How to get a job in Cyber... Security... Cybersecurity.

The good old days when things weren't so complicated, chatters just ignored things instead of getting upset.

Getting your foot in the door with cybersecurity is challenging, especially now. You may be just graduating from college, or a veteran transitioning to the private sector, or you’ve worked in other areas of IT, or maybe you’re just self-taught. There's a lot to be learned about cybersecurity hiring. I’ve written and published books on this topic, and here, I will try to be brief.

The first thing to know is what jobs in cybersecurity are considered entry-level. The answer is complicated. If you’re coming from other areas of IT, then you may already have overlapping experience in one of the domains in cybersecurity that you could pivot into. If you have worked in intelligence or cyber ops in the military, you will have more options available. But suppose you’re self-taught or fresh out of college and looking for your first professional job. In that case, there is only one clear winner: the Security Operations Center Analyst (SOC analyst).

So let's break down the SOC analyst role and why it is a good starting point.

When companies embrace the need for cybersecurity, it usually begins with the Security Operations Center, or SOC for short. The SOC is responsible for triage, investigation, and response to cybersecurity incidents. This concept is not new. Military and law enforcement agencies have used Tactical Operations Centers to coordinate conflicts for decades. Like the TOC, the SOC serves as the command and control hub for first responders to cybersecurity incidents.

Definition: A cybersecurity incident is an adverse network event in an information system or network or the threat of the occurrence of such an event according to the SANS institute.

This article aims to prepare you to become a SOC analyst. Whether you wish to join one of the many specialties of cybersecurity or work your way up to management, the SOC analyst profession has the lowest barrier to entry for cybersecurity. Becoming a SOC analyst is an excellent strategic position to get your start in the industry.

When staffing a SOC, hiring managers continuously face a few challenges. The most prevalent of those challenges is the SOC's revolving door.

After a SOC manager is hired for an open position, it takes several months to train the new analyst. Once training is complete, retention becomes a problem as SOC analysts begin to want more after they become comfortable in their position. They want that coveted six-figure mark.

One of the most common upward paths is becoming a senior SOC analyst. The “senior” title comes with better pay and additional responsibilities, such as mentoring the junior analysts who join the SOC. Senior SOC analysts also handle more complicated work, as junior analysts will escalate challenging items to their seniors to resolve. Being in this position allows an analyst to become more technical and will enable them to learn how to train and mentor others. This role is an excellent way to become a SOC manager, grooming them for their next leadership role in the SOC. The senior SOC analyst pays over six figures almost everywhere in the United States. Becoming a Senior SOC Analyst usually takes 1-2 years after becoming a SOC analyst.

As a new SOC analyst, set stretch goals for yourself to reach this milestone. However, that leaves the hiring manager with your spot open again!

Another problem that SOC managers struggle with is burnout or alert fatigue. An example of this could be when analysts investigate so many alerts that something important is overlooked or “lost in the noise.” SOC analysts usually work in shifts with 10—or 12-hour days, sometimes evening and overnight shifts, and at some point, the task might seem fatiguing. It’s easy to get complacent when the work becomes second nature and can get monotonous. Most everyone in an SOC is brilliant and constantly needs to be challenged.

The third challenge that SOC managers face is that the SOC is a 24/7/365 operation, which means they need coverage outside regular business hours and on holidays. Many international companies utilize the “follow the sun” SOC model. That is when companies build three SOCs in different geographical locations for 24-hour coverage. Typically, companies will have a SOC in the United States, a second in Singapore or Australia, and a third in India or Europe. However, there are use cases where companies require analysts from a specific nationality to work with their data. It’s especially true in staffing a Managed Security Services Provider (MSSP).

Figure 1–2: Follow the Sun Model: US/India/Singapore

Hiring for early morning and overnight shifts is not an easy task, and the people who fill them don’t stay for long before wanting to move to regular business hours. Tyler’s first security job was working as a second-shift analyst in a SOC at an MSSP. He was in a life position where it worked well for him. He had a base salary and was offered a small shift differential for the second shift. He was freshly out of college, and who needed to wake up before noon anyway? He credits his career to making that sacrifice because it gave him invaluable experience that still serves him today. He decided to take his expertise and run after only a year. It was a hard decision because it was a great company, but he couldn’t wait for a day shift to open up. The night hours started to take a toll. It is nobody’s fault, but it is another challenge of the SOC revolving door.

