Ep29: Hack Your Career: Insider Tips for Cybersecurity Beginners

Speaker: 00:00:00

Today's podcast is going to

be a little bit different.

2

: 00:00:02

And an outdoor recording studio.

3

: 00:00:05

And I want to take some

Q and A's from listeners.

4

: 00:00:09

So I grabbed about six

of the best I could find.

5

: 00:00:12

And if you want to send a question and

it's Marc MARC at ByteSized Security

6

: 00:00:17

Dot show B Y T E sized security.show.

7

: 00:00:22

So I'm going to have my assistant

read off each question, and then

8

: 00:00:25

I'm going to attempt to answer it.

9

: 00:00:26

So without further ado, Let's go.

10

: 00:00:29

What's the question.

11

: 00:00:30

Number one.

12

: 00:00:31

Gabi: Thank you Marc.

13

: 00:00:32

Here's our first question.

14

: 00:00:34

What are the most effective ways for a

beginner to gain practical experience

15

: 00:00:38

in cybersecurity, especially if they

don't have a formal I T background?

16

: 00:00:42

So the most effective ways for beginner to

gain practical experience, especially if

17

: 00:00:47

they don't have any formal it background.

18

: 00:00:51

Get that formal it background.

19

: 00:00:54

You don't have to have it

to get into cybersecurity.

20

: 00:00:57

There's.

21

: 00:00:57

Divisions and areas that you could

go into, if you're a good at legal

22

: 00:01:01

or document writing, technical

writing, working with people

23

: 00:01:04

like security awareness training.

24

: 00:01:06

But if you don't have any formal

it background, It still would

25

: 00:01:10

be helpful to get yourself.

26

: 00:01:12

Something.

27

: 00:01:13

And I'm not saying a help desk job.

28

: 00:01:15

But it does help.

29

: 00:01:17

Explain cybersecurity principles.

30

: 00:01:19

When you do have an it background,

some of the best people I know.

31

: 00:01:22

In cybersecurity.

32

: 00:01:24

Have extensive it backgrounds.

33

: 00:01:26

It could be from architecture.

34

: 00:01:28

To help desk to software development.

35

: 00:01:32

It doesn't really matter, but they

have an understanding of network and

36

: 00:01:35

computers and technology, and then they

can apply that easily to cybersecurity.

37

: 00:01:39

It's hard to secure a network if

you don't know what a network is.

38

: 00:01:42

It doesn't mean you have to go into

help desk, but if you don't have

39

: 00:01:46

that formal it background, Take

some classes, take some courses.

40

: 00:01:50

Look for volunteer opportunities

in your local community, where

41

: 00:01:54

you can start to develop that.

42

: 00:01:55

Not everything has to be a formal job.

43

: 00:01:58

You could be working in a

completely different industry.

44

: 00:02:02

And still figure out some different

ways to get yourself some.

45

: 00:02:07

It knowledge in order to get

yourself into cybersecurity now.

46

: 00:02:11

That sounds a lot.

47

: 00:02:13

Easier said than done.

48

: 00:02:15

I'll give you that there's hundreds of

people looking for cybersecurity jobs.

49

: 00:02:19

The do have extensive it backgrounds.

50

: 00:02:22

So.

51

: 00:02:23

But it can be done.

52

: 00:02:26

And if you do want to do that, I

don't think you should give up,

53

: 00:02:29

but it was difficult enough for

me to make a lateral transfer.

54

: 00:02:33

I can imagine that if you don't

have any it experience how difficult

55

: 00:02:36

it would be, that being said.

56

: 00:02:38

Governance risk and compliance GRC.

57

: 00:02:41

Which is not easy.

58

: 00:02:43

But those people that I've worked with

do not have extensive it backgrounds

59

: 00:02:47

at all, but they're very good at policy

writing, policy, reading documentation.

60

: 00:02:53

Legal putting together presentations.

61

: 00:02:55

So if you have those types of

skillsets, You don't necessarily have

62

: 00:02:58

to have a formal it background to get

into a division of cyber security.

63

: 00:03:04

So there's, there's other options.

64

: 00:03:06

They may not be a pen tester.

