,
when you're looking at resumes and you're putting them together, this is a test.
You want to do your absolute best in this test. And hopefully this presentation and talk is going
to help you do some of this. And just remember this document is there to get you the interview.
And once it's got you the interview, it's going to form a major part of your actual interview
process. So let's make sure you got it right. Let's make sure it's something that you know
really well and then you can use. So owning your resume. Your resume represents you.
This is supposed to be you, right? You should be the one that is putting your resume together.
It represents you, it represents your career history. You must write it. Can you take a look
at others? Of course you can. Who else do you know in the industry? Let's have a look at their
resume. Will they share them with you? Could you use other people's in a template? Of course you
could. You know, if you want to do that, great. No problem with that. Use a second set of eyes.
You know people that are in the industry or recruiters or whoever it may be. Get them to
take another look at your resume and give you feedback on it. You've got friends, you've got
contacts. Do that. Just don't pay for somebody to do this. Please, please, please, please, please do
not pay for somebody to do this. And I'm probably really annoying a lot of people that maybe do
resume writing as a career. I'm sorry. I'm sorry. I'm not really that sorry, honestly.
That professional resume writers, I think I know one professional resume writer that actually
works within the cyber security industry and has cyber security experience. One,
one. I think I know 15,000 contacts on LinkedIn, well over 15,000 now. I still only know one,
right? And your resume is very, very much industry specific. Different resumes are
needed for different industries. And so the cyber security industry has its own requirements. So
having a generic resume written by somebody that writes resumes for every industry isn't going to
be that good for you. And I've looked at a lot of these and I can tell you much of the time when
we are asking for changes and we have somebody say, well, but I paid somebody to do this.
They still need changes in them because they're not set up for what a cyber security resume should
look like. And so you could pay quite a lot of money for that to be done. So I'm just going to
say, save your money, spend it on something that would help your career, whether that's expanding
your knowledge, a training course, whether that's buying a new tool that you can play with at home,
or whether that's even getting a certification, just don't pay somebody else to write your
resume. Don't do that, please. Sorry, resume reviewers, but don't do it. Don't do it,
resume writers. Anyway, right. Dress for the occasion is what I call this. You want your
resume to fit the occasion. And so you're going to have multiple resumes. What we're going to
mainly focus on is your generic resume. So your generic resume is the one that you're going to
base your specific resumes from. So you've got to get this one right, first of all.
If you're one of those people who like to take a printed copy to job fairs, and I gather there are
still people that like to do that, especially because people don't want to send documents
that could, you know, especially within cyber security, sending documents to different people
or letting people loose on your computer might understand that. So if you're somebody who wants
to take a printed copy with you, this is the one you're going to use.
This one is going to be more tailored towards the type of job that you're most likely to be
applying for. This one's going to talk about projects, experience that you've got that's
broad. It's not going to go into so much the specifics. It's going to give people a general
understanding of who you are and the experience that you've got. And you're going to use that
for certain things you will use that for. The specific resume is the one that you're going to
actually use and write for job description, specific job description. You know, you've got
the job description there. You're going to take your generic resume. You're going to really,
really read that job description, or even better, if you know somebody that works there,
or you even may know the hiring manager, speak to them, get more information out of what they're
truly looking for, and then make sure that's in your specific resume. I did this at my last
position, and I know you're looking to do the same project, right? Make sure that's in there.
And you've got to make sure that that relevant experience relates to the job you're applying for.
The most relevant skills are in there. The most relevant tools are in there. Your most
relevant projects are in there. They're all ready for that particular job, and you're going to want
to detail that in your specific resume. So you might end up with quite a few specific resumes.
Totally normal. It's important. It does take time. But this resume is the one that will
get you the job, and it's the one that will create the conversation during your interview.
So take time. It's worth it. All right, common mistakes. Oh, boy.
Let's start off with resume length. Now, I'm talking very much about... I said this earlier
in the presentation. We're talking about generically what most managers want to see.
Some managers out there may well like to see a long, detailed resume, but on the whole,
most do not. And so we're going to work for the most. We're going to put together a generic
resume that works for the most. And so talking about resume length, your resume is a clear,
concise example of your written communication skills.