Now that you know the challenges of hiring and retaining SOC analysts and why the position frequently opens up, let’s discuss what hiring managers are looking for in an SOC analyst.

Four areas make a well-rounded SOC analyst.

• High-Level Concepts

• Hard Technical Skills

• Business Acumen

• Culture Fit

High-Level Concepts

Everyone should know the high-level concepts for cybersecurity experts and anyone in a professional capacity. What are things like the separation of duties, the least privilege, and the CIA triad? These are fundamentals in cybersecurity, and the best place to learn is CompTIA’s Security+ Certification. It is long-standing and well-regarded as the minimum standard for entry-level cybersecurity.

It should be very structured, and maybe even boring for high-level concepts, as it's the same information we all get and know (and repeat). Any one of Udemy’s courses for Security+ would be a good start.

I wrote an introductory to SOC Analyst Prerequisite Skills that serve as fundamentals for what you need to know as a SOC Analyst, the gateway to cybersecurity.

Hard Technical Skills

Hard technical skills are harder to come by. It's all about projects, projects, projects. They don’t all have to be boring. I have three SOC Analyst Projects inside the course, SOC Analyst NOW!, that are fun and practical.

They are extremely popular in all circles, including LinkedIn.

Since everything is moving to the cloud and having cloud exposure is very advantageous, I created a fun project for you to do in the cloud in this free article.

Pair this with the SOC Analyst Method found in JYSAC and practice security analysis.

Business Acumen

Cybersecurity is a glorious customer service job. Customer service is a massive part of the job. Knowing how to say bad things in a good way will be an essential part of your job. That's where framing comes in.

There is a wide variety of cybersecurity tasks. Because all security-related tasks are essential, they must be prioritized appropriately on a case-by-case basis. Determining which elements are crucial now can be difficult without understanding the business as a whole.

In an SOC queue, a big part of someone’s job is prioritizing the work for you, but as you become more senior, that will become more and more a part of your own job. I like the Eisenhower matrix for prioritizing tasks. It's simple, fast, and crazy effective. Check out this video we made.

The Eisenhower Decision Matrix

Most of us in cybersecurity work from home at some capacity, and it's an essential part of your career to learn how to communicate with people remotely. That is, knowing how not to isolate yourself while you are at work when you are working from home. Watch this video of ours for tips.

Culture Fit

Here at Cyber NOW Education, we love the SOC. We love everything about it, including this unique but strangely not unique culture that comes along with it. After spending time in the SOC, you will realize how rewarding it is to be on the front lines.

There is so much action; we want you to love it like we do. Whether you lean hard left, right, or right down the middle, there are companies for you. I’ve worked on both sides of the spectrum and found hard left companies tend to rely on psychology a lot in management style, and hard right companies are more direct to your face, but make no mistake, they both are capitalistic at their very core. It's so important to find a boss you like, and it's often not until you’re there that you really find out if you’re a good culture fit.

It takes practice to be a general culture fit, but after a while, you’ll catch things like this:

You’ll also have a nice little chuckle when you see that FedEx's logo has an arrow for all the packages it delivers. That's what being an analyst is all about.

Now you understand what makes a qualified SOC analyst. You need a mix of hard technical skills, a company with the right culture for you, some business acumen, and you need to be able to recite all of the fundamental cybersecurity concepts.

Traditionally, a candidate would have a bachelor’s degree and Security+ certification before employment. Recently, the competition has gotten fiercer. There seems to be a bunch of folks wanting to make their way into cybersecurity right now, and these people are doing a lot.

It's important to note that fewer companies require degrees as time goes on because fewer people who graduate from college have the skills needed to do the technical entry-level work of an SOC analyst.

Developing the skills you need takes a while, and you have to practice independently. Just you, the computer, Google, a few projects, online courses, and long romantic nights alone with your keyboard.