65

: 00:03:08

But there's a lot of other things you can

do in cybersecurity, if you're really good

66

: 00:03:11

at educating people and you understand.

67

: 00:03:14

The culture of security.

68

: 00:03:16

Culture of security awareness.

69

: 00:03:18

You could develop training

for a particular company.

70

: 00:03:21

You could easily come in as a

learning management developer,

71

: 00:03:24

into the cybersecurity area to

help train your employees up on it.

72

: 00:03:28

And you wouldn't have that.

73

: 00:03:29

Quote, formal it background.

74

: 00:03:31

Next question.

75

: 00:03:33

How important are certifications like Comp

TIA Security+ or C I S S P when applying

76

: 00:03:38

for entry-level cybersecurity positions?

77

: 00:03:41

For entry-level well,

for entry level CISSP.

78

: 00:03:45

Should not be entry-level.

79

: 00:03:47

Um, However.

80

: 00:03:50

I do know that I've seen job

descriptions that look to be

81

: 00:03:52

entry level and they want a ton of

experience and your, you know, years

82

: 00:03:56

of experience and they want to CISSP.

83

: 00:03:59

That's ridiculous.

84

: 00:04:00

Um, that's just somebody who doesn't

know how to write this job description,

85

: 00:04:03

or they don't know what they're

looking for, or they just want to hit.

86

: 00:04:05

Everything under the sun.

87

: 00:04:07

It doesn't really matter.

88

: 00:04:08

They just want to grab.

89

: 00:04:10

Anything they possibly can.

90

: 00:04:11

So that that's.

91

: 00:04:12

Not good.

92

: 00:04:13

But the comp Tia security plus

honestly that I know certificates

93

: 00:04:19

get, you know, hit or miss yay or

nay people like them that don't.

94

: 00:04:22

That's exactly the one that

I took, I did the comp Tia

95

: 00:04:24

security plus out of the gate.

96

: 00:04:26

Um, it was hard.

97

: 00:04:28

But I did have that.

98

: 00:04:29

It background.

99

: 00:04:31

I was able to stay for, it

took a couple of months.

100

: 00:04:34

Pass it.

101

: 00:04:35

And one of the nice things about it is.

102

: 00:04:38

On job applications, they're looking for.

103

: 00:04:41

Particular certifications.

104

: 00:04:42

And so you just kind of hit

that right out of the gate.

105

: 00:04:45

It just gets you past an

applicant tracking system.

106

: 00:04:47

And I think if you can do that, I

think that is probably your best bet.

107

: 00:04:51

As far as different

certifications, I always preached.

108

: 00:04:55

On this podcast or my tech talk series.

109

: 00:04:57

If you're going to go for certs

and now they are not the end.

110

: 00:05:00

All be all.

111

: 00:05:01

But if you're going to go

for certifications for.

112

: 00:05:05

You know, Different jobs.

113

: 00:05:07

Look at the job that you're applying for.

114

: 00:05:10

Or jobs that you're applying for

and see if you see a pattern and

115

: 00:05:13

then go for those certifications.

116

: 00:05:17

So for me, I did see comp

Tia security plus, oh, a lot.

117

: 00:05:21

And I saw a lot of ISC

squared on there as well.

118

: 00:05:25

Um, I went from comp Tia security

plus got my cybersecurity job

119

: 00:05:30

and then studied for the CSSP.

120

: 00:05:31

And I really don't intend to

get any more certifications.

121

: 00:05:35

I just will keep getting.

122

: 00:05:37

Uh, continuing education

credits for those.

123

: 00:05:40

And just leave it at that.

124

: 00:05:42

But for entry level.

125

: 00:05:45

You know, if it.

126

: 00:05:47

If there is an entry-level position

and there are some, although they're

127

: 00:05:50

rare, take a look at what they're

looking for and then go for those.

128

: 00:05:54

But don't look for certifications

that require five years of

129

: 00:05:57

experience like the CSSP.

130

: 00:05:59

Because that makes absolutely no sense

for it to be an entry-level position.

131

: 00:06:03

So.

132

: 00:06:04

I don't know that I would put

an importance level on them.

133

: 00:06:07

I just wanted to check

as many boxes as I could.

134

: 00:06:10

To get past the recruiter.

135

: 00:06:11

That's basically it.

