Episode 26 · · 37 min
Nick Jeswald Confessions of a Cybersecurity Recruiter (Part 1)
Director of Corporate Development at Red Mesa
Episode summary
Part 1 of 2 - Nick Jeswald has been an external and internal recruiter in security. He shares with us what he looks for in a candidate, common mistakes made by candidates, and the nuances of hackers he's learned over the years.
BIO:
I've been in infosec for 8 years, and in various IT roles since 1996 (Developer -> Sales Engineer -> BD Specialist -> Security BD -> Security Recruiting -> Dir. Corp Dev). However, I've also been one of the top recruiters for each company I worked at whatever role I've had.
Before infosec: Developer, sales engineer and external security recruiter
Chapters
- 0:00
Cold open and Ayman introduces Nick
Ayman explains why a recruiter is on the show and how he reconnected with Nick at a DEF CON dinner.
- 2:23
What Nick does at Red Mesa
Nick describes his work in organization development and key accounts at a red teaming consultancy.
- 3:52
Internal vs external recruiters
Nick compares motivations, commissions of up to 20 percent and why he prefers recruiting from the inside.
- 10:24
Common interview missteps
Arrogance and admitting to illegal hacking are the two biggest mistakes Nick sees from candidates.
- 13:41
Meeting in person and not wielding your otherness
Nick warns that appearance can limit client-facing work and that candidates should not hide who they are.
- 16:49
The Halloween mask
Nick explains choosing which parts of yourself to show during hiring while staying true to who you are.
- 22:12
Bias and what a resume should show
He advises no photo, one page and proof of work like CVEs, bug bounty and GitHub over certifications.
- 26:24
Resume gaps from classified work
Candidates from agency backgrounds should flag work they cannot discuss and apply where it is understood.
- 27:37
Advice for entry-level candidates
Learn to code, know the OWASP Top 10, networking and RF, and expect competition from low-skilled applicants.
- 33:00
Starting in a SOC and building offensive skills
Nick says a SOC is a fast way in but warns of burnout and urges joining local hacker groups.
- 35:09
Ayman wraps up Part 1
Ayman notes Nick's red team perspective and points to Part 2.
- 35:58
Closing plug for Ayman's community
Ayman invites listeners to join the new community linked in the show notes.
Key takeaways
- Think about a recruiter's motivation, whether commission and SLAs or long-term fit, to understand how they will treat you.
- Never tell a recruiter about illegal hacking; talk about CTFs, collegiate cyber defense and other legal applied work instead.
- Keep your resume to one page with no photo, GPA or personal details, and lead with CVEs, bug bounty work, GitHub and CTFs.
- Learn to code in more than one language and know the OWASP Top 10 well before calling yourself a pen tester.
- If you start in a SOC, build offensive skills early through local 2600 meetings and DEF CON groups.
- If past work is classified, say it is unable to be shared and apply to companies that understand that background.
Notable quotes
Every single person has a bias, whether or not they want to admit it to themselves or anyone else.
I know the value of the Halloween mask and I don't give away any of myself by wearing the Halloween mask.
you are in competition with an army of low-skilled counterfeits.
Questions answered in this episode
- What is the difference between an internal and an external security recruiter?
- According to Nick Jeswald, external recruiters aim to meet client SLAs and earn a commission, so they push many candidates through quickly. Internal recruiters plan to work beside the hire for years, so they look for long-term fit.
- What should a cybersecurity resume include?
- Nick wants a one-page resume with no photo or personal details. He values proof of skill such as CVEs, bug bounty work, CTF results and an active GitHub more than certifications, GPA or school affiliations.
- Is a SOC job a good way into red teaming?
- Nick says the SOC is the quickest way into security but can lead to boredom if you stay too long. He advises building offensive skills while you work there and joining local 2600 and DEF CON groups.
Show notes and links
Show the original episode notes
Part 1 of 2 - Nick Jeswald has been an external and internal recruiter in security. He shares with us what he looks for in a candidate, common mistakes made by candidates, and the nuances of hackers he's learned over the years.
