I got the triad and am going to get the CySA+ within the next few weeks. Has anyone been in this position? Specifically, what would be a step you've taken to put the cherry on top of your 1 scoop vanilla sundae of experience?
Thanks folks
Posted Apr 26, 2021, 10:16 AM UTC
Put something on your resume that will make you stand out CTF or a bug bounty. You don’t have to be an expert just participate and be prepared to answer some questions.
It’s not always true that you need experience what you need is to give them a reason to interview you.
Just apply. There are companies hungry to hire talent. Put that Cysa+ with an expected date of cert on your resume just to get passed HR but just apply. You are already at a point where you can pivot, you just need to go online and start applying.
Oh I'm applying. Like 1-5 applications a day. I do like your idea with the expected cert date.
Find a security as a service company near you, brush up on packet reading, and get an interview.
You will, most likely, be able to leverage your NOC experience to get into a SOC position. I would highlight familiarity with how systems are supposed to be operating during BAU, familiar with escalation process for different severity events, ability to digest structure of corporate network to provide SME recommendations, etc.
I'm caught in the traditional need experience to get experience web. I've been trying mostly Jr SOC analyst positions, but I am not getting any bites of a follow-up. Maybe I will have to redo the bit if my resume to better include those words. I have personable skills, so getting an interview, I believe, would help me significantly, but getting there has been uneventful.
Are you familiar with pay rating? I do wonder if I'm asking for too much. Without much information, I really don't want to leave my job to make the same amount, which I know may happen in the long term, but currently I want to stick to my guns. I will eventually lower request of course, but I feel if a job says x amount of dollars, I should expect to be able to request that. I think it comes down to me not wanting to be in a position where I think I undervalued myself. Doesn't help me, doesn't help the next guy, but the guy before us sure trained payroll to send that rate unfortunately.
TBH one of the best ways to fill that experience gap, if you can do it, is a cyber internship. Even though it will only be a couple of weeks, having that little taste of corporate cyber experience will help you a ton in getting you, at least, to the interview stage.
One of the biggest things right now that I am seeing (I am currently interviewing people for open, internal T2 analyst positions) is the lack of experience/correlative ability between different tools. I.e. I receive an alert for malicious outbound communication. I should check these 3 different security tools and they will each provide me x information about this event.
As far as pay scale goes, I would assume a jr soc analyst is making between 50-60k a year in the US, but it all really depends on your experience. If your a veteran of the workforce, you may be looking at a pay cut to move into the cyber space for entry lvl positions.
Knowing your value is a big part of the negotiation process. I would compare similar positions salaries, match expectations to that, then argue for more of you bring something special to the team.