Mentorship Monday - Discussions for career and learning!
from shellsharks@infosec.pub to cybersecurity@infosec.pub on 15 Jan 2024 12:33
https://infosec.pub/post/7192652

Weekly thread for any and all career, learning and general guidance questions. Thinking of taking a training or going for a cert? Wondering how to level up your career? Wondering what NOT to do? Got other questions? This is the time and place to ask!

#cybersecurity

threaded - newest

knova@infosec.pub on 16 Jan 2024 22:04 next collapse

Wondering how I can best spend my time in a vast universe of infosec knowledge.

I feel like a lot of learning websites are geared towards pentesting, because it is a very active / immediate skillset - if you do things right, you’ll get a flag.txt or something. I guess I’m just looking for something that isn’t just watching videos or plugging away at Jeopardy style learning (HtB, Try Hack Me). But I’m also a bit directionless at the moment - there’s so much to learn and I don’t know which way to go.

Edit: decided to peruse some of the older topics for immediate gratification, came across your great guide here - shellsharks.com/getting-into-information-security - problem is I do a lot of this stuff already. I think I need to figure out my own direction.

shellsharks@infosec.pub on 18 Jan 2024 19:47 collapse

Yeah infosec is pretty huge. Do you have an idea more specifically of what you want to do? Like what type of role are you looking for or skills would you like to have?

knova@infosec.pub on 18 Jan 2024 22:14 collapse

I’m doing information assurance / GRC stuff at the moment. Not sure what the end goal is.

I think I might just need to soak it all in. I’m not particularly great at stuff like HackTheBox at the moment, but I’m sure that can be changed with more practice.

shellsharks@infosec.pub on 19 Jan 2024 14:00 collapse

Fair enough. Just remember, there’s more (a lot more) to infosec than just Hack the Box stuff.

mrh@mander.xyz on 17 Jan 2024 04:44 collapse

Any advice on requirements to have a shot at appsec jobs?

I have my sec+ and my job is devops. We do everything in AWS (no on prem at all). However I have no actual cyber experience. Our team is pretty small, so I do as much dev as anyone else and as much ops as anyone else (deploying/managing cloud infrastructure), including standard security stuff like IAM and network configuration. It’s also a small unknown company.

Is this enough to try and directly break into appsec, or do I need to start with another “cyber” role like SOC analyst or security engineer or something like that? I also plan on getting my OSCP at some point soon if that’s relevant.

shellsharks@infosec.pub on 18 Jan 2024 19:46 collapse

Hard to give you a definitive answer on this one. I’d say you’d be hard-pressed right now to pull that off without a direct referral or other networked way-in. Job market is condensing, lots of (experienced) out-of-work folks looking for new roles, etc… If you aren’t already in infosec, or you’re not a full-time dev with some security knowledge, it will be tough. Your best bet (roughly) on things to add to your skills/portfolio would be…

  • Proficiency with one or more languages that your target role company uses (and evidence of this XP)
  • In-depth knowledge of OWASP “stuff” (Top 10, ASVS, etc…)
  • Practical XP with attacks/exploits (via experience, CTFs, trainings, Web Security Academy, etc…)
  • Some applicable certs

Some other stuff you might find useful…

mrh@mander.xyz on 18 Jan 2024 22:34 collapse

Thanks!

Do you happen to know what certs would be most “applicable” in this case? Something like OSWE?

shellsharks@infosec.pub on 19 Jan 2024 13:54 collapse

Pure appsec certs off the top of my head… OSWE, GIAC GWAPT (and others from SANS), Portswiggers Burp Suite cert, OffSec also has a 200-level appsec cert. I’m sure there are other popular ones too.