I can haz job?

[lucid]

Many of you here have jobs working as sys admins, network admins, security analysts/researchers, etc. I am completely eluded by the process which one must go through in order to get a job in this field. Obviously I don't just walk in and grab a little application like at Burger King .

Of course I'm sure most of you are going to tell me that you got lucky and stumbled upon some random dude at a strip club who you then somehow started a conversation about hacking with, and he found out that you can "pwn shit real hard!" so he gave you a job.

But for those of us who aren't super lucky, I want to know how you get a job in the network/security field..... with a high emphasis on security.

[lucid]

Thanks that's helpful. Unfortunately I'm moving to a relatively small town with few jobs. Should I be looking on linkedin or some shit?

[Z3R0]

Sadly, moving to a small town limits your possibilities of places to work down to schools, hospitals, banks, and the state/township. Good luck

This. Don't be afraid of the big city brah. It's quite fun!

[Kulverstukas]

Well I work in tech support for a university, not exactly infosec, but I get to code shit, do network stuff and whatnot, basically mean dream job. And tbh, I got it by accident a friend's friend was leaving and was looking for a replacement. I am forever in debt to him

I tried to find a job that would fit my skillset but that didn't turn out very well, but I only went to like 2 interviews until I was offered my current job.

I'd say making a neat looking resume, getting people to know you, making a good portfolio (a website with your work, a blog perhaps)

[lucid]

In order to more properly assist you, could you post your skillset and your actual desired position/ideal position. For example if you wanna be a Security Consultant (aka, but improperly referred to as a "Pentester") but your offensive security skills are abhorrent it would allow me to better determine what to suggest you to go learn/improve upon.

I guess I'm looking for a security analyst/consultant position. So... pentesting for the laymen. As far as skills go... idk, I guess I just suck. I am a novice coder and really the only thing I could code anything semi-decent in at all would be PHP. Even so, I wouldn't say I'm "good" with PHP. I coded a PHP webshell that looks really cool, but doesn't have a lot of more advanced features of other shells. It's around the forums somewhere, and also on my github. I know plenty about networks and security in theory, I'm going to be taking my Sec+ exam soon and I have confidence that I will pass. Sadly my practical experience is severely limited. I've been attempting to set up a lab at home(as you know), and failing miserably due to the fact that life simply won't allow me to obtain any sort of worthwhile gear. As soon as I obtain something, something else breaks coincidentally. I was hoping to gain a large amount of security and networking hands-on experience that way but...

Awhile ago you posted something about how it's funny that I was trying to build a lab, and that when you were learning you just hacked IRL boxes and whatnot. I suppose that's what I should be doing but I am sometimes devoid of ideas/targets/whatnot, aside from breaking into wireless networks and doing a whole lot of recon and enumeration and other shit.

I'd have to say that my strongest area is that of linux use, but I'm obviously no pro.

So there's my sad and lacking skillset. So yeah, my skills are pretty much abhorrent then. Perhaps I should go work at Burger King instead 

[Kulverstukas]

Perhaps I should go work at Burger King instead

Yeah perhaps that would be the best thing for you

[lucid]

I suppose I was being a little negative yesterday. Bad day. Anyway, looks like I do fit most of that criteria. As far as security knowledge goes I believe I do have more then the average computer geek I think. Again, unfortunately my knowledge of the theory is more in depth then my actual hands-on experience.

Never should have gone to fucking school. Wasted all my time doing dumb homework, and being taught shit that I already knew, so I didn't have a lot of time to do the things that I REALLY wanted to do.

I'd actually say that I have a pretty strong understanding of networking protocols and concepts. Also maybe a little more so then the average computer geek. I know that I definitely know more about networking then 99% of the new members who join and say they have "networking" knowledge.

Obviously I know how to use a variety of security related tools, including the majority of the ones you've mentioned. Never really used Paros but hey, there's always time. I could certainly spend more time with IDS/IPS devices and the like, but I've actually done a fair amount of hands-on work with that at school.

