Getting the job?!

[Ricky]

So far from what I can see HoH has a wide range of people within its community, ranging from young to the not so young. From hobbyists to paid professionals.

There is a question I have, an sure some of the overs (not already in a security related job) would like to ask the people of HoH. That question is.

How did you get into the job? What certs did you get/need? What would you say where a basic need before even looking for such jobs? (I know these question will be answered different from the different type of jobs people have)

Answer form:

Age:

Job title:

Your answer:

[GphreakX]

I am 25, and I work in information assurance for Homeland Security (don't worry, I only care about attacks against the government and its systems, no domestic stuff =). The path I took involved getting my masters under a scholarship called the scholarship for service. They paid me a stipend, and my grad bills, with the agreement I would work for them right after college. Seeing as how they pay me nearly 6 figures starting out, it seemed like a good deal to me. As part of my contract, I had to get three certifications (CISSP, SSCP, and Security+). While there are other certs for different types of security jobs (cisco's certs are solid for network security, SANS makes some good stuff...), the certs from ISC2 are for security managers, and tend to lead to be a requirement for higher paying positions. I am young, and work exclusively for the gov (which I never thought I would do), so my perceptions may be warped on what will get you into the field.

[Technogeek]

38
Information Assurance Engineer
I got into it by working my way from phone tech support into the service desk. Then worked my way over into the Network team and eventually onto the IT security team. I just kept abreast of what was going on in the security world, kept pushing and prodding till I got where I wanted to be.

From there, it was a simple matter of people leaving and presenting my knowledge.

Currently I'm the IAE for a contract agency working at remote sites. If it has to do with network security (NAC/IDS/IPS/Firewall/remediation/scanning/phishing/social engineering testing/etc,) I'm involved with it.

It's a great gig, almost 6 figures a year, but there's a LOT of hours involved. I probably work 60-70 hours a week and could use more. I've got some college background (majoring in information security) and will be seeking a masters degree within the next two years. I've got multiple certifications from DoD which I picked up along the way.

Best thing to do is to start off with the A+, Net+ first. Then work towards the Security+ at the least. After that, MCSE or CCNA. Maybe some of the SANS GIAC certs or others to help you get in the door. The real testament though is to get into somewhere that promotes from within and get knowledge and some good referrals. Those are the biggest things in finding that perfect security job.

[IDE]

@GphreakX respect for this job position, I am 21 and System Engineer , what is your daily effort for this work? I have 4 years to get a equal work position ;).

[GphreakX]

IDE, I am confused what exactly you are asking, but as far as the duties for my job it has to do with security incidents, risk, threats, response, etc.. As far as the details of my job, I can only speak in generalities. It is an exciting field, and in an exciting arena, so if you are really interested in working for a Federal Agency I would look into the SFS program (https://sfs.opm.gov/) and pick a university near you to get a higher education. Most of these agencies (CIA, NSA, DoD, DHS) all look to this program to hire cyber security specialists, so its a great way to get in the door.

[scorcher821]

Age: 18
Job Title: IT Manager
How I got the job: Funny story actually. One time I delivered a pizza to my managers (now ex-manager) home, and he had an MCP shirt on I commented on, and he told me they were in need of a tech guy. Long story short, he got fired and I got his position. Prior to that, I had been working here for about 7 months.

[wishi]

What do you think about this SANS course btw.?
I mean: it's very basic what they do. But on the other hand managers might think unless you din't have the course, you don't have specific knowledge. I don't know...

[dandantheitman]

Stuff like SANS's GSEC course is bread and butter to your IT security companies. A lot of your entry level openings in firms specialising in IT security generally tend to be junior analysts in operation centres. This will provide you with exposure to a lot of the fundamental security technologies: Nessus, Snort, Netcat, NMAP etc.

[Sam Aldis]

Age: 17
Thinking about setting up a UK based security research
company and tiger team.

[cyberpunk]

like GNUCITIZEN? ;]

[missenlinx]

22
Systems Administrator

I've got no certifications and look after about 4 systems 1 of which is a security system for an entire University. I have a diploma in Network Engineering and currently completing Computer Science part-time at University.

I do wish to complete some certifications in the future though.

[City Seven]

Age: 26
Job Title: Software Engineer

At my current employer, my physical title is Software Engineer (about 60%). I only do about 40% of security work. Nevertheless, working for smaller employers rather then huge corporations prove an opportunity to work your way into whatever job your looking for. The bigger the cooperation (usually) is more process and procedure. Smaller companies sometimes give you a chance to implement things, try techniques, and pen test freely. Depending on the type of position would greatly depend on the type of cert that would prove beneficial. When someone applies for a IS/IT job with us, I very rarely look at degrees. I would much rather see experience and maybe a cert or two backing up the position. In my opinion, experience is the key factor in nailing a job with me. Without experience, a certification or two would definitely keep me interested. A degree shows dedication to the field but not necessarily the experience to meet the job description. A basic need would definitely be researching what field interests you the most. After researching, try to find your niche. There are many different levels of security within a business. If your looking at web based security, what type of operating systems/web servers? What type of web applications? What language is it written in? Hope this helps even though its not strictly "security" but rather a more broad spectrum.

[Ricky]

Yer the answer helps alot but there the catch of not having experiences with out a job an you need a job to get experiences and so on.