BIO:
I've been in infosec for 8 years, and in various IT roles since 1996 (Developer -> Sales Engineer -> BD Specialist -> Security BD -> Security Recruiting -> Dir. Corp Dev). However, I've also been one of the top recruiters for each company I worked at whatever role I've had.
Show Notes:
- Internal recruiters != external recruiters
- Backgrounds are different
- External recruiters come from varied backgrounds, virtually zero from infosec
- Much like BD people
- Internal recruiters are more likely to have a greater understanding of infosec or at least IT
- A recruiter that doesn't understand security is more likely to make bad placements with higher turnover
- External recruiters come from varied backgrounds, virtually zero from infosec
- Motivations are far different
- I want to choose people to spend a career with
- They want to make a commission and meet SLAs
- Attention to detail is very different
- A tiny detail that could betray a hidden skill set or flaw would likely be overlooked by a 3rd party
- I have an interest in understating the person, not just the resume
- What is their desired career/life trajectory?
- How will our company enrich/hinder that life?
- Backgrounds are different
- You are in competition with an army of low-skilled counterfeits
- You need to be able to demonstrate raw skills, not just list your certs
- Have a body of work available for review on GitHub, your own site, etc.
- Internships are a nice touch, but they cut both ways
- You interned with unnamed-big-4-biz-consulting firm? Don't drag that culture in here. I fear for what you learned.
- Can't talk about where you interned because it was a non-DOD three-letter agency? Communicate that point to me in your way. If that is the truth, I'll trace you back and verify.
- Always be client-facing
- I have seen many recruits passed over for poor hygiene, arrogant treatment of interviewers, disclosure of illegal activity, and just generally obnoxious behavior
- You couldn't act like this on a client site and not get sent home; don't do it on the interview
- Yes, you are talented...there's always someone cooler than you
- I have seen many recruits passed over for poor hygiene, arrogant treatment of interviewers, disclosure of illegal activity, and just generally obnoxious behavior
- Interview your interviewers
- You should have a standing list of questions for interviewers
- Why do you stay with them?
- What is the intended growth path? Organic? IPO? Channel?
- Is there any merger/acquisition activity going on? Planned? Intended impact?
- Is there any rebranding activity going on? Planned? Intended impact?
- What conditions are driving this open role? Turnover? Internal restructuring? Organizational growth?
- Will I be supported in my security research? How?
- Does your company have a defined mentoring path? Why not?
- How does the company support continuing infosec education?
- You should have a standing list of questions for interviewers
- Meet your team
- Watch the team interaction closely
- Can you see cohesion? Are they supportive or adversarial? Are they authentically happy with their jobs?
- Understand the org chart you are stepping into
- To whom does security answer? CXX? IT Director? General Counsel?
- Understanding this will help mitigate surprises later
- To whom does security answer? CXX? IT Director? General Counsel?
- Understand the company culture
- Big corp? Big corp problems.
- Boutique? Founder problems.
- Is there a "treehouse" mentality among the senior employees?
- Never forget who you are
- I know you want a job, but don't take a job that is sure to kill you slowly from the inside
- Like doing offensive security? Don't start in the SOC.
- Did you walk away from the interview(s) thinking that this company understands the care & feeding of hackers?
- If you can already see the point at which you will outgrow the company, is it the right place to start?
- Maybe! If you have a goal of entrepreneurship, or of working for a specific team, this first step just needs to support that eventual goal. This may be detected by an astute interviewer, though.
- I know you want a job, but don't take a job that is sure to kill you slowly from the inside
Resume tips
- One page.
- My dad started at the bottom, and worked up to EVP of a Fortune 50 corp. One page.
- Focus on your work experiences and extracurricular infosec workrelevant
- I'd rather read about 0days and CVEs than certs
- I want to know about your community involvement
- 2600, local DCs, TOOOL, OWASP, etc.