136

: 00:06:13

Right.

137

: 00:06:14

I mean, if you've got 10 applicants

that come in and this job requirement

138

: 00:06:18

says nice to have security

plus, and you don't have it.

139

: 00:06:22

Do you really want to be number 11?

140

: 00:06:24

Would you rather just make that cut

from whatever system is looking at?

141

: 00:06:27

You know, how much, how much

of a matches this person?

142

: 00:06:30

That's all.

143

: 00:06:30

But it's not the end.

144

: 00:06:31

All be all experience.

145

: 00:06:33

How you handle yourself, your level of

professionalism, what you can bring to the

146

: 00:06:36

table, your attitude, all those things.

147

: 00:06:39

How do you fit into the culture?

148

: 00:06:41

Way more important than certification?

149

: 00:06:43

Hands down.

150

: 00:06:45

Next question.

151

: 00:06:46

What soft skills are crucial

for success in cybersecurity,

152

: 00:06:50

beyond technical knowledge?

153

: 00:06:52

Curiosity.

154

: 00:06:54

Curiosity.

155

: 00:06:56

Um, I w I don't want to

use the word self starter.

156

: 00:07:01

I would say someone who.

157

: 00:07:04

Could.

158

: 00:07:05

Take an idea.

159

: 00:07:07

And just be able to figure out a

lot of that stuff out on their own.

160

: 00:07:12

Meaning.

161

: 00:07:13

You're going to do searching.

162

: 00:07:14

You'll go into forums.

163

: 00:07:15

You'll use AI, you'll chat with coworkers.

164

: 00:07:18

You'll be able to take a particular.

165

: 00:07:21

Problem.

166

: 00:07:22

And come up with your own solution.

167

: 00:07:24

You're not someone who needs

to be told every step of

168

: 00:07:27

everything that you have to do.

169

: 00:07:29

Right.

170

: 00:07:29

It's self-discovery cybersecurity

is a lot of curiosity.

171

: 00:07:33

Self discovery.

172

: 00:07:35

Doing things on your own.

173

: 00:07:38

Figuring things out.

174

: 00:07:40

I know these are all buzzwords

and keywords, but honestly, If

175

: 00:07:43

there's a problem with the system

and you're the person that needs to

176

: 00:07:46

fix it, or you have to investigate.

177

: 00:07:48

Some kind of suspicious potential threat.

178

: 00:07:51

Or, you know, fix one of your CASB

products or, you know, work with.

179

: 00:07:57

Work on a browser or something.

180

: 00:07:59

You've got to be able to take that from.

181

: 00:08:02

Not very much information and, and

follow that all the way through.

182

: 00:08:05

So.

183

: 00:08:06

If you're someone who needs to be handheld

and I want to, I don't want to know

184

: 00:08:10

exactly everything I'm supposed to do.

185

: 00:08:12

I want my boss to tell me

everything every step of the way.

186

: 00:08:15

Cybersecurity is gonna be really difficult

because it's just, you think computer

187

: 00:08:19

and technology is changing all the time.

188

: 00:08:21

Cyber attacks and technology

is changing all the time.

189

: 00:08:24

Two years ago, there wasn't

really, you know, phishing

190

: 00:08:26

emails and all that was a joke.

191

: 00:08:28

Um, it's not so much of a joke anymore.

192

: 00:08:30

Because the landscape has changed.

193

: 00:08:32

You've got AI.

194

: 00:08:33

You've opened up.

195

: 00:08:35

Um, really good English speaking

abilities or any other language speaking

196

: 00:08:40

bellies now to craft really great.

197

: 00:08:43

Emails to.

198

: 00:08:45

You know, exfiltrate or infiltrate

data and hack and all this kind of

199

: 00:08:49

stuff and the landscape changes.

200

: 00:08:50

And so that soft skill.

201

: 00:08:52

Curiosity, self discovery.

202

: 00:08:56

Ability to not know everything and

rely on other, you know, work with your

203

: 00:09:00

coworkers on how to solve these problems.

204

: 00:09:03

It's going to be huge and that's.

205

: 00:09:05

That's a hard thing to teach.

206

: 00:09:07

You can teach people technical skills.