I will tell you how to do this the easy way, but it does take time.

Online Courses

You don’t need to spend much money on online training if you can have patience and keep an open mind. Things might be less spoon-fed to you, and there might be some mistakes in the curriculum, but it requires you to think. Hop on over to Udemy and pick out a nice Security+ course. Cybersecurity fundamentals don’t require you to be hands-on with a keyboard, so you can watch these modules independently. Before you go to bed every night, lie and watch a couple of modules. I watched it on my TV and ate dinner on a tray. A month goes by, and batta bing batta boom, you have a new certification, and it wasn’t even hard at all. Didn’t cost much either. Just takes a little persistence.

Projects

You do need to have significant hands-on keyboard muscle memory with a few things. Systems fundamentals is one, and networking is another. It's best if you focus these efforts in the cloud. By the time you’re getting a job in cybersecurity, infrastructure will mostly be in Amazon, Azure, or GCP - mostly Amazon and Azure for large organizations.

You must spin up a few honeypots, create VMs, configure access groups, and play around with things. In the articles linked above, you can spin up two projects in the cloud, one of which is the 30m Azure Honeypot project that is super fun and relatively easy to do as an introduction. Play with it some, explore the attacks, Google around, and ask yourself questions and answer them.

I want you to study the data. Use the 5-step SOC Analyst Methodology found in JYSAC and write sample tickets. If you don’t like doing this, you won’t enjoy being an SOC analyst much. Being an SOC analyst is about being curious about how things work and why they happen. Not everyone starts out with this curiosity, but it can be cultivated if you make it intentional to be investigative.

You’ll probably be curious for the rest of your career and life. Curiosity will change the way you think; if you pursue it long enough, it will change your life and open up a new esoteric world of creativity.

Competitions

This article wouldn’t be complete if we didn’t take a minute to talk about capture-the-flag (CTF) competitions. Capture the flag has been around since the beginning, and it started with vulnerable applications and systems with a text string hidden inside them. The participant finds the text string and submits it to the judges, and they get points for every proof they’ve hacked. It started in 1996 at DEF CON, and today, it has evolved into various capture-the-flag challenges inside and outside of conferences. In fact, Tyler’s favorite challenge is the DEF CON Blue Team Village capture-the-flag, but he has competed in Ghost in the Shellcode, SANS Netwars, Holiday Hack, CSAW, and was a mentor for high schoolers for the CyberPatriot program. Tyler was never really fantastic at them, but always competed on a team, which was the fun. Most bigger conferences other than DEF CON will have their own capture-the-flag competitions. For instance, the Splunk conference, Splunk.conf, hosts a popular capture-the-flag called BOTS for Boss of the SOC, which is very challenging and popular. If you are in college, there are many student-oriented capture-the-flag competitions, and perhaps the biggest one that should be on your radar is the Collegiate Cyber Defense Competition (CCDC).

Medium

You need to start building a brand as a cybersecurity expert, so Medium is where you need to go to start doing it. I’m not asking you to do something I haven’t done ten years into my career. Creating a blog can be one of the most rewarding things any professional can do. Not only does Medium have a huge built-in audience of technology professionals, but teaching and writing about a topic also improve the retention of information. You’ll find out sooner or later that you lose the information if you don’t use it. Teaching something to someone else helps you retain that knowledge for longer. Choose a few topics on the SOC and cybersecurity, maybe about your latest project or something you’ve studied that you’ve found interesting, and teach them. One of your audience members might be your new manager! Please write at least two weekly articles and share them on all your social media outlets, including LinkedIn. Every time you finish a course, write about what you’ve learned. Every time you finish a project, teach others how to do it. Write about your journey to finding a SOC analyst job.

And always remember to learn, do, teach to retain.

A blog will establish you as someone who knows something about cybersecurity. Leave a banner at the end of every Medium article connecting to your LinkedIn profile. This way, any person interested in you can reach out and connect!