- Presentations at cons matter to me, especially if I can watch you deliver information to an audience
- Like a free audition, and believe me I watch every one people link in resumes
- I don't care about your GPA, fraternity/sorority, who we know in common, what sports you enjoy, or what you look like. At all.
- Seriously, don't add a photo.
General tips
- Code in several languages.
- Despite semantic differences, you should have a pretty good working knowledge of the most widespread VMs, coding languages, and compilers
- Web apps are your paycheck
- Knowing the OWASP Top 10 is like knowing your middle name...not impressive in and of itself, but if you don't know them, there's something wrong.
- Many composite "red team" projects will involve some Web app hacking, and even the most specialized consultancies will agree to a Web app assessment for an established client
- Think holistically, and make yourself more valuable
- If you can't write a report, of what value are your assessment activities?
- Seem always to have interpersonal conflict? Time to read up on Empathy and EQ. Be the go-to on your squad.
- Get comfortable with an audience. Toastmasters is there for you.
- Learn the value of "the Halloween Mask" as Henry Rollins called it
- Sure, you're a young security professional. We all expect eccentricity from you. We're all also trying to make money and be taken seriously
- Don't forget: in boardrooms of white-haired old men across the nation, we're still the same guys who lost them millions of dollars on ERPs and useless Y2K preparations
- I'm not kidding about this.
- Don't wield your difference like a blunt object. A little bit goes a long way when you're also scaring the hell out of everyone with pen test reports.
- My life is far more complex and wacky than my coworkers know, and I talk a lot. I just know how much to let through the mask
- Sure, you're a young security professional. We all expect eccentricity from you. We're all also trying to make money and be taken seriously
Getting Into Infosec:
- Follow Me on Twitter: https://twitter.com/coffeewithayman
- Subscribe To YouTube: https://www.youtube.com/channel/UCg6gV_gdfc188HZdN8LUx4A
- Checkout My Book: https://amzn.to/2HP2i25
- Sign up for updates and commentary: https://mailchi.mp/467573a314e5/gettingintoinfosec
- Website: https://gettingintoinfosec.com
See omnystudio.com/listener for privacy information.
Mentioned in this episode:
Full transcript
Transcribed from the episode audio. Spoof ads (Ayman's parody commercials poking fun at the industry) are marked.Download .txt
If I am not going to bring you on my team or advocate for the next round of people to bring you on the team, then I think it's on me to at least provide you direction.
Welcome to Getting Into Infosec. I'm your host, Ayman Elsawah. My guest this week is Nick Juswald.
Every single person has a bias, whether or not they want to admit it to themselves or anyone else.
Nick is a cybersecurity recruiter. Now, I've always made it a point not to have recruiters on the show, but Nick and I have a special connection. I reconnected with Nick at an annual dinner amongst friends at DEF CON. Let me just say I'm bad with faces and names. So when I walked in and went to introduce myself, I said, hi, I'm Eamon. He's like, oh, Ayman Elsawah? Good to see you. I'm like, huh? How does somebody remember my first name, let alone my last name? Turns out he was a recruiter on the other side of an interview quite a long time ago.
Are you an internal recruiter who understands that, you know, their company will be in contact with these people later for better or worse? Or are you a gunslinger external third party recruiter who might do some security recruiting sometime in the future? And if they do, your name might pop up on their LinkedIn search.
You really kept dropping wisdom throughout the interview.
And brilliant people tend towards eccentricity. And it's like the thing, like what I said to you the other night, you know, the higher order of the mind, the more prone it is to entropy.
He laid out all the things he's looking for as a recruiter and common mistakes people make when applying for a security role.
I like to hear about your exploits as a recruiter. I really do. You want a CTF somewhere at a conference? That's awesome. Tell me about it.
