Part 1 of 2 - Nick Jeswald has been an external and internal recruiter in security. He shares with us what he looks for in a candidate, common mistakes made by candidates, and the nuances of hackers he's learned over the years.

BIO:

I've been in infosec for 8 years, and in various IT roles since 1996 (Developer -> Sales Engineer -> BD Specialist -> Security BD -> Security Recruiting -> Dir. Corp Dev). However, I've also been one of the top recruiters for each company I worked at whatever role I've had.

Show Notes:
Internal recruiters != external recruiters

Backgrounds are different

External recruiters come from varied backgrounds, virtually zero from infosec

Much like BD people
Internal recruiters are more likely to have a greater understanding of infosec or at least IT
A recruiter that doesn't understand security is more likely to make bad placements with higher turnover
Motivations are far different

I want to choose people to spend a career with
They want to make a commission and meet SLAs
Attention to detail is very different

A tiny detail that could betray a hidden skill set or flaw would likely be overlooked by a 3rd party
I have an interest in understating the person, not just the resume

What is their desired career/life trajectory?
How will our company enrich/hinder that life?
You are in competition with an army of low-skilled counterfeits

You need to be able to demonstrate raw skills, not just list your certs
Have a body of work available for review on GitHub, your own site, etc.
Internships are a nice touch, but they cut both ways

You interned with unnamed-big-4-biz-consulting firm? Don't drag that culture in here. I fear for what you learned.
Can't talk about where you interned because it was a non-DOD three-letter agency? Communicate that point to me in your way. If that is the truth, I'll trace you back and verify.
Always be client-facing

I have seen many recruits passed over for poor hygiene, arrogant treatment of interviewers, disclosure of illegal activity, and just generally obnoxious behavior

You couldn't act like this on a client site and not get sent home; don't do it on the interview
Yes, you are talented...there's always someone cooler than you
Interview your interviewers

You should have a standing list of questions for interviewers

Why do you stay with them?
What is the intended growth path? Organic? IPO? Channel?
Is there any merger/acquisition activity going on? Planned? Intended impact?
Is there any rebranding activity going on? Planned? Intended impact?
What conditions are driving this open role? Turnover? Internal restructuring? Organizational growth?
Will I be supported in my security research? How?
Does your company have a defined mentoring path? Why not?
How does the company support continuing infosec education?
Meet your team

Watch the team interaction closely
Can you see cohesion? Are they supportive or adversarial? Are they authentically happy with their jobs?
Understand the org chart you are stepping into

To whom does security answer? CXX? IT Director? General Counsel?

Understanding this will help mitigate surprises later
Understand the company culture

Big corp? Big corp problems.
Boutique? Founder problems.
Is there a "treehouse" mentality among the senior employees?
Never forget who you are

I know you want a job, but don't take a job that is sure to kill you slowly from the inside

Like doing offensive security? Don't start in the SOC.
Did you walk away from the interview(s) thinking that this company understands the care & feeding of hackers?
If you can already see the point at which you will outgrow the company, is it the right place to start?

Maybe! If you have a goal of entrepreneurship, or of working for a specific team, this first step just needs to support that eventual goal. This may be detected by an astute interviewer, though.

Resume tips
One page.

My dad started at the bottom, and worked up to EVP of a Fortune 50 corp. One page.
Focus on your work experiences and extracurricular infosec workrelevant
I'd rather read about 0days and CVEs than certs
I want to know about your community involvement

2600, local DCs, TOOOL, OWASP, etc.
Presentations at cons matter to me, especially if I can watch you deliver information to an audience

Like a free audition, and believe me I watch every one people link in resumes
I don't care about your GPA, fraternity/sorority, who we know in common, what sports you enjoy, or what you look like. At all.

Seriously, don't add a photo.

General tips
Code in several languages.

Despite semantic differences, you should have a pretty good working knowledge of the most widespread VMs, coding languages, and compilers
Web apps are your paycheck

Knowing the OWASP Top 10 is like knowing your middle name...not impressive in and of itself, but if you don't know them, there's something wrong.
Many composite "red team" projects will involve some Web app hacking, and even the most specialized consultancies will agree to a Web app assessment for an established client
Think holistically, and make yourself more valuable

If you can't write a report, of what value are your assessment activities?
Seem always to have interpersonal conflict? Time to read up on Empathy and EQ. Be the go-to on your squad.
Get comfortable with an audience. Toastmasters is there for you.
Learn the value of "the Halloween Mask" as Henry Rollins called it

Sure, you're a young security professional. We all expect eccentricity from you. We're all also trying to make money and be taken seriously