207

: 00:09:09

I've seen this on LinkedIn all the time.

208

: 00:09:11

You can teach somebody technical

skills, but it's really hard

209

: 00:09:14

to teach people soft skills.

210

: 00:09:16

That's more of a learning thing.

211

: 00:09:17

How do I be a better listener?

212

: 00:09:19

That's a lot harder to do than,

Hey, how do I become better at.

213

: 00:09:22

Python programming or something.

214

: 00:09:24

So those, those are my soft skills.

215

: 00:09:26

How can I stand out in a cybersecurity

job interview, particularly if I'm

216

: 00:09:31

transitioning from a different career?

217

: 00:09:33

So I transitioned from it.

218

: 00:09:35

Windows, SharePoint, world.

219

: 00:09:38

Into cybersecurity.

220

: 00:09:40

And I found it very difficult because

a lot of times initially on my resume,

221

: 00:09:45

people would see that and they're

like, oh, you're you're SharePoint.

222

: 00:09:48

Your windows.

223

: 00:09:49

And it was difficult to get

away from that perspective.

224

: 00:09:52

Until I completely revamped my resume.

225

: 00:09:55

To focus more on the cyber security

things that I did in my previous jobs.

226

: 00:10:00

And I crafted my resume to be the

person I wanted to be instead of

227

: 00:10:04

the person that I was or had done.

228

: 00:10:06

If that makes any sense.

229

: 00:10:08

Right.

230

: 00:10:08

If you want to be in cybersecurity.

231

: 00:10:11

And someone's looking at your resume.

232

: 00:10:12

They're going to want

to look at someone who.

233

: 00:10:15

Has those has that particular

skillset, as opposed to somebody who

234

: 00:10:19

doesn't, but just really wants to get

in and they're passionate about it.

235

: 00:10:22

Right?

236

: 00:10:22

You hear a lot of passion.

237

: 00:10:23

But if you want to stand out in

that job interview, What is it

238

: 00:10:26

that you can bring to the table?

239

: 00:10:28

If an, if an employee has something

that they need to fill a gap.

240

: 00:10:33

You've got to be able to provide

the technical skills or at least

241

: 00:10:35

showcase that you could learn.

242

: 00:10:38

All right.

243

: 00:10:38

That you could learn this.

244

: 00:10:40

And that you, you fit into the culture.

245

: 00:10:42

And that, that one I hate the most

because I don't know what that means.

246

: 00:10:45

How do you fit into the culture?

247

: 00:10:47

Right.

248

: 00:10:48

Um, you don't.

249

: 00:10:50

Gut instinct, you know,

if you're going to fit.

250

: 00:10:52

Just be yourself.

251

: 00:10:53

I mean, you hear that a lot, but honestly,

If you go into a culture where you're not

252

: 00:10:57

comfortable day one and you don't like it.

253

: 00:10:59

You probably aren't

going to last very long.

254

: 00:11:02

So standing out for me was crafting my

resume and highlighting the things that

255

: 00:11:06

I'd done, sort of tooting my own horn and

saying, Hey, here's the things I've done

256

: 00:11:10

in cybersecurity that I can help you, or

that I've got the skillset that you need.

257

: 00:11:15

To be able to do this.

258

: 00:11:17

And.

259

: 00:11:18

There are a lot of skills

in your previous job.

260

: 00:11:23

That.

261

: 00:11:24

We'll transition into cyber security that

you don't think will, for example, Um,

262

: 00:11:30

I did a lot of videos previously in, in,

before when I transitioned careers, I did

263

: 00:11:35

a lot of learning videos, just on my own.

264

: 00:11:37

Nobody asked me to do it.

265

: 00:11:38

I used Camtasia and I just

made videos on SharePoint.

266

: 00:11:41

And how did you certain things

and it became really popular.

267

: 00:11:44

And I point to that is that is

how I transitioned that particular

268

: 00:11:47

skillset into cyber security awareness

training, because I was good at making

269

: 00:11:50

videos, communicating with end-users.

270

: 00:11:53

Drafting up emails and materials and

getting people on board with training.

271

: 00:11:57

And that is something I'd be

interested in doing at your company.

272

: 00:12:00

And guess what they had a need for that.