Nick is one of the most amazing human beings I've ever met. He's real, not fake. He understands the world and how it functions. If somebody says offends you, that's okay, but hear him out. Take a minute to gain understanding on his perspective. He's also a recruiter for a boutique consulting firm, so take that into consideration. I try not to filter my guests, so I think there is value for what each of my guests bring to the table. Okay, so this episode was really long, so I split it up into two parts. The next episode has a bombshell in it based on my past experience with Nick, so stay tuned for that. He also wrote up tons of notes on the job search process for infosec, so I have all that in the show notes, so go ahead and check them out.
All right, on to the show. Hi, Nick. Welcome to the show.
Hi, man. Thank you so much for having me.
Yeah, thanks for coming on. Of course. So this is going to be an interesting episode. Let's first start off and let everybody know, what do you do today in the security world?
Sure. I am the director of corporate development for Red Mesa. And we are a security services firm that specializes in being able to do state actor level red teaming.
Okay. And what's your day to day like generally?
So my day to day... Is divided evenly between organizational developments and key accounts. So functionally, the way that looks is I maintain a network of high-level security professionals that we dip into both for contract work and also potential W-2 full-time recruitment. And then I also do Design of our organization development going forward. So the strategic side of helping to plan the shape of Red Mesa in 2020 forward. And then, of course, the other half of my work is key accounts. So I spend a lot of time with our clients, both at the executive and engineering levels. And I also develop all of our proposals, respond to RFPs, that sort of thing.
Okay. And so what's interesting is I believe you've done some recruiting in the past. Is that right?
A lot. Yes. Both from an internal standpoint and third party.
Okay. And what's the difference between an internal recruiter and external recruiter?
There are a lot of differences. I'm glad you're asking. So let's start out purely with motivation. OK, anytime somebody is engaging you with what they term as an opportunity, it will really benefit you to stop and think about their potential motivations. You know, that's sort of the core of social engineering, right? Understanding the motivations and how to play with those levers of your targets. And this is no different. So the motivations of an external recruiter are going to be number one, to meet their agreed upon SLAs with their client, and to number two, secure the commission for the hire of a resource. So in order to meet those SLAs, I, as an external recruiter, am motivated organizationally
To just put butts in seats, so to speak. I'm going to try to just do the cattle call effects. I'm going to get out on LinkedIn. I'm going to fire those out a whole bunch of messages, try to get people who fit the job description loosely enough to make it into the pipeline internally. I am going to hope, cross my fingers, that something falls out of that pipeline because, hey, your client wants to hire somebody or they would not have engaged your services. So they want to hire somebody. You want to see somebody hired. And then, of course, comes the commission for that hire. So you like to see them work out long enough that you get your money for that resource being hired.
And what's that commission like?
You know, it depends. If you are just a bulk IT recruiter out there, you know, those comp plans are usually complex. They are stacked. You know, they'll have different goals for different, you know, hiring silos that they're working on because they're probably not dedicated just to hiring that security unit. If you're talking about one of the big recruiting firms, these people are generally not specialists. They're generally hiring from many different IT positions. Your security position, if you're the client that they're hiring, is just one of many. They're trying to make a commission.
But like, what's an example? Is it like 20% of yearly salary?
20%? Okay, that's the high end. Now that's something that you get when you are headhunting. So if I am doing targeted recruiting for somebody like, hey, we need a very senior resource who can, you know, grow into a CISO role at, you know, let's just say a power generation utility. If that's what you're coming to me with, okay, then you and I need six months of time. You're paying me a retainer and I'm getting 20% of that person's first year total compensation, including their benefits package.
Oh, and that's like after they work for like, what, three months, six months?
Generally speaking, I will take half of my money in three months and 100% of the rest at six months.
Okay that's how i work when i'm when i'm freelance though and this is still discussing it as an outside person yeah and so the internal recruiter completely different animal okay so internal recruiter that's the position i want to be in i don't want to be an external recruiter i've done it is very necessary role because there are many small companies boutique size that simply do not have The internal recruiting capabilities. You know what I mean? And it's not that they have to go through a lot of structure. They're too small for the equal opportunity type structure requirements or auditing that would go on. But at the same time, these folks just don't have the time to bring a whole bunch of names into their recruiting pipeline.
