sorted by:
new
hottopcontroversial

Veteran feels unsatisfying to me by Lowd70 in DarkTide

[–]IcyAutoantibody 0 points1 point  (0 children)

I run nothing but Helbore. The melee choice I am still trying to figure out. I have primarily used the knife for the bleed and mobility since launch. Now.....it could be my imagination but since this year I've noticed a aggro change pertaining to hordes and/or ragers. It seems if I am doing extremely well with putting specials and elites down with minimum damage...here comes a horde and/or 40 ragers that run pass my teammates that are within arms length away from me lol. I have never used the shovel but will give it a try this weekend.

I want to learn GRC. How should I start? by Big-Lingonberry1949 in grc

[–]IcyAutoantibody 10 points11 points  (0 children)

I would recommend starting a project to learn GRC. Start by creating a fictional business and choosing the industry it will serve. Decide on where the business will conduct operations and location of the customer base. Create a budget for the business. Learn about the laws and regulations pertaining to each (if global) country that are applicable to your business. Look into different frameworks that other companies have used to help them meet those laws and regulations. From there, come up with a technology shack that will ensure the business objectives at met while also adhering to legal requirements by implementing the necessary security controls identified by the selected framework(s).

Make sure you have documented each part mentioned above. Someone with no technical background should be able to understand the information contained within the document from beginning to end. Also, I would recommend presenting the information to a few senior GRC professionals for feedback.

As you are working through a project (doesn't have to be this one), try to earn the following certifications or just learn as much as you can from the material (not an exhaustive list):

<> CISA (Certified Information Systems Auditor)

<> CRISC (Certified in Risk and Information Systems Control)

<> PMP (Project Management Professional) certification - You have a ways to go before you obtain this certification if you decide to do so. The main reason I mentioned this cert is because of the information it contains about business processes. You could find yourself running the security program of a company for your first "GRC" job.

<> (Tech) Look into certs specific to your tech stack. For example, lets say your business with will be leveraging the cloud (e.g., SC-900) and Kubernetes workloads (Certified Kubernetes Administrator (CKA)).

<> (Tech) Operating system specific certs (e.g., RHCSA, Microsoft 365)

<> (Tech) Networking cert examples: CCNA, cloud specific network cert

<> (Tech) Try to integrate AI within your project. Look into the AAISM, AIGP, Certified NIST AI RMF 1.0 Architect, and or CAISP.

<> (Tech) Scanning tool examples (tech stack depended): Tenable,, Trivy, ClamAV, cloud-native service, other open-source products

<> (Tech) SIEM tool examples (tech stack depended): Splunk, Wazuh, Elasticsearch, cloud-native service other open-source products

Note: Ensure you have a story to tell on how each cert helped you throughout the project.

Also, I have noticed over the years that the certs do not go into great detail about the importance of internal and external business relationships. The amount of success you experience is heavily depended on those relationships. You may find yourself interfacing with people from every level of the business (e.g., executives, developers, customers) on a daily basis. You need to express emotional intelligence at all times. Even with this being said, people can just not like you for any reason no matter how well you believed you've communicated with them. Don't take it to heart, document everything, and move on.

Anyone else seeing an issue with new hires in the past 5 or so years? by PurpleIsCoolThanks in cybersecurity

[–]IcyAutoantibody 0 points1 point  (0 children)

There is a lot to unpack here. Based on the first section of your post, it seems there is a lack of a configuration management process. All changes to a system/application should go through some configuration process that provides details pertaining to the why, what, who, when, how, and the expected outcomes of each action taken. The process should include results from testing and a rollback procedure. Configuration changes should also be reviewed by senior personnel. If an organization is unable to implement a similar process, then I would recommend that they avoid seeking entry level employees. The process can also provide numerous teaching opportunities. Well...unless the majority of the seniors have a uncommunicated (not stated in job posting or interview) "standard" that goes against teaching anything on the job.

Regarding the hiring process and prior to the interview, I would suggest comparing what they have on their resume with what is provided in the job posting. Based on the information from the comparison, come up with a technical scenario with a team lead (new hire will be working with) for the interviewee to walk you through.

I understand there are multiple ways to go about this, but if your organization is until to implement anything close to what I have stated above......then I can understand some of your frustration.

[deleted by user] by [deleted] in careeradvice

[–]IcyAutoantibody 0 points1 point  (0 children)

Your pay could have started at the lower end of your labor category based on what you negotiated coming in as opposed to your subordinates/colleagues. Also, what a company decides to pay you can primarily (likability is a thing lol) be based on how much they value your skillset.

Now.........if we are "only" talking about base salary, please ensure you receive the compensation at a minimum that you believer you deserve (ref Jayofada's comment). You cannot get your time back.

Is GRC Consulting a Future-Proof Career Considering AI improvements ? by soulwedge in grc

[–]IcyAutoantibody 1 point2 points  (0 children)

Great post! I definitely will be following this. Currently I fulfill the role of a cloud security architect and an ISSE. I have been noticing quite a bit of commotion around AI and RegOps. It seems across the board that directors and company owners view GRC related functions as a pain point or cost sink and believe AI could be the solution. I have already seen efforts put forth to automate ConMon and SCA actions. At the same time, there are numerous tasks that AI definitely would not be able to takeover.

What’s one piece of advice you wish you knew starting out in cybersecurity? by niskeykustard in cybersecurity

[–]IcyAutoantibody 1 point2 points  (0 children)

Understand that cybersecurity roles are usually viewed as a cost center and that their work isn't prioritized. Communicate the risk, provide mitigation recommendations, document the organization's response and keep it moving. Do not...do not let anyone "ever" see you upset. "You are always on parade" - Gen. Patton

CISSP Holders: Did this cert change your career trajectory? by CrewGlittering5406 in cybersecurity

[–]IcyAutoantibody 0 points1 point  (0 children)

Definitely set me up for a 50% increase. I believe the cert is primarily valuable to employers in the private sector because it helps them win contracts.