So unless you just graduated and have very little work experience,
I can't see how you will get it to one page. And the ones that I have seen that are one-page
resumes, they're usually missing key information, and they're usually written in a really small font
that just makes it awkward to read. It's not good. It's not what you would do in a report that you
would be writing. So skip the one-page one unless you've just graduated. Ideal resume length,
two to three pages. Once you get to four pages, you're kind of pushing it. And anything more than
that, you're going to lose your audience. I'll tell you a story, and I wrote a blog about this,
but I had a resume sent across to us, and I opened it up. It was 55 pages. 55-page resume. Wow.
I don't know whether to write a resume or a novel. It was insane. So I actually spoke to the person,
and you have to be pretty tactile because this is somebody's experience, and they obviously feel
passionate about the experience they've got, and they feel passionate enough to write a 55-page
resume. So I did say to the person, have you got another resume that you also use? Because
some people have a couple of generic resumes. Some people will have a two- or three-page
generic resume, and then they might have something, a longer one, in case they get
asked and you've got something that goes into more detail. So I asked that question,
and got an email back, excitedly opened up the resume. That's an amazing experience.
Opened up the resume, 70 pages. Yep, turns out the 55-page resume was their short one.
So look, I know you're passionate about your experience. I know you want to work for companies
that are also passionate about your experience, but you need to be able to write clear and concise
documents for most jobs that you go for. And so if you can't get it down to that, and we'll talk
a bit about how you might be able to do that, but if you can't get it down to that length,
you've got to look at your ability and what kind of information you're putting in there.
So look, work on it. Get your resume down. Two or three pages is ideal.
So the other thing we're going to talk about is formatting errors.
Choose your font and stick to it. Same font throughout the whole document. Don't do multiple
fonts. Be careful when you cut and paste things, maybe from one resume to another or from your
LinkedIn, you might find that you actually end up putting in a different font and you didn't know
that. So regularly check that you've got the same font throughout the whole lot.
And generally, probably the same size font as well. You might have titles in a slightly
bigger font, I suppose, but you've got to keep whatever you do, do the format the same right
the way through. So if you have a description of where you worked, how long you worked there,
your job title, and then underneath, you've got bullet points of the things you did.
Every job should be done the same way, not bullet points on one and no bullet points
for another or square bullet points on one and round bullet points on another.
You want to make sure that you've got all of these things laid out so that the format reads
and there's nothing distracting them, basically. And be really careful about where you use
your bolding. Some places, if you bold every company you work for, and then the date,
and then the date isn't bold, you know, if it's the same all the way through,
and it's used sparingly, it can look good. If you're bolding lots of words and you're
sending them to different jobs, and sometimes those skills don't apply to those jobs, it's
going to look a mess. First off, and it's often not going to apply. And somebody's going to be
looking and saying, why are they even bolding those words? They don't apply to this job.
So just be really careful and use it sparingly. Spelling and grammar mistakes.
I always get a bit, but why are these still happening? We have tools, you know, Microsoft
has tools for you. If you're using the Microsoft suite, it picks up your spellings. You get a
little red squiggly line underneath. It tells you that it picks up your grammar mistakes.
It tells you to check them. And this page had quite a lot of squiggly lines on it, I can tell
you. Use those, read through them, and that should be your first point. And you'd be so surprised,
probably three quarters, I would say, of the resumes we see have still got spelling and
grammar mistakes in them. And so it's such an easy one to avoid. So make sure you're using
the word processing systems or whatever software you've got to pick up on that.
And I get that not everybody's great with spelling and grammar. I may well be from England,
but actually I'm pretty shit at it. It's not a skill of mine. And so I ask friends, I ask other
people to read over. In fact, even this presentation, I asked one of my colleagues to have a
look through it and point out stuff. And I made some formatting mistakes. Thankfully,
the spelling and grammar mistakes were only the ones I meant to make. But I did make some mistakes
in it. So look, get somebody else to look at it. Now these next couple of things, they kind of do
merge a little bit in together. So missing specific employment dates. We will see resumes that are
sent to us that will say 2018 to 2019. I mean, when? I mean, is that a two-month job? Did you
start in December and finish in January? Or is that a two-year job? Did you start in January
and finish in December? You need to be specific with your employment dates. And I'll talk about
why, because as we roll into sort of leaving employment gaps, everybody at some point may
well have an employment gap. Maybe you were out of work and you were looking. Maybe you took the
time off to do some certifications. Maybe you travelled. Maybe you looked after a loved one.