273

: 00:12:02

And that's what I still do today.

274

: 00:12:04

Security awareness training.

275

: 00:12:05

As far as I know, we're

relatively secure Yami.

276

: 00:12:08

But my point is you will have skills

in your previous job that you don't

277

: 00:12:13

think transition into cybersecurity

and they absolutely do so you need to

278

: 00:12:17

figure out what is it that I've done

that I think I can bring to the table.

279

: 00:12:21

That's going to make it.

280

: 00:12:22

Something I can do for this company

that relates to cybersecurity.

281

: 00:12:25

You will have those

skills do not discount.

282

: 00:12:28

Uh, those transitional skills that

you have, everything is not technical.

283

: 00:12:32

It doesn't have to be.

284

: 00:12:34

What's the best way to network

and build connections in the

285

: 00:12:37

cybersecurity community as a newcomer?

286

: 00:12:39

Uh, I love this one.

287

: 00:12:41

It's the best way to network

and build connections in the

288

: 00:12:43

cybersecurity community as a newcomer.

289

: 00:12:45

So I went to, I went to RSA.

290

: 00:12:48

Which is, uh, a local, huge

local show here in the bay area.

291

: 00:12:53

And I went to that for two years,

uh, prior to actually getting

292

: 00:12:57

into the industry because you can

basically get a free expo ticket.

293

: 00:13:00

If you have any vendor contacts, you know,

anybody, or you look online, whatever.

294

: 00:13:04

And it's not very expensive,

even if you don't.

295

: 00:13:07

And I just went to the show and I

walked this, I walked the floor.

296

: 00:13:10

I spent two days walking around,

talking with different vendors,

297

: 00:13:14

getting into the industry,

getting, understanding the tools.

298

: 00:13:18

What different products are out

there, what people are doing,

299

: 00:13:21

listening to the bud buzzwords

and the vibe that was going on.

300

: 00:13:25

You know, taking every opportunity

to attend any of the parties that

301

: 00:13:28

these vendors would have like, oh,

we're having a happy hour at five.

302

: 00:13:31

If you meet us at such and such.

303

: 00:13:33

And it was a networking event, a bunch

of people, I didn't know anybody.

304

: 00:13:37

And industry.

305

: 00:13:38

I didn't know anybody

at any of these events.

306

: 00:13:40

I just went.

307

: 00:13:41

And got myself out there and attended the,

this particular cybersecurity conference.

308

: 00:13:47

And that was instrumental in

getting me into the industry

309

: 00:13:52

that I wasn't already in.

310

: 00:13:53

And there are a ton.

311

: 00:13:54

Of free or low cost.

312

: 00:13:56

Cyber security conferences

that you can go to.

313

: 00:13:59

And I'll link that in the show notes is

actually a site that's, um, very good.

314

: 00:14:03

It's got all different countries and

cities and genres of cyber security

315

: 00:14:07

that you can sign up for alerts.

316

: 00:14:08

And then we'll tell you about different

events are happening, not just meetups

317

: 00:14:11

and stuff, but actual conferences.

318

: 00:14:13

You know, small, large, whatever.

319

: 00:14:14

Some are free, some are not.

320

: 00:14:16

And you should just attend those.

321

: 00:14:18

That was a great way for me to build

up a connection and get myself into.

322

: 00:14:24

I get myself into the

cyber security community.

323

: 00:14:27

When I didn't have any experience in

it when I didn't know anybody in it.

324

: 00:14:31

And I wasn't currently working

in industry, I would say that

325

: 00:14:34

is the best and biggest thing.

326

: 00:14:36

You can do.

327

: 00:14:37

Get yourself into some

cybersecurity conferences.

328

: 00:14:39

You know, even if they're online, I

know that's not going to be as good.

329

: 00:14:42

But even if they're online,

It's a good way to just start

330

: 00:14:46

getting yourself in there.

331

: 00:14:47

I just, I just went to BSides Vegas.

332

: 00:14:50

Not.

333

: 00:14:50

Three weeks ago.

334

: 00:14:52

And my ticket for the two day event.

335

: 00:14:55

It was a hundred bucks.

336

: 00:14:55

That is such a cheap.

337

: 00:14:57

Conference ticket.