Once you have attended a few meetings and are blogging, you can build a network of like-minded community members to associate with. Make friends quickly, they are going to be vital in your career. You really can’t do cybersecurity alone with much success.

Now that you’ve made it this far, you’re now qualified. How in the heck do you find a SOC analyst JOB?

Where to Search for Jobs

The Information Security world has embraced social media to locate and recruit top talent, with LinkedIn standing out as a clear place to start. Not only can you find job postings, but you can also get connected with headhunters and recruiters looking to find top talent. LinkedIn offers a premium subscription that can be used to find and connect with recruiters. They offer free trials of LinkedIn Premium, and I highly recommend using it when searching for a job.

If your LinkedIn profile is uninteresting, you will not attract the attention you need, no matter how good your cybersecurity knowledge. Other than putting your certifications and credentials in the headline, there are a few tips to keep in mind.

LinkedIn Profile Tips

LinkedIn is not the only website to consolidate job postings; Indeed and Monster are worth investigating, too. Once you’ve accumulated a few technical certifications, sites like Credly.com have job boards that are looking for talented people with those certifications.

Finally, you can’t go wrong by looking at the careers section of a company’s website. This will show you what open positions are available and provide you with insight into what they are looking for in an applicant.

Note: Don’t be afraid to apply even if you don’t meet all of the requirements in the job posting. To quote the great Wayne Gretzky, “You miss 100% of the shots you don’t take.”

Applying for Jobs

I would like to explain to you how to perform a job hunt. First off, you need to get your resume together. It takes a lot of trial and error to perfect a resume, but a professional can also help you build a good one. A resume can take form in many styles, but it will have the same basic information:

Resume Components

Keep your resume to under three pages to prevent readers from over-skimming. The benefit of having a professional resume writing service, like our service, is that they will share a document with you and probe you with questions until they get all of the information out of you about your previous experience, and then write it in a way that is quickly and easily consumed.

Once your resume is together, you can search for a job. Several job posting websites have proven successful for us; however, I have had the most success with LinkedIn. When searching for a job, I usually purchase their premium membership to see the statistics for each job I am applying for, send InMail messages to hiring managers or recruiters for a company I am interested in, and see who is looking at my profile. Also, Google has a good aggregation of jobs to search through. Using Google, you can set up and configure job alerts specifically for cybersecurity jobs.

The SOC analyst position is the job that will allow you to land the easiest first step into information security. There is a revolving door in most SOCs, and the position for a SOC analyst opens frequently. The titles that you want to look for first are:

SOC Analyst Job Titles

If you are mobile and can move anywhere, your odds of finding a good fit quickly are better. If you live far outside of a big city, then your options may be more limited. Most SOCs require you to be on-site for security purposes. During COVID, everyone moved remote, and now more companies are returning to a hybrid work model.

You’ve got your resume together now, and you know how to apply for jobs. You have a network of colleagues because you’ve been attending meetings and getting involved in the community. You’ve provided them with your resume and asked them to refer you to any open position they have, and you’ve kept in touch with them just to chit-chat. You have some projects and a blog to show your progress on your road to cybersecurity success.

You have a portfolio now.

Include the link to your blog on your resume so that the hiring manager invests time in you as a candidate and reads about your story and your projects.

You’re likely to get an interview now.

Whew, that's a lot to get an interview! So let's talk about that.

Common Interview Questions

The following is a list of common interview questions that might be asked during an interview for a junior SOC analyst. Some are very basic, and some are harder, but we feel that if you can answer these questions, you have the required knowledge to become a SOC analyst:

• What is an RFC 1918 address?

Do you know them?

• Define a Class A, B, or C network.

• What are the seven phases of the cyber kill chain?

• What is the purpose of the Mitre ATT&CK Framework?

• What is the difference between TCP and UDP?

• What are ports 80, 443, 22, 23, 25, and 53?

• What is data exfiltration?

• What Windows protocol is commonly used for data exfiltration?

• Do you have a home lab?

Explain it.

• What is AWS? Azure?

Explain how you’ve used it.

• What is a DMZ, and why is it a common cyberattack target?