Maybe you had a baby. Who knows? People have good reasons for having gaps in their employment.
And you should embrace that. That gap in your employment, put what you were doing,
put it down there on your resume. And the reason why I say that is because
you will want to cause... when people are reading your resume, you don't want them having doubts.
You don't want them making lists of, okay, I must ask them about those employment dates. I must ask
them what they were doing between that time and that time. You don't want them asking you that.
You don't want them... because if you have more doubts than the resume next to them, you might
just never get a chance to talk to them about it. Maybe they'll take these resumes and they'll never
get to that pile of resumes. So get rid of the doubts. Make sure that they can focus just on
what your resume has in it, the information and stuff that's applicable. That's why this is so
important. And then irrelevant information. I'll give you a few examples. This is going to really
help you with your resume length. So nobody, at least nobody I know, wants to know lots of detail
about a three-month job that you had 15 years ago. Just probably not applicable, right? Just
not applicable. So anything you've done even 10 years ago, and some people I've seen even go up
to sort of seven, eight years, but certainly 10 years ago. If it's 10 years ago, it doesn't need
to have any detail. I think if it's 10 years ago, you need to have the company you work for,
the specific employment date you work for them, and the job title. That's it. A few of you now
are looking at really long resumes and thinking, wow, I can just get rid of half of it. That's
perfect. Thank you, Chris. So that's what you're going to look to do. If they want to find out
more information about those jobs, they'll ask during the interview. They're not going to, that's
not going to stop you from getting an interview. It's going to be something they'll ask you about,
especially if it's very applicable to the job, or at least the job title is applicable.
So just bear that in mind. Likewise, and this is kind of a little bit of a bugbear of mine.
Under certifications, a lot of people will have not only certifications they've got,
certifications that they've let run out. So they don't have, they no longer have them.
And then also certifications that they haven't even got yet. CISSP-studying. I've seen it so
many times. And that's a bugbear for me because you forget, we have old resumes of people when
they apply for jobs. I can see that for two years, you've been studying for your CISSP
because on your last resume, the last time you were looking, it says it. So honestly,
it's bullshit. I'm going to mince my words, right? It's bullshit. You're not still studying for it.
So take it off. Or if you're truly about to do the test, right? If you know, September,
I've got my test book, September, 2020, I've got my test book, then put it CISSP
test book for September, 2020, put the year, right? But other than that, take it off. People
will ask you, like when you've got stuff on there, people will ask you about it. And then,
you know, you've got an M&R and you might have to, you know, blur the truth a little bit. And
they can tell, they can tell this stuff. So don't put it on there. Other thing is we don't need a
load of degree, a load of information about what you studied your degree in if it was 10 years ago.
And don't bother people putting graduation dates, right? You don't want anybody to date you or to
age you. You don't need to put dates of education in there. You can put what you studied, you put
what your major is, you can put your GPA, that's it. Don't go into detail. Now, there's a caveat
to that. And the caveat is that if you're a recent graduate, you don't have a lot of experience,
then you may want to put into a little bit more detail as to what you did as part of that study.
But that's the only reason you should do that. And then the last thing about your resume is
this is going to be read by multiple people in a company.
Some of those people are going to be technical, and some of those are going to be non-technical.
And they're going to judge your written communication on this resume. And if you do
really, really well, this is probably going to be, you know, in front of management directors,
maybe even execs, depending on the position you're vying for. And you've got to write a
resume that speaks to all of those different people. In my experience, if you're going for
a technical job, you will end up having some kind of technical test. So you don't need to worry
too much about making it overly technical. As long as they've got an idea of what you did,
what projects that you've done, they're going to ask you about it. Make it something that works
for all different levels of people. Because, you know, if you're writing a pen test report
or a risk assessment, they want somebody that's able to write something that speaks to different
people, different levels of people. And so let's not make it overly technical. You don't want a
non-technical person to get lost in it and just put it down, right? Reminder, they will check your
technical skills. I'm going to leave this one up here. Dishonesty. Let me take a drink of water
while you just look at this slide. Don't be dishonest, please. It always comes out. I've
seen it come out during interview. I've seen it just during people sending their resumes. I've
seen it during the interview process. It's really awkward. I've seen it come out after people have
been offered jobs and I've seen jobs retracted. I've seen it come out after people have got jobs
and I have seen people fired. Just don't do it. There's no reason. This should be your honest
career experience. Be proud of what you have done. Don't make up things you haven't done. It will
come up and it will bite you in the arse. So social media. You guys generally are pretty savvy
and I put a big buck here because for eight years I've been doing this and I still see
cyber security people not thinking about how their social media impacts their job search.