338

: 00:14:58

And besides is all over the

world, it isn't just in Vegas.

339

: 00:15:00

It's, it's all over the place.

340

: 00:15:02

They have conferences at different areas.

341

: 00:15:04

You could look it up.

342

: 00:15:06

But it's such a cheap

ticket for what you get.

343

: 00:15:08

And you're networking with people who are

literally in the trenches, working in the

344

: 00:15:12

industry that may be able to hook you up

or help you out with jobs or anything.

345

: 00:15:16

I was standing in line and

I listened to this girl.

346

: 00:15:18

Talk about.

347

: 00:15:19

How she was.

348

: 00:15:20

You know, taking these courses and classes

and doing all this stuff on the side,

349

: 00:15:24

she really wanted to be calm pen tester.

350

: 00:15:26

And the person that she was just

chatting with was like, Hey, we're

351

: 00:15:28

looking for people to do that.

352

: 00:15:30

You know, drop me your

contact information.

353

: 00:15:31

I'll see what I can do.

354

: 00:15:32

And maybe we can hook you up.

355

: 00:15:33

Or if I know someone.

356

: 00:15:35

That.

357

: 00:15:36

You're not going to get that.

358

: 00:15:37

Elsewhere.

359

: 00:15:38

That, that that is the kind of stuff

that you want to build connections.

360

: 00:15:43

As a newcomer when you're just talking

with people and it gets you out there

361

: 00:15:46

and start talking about yourself and what

you want to do with people that you don't

362

: 00:15:49

know, which is uncomfortable for some.

363

: 00:15:51

And that is, that is huge.

364

: 00:15:53

So attending cyber security conferences.

365

: 00:15:55

And I'll, I'll link that in the

show notes is, um, absolutely huge.

366

: 00:15:59

How should I handle rejection in

my job search, and what can I learn

367

: 00:16:03

from unsuccessful applications to

improve my chances in the future?

368

: 00:16:07

I'd say I had about a 54% hit

rate on stuff where I would hear

369

: 00:16:13

something back from somebody.

370

: 00:16:15

Um, 50% ghost.

371

: 00:16:17

Like nothing.

372

: 00:16:18

And then 50%.

373

: 00:16:20

You know, I'd hear back from something.

374

: 00:16:21

I got a lot.

375

: 00:16:22

I got really close to a lot

of thought opportunities.

376

: 00:16:26

And rejected.

377

: 00:16:27

And I had a lot of

highs and a lot of lows.

378

: 00:16:30

And it was really.

379

: 00:16:32

Took.

380

: 00:16:32

84 tailor job applications.

381

: 00:16:34

And this is 20 18 84 tailored

job tailored job applications.

382

: 00:16:38

I wasn't shot getting it.

383

: 00:16:41

And.

384

: 00:16:42

It was, it was.

385

: 00:16:44

It very difficult and painful.

386

: 00:16:46

Uh, seven months to be able to

land that first cyber security job.

387

: 00:16:49

And I made my job looking for a job I

was applying or looking every single day.

388

: 00:16:54

I never really took breaks.

389

: 00:16:56

Um, I didn't burn out.

390

: 00:16:59

But you get really good at interviewing

and you get really good at.

391

: 00:17:03

Knowing what questions people are

going to ask you because eventually

392

: 00:17:06

it's like an actor, right?

393

: 00:17:07

You're learning your lines.

394

: 00:17:09

At first, you don't know your lines,

you really nervous you, you fumble

395

: 00:17:13

around, but after a while you hear the

same, what's the difference between

396

: 00:17:17

asymmetric and symmetric encryption?

397

: 00:17:19

Or how would you secure this network

or what order do firewalls rules go in?

398

: 00:17:23

You know, whatever.

399

: 00:17:24

You're going to hear the same

things over and over and over.

400

: 00:17:27

Um, And you'll just get better at that

and there, how to handle rejection.

401

: 00:17:33

I never took it personally.

402

: 00:17:36

And I never really followed up with

interviewers or hiring managers.

403

: 00:17:39

Anybody I would apply.

404

: 00:17:41

I would interview.

405

: 00:17:43

And I would go onto the next job.