I'm already learning ruby and loving it, although since my laptop took a shit I've been stuck borrowing my girlfriends laptop, so there's not a vast amount of things I can do on her shit. I'm also already learning assembly with hopes of moving on to reverse engineering and shellcoding. Loving asm by the way, and I think I'm taking to it rather well, although I can't do anything with it quite yet. Didn't start all that long ago.

On top of that, I happen to be an extremely fast learner(people are surprised when I tell then how long I've been into computers/security), and if I could manage to find a good solid couple months to buckle down and practice, I know I could become much better, probably a lot faster then the next guy. The trouble is actually making that happen.

PM me if you are at all interested in a private tracker invite. You've been incredibly helpful.

[proxx]

I suppose I was being a little negative yesterday. Bad day. Anyway, looks like I do fit most of that criteria. As far as security knowledge goes I believe I do have more then the average computer geek I think. Again, unfortunately my knowledge of the theory is more in depth then my actual hands-on experience.

Never should have gone to fucking school. Wasted all my time doing dumb homework, and being taught shit that I already knew, so I didn't have a lot of time to do the things that I REALLY wanted to do.

I'd actually say that I have a pretty strong understanding of networking protocols and concepts. Also maybe a little more so then the average computer geek. I know that I definitely know more about networking then 99% of the new members who join and say they have "networking" knowledge.

Obviously I know how to use a variety of security related tools, including the majority of the ones you've mentioned. Never really used Paros but hey, there's always time. I could certainly spend more time with IDS/IPS devices and the like, but I've actually done a fair amount of hands-on work with that at school.

I'm already learning ruby and loving it, although since my laptop took a shit I've been stuck borrowing my girlfriends laptop, so there's not a vast amount of things I can do on her shit. I'm also already learning assembly with hopes of moving on to reverse engineering and shellcoding. Loving asm by the way, and I think I'm taking to it rather well, although I can't do anything with it quite yet. Didn't start all that long ago.

On top of that, I happen to be an extremely fast learner(people are surprised when I tell then how long I've been into computers/security), and if I could manage to find a good solid couple months to buckle down and practice, I know I could become much better, probably a lot faster then the next guy. The trouble is actually making that happen.

PM me if you are at all interested in a private tracker invite. You've been incredibly helpful.

Sounds like some positive energy
Just wanted to say that if you need some help on networking topics I am here to help.
We could do some more sessions with the sketchpad stuff.

[azayzel]

Best thing you can do to get the job you want is scout what's available and ensure you're making contacts and following up.  Employers know that having an experienced red team member just fall into their lap is not going to happen, so they're willing to let you develop your skills, provided you have something to start with and a drive to improve them.  Certifications... quite frankly I thought they were just BS for ppl to hang on the wall and brag about, but the reality is that they are what employers consider when hiring.  You can have experience at pen-testing, building networks, coding, etc., yet without any type of certification, the potential employer sees you as a stagnant product not willing to improve or grow.  Almost every IA job requires a Security+ cert, or equivalent, then there is the CISSP, but you're required to have a certain amount of experience for that.  I see a lot of kids want the CEH, but while it's something cool to have, I have yet to see an employer looking for that qualification.

The cert just gets you in the door, then you better be able to back it up at the interview.  Be confident, but not cocky or disrespectful.  Let them know the skills you have and where you want to take them, but if you're interviewing for a Web Design job, don't brag about your l33t hax0r skills or ability to break systems.  Lastly, know some info about the company you want to work for.  Impress them with your research and willingness to go above and beyond.  I've seen people with little to no skill get hired simply because they gave a good interview... it was amazing just how little they knew too.  Finally, just because you got the job doesn't mean you can be lazy.  I fired quite a few college hires that started out good but got cocky (pissed people off) or lazy (never wanted to put any effort into projects assigned to them).  The guy that took my university position when I moved was/is a total slacker.  He's pretty much just warming the chair until the guy who hired him moves along and then he'll have no cover.

Anyway, don't tldr this.  Most of it should be common sense and the rest will get you a job.  Be confident, don't be complacent, and never stop learning.  Good luck!