I've seen public tweets, old public tweets, that people probably don't feel that way anymore
come and stop people getting jobs. Certainly stop people getting interviews.
There's two ways to work it. Keep it private and I think a lot of cyber security people probably
understand that. You can have a couple of different social media. If you want to have a
private and a public one and have it separated like that, you can absolutely do that.
Or, of course, you can be at the point of, look, I don't give a shit. This is me.
If you're going to hire me, this is what I feel. And I see a lot of people do that and that's great
for them. And there are a lot of people in high demand in our industry. And so, you know,
absolutely, you know, you can go ahead and do that. But you make that decision. Just do it with a
clear head, I guess. Do it and understanding what you're doing. Because the last thing you
want to do and I guess, you know, we should be pretty good at assessing risk, right? And you
can decide how risky it is, whether you want to manage that issue or whether you don't want to
manage it. Up to you. Just make sure you're thinking about it because it can stop you and
it will stop you getting jobs and it could stop you getting your dream job. It could stop you
getting the thing that you most want to do. And, you know, you don't really want it to do that.
So, moving on to LinkedIn accounts. I've seen a couple of people with a couple of different
LinkedIn accounts. That always looks a bit strange, especially as most of them are not
private and they often say different things. Don't do that. Have one LinkedIn account.
And make sure the information matches what's in your actual resume. So make sure the job title
matches. Make sure the description matches. And if you could probably have a couple of different
job titles, you're welcome to have one on LinkedIn and then you could have that same one on your
resume and then in brackets, the job title that you would put that as. Because I know that some
businesses use very generic job titles. So you can you can work within this, but make sure that
there is a match there and it isn't going to make somebody say, I love this resume, this person looks
great. Let me look at their LinkedIn. Oh, oh, well, that's totally different. Why is it totally
different? That's strange. And you don't want to create that doubt because you don't know how many
people you're up against when you're going for these jobs. And then think about the information
that you share as well. Would your previous employer be happy about that information? Would
your current employer be that happy with that amount of information you share? And would your
future employer be happy about the amount of information you share on there? So just be very,
very careful around that. Maximizing impact. Got a couple of slides on this. Very important. You've
got the best resume in the world. You put something together. You're very happy with it. How can we
maximize impact? First up, we're going to talk about cover letters or cover sheets. As an external
recruitment company, we do not send out a resume unless it has a cover sheet, a one-page cover
sheet right at the beginning. Absolutely every time. We do it because we believe it makes an
impact on how long that hiring manager will take to look at your resume.
And so it's a way for us to take out very much the most relevant experience in those two or
three pages and putting it right up front. We know Mr Hiring Manager or Mrs Hiring Manager that you're
miss hiring manager. Whatever pronoun you prefer. We know hiring manager that you are looking for
these five skills. This person has this many years with this skill.
They were using it in their most recent role. We pull out that information. We make it so that
the manager looks at it and is excited by your impact. So that's how we do it. As an individual,
you might do it a little bit differently. First off, you've got to make sure that they're specific
and concise. The same way as you would do in your resume, you've got to do the same in your cover
letters or cover sheets. Make sure they're specific to the job description. Don't send out
generic cover letters. They're horrible. They really are. Don't send a cover letter. If you're
going to send a generic one, just don't bother sending one at all. Make sure they're specific
to the job you're applying for. Make sure they're concise. Take your relevant experience and actually
look at the job description or the job specification and read through it and think
about it being a question and answer. They are looking for this. What experience do I have with
this? They are looking for this. What experience do I have with this? And think about pulling that
kind of information out. The other things you should put on the cover letters or cover sheets
are why you really want the position. What's exciting you about it? And then that folds
on to why you want to work for that company. What excites you about that company? If they feel that
you're excited about the job, you're excited about working for them, you've done a little
bit of background on them, they're going to be excited to meet you. And then finally, if relevant,
you may want to put why you're leaving your current position. It's really, really important
if you're doing this, you keep it very positive. And you should always be talking as positively as
you can about why you're leaving your current position. It's been wonderful working here,
but they don't support going to conferences or they don't actually pay for people to do
certifications. Something like that. They have eight days vacation time. I work really hard.