Don't forget: in boardrooms of white-haired old men across the nation, we're still the same guys who lost them millions of dollars on ERPs and useless Y2K preparations
I'm not kidding about this.
Don't wield your difference like a blunt object. A little bit goes a long way when you're also scaring the hell out of everyone with pen test reports.
My life is far more complex and wacky than my coworkers know, and I talk a lot. I just know how much to let through the mask

Getting Into Infosec:
Follow Me on Twitter: https://twitter.com/coffeewithayman
Subscribe To YouTube: https://www.youtube.com/channel/UCg6gV_gdfc188HZdN8LUx4A
Checkout My Book: https://amzn.to/2HP2i25
Sign up for updates and commentary: https://mailchi.mp/467573a314e5/gettingintoinfosec
Website: https://gettingintoinfosec.com

Part 1 of 2 - Nick Jeswald has been an external and internal recruiter in security. He shares with us what he looks for in a candidate, common mistakes made by candidates, and the nuances of hackers he's learned over the years.
BIO:
I've been in infosec for 8 years, and in various IT roles since 1996 (Developer -&gt; Sales Engineer -&gt; BD Specialist -&gt; Security BD -&gt; Security Recruiting -&gt; Dir. Corp Dev). However, I've also been one of the top recruiters for each company I worked at whatever role I've had.
Show Notes:
<ul>
<li>Internal recruiters != external recruiters
<ul>
<li>Backgrounds are different
<ul>
<li>External recruiters come from varied backgrounds, virtually zero from infosec
<ul>
<li>Much like BD people</li>
</ul>
</li>
<li>Internal recruiters are more likely to have a greater understanding of infosec or at least IT</li>
<li>A recruiter that doesn't understand security is more likely to make bad placements with higher turnover</li>
</ul>
</li>
<li>Motivations are far different
<ul>
<li>I want to choose people to spend a career with</li>
<li>They want to make a commission and meet SLAs</li>
</ul>
</li>
<li>Attention to detail is very different
<ul>
<li>A tiny detail that could betray a hidden skill set or flaw would likely be overlooked by a 3rd party</li>
<li>I have an interest in understating the person, not just the resume
<ul>
<li>What is their desired career/life trajectory?</li>
<li>How will our company enrich/hinder that life?</li>
</ul>
</li>
</ul>
</li>
</ul>
</li>
<li>You are in competition with an army of low-skilled counterfeits
<ul>
<li>You need to be able to demonstrate raw skills, not just list your certs</li>
<li>Have a body of work available for review on GitHub, your own site, etc.</li>
<li>Internships are a nice touch, but they cut both ways
<ul>
<li>You interned with unnamed-big-4-biz-consulting firm? Don't drag that culture in here. I fear for what you learned.</li>
</ul>
</li>
<li>Can't talk about where you interned because it was a non-DOD three-letter agency? Communicate that point to me in your way. If that is the truth, I'll trace you back and verify.</li>
</ul>
</li>
<li>Always be client-facing
<ul>
<li>I have seen many recruits passed over for poor hygiene, arrogant treatment of interviewers, disclosure of illegal activity, and just generally obnoxious behavior
<ul>
<li>You couldn't act like this on a client site and not get sent home; don't do it on the interview</li>
<li>Yes, you are talented...there's always someone cooler than you</li>
</ul>
</li>
</ul>
</li>
<li>Interview your interviewers
<ul>
<li>You should have a standing list of questions for interviewers
<ul>
<li>Why do you stay with them?</li>
<li>What is the intended growth path? Organic? IPO? Channel?</li>
<li>Is there any merger/acquisition activity going on? Planned? Intended impact?</li>
<li>Is there any rebranding activity going on? Planned? Intended impact?</li>
<li>What conditions are driving this open role? Turnover? Internal restructuring? Organizational growth?</li>
<li>Will I be supported in my security research? How?</li>
<li>Does your company have a defined mentoring path? Why not?</li>
<li>How does the company support continuing infosec education?</li>
</ul>
</li>
</ul>
</li>
<li>Meet your team
<ul>
<li>Watch the team interaction closely</li>
<li>Can you see cohesion? Are they supportive or adversarial? Are they authentically happy with their jobs?</li>
</ul>
</li>
<li>Understand the org chart you are stepping into
<ul>
<li>To whom does security answer? CXX? IT Director? General Counsel?
<ul>
<li>Understanding this will help mitigate surprises later</li>
</ul>
</li>
</ul>
</li>
<li>Understand the company culture
<ul>
<li>Big corp? Big corp problems.</li>
<li>Boutique? Founder problems.</li>
<li>Is there a "treehouse" mentality among the senior employees?</li>
</ul>
</li>
<li>Never forget who you are