So there are times when that third party approach is very highly necessary. But that being said, I want to be on the inside because my motivation is completely different. So at Red Mesa, where I am now, when I'm recruiting people, I am looking at them through the eyes of someone who will be sitting next to them. I want this person to be someone I want to work with for the long haul. We're not a company that wants to grow and shed and grow and shed our workforce. We are moving towards a much more solidified W2 model. So when I'm looking at people, I want to work next to this person for 20 years. I want this person to be happy and growing with me for 20 years at the company. And in order to do that, it has to have been a very holistic approach to the recruiting in the first place.
We have to have had a sort of a consultative exchange with this person that we're bringing Understanding where they want to go with their career, where their skill set wants to be next year, five years, 10 years, all that sort of thing. And make sure that this is a good fit for both of us. And only after these people have been in the saddle for far longer, a number of months beyond, I would have taken my commission on an external. Only at that point do I get a bonus at Red Mesa. So until I am really genuinely confident and it's an agreement between the president and myself, by the way, you know, if he's bringing somebody in, he's already got the connection and we already know this person in the market.
It's going to be a much shorter process, much easier for us to bring this person in, you know, far less work on my end.
Okay.
Again, back to that motivation, it's going to be highly different for me just in terms of I'm not an external recruiter who's going to cut and run. I'm the person who's going to be talking to this person every week. Not only that, because I'm in a position of handling key accounts. When I'm hiring somebody, it's in my mind that I will be at some point in the following week speaking with a client and saying to myself, I'm hearing technical items that will be on projects in this conversation. That individual that I just hired can actually do those tasks. And I can communicate that back to this client. Hey, I just recruited an amazing person who has that skill set. And you're selling them the bench.
Yeah.
I mean, any consulting firm is only as good as this bench, right?
Right.
You know, so it's the people who are actually doing the work. Well, if I can tell you about this great, you know, man or woman who's going to be doing the work, that's what they're going to want to be looking for. They want to hear that from us because we're a boutique company. We're specialists. So for me, that very much fits my model.
Okay. So what are some missteps that people have done during interviews?
Oh, boy. Yeah.
Well, okay. I mean, if you want to be very surface on it, generally speaking, okay, from the top, most common misstep, arrogance, total arrogance. I know I'm interviewing with you, but I already know people on the inside. I know I'm going to get hired anyway. I'm smarter than you. Let's get this over with. If that's the attitude, I'm sorry, I can't let you sit next to my guys either. If you're treating me that way, how are you going to be treating clients? How are you treating the rest of your team? And immediately, I'm going to recommend do not hire. And it happens quite a bit. A lot of gunslingers, because for our model right now, we are only hiring senior resources at the moment. That's the way our company began.
We began with a group of specialists who were doing very sensitive work. And as the company grows, we are going to build our ability to mentor and build our ability to bring in mid-level and then eventually more entry-level folks. So for us right now, we're only really interviewing senior resources. So a lot of these folks... Have very overblown opinions of themselves. And that happens. People know they're very good at their role. Sometimes arrogance happens. But the problem is, I can't bring that arrogance into our culture. I can't bring that arrogance onto a client site. If they're going to speak to me that way, how will they speak to the business unit managers to whom they're delivering results?
And that's going to be a huge problem. It's going to translate into a loss of revenue for the company. Second big misstep. How can I put this? I like to hear about your exploits as a recruiter. I really do. You want a CTF somewhere at a conference? That's awesome. Tell me about it. How'd you win? What happened? What were the vulnerabilities that you spotted that nobody else did before anybody else? How did you win? I love hearing those things. Collegiate cyber defense, I love hearing those stories. It's applied. People went and got their fingers dirty And really got in there and simulated some real conditions. I love hearing those things. Don't tell me about illegally hacking somebody's website.