The importance of having technical knowledge cannot be overstated. The above questions are straightforward, but you might be surprised to learn that seven out of ten candidates don’t know the common TCP/UDP ports used by modern services. I highly suggest using a common study guide to prepare for your interview. An example of this is the website Quizlet.com. They provide a flashcard-style learning platform for information technology certifications like Network+ or Security+. Also, Udemy has a few SOC Analyst interview question courses that you can take (I like Udemy).

Despite the need for a basic understanding of information technology, that only covers half of the requirements to be a SOC analyst. An analyst should be a critical thinker and possess the acumen for problem-solving. Interviewers will usually test a candidate’s problem-solving ability with scenario-based questions. Let’s cover some scenarios I’ve seen and used to conduct interviews:

“You are a tier 1 SOC analyst, monitoring the SOC inbox for user-reported incidents. The SOC receives an email from the VP of Human Resources stating they can’t access their cloud drive. The VP knows this is against company policy, but the VP is adamant that this is required for legitimate business requirements.”

Do you process the access request for the VP?

What is your response to the VP?

Who else should you include in the reply email?

“You are monitoring the SIEM dashboard for new security events. A network IDS alert is triggered, and you begin investigating. You see a large amount of network traffic over UDP port 161 originating from dozens of internal IP addresses, all with the same internal destination IP address. Some quick Googling shows that the Simple Network Management Protocol uses UDP port 161, and the byte count of the traffic is minuscule.”

Do you think this is data exfiltration?

If this is not data exfiltration, what legitimate services could cause this alert?

What team could provide an explanation for the traffic?

The first scenario exemplifies what you might be asked when applying for an entry-level analyst role, while the second is a little more advanced. Let’s go over what the interviewer is looking for.

Scenario 1 is designed to identify if the applicant can be easily intimidated by senior leadership in your organization. Information security is the responsibility of all organization members; it should not be waived for the convenience of one senior leader. The larger lesson here is about making risk-based decisions. A junior analyst should never assume the risk of policy exceptions.

The interviewer will ask how the applicant will respond to the VP, as it will showcase their experience with customer service. Customer service is another essential task of a SOC analyst. Whether working for an MSSP or a company's internal SOC, there will be times when interfacing with other teams will require the analyst to show a certain level of tact and professionalism. The third question helps the interviewer understand the analyst's prioritization skills. If an analyst is working with a VP, there is a high probability that there is a procedure around communicating with senior leadership within the organization.

Scenario 2 tests the applicant’s critical thinking and technical knowledge while providing the interviewer insight into the applicant’s investigative reasoning. This scenario also gives insight into the most essential quality of a SOC analyst: if you don’t know the answer, admit it. The SOC team's last need is a “know-it-all”; they are dangerous and toxic to the workplace. If this article teaches you one thing, let it be this lesson. There will be questions you can’t answer, and that’s fine. The worst thing you can do is give a wrong answer with the confidence that you are 100% correct.

Remember that the above scenarios are examples; each interviewer will use their own questions. The goal remains the same: to locate and select the best applicant for the position. Our goal is to assist you in becoming that applicant. The following are a few tricks and tips to help you become the “best applicant” for the position:

Interview Tips

And that covers it.

Summary

We’ve discussed the demand for SOC analysts and why that position is the best strategy for entering cybersecurity. We’ve also talked a bit about the four requirements an entry-level SOC analyst needs to have, how to acquire fundamental knowledge and hands-on technical skills, and how to interview. This is not an overnight process. It is going to take time. No one can walk into an entry-level SOC analyst job without preparing. What I am trying to say is that it's not easy.

But it is worth it. I’ve dedicated my career to helping others find their way into cybersecurity. My courses have served over 25,000 students. I have developed training materials, both paid and free, for the last decade to give back to the community that gave to me. I can’t tell you how appreciative I am to have had the people in my life that I did when I was just starting. They helped me and didn’t expect anything in return, unlike anything I have ever experienced. That is the cybersecurity community, and you’re doing yourself a disservice if you don’t get involved. There are so many communities that I am sure you’ll find your tribe. Find them. Good luck and godspeed!