I'm willing to work really long hours, but I would like to spend more time and see more of my family.
Whatever it might be, if it is relevant, then you can put that in the cover letter.
So going on to sort of other ways to maximise impact. These are the three ways that you're
going to really do your search. So you've got to make sure you own it. Own your search.
One way is going to be responding to adverts. The other way is going to be utilising your network.
And then finally, and these are the big three for me,
is recruiters. Working with internal recruiters and working with external recruiters.
So we'll talk about adverts first of all. Call that adverts a mess.
Adverts are a funny thing, especially for our industry.
So let's think about this for a second. I'm going to advertise to people that work in security
and privacy. And I'm going to expect them to send their resume, which includes their personal data,
through an advert to get added on a database, multiple databases,
for who knows how long that's going to be sitting there for. And then you're going to get maybe
standardised responses. You may or may not even be contacted. And when you do get contacted,
there's a high chance that the first person contacting you or speaking to you may know
nothing about our industry. And maybe even working off a checklist. Do you have this?
Do you not have this? Check, check, check, check, check, check, check. Strangely enough,
it doesn't work very well in an industry. It's broken! I should be there. I should smash a glass
here for effect. That would be really good. It is broken. Advertising is broken. You should not rely
on this, no matter how great your resume is. Don't rely on responding to adverts to be the major part
of your job search. Am I saying you shouldn't do them? No. I'm saying you can still do that,
but it shouldn't make up the major part of that. And we'll talk about the other things that you
are going to do. As a recruitment company, you're probably saying, hey, but Chris,
I've seen Tyro Security. I've seen them advertise their jobs. You've got a job page on your website.
You advertise your jobs here. You advertise your jobs here. Yes, we absolutely do.
And I can tell you, we don't get a lot of response from them. And a lot of the response we do get
people that are hoping to work in cyber security. And so the thing is, they haven't got any
experience. And as a recruitment company, we get paid to find experienced people. So we don't have
a lot we can help those people with. And actually, we've got to do a lot of delving through people
that aren't qualified to get to the people that are. It's not really worth a whole lot of our time.
We still do it because at the end of the day, we're putting out there and you're taking the
time to respond to us and we want to take the time to respond to you. But really,
we don't get a lot of benefit from advertising. The major benefit is probably from having companies
come to us and say, oh, do you know what? I've seen you do a lot of adverts for that application
security people or cloud security people or DevSecOps or whatever it may be. You're advertising
a lot of jobs for that. So you probably got a lot of candidates. So I want to talk to you because
you're a specialist in that area and I'm looking for a DevSecOps person as well.
So we actually probably get more benefit from the client side rather than the candidate side.
Right. Your network. Your network is going to be absolutely key. The people you know,
what companies are your friends, do your neighbours work for? Are they recruiting
for positions that you might be interested in? How are you networking? Are you using those?
Think about the people you know in person. Then you think about your virtual network.
LinkedIn is key for this. Who do you know? Who do they know? Connect with managers that you think
may be hiring and take the time when you connect them to write a personal note. Are you involved
with your local community? The funny thing about this is that we're not meeting up so much in
person at the moment, right? But a lot of the communities are doing a lot of webinars and
things like that. Certainly, my Cloud Security Alliance chapter is doing regular webinars.
So think about getting involved with that, either just as a member or even as a volunteer. It's a
great way to build your network and be involved. It'll be amazing to see who you might meet.
You've got people like the Cloud Security Alliance, OWASP, ISARCA, ISSA. You've got other local
groups as well that may just have meetups or webinars. So take a look at meetup.com.
That might help you. If you're part of an underrepresented group,
Cyberjutsu, the YSYS people, the Women in Security and Privacy, ICMCP, the Blacks in Cybersecurity.