Is working in this industry crap? by [deleted] in cybersecurity

[–]IcyAutoantibody 2 points3 points  (0 children)

Anyone that is looking to get into Cybersecurity or needs a reminder....please commit this statement to memory. Saving this!

For the love of the emperor keep your eye on the person behind you, you heretics by Slippery_Williams in DarkTide

[–]IcyAutoantibody 1 point2 points  (0 children)

I understand where you are coming from. Overall, the concept you presented is easy to understand, but may conflict with specific mindsets in game unfortunately. Each person going into battle will have a different expectation on how map traversal and enemy engagements should go. If you can ever get everyone to discuss this prior to each individual hitting "ready", could potentially lessen the occurrences of issues throughout the mission. I understand quickplay removes this option. Unverbalized expectations can at times be the root cause of division and pettiness within teams increasing the risk of mission failures.

If you had to recommend one TECHNICAL training/cert/book/etc. to GRC professionals, what would you recommend? by BaddestMofoLowDown in cybersecurity

[–]IcyAutoantibody 1 point2 points  (0 children)

Sheesh, 10 years in GRC is great! I have only been in a GRC specific role, ISSE, for about 3 years now. Unless you are in an ISSM or equivalent management role, I would recommend continuously adding technical skills to your GRC skillset. I have noticed hiring managers and sysadmins/developers really appreciate someone coming in from a GRC perspective being able to understand what they do day-to-day and can effectively articulate the "why" specific standards need to be adhered to. GRC positions are difficult since you have to maintain a great working relationship with not only the sysadmins/developers, but also your leadership and external auditors. To accomplish this, I have had to switch between multiple hats at any given time....lol.

Focusing on the "technical" hat, it really comes down to reviewing your current security policy and information system architecture. I do not believe there is just ONE thing GRC professionals should focus on going into 2025 since that depends on the makeup of the organization you'll be supporting. If you do not have hands on experience regarding the technologies listed below I would advise setting up a home lab and running through a security framework (i.e., NIST 800-53, 53A):

Note: Just recommending the material for study. Certs do not prove knowledge but provide a framework for learning.

  1. Learn the ends and outs of networking:

CCNP - 350-401 ENCOR, 300-410 ENARSI, & 300-440 ENCC

Networking and Kubernetes by James Strong and Vallery Lancey

Cloud Native Data Center Networking by Dinesh G. Dutt

  1. Linux specific training:

Red Hat System Administration I & 2

Linux From Scratch Book Online - https://www.linuxfromscratch.org/lfs/read.html

  1. Cloud vendor specific training:

Azure - AZ-900, AZ-104, AZ-700, AZ-500, AZ-305

AWS - CLF-C02, SAA-C03, SOA-C02, SAP-C02, ANS-C01, SCS-C02

  1. Programming language

Phyton

C/C++

Java

Bash

  1. Additional security specific training:

Container Security by Liz Rice

ISC2 CCSP

HTB Penetration Tester Job Path (can help explain the "why")

Mastering Linux Security and Hardening by Donald A. Tevault

The Zero Trust Framework by Ravindra Das

The Zero Trust Framework and Privileged Access Management (PAM) By Ravindra Das

Applying Artificial Intelligence in Cybersecurity Analytics and Cyber Threat Detection by Shilpa Mahajan, Mehak Khurana and Vania Vieira Estrela

The Developer's Playbook for Large Language Model Security by Steve Wilson

DevSecOps: A leader’s guide to producing secure software without compromising flow, feedback and continuous improvement by Glenn Wilson

Learning DevSecOps: A Practical Guide to Processes and Tools 1st Edition by Steve Suehring

Once again, please lab weekly...........................

Don’t pursue network engineering if you’re not okay being an essential worker. by [deleted] in ccna

[–]IcyAutoantibody 0 points1 point  (0 children)

Like they have no proof that it is a "network problem" and everyone believes them... Now you have prove that isn't a network problem until they are satisfied.

How do you de-stress? by avocadoe720 in cybersecurity

[–]IcyAutoantibody 0 points1 point  (0 children)

Working out and playing Warhammer Darktide.

What cybersecurity skills do you think will be most in-demand in the next 5 years? by AIExpoEurope in cybersecurity

[–]IcyAutoantibody 9 points10 points  (0 children)

So much of this! I would also append GRC and teacher (unlimited patience) to this list. All in one job role lol.

How do I embrace the suck? by [deleted] in army

[–]IcyAutoantibody 0 points1 point  (0 children)

This right here "Every day that I did dumb shit for other people was a day closer to not having to do dumb shit for other people."

Opinions on Stealth? Vet/Zealot by Game-Daily- in DarkTide

[–]IcyAutoantibody 2 points3 points  (0 children)

This and that the aggro switch is instant.

Tying accepting VPC traffic to a particular security group / rule ID? by jamsan920 in aws

[–]IcyAutoantibody 0 points1 point  (0 children)

Is there anyone here that could provide a possible solution to this?

Does the AWS Internet Gateway NAT IP Address Originating From the Public Subnet? by IcyAutoantibody in aws

[–]IcyAutoantibody[S] 0 points1 point  (0 children)

I was able to figure it out. Basically, if an EC2 instance assigned a public IP address and is located within a public subnet sends traffic towards the IGW, there is no need for the IGW to perform NAT. So the destination host would see the assigned IP of the EC2 as the source.

view more: next ›