406

: 00:17:45

I didn't spend time sending gift baskets

and flowers and thanking recruiters

407

: 00:17:49

and having a bunch of conversations.

408

: 00:17:51

I'd follow up.

409

: 00:17:51

If I didn't hear back from somebody.

410

: 00:17:53

But I didn't, it didn't really matter.

411

: 00:17:55

And if I was rejected, I never asked

the recruiter why, or they're never

412

: 00:17:59

going to give you any good information.

413

: 00:18:00

For legal reasons for a

whole bunch of reasons.

414

: 00:18:02

It won't really disclose any of that.

415

: 00:18:05

Um, and I don't really care, you

know, maybe it wasn't a culture fit.

416

: 00:18:09

Maybe they're hiring their brother-in-law.

417

: 00:18:10

Who knows, who cares?

418

: 00:18:12

So I didn't.

419

: 00:18:14

I didn't handle rejection per se.

420

: 00:18:15

I just moved on and went to the next thing

and the next thing and the next thing,

421

: 00:18:18

the next thing, I just, I was a machine

that's my job was looking for a job.

422

: 00:18:22

To get a job in cybersecurity industry.

423

: 00:18:24

That was, that was it.

424

: 00:18:26

Basically in a nutshell, that was it.

425

: 00:18:27

I didn't think about anything else.

426

: 00:18:30

And it didn't.

427

: 00:18:31

It doesn't matter.

428

: 00:18:32

I see a lot of that on LinkedIn.

429

: 00:18:33

It's like, oh, what do I, you know, I'll

go on LinkedIn and complain about the job.

430

: 00:18:36

How sucky jobs are and how

broken industry is whatever.

431

: 00:18:40

Not going to change anything.

432

: 00:18:42

And it doesn't help you.

433

: 00:18:43

It's not to say venting doesn't

help, but public venting is just.

434

: 00:18:47

Yeah.

435

: 00:18:47

Waste of time.

436

: 00:18:48

And you're not really gonna learn

anything from the, recruiter's not going

437

: 00:18:51

to be like, oh, if only you had more

experience or if only you had this or you

438

: 00:18:56

really should present yourself better.

439

: 00:18:57

You're.

440

: 00:18:57

You got to say anything.

441

: 00:18:59

And nobody wants to get sued.

442

: 00:19:00

So you just, oh, you know, we went

with a different candidate choice.

443

: 00:19:04

You know, the generic bullshit, whatever.

444

: 00:19:06

And what if they said, oh,

you're just in a culture fit.

445

: 00:19:09

What are you going to do with that?

446

: 00:19:10

How was that helpful to you?

447

: 00:19:11

Oh, I'm not a culture fit.

448

: 00:19:12

What?

449

: 00:19:13

Come on.

450

: 00:19:14

Don't so don't, you don't

need to really handle it.

451

: 00:19:16

You just need to not take

it personally and move on.

452

: 00:19:20

And I think this job market is a

lot harder than when I had, I got my

453

: 00:19:23

was hard, but that's my perspective.

454

: 00:19:25

But.

455

: 00:19:26

I think it's, I think it's definitely

harder now than it was before.

456

: 00:19:29

So.

457

: 00:19:30

You know, Now, what can you learn

from unsuccessful applications

458

: 00:19:34

to improve your chances?

459

: 00:19:35

I would always constantly tweak my resume.

460

: 00:19:38

Uh, I wrote a book zero to

hired and it's on Amazon.

461

: 00:19:41

And I've got a podcast on it.

462

: 00:19:44

It's called the higher drive.

463

: 00:19:45

And one of the things that I did

was I constantly looked at jobs

464

: 00:19:50

on LinkedIn that I wanted to do.

465

: 00:19:53

And maybe there's a bullet point

that I missed that I had done

466

: 00:19:56

that looked better like, oh yeah,

I've done vuln, vulnerability

467

: 00:19:59

management, scanning, and Nessus.

468

: 00:20:00

Why didn't I include that on my resume?

469

: 00:20:02

And then it would just take that

from what they were looking for.

470

: 00:20:04

And then I'd put that on my LinkedIn

profile on my resume and use that.

471

: 00:20:08

And eventually what you end up doing,

I called it the save a job method was.

472

: 00:20:13

I would save jobs.