Join a group that you feel you will fit in well to, and that can be a great networking
opportunity for you. And you can give back as well at the same time. Another thing, conferences.
Welcome to DEF CON, right? You're attending the conference right now.
Conferences are an amazing way to meet people that may well hire you or may be able to even help you.
Most companies nowadays have referral schemes. They're very, very common.
So even if you're not meeting a hiring manager, you could still be meeting somebody that could
refer you internally. And a referral internally can help you skip a lot of the process. You'd
be surprised. I know companies that guarantee that if you refer somebody, if somebody internally
refers you, they will call you. You'll definitely get a call. Now, whether you'll get a full
official interview or not, but you'll get at least a phone call. So you will hear back. They
get back to their referrals in ways that they sometimes don't get back to their advert responses.
So bear that in mind. The other thing to think about is speakers. I always say,
failing to plan is planning to fail. It's one of my favourite quotes. If you're going to go
to a conference, if you're going to attend a conference, make sure you're seeing in advance
who you want to see talk. Could they help you in the process of you looking for a role? Do you
want to work for that company? If it's an in-person one, be that person hanging around the stage
afterwards and actually meet the person. If it's virtual, hopefully, like me, they'll be in a Discord
chat and you can talk to them in there. Or you can reach out to them and say to them, I listened to
your speech here and it was great. It was a really great presentation. I'd love to connect with you
if you're going to connect with me via LinkedIn. And then the last thing is research and presentations.
This is going to help your credibility hugely. It's going to be really good for your personal
branding. It's a great, great, great way to network and it's experience that will help you
in your career and it will really improve your resume. So get involved in doing research,
presenting research, network and volunteer and help. These are all great ways to really
maximise what you're going to be able to do with your resume. Right, this one.
72% of cyber security professionals do not believe that their HR department understands
their hiring needs. Ouch. Wow, that sounds really, really terrible. I should state here,
I know some amazing internal recruiters. In fact, I'm going to be on a recruitment
happy hour panel within DEF CON and some of them I've got so much respect for.
This isn't always actually an internal recruiter's issue. Internal recruiters that spread at many
companies very, very thinly, very thinly. And they can't get enough just cyber security,
job JDs, job descriptions to actually just work in that area, to specialise in that area.
Very tough. It's a tough ask. How can you ask somebody that one day could be recruiting for
a cyber security person and the next day could be recruiting for an accountant or even recruiting
for the same person on the same day? Really tough ask to expect them to know and understand cyber
security, to sort of recognise what's on a resume and recognise the relationships between certain
skills or certain tools. And so it can and it does result in people that have applied actually
not getting through to the next stage and being overlooked despite them being really good.
It's very tough ask for internal recruiters. So I just say don't give them too hard a time. Even
if you've had a bad experience, internal and external recruiters, please don't give any of
us a bad time. We try our best, right? Now, I will say this. There are, you know, your first port of
call really should be technical hiring people when you're trying to get your resume in front of them.
But there are some great internal recruiters. If you're working for a very, very large company as
an internal recruiter, certain ones have people that specialise just in cyber security. So they
do know what they're doing. And if they work for a cyber security company or a company, the majority
of what they do is in the cyber security business, there's a good chance they're going to know and
understand your resume. So just bear that in mind. And that stat, by the way, is from the ISRC state
of cyber security. And it is tough. And I think it's tough because a lot of these roles stay open
for a very long time. And people lose faith in their internal people because of that. So just
bear in mind that don't be rude to people. Don't be rude to anybody, anybody you speak to. I've got
a rule. It's funny. When I used to interview people to come and work for me, one of the
first people I would speak to at the end of an interview would actually be the person that worked
on the reception desk. I'd ask what their first impression was. How was the person to them? So
anybody that's involved in the process, don't be rude to them. Don't talk down to people. No need
to do that. And you'd be surprised how much of a say somebody that you may think may not have
could have. So don't do that. And don't ignore company's process. If somebody tells you this
is the process we go through, don't ignore it. Right. So external recruiters, us guys.
When you're looking at external recruiters, you really want to build relationships with
ones that specialise in cyber security. Great way of doing that, you can look at their LinkedIn,
of course, you can see what they write, how they describe what they do.