<ul>
<li>I know you want a job, but don't take a job that is sure to kill you slowly from the inside
<ul>
<li>Like doing offensive security? Don't start in the SOC.</li>
</ul>
</li>
<li>Did you walk away from the interview(s) thinking that this company understands the care &amp; feeding of hackers?</li>
<li>If you can already see the point at which you will outgrow the company, is it the right place to start?
<ul>
<li>Maybe! If you have a goal of entrepreneurship, or of working for a specific team, this first step just needs to support that eventual goal. This may be detected by an astute interviewer, though.</li>
</ul>
</li>
</ul>
</li>
</ul>
Resume tips
<ul>
<li>One page.
<ul>
<li>My dad started at the bottom, and worked up to EVP of a Fortune 50 corp. One page.</li>
</ul>
</li>
<li>Focus on your work experiences and extracurricular infosec workrelevant</li>
<li>I'd rather read about 0days and CVEs than certs</li>
<li>I want to know about your community involvement
<ul>
<li>2600, local DCs, TOOOL, OWASP, etc.</li>
<li>Presentations at cons matter to me, especially if I can watch you deliver information to an audience
<ul>
<li>Like a free audition, and believe me I watch every one people link in resumes</li>
</ul>
</li>
</ul>
</li>
<li>I don't care about your GPA, fraternity/sorority, who we know in common, what sports you enjoy, or what you look like. At all.
<ul>
<li>Seriously, don't add a photo.</li>
</ul>
</li>
</ul>
General tips
<ul>
<li>Code in several languages.
<ul>
<li>Despite semantic differences, you should have a pretty good working knowledge of the most widespread VMs, coding languages, and compilers</li>
</ul>
</li>
<li>Web apps are your paycheck
<ul>
<li>Knowing the OWASP Top 10 is like knowing your middle name...not impressive in and of itself, but if you don't know them, there's something wrong.</li>
<li>Many composite "red team" projects will involve some Web app hacking, and even the most specialized consultancies will agree to a Web app assessment for an established client</li>
</ul>
</li>
<li>Think holistically, and make yourself more valuable
<ul>
<li>If you can't write a report, of what value are your assessment activities?</li>
<li>Seem always to have interpersonal conflict? Time to read up on Empathy and EQ. Be the go-to on your squad.</li>
<li>Get comfortable with an audience. Toastmasters is there for you.</li>
</ul>
</li>
<li>Learn the value of "the Halloween Mask" as Henry Rollins called it
<ul>
<li>Sure, you're a young security professional. We all expect eccentricity from you. We're all also trying to make money and be taken seriously
<ul>
<li>Don't forget: in boardrooms of white-haired old men across the nation, we're still the same guys who lost them millions of dollars on ERPs and useless Y2K preparations</li>
<li>I'm not kidding about this.</li>
</ul>
</li>
<li>Don't wield your difference like a blunt object. A little bit goes a long way when you're also scaring the hell out of everyone with pen test reports.</li>
<li>My life is far more complex and wacky than my coworkers know, and I talk a lot. I just know how much to let through the mask</li>
</ul>
</li>
</ul>
Getting Into Infosec:
<ul>
<li>Follow Me on Twitter: <a href="https://twitter.com/coffeewithayman">https://twitter.com/coffeewithayman</a></li>
<li>Subscribe To YouTube: <a href="https://www.youtube.com/channel/UCg6gV_gdfc188HZdN8LUx4A">https://www.youtube.com/channel/UCg6gV_gdfc188HZdN8LUx4A</a></li>
<li>Checkout My Book: <a href="https://amzn.to/2HP2i25">https://amzn.to/2HP2i25</a></li>
<li>Sign up for updates and commentary: <a href="https://mailchi.mp/467573a314e5/gettingintoinfosec">https://mailchi.mp/467573a314e5/gettingintoinfosec</a></li>
<li>Website: <a href="https://gettingintoinfosec.com/">https://gettingintoinfosec.com</a></li>
</ul>

Interviews with people who have transitioned and got jobs in #infosec and #cybersecurity so you can learn and be inspired from their experience. There is no linear path into the field of Information Security, so the hope is that you will resonate with at least one of the guests. Some of my guests were teachers, paralegals, librarians, military vets, developers, and IT help desk techs (to name a few) before transitioning. Also featuring "spoof" ads poking fun at the industry.

Interviews with people who have transitioned and got jobs in #infosec and #cybersecurity so you can learn and be inspired from their experience.

Getting Into Infosec

Part 1 of 2 - Nick Jeswald has been an external and internal recruiter in security. He shares with us what he looks for in a candidate, common mistakes made by candidates, and the nuances of hackers he's learned over the years.

Advertisement