Skip Navigation

shellsharks

@ shellsharks @infosec.pub

Posts
302
Comments
186
Joined
3 yr. ago

  • What are You Working on Wednesday

    Jump
    • Been reviewing Flipboard's "Surf" app (social web browser)
    • Working on some other write-ups for my blog... such as, overcoming my own burnout to write a piece ABOUT said burnout
    • Assessing some (un-named) endpoint security software at work
    • Testing out some other Fediverse client software, specifically, been using the Mona app more recently
    • Going to start thinking about getting back into some training of some kind... not sure what though (yet)

  • Off-Topic Friday

    Jump

  • Hello! 👋

  • Mentorship Monday - Discussions for career and learning!

    Jump

  • You'll need technical chops sure, but the hard part imo is finding the gigs. For that, good ol' fashioned networking. Start a blog, build a portfolio, network with folks and take work where you can find it. Good luck and happy new year!

  • Mentorship Monday - Discussions for career and learning!

    Jump

  • Mentorship Monday - Discussions for career and learning!

    Jump

  • There's no one path in to be sure. But there's lots of ways to educate yourself and build a "hireable" portfolio from home and without getting a typical 4-year degree. Learn to code, get some applicable certifications, start a website (as your digital portfolio), contribute to open source or spin up your own project(s), etc... The IT/software/cyber market is not at its peak (in terms of opportunity), but we're definitely still here and there are openings. It's still a great field with a lot of perks if you can weather the challenges of "breaking in". It's also not going anywhere, despite what some may lead you to believe given the advent of "AI". For those of us in tech, we'll be the first to tell you that our jobs are pretty safe.

    If it's infosec you might be interested in, you may find this guide I put together and typically share interesting - https://shellsharks.com/getting-into-information-security.

    Good luck!

  • Off-Topic Friday

    Jump

  • I've tried a bit. But not really day-to-day just yet

  • Mentorship Monday - Discussions for career and learning!

    Jump

  • nope 😕

  • Mentorship Monday - Discussions for career and learning!

    Jump

  • Overall, yes. Day to day y'know it varies. Pure "security work" is, for me, genuinely interesting and I spend legit personal time learning and working on projects, for no other reason than they are kinda fun. What I do as a security engineer for a corporation day-to-day and week-to-week doesn't always translate to the "fun stuff". So my answer is somewhat nuanced. Yes, I do like cybersecurity. But no, I don't always like the work in terms of how it manifests in corporate life.

  • What are You Working on Wednesday

    Jump

  • 🦀

  • What are You Working on Wednesday

    Jump

  • Got a bunch of house projects coming up myself... What kinda renos you up to?

  • Off-Topic Friday

    Jump

  • Yeah $400 is too rich for me at this point in my life. But maybe one day 🤷‍♂️

  • Off-Topic Friday

    Jump

  • Mentorship Monday - Discussions for career and learning!

    Jump

  • I wouldn't worry about certs to start, especially not OSCP. Since you are in the software/dev space, I would consider security roles in the AppSec or CloudSec space as places to jump first. For that, consider going through PortSwigger's web security academy (free) training online to learn more about web vulns, their impact, how to mitigate, etc... If you want a cert, consider one from a cloud vendor and apply to jobs that use that vendor. If you can do even basic scripting, understand app-related vulns and use a few appsec tools then you should be an easy hire for a lot of places. (That said, I've been hearing the market for infosec is atrocious right now).

  • Mentorship Monday - Discussions for career and learning!

    Jump

  • Never been in the QA world myself, but as someone who has spent a fair bit of time in AppSec, I've encountered Selenium the most. 🤷‍♂️

  • Mentorship Monday - Discussions for career and learning!

    Jump

  • When you say "transferrable in QA" do you mean, languages useful for QA folks that transfer out? I'd argue any/all of them would be for appsec folks.

  • Mentorship Monday - Discussions for career and learning!

    Jump

  • Not a bug bounty hunter myself, but it seems like one of those things that you just have to jump into and start trying to do. So many bounties seem to be pretty low-hanging fruit type of stuff. The payouts might be either LOW or non-paid, just recognition type stuff, but seeing an accepted bounty submission come back does a lot for your confidence. It's like CTFs in a way. Getting into CTFs seems intimidating at first, but then when you go actually do one and you have some level of success, it starts to feel a bit more approachable, you get more XP and you do better the next time.

    You could also check this out https://www.bugbountyhunter.com/zseano/ and anything/everything from https://portswigger.net as that team is the best I know in terms of cutting-edge web app research.

  • What are You Working on Wednesday

    Jump

  • 🔥

  • Mentorship Monday - Discussions for career and learning!

    Jump

  • That's a loaded question 😅. One that can be answered in a few different ways... From a technical perspective, "infosec" is a relatively vast field comprised of a lot of sub-disciplines, so from a tooling and procedural perspective, it varies from job to job. Some would argue a lot of what we do is just theater, and for many orgs and many "pros", this may very well be true. At the root of it all though, you could say our job is to ensure the Confidentiality, Integrity and Availability (classic CIA triad) of data/systems, keeping in mind the balance/tradeoffs between security needs and business requirements. To do so, we employ a variety of tactics, techniques, tools, methodologies, frameworks, etc... Another way to boil down what security folks do is in the lens of "risk". Most business and IT decisions in general come down to risk-based decision making and security is no different. Security teams should understand the risk introduced by the threat landscape coupled with the respective data, attack surface, business assets, etc... to help inform the business how to reduce security risk to acceptable levels.

    Hopefully this answer isn't too vague and non-answer-ey!

  • Mentorship Monday - Discussions for career and learning!

    Jump

  • Titles in the security world are kinda a mess. Generally I just look for "-security engineer" titles. So in this case you would probably find "Cloud Security Engineer" or something. Look for security engineer roles that have anything cloud-related in the job req and you are probably on to something.