Another way could be looking at the company they work for. Are they advertising just cyber
security positions? Or are they saying they're specialists? Because there's an awful lot of
specialists in cyber security that aren't actually specialists. They're generic people
and they work on whatever roles that their clients give them. Right. So you want to work
with specialists. There's an easy way of doing that. They have credibility in their industry.
They can put you in front of hiring management and they can also talk to the hiring management,
maybe even explain in a little bit more detail and get a little bit technical as to why you are
somebody that should get an interview. And, you know, that credibility, certainly we see our
resumes go to the top of the pile when maybe some generic recruiters might have to go through a
slightly different process. So, you know, part of that credibility and stuff will really help you.
A good way to identify them as well is are they involved in the community? Are they going out and
building a network? Do they go to these conferences? Do they go to the meetups? Do they volunteer at
these places? Are they regularly attending these? Have you given up your personal time to
regularly attend them? Chances are they are dedicated to the industry. So that's a good
way to find them. They wouldn't be that hard to search for, I'm sure. They're the recruiters you
build your relationships with, you connect with them. They'll have a network and they'll also
give you free cyber security resume advice. They'll be able to tell you on there what you
should maybe change. They'll be able to use that industry experience to help you during the
interview process. And they're going to be able to really guide you through that process and
give you a much better chance of probably getting the job you want. So, just bear that in mind.
So, coming towards the end of the talk now. Hopefully I'm not too short and not too long.
Looking at my watch here, hopefully I'm doing all right. So the takeaways from this.
Let's make sure you understand, and hopefully you do at this stage, you understand why resumes
are still so, so important and why they're worth taking the time to make sure that you get them
right. Hopefully you also understand the common mistakes that we see and you can avoid at least
those ones. Also, understanding that relationship of how social media fits into your resume,
owning the risk you're going to take,
understanding what you're doing when you post things on social media publicly and what the
benefits might be to keeping that private. And then finally, how to get this most amazing
resume that you're going to be able to put together. How are you going to actually be
able to maximise it and put it out there and get it in front of the people that will make
the decisions. So hopefully this has been useful for you. This is the end of the presentation.
You can follow me on Twitter. I'm actually not on Twitter an awful lot. A lot of the stuff that
I post on LinkedIn, I will also post on Twitter. LinkedIn really is, I'm a pretty big user.
Anybody that's connected with me probably knows that already. I'm a big user of LinkedIn. So
absolutely, connect with me, please. I get a lot of connections and I'm probably turned down maybe
80% of what I get. So generally, if you work in the cyber security industry, I'm going to accept
you. Please, if you can, if you wouldn't mind, just taking the time to write a little note in
that section and tell me if you wanted to connect with me to tell me how terrible my talk was at
DEF CON. That's fine. I'll still connect with you. We all need some constructive criticism.
If we can keep it constructive, that would be amazing. So yeah, connect with me on LinkedIn
and mention DEF CON if you did see it there. So look, thank you very, very much. Thank you,
Kathleen, for the opportunity to speak. Hopefully I did okay. And those people that
I've maybe sent to sleep, they can wake up now. At least they got a good nap. Thank you.
Chris, thank you so much. You brought up some really great points. One thing I wanted to point
out that a lot of people, a lot of the technical resumes that I've been reviewing in the community,
a lot of people use templates. They believe that the templates are going to make their
resumes look pretty. But when you use the template, it doesn't have the spell check
or the formatting check. Primarily the spell check. So a lot of people have been using templates
to make it look design pretty. Please, just keep it simple. Keep it something straightforward for
everyone to be able to read. Love the advice about social media. Keep an eye that it stays out there.
There's online reputation reports that say that HR managers and recruiters will check your social
media before they call you in for an interview. And you might not like what they view as far as
your social media. So be very careful about that. Also great recommendations on connecting with
recruiters, connecting with them in various different places, socially, online, through
conferences. Always great to be expanding your network. Chris's team is going to be part of our
resume review team. So be sure you be sure you're signing up for resume review and get some really
good advice on that. Chris, as always, great to have you part of this. Thank you for being part
of DEF CON Hacking Career Village. Thank you so much. Thank you for asking me. It's been great.