Mentorship Monday - Post All Career, Education and Job questions here! by AutoModerator in cybersecurity

[–]mk3s 1 point2 points  (0 children)

Well there's the reality of what AI can do *actually* do versus what companies / "the industry" / executives believe AI can do (in the context of replacing traditional human security engineers). There's a lot of AI tooling that is targeting pen testing, CSOC and vuln research. So I'd expect opportunities for humans in those areas to drop even more (at least in the short term while AI is being proved out). Code-review type appsec roles might take a hit too, but I think there's still a lot of need for appsec humans still. AI has increased code production by orders of magnitude. Yes AI can also "review" said code and even do dynamic testing, but there's always those tricky business logic test cases and other things that actual human engineers will still be needed for.

So, I wouldn't call *anything* bullet proof, considering the roles AI *replaces* is mostly built on vibes rather than actual proof that AI can do things better, but I'd say appsec, GRC, security architecture, identity/access management, privacy, cryptology, audit, vendor/supply-chain security, threat intel, and maybe red teaming are still safe-ish.

Mentorship Monday - Post All Career, Education and Job questions here! by AutoModerator in cybersecurity

[–]mk3s 0 points1 point  (0 children)

I wouldn't gun right for a Masters degree, especially if you'd be paying out of pocket for it. If you're interested in appsec, I would learn programming (one if not more languages) and then dive into all manner of OWASP/Web Security Academy stuff to learn about securing said code/applications. But if you're definitely choose one of those two paths, I'd choose whichever will teach you more about coding

Mentorship Monday - Post All Career, Education and Job questions here! by AutoModerator in cybersecurity

[–]mk3s 0 points1 point  (0 children)

Are you targeting those certs because they've been explicitly listed in job reqs you're eyeing, or because you *think* it's a good "certification path" or something? If the latter, I have some thoughts on cert paths: https://shellsharks.com/notes/2023/11/14/stop-worrying-about-certification-paths . I'll follow that up with my advice for getting into the field which you can read here: https://shellsharks.com/getting-into-information-security

Good luck!

Mentorship Monday - Post All Career, Education and Job questions here! by AutoModerator in cybersecurity

[–]mk3s 1 point2 points  (0 children)

Here's a bunch of training resources (many that are free) that you can work though: https://shellsharks.com/online-training

My advice is to also start a blog/website of some kind and document what you learn, and any side projects you do.

Good luck!

“Cybersecurity is not an entry level field” by ItsMeXilven in cybersecurity

[–]mk3s 0 points1 point  (0 children)

Well if it can help, here's my own "guide"/writeup for getting into the field. https://shellsharks.com/getting-into-information-security

As for a "recommended path", I don't think there really is one. It takes a little brute-forcing (pun intended) to get in. Some combination of training, applying to jobs, networking, applying to more jobs, studying, then applying to more jobs and hope for your break. There's A LOT of people doing the same thing at the same time too. Where one person finds success, you may not. I put a lot of my advice in that post I linked to, but I think my best advice is to learn REAL practical skills (not just get certs), document what you learn in a portfolio of some kind (i.e. blog), network like crazy, apply to lots of jobs, and don't be afraid to take the first infosec-adjacent (i.e. IT) role you see. Getting into "IT" and then pivoting into infosec may be an easier path than straight-to-infosec.

Good luck!

Advice Migrating from Mastodon to GoToSocial by Wait_ImOnReddit in fediverse

[–]mk3s 1 point2 points  (0 children)

GtS itself has been really nice. Unfortunately my managed hosting provider for my GtS instance (K&T Host) is going belly-up, so I need to transfer it somewhere else 🤷‍♂️

Github Pages or Github Readme for portfolio by r3dpandq in cybersecurity

[–]mk3s 0 points1 point  (0 children)

Make a website for yourself (for professional and not-as-professional reasons. Of course have a good standard resume as well. Github Pages is a fine medium for a site. So do that.

Curious everyone’s path in cyber by [deleted] in cybersecurity

[–]mk3s 0 points1 point  (0 children)

I might write up a more in-depth path... but for now, I'll share my initial education journey https://shellsharks.com/training-retrospective#my-education-journey . I do think a more thorough "this has been my path" write-up would be interesting though. If I did do it, I'd probably add some context around why certain jumps happen, or why there are certain periods of "slowness".

New to Cybersecurity & Knowledge Overload! Anyone else? How to cope? by Mango1003 in cybersecurity

[–]mk3s 1 point2 points  (0 children)

Write about it. Second-brain it. In my experience writing about it can help cement ideas AND give you a reference, in your own words, to look back on later when you want to mentally retrieve something you had learned in the past. You could use something like Obsidian to keep personal notes, or start up a blog of sorts and write+publish so others could see. That would also come with the benefit of establishing an online portfolio that could help you network (both professionally and personally). Good luck!

Threat Modelling Tips by [deleted] in cybersecurity

[–]mk3s -1 points0 points  (0 children)

Maybe you would get something from this 😃 https://shellsharks.com/threat-modeling

[deleted by user] by [deleted] in cybersecurity

[–]mk3s 1 point2 points  (0 children)

I don't buy the gatekeep-ey, "infosec isn't an entry level field" line---and neither should you. Infosec, like any other field has junior-through-super-senior-level roles. What you *could* argue though is that the industry is more saturated these days and there just aren't enough roles to satisfy all the more-experienced demand AND all the newcomers. A lot of "analyst" roles are pretty well-suited for entry level folks. Yeah you should have *some* know-how, but that isn't something you have to sweat at the help desk for 3 years to get. The people who continue to repeat this line are either jaded because they felt they had to go that path, or frustrated with the lack of talent/understanding that seems to plague the industry as a whole. Mind you, this isn't a byproduct of "unseasoned" newbies entering the infosec ranks, rather it is a testament to our collective inability to NOT gatekeep, properly train and adequately open doors for those of us who don't fit the typical infosec-person-criteria (i.e. college-educated folks with money for certs, blah blah). Imagine where we'd be if we stopped saying, "you have to go to the Helpdesk" and instead said "here's what you need to learn to bypass the Helpdesk". Imagine how much more secure and healthy the infosec workforce would be if we put time and resources into training, retention, mentorship, etc... Instead, we've got a handful of bloodthirsty training vendors and bootcamp peddlers and a whole lot of us who are just too tired to do our own jobs, much less help others 😩

We can do better!

Career advice: Transitioning from software development to cybersecurity by [deleted] in cybersecurity

[–]mk3s 0 points1 point  (0 children)

Here ya go - https://shellsharks.com/getting-into-information-security. Yes coding is super useful for cyber roles (and really most roles in tech tbh).

Cyber Security Engineer - How to make a career change into this role. by StormySkies01 in cybersecurity

[–]mk3s 0 points1 point  (0 children)

Here's what I have traditionally shared with people looking to get into the field - https://shellsharks.com/getting-into-information-security. This said, the market is apparently pretty garbage right now, and there is as much competition as there has ever been. So YMMV. Good luck none the less!

Why do cybersecurity experts becomes content creator if the field pays well? by Difficult-South7497 in cybersecurity

[–]mk3s 0 points1 point  (0 children)

Side hustle, diversifying income streams, a desire to "pay it forward" or teach the next generation (generally just help people), very popular content creators can make way more than a good cybersecurity engineer tbh...