473

: 00:20:13

I was interested in and I was looking

at what they were looking for.

474

: 00:20:16

And then I'd look at my resume and see

if there was areas that I can improve.

475

: 00:20:19

Could I improve.

476

: 00:20:20

the description?

477

: 00:20:21

Could I add a keyword that I'd missed?

478

: 00:20:23

Could I add a bullet point that I had

done that I neglected to put on there?

479

: 00:20:27

Could I drop something that wasn't,

that I thought was important that

480

: 00:20:30

apparently no, one's looking for.

481

: 00:20:32

And put something else.

482

: 00:20:33

So could I word it better so

that the industry is looking for.

483

: 00:20:36

this particular set of keywords, but

I'd use a different set of keywords.

484

: 00:20:39

So I used their job descriptions to build

up my resume for things that I had done.

485

: 00:20:44

And then at the end of the

month or whatever, I had a

486

: 00:20:47

damn good looking resume.

487

: 00:20:48

In my opinion.

488

: 00:20:50

That.

489

: 00:20:51

Are what people in the cybersecurity

industry are looking for of

490

: 00:20:54

things that I'd done, because

there are looking for That.

491

: 00:20:56

I had done that and it was

able to present on a resume.

492

: 00:20:59

And I did it in a way that

I would have talking points.

493

: 00:21:02

So it wasn't just a list

of responsibilities.

494

: 00:21:05

It will list of accomplishments

and things that I'd done.

495

: 00:21:07

So I could have stories to tell

because storytelling is important.

496

: 00:21:11

And that's why I think podcasting

is successful is because people like

497

: 00:21:14

listening to content and stories.

498

: 00:21:16

If I just rattled off these six questions

and gave you real quick answers,

499

: 00:21:19

it wouldn't be that entertaining.

500

: 00:21:21

But I'm giving you information

and in a kind of a story format.

501

: 00:21:25

That's giving you that information.

502

: 00:21:26

It's more, it's better.

503

: 00:21:27

And so a resume in ways like

a calling card slash story.

504

: 00:21:31

Tell me about when you

worked here, what'd you do?

505

: 00:21:34

it shows that you saved the money, the

company, this much money and stuff.

506

: 00:21:37

Can you tell me about that?

507

: 00:21:39

It's a much more interesting

than I manage SharePoint.

508

: 00:21:42

Okay.

509

: 00:21:43

Great.

510

: 00:21:44

But, you know, what else?

511

: 00:21:46

So thank you for your resume as

like a, as a list of accomplishments

512

: 00:21:50

and things that you had done, your

responsibilities are important, but.

513

: 00:21:54

A lot of people, they got ugly looking

resumes and that doesn't really, it might

514

: 00:21:57

pass an applicant tracking system, but.

515

: 00:21:59

it doesn't make for something that

someone is curious to talk to you

516

: 00:22:03

about the things that you've done.

517

: 00:22:05

You should toot your own horn,

tell people what you've done.

518

: 00:22:07

and how you can help them out.

519

: 00:22:08

That kind of thing.

520

: 00:22:09

But, you.

521

: 00:22:10

know, getting into

cybersecurity is difficult.

522

: 00:22:12

Not going to lie.

523

: 00:22:13

It was hard for me and I, and I look

out there in the landscape now..

524

: 00:22:16

It looks nasty.

525

: 00:22:17

So there's anything.

526

: 00:22:19

That I want to do.

527

: 00:22:20

It's trying to help people avoid

the mistakes or the pain that I did.

528

: 00:22:23

And that's the purpose of this podcast.

529

: 00:22:25

And the videos that I do.

530

: 00:22:27

And I think the industry needs a lot

more qualified, passionate, good people.

531

: 00:22:31

And I know there's a lot of

people out there that could do.

532

: 00:22:34

These type of jobs.

533

: 00:22:35

Thank you Marc!

534

: 00:22:36

I hope the listeners

will enjoy this episode.

535

: 00:22:39

As a reminder, contact

information and show notes will

536

: 00:22:42

be available in this episode.

537

: 00:22:44

Check your podcast app to view the notes

for links to any resources mentioned.

538

: 00:22:49

Stay safe and hope you join us again.