Don't tell me those things. The minute you tell me that, I have to, one, end the call immediately. Two, fill out a report. Three, submit it to the company president. Okay, we have specific knowledge that this recruit has admitted to a felony.
Wow.
Sigh, we can never speak to this guy again. You know what I mean? There are cases. I'm not saying everything is unredeemable. I'm not saying that at all. We have people on our team who made mistakes when they were 17. Of course, we all did. But the problem is, if you don't have the decorum to exclude that from a conversation with a recruiter, no matter how much rapport you're building with that recruiter, then you just simply misunderstand the space.
Yeah.
So I cannot move forward with that person. So those are the two biggest missteps that I see. And they're more common than you think they are.
Wow.
I would say the third one comes with the in-person meeting of the teams. OK, so when I am going to talk to one of our recruits and we're pretty sure that we're going to bring somebody onto this team because we are a very low turnover company. I want to fly to that person and no matter where they are and meet them, I want to sit down with this person and understand them because without that in person, you know, you can be anybody. Right. And when I sit down with you, I want you to be who you are, but understand not to wield your difference or your otherness like a blunt object.
What does that mean?
Okay. I got a bunch of tattoos. You probably didn't know that.
No, no.
You've met me on several occasions too with short sleeves and you had no idea I had a bunch of tattoos, but I do. So if you're going to get face tattoos and things like that, I appreciate that. You know, I have some friends who are amazing artists, but don't forget, it might make you difficult to put on site. If there's something in your appearance that might shock you, The old men of the Fortune 50 boardrooms, let's be frank, it might be difficult to put you in a client facing position where you're going to be walking in there and delivering that sort of assessment.
I guess that's kind of unique, I guess, for your world, right? From the consulting world where in some other positions, you know, they might be full time remote, especially the senior ones, right? Or, you know, they may be in the Bay Area or whatever, where they're kind of more leaning on those kind of things.
Sure. Sure. But don't forget, you work in the Bay Area. I really might need you to go to Birmingham for me. You know what I mean? Like there might be a really big project in Birmingham and you're going to have to deliver some results to, you know, city executives, municipality executives. Gotcha. They don't really want to have to filter through their personal shock at, you know, wow, this guy's got a pretty strong sense of his appearance or her appearance, whatever it may be, to sort of wade through your results. You sort of want to lessen that blow a little bit. You're going to be scaring the heck out of these people.
I guess your mileage may vary in that sense, right?
How do you mean your mileage may vary?
Because there's this whole thing about like accepting people as they are and all that kind of stuff.
Oh, yeah. That's the other part of what I was saying. Never forget who you are.
Gotcha.
That's the other big mistake that people make.
Oh, OK.
They get into the interview process. They start forgetting who they are. And they start being okay with getting into a role that's not them.
Oh, I see.
And that's a big, big mistake. You realize that you're meeting this team of people and they're definitely too stodgy for you. This feels like IBM, you know, in the late 80s. And it's everybody's got a black eye and you're really, really stodgy. And that really just doesn't communicate with you. Or there's something about the role or the potential work. That simply doesn't work for you. You have to be strong enough to back out of that interview process, no matter how well it's going.
So you mentioned something, the Halloween mask. Yeah. What does that mean exactly?
The Halloween mask. So everybody I know in information security is different, is unique in a very sharp way. In some way, you know, they're, Almost always brilliant, you know, and brilliant people tend towards eccentricity. And it's like the thing, like what I said to you the other night, you know, the higher order of the mind, the more prone it is to entropy.
That's really interesting. I love that quote.
Thank you. And it's the absolute truth in my experience, you know, and I've experienced some people who are absolutely brilliant in the technical world. I have worked with people who are brilliant in the physical world, teaching martial arts for many years, and it's the same. It's the same. Anytime you find a higher order mind that's incredibly gifted in something, they're very much oriented toward disorder as well. And so for me, I love my disorder. OK, my life is far more wacky and crazy than any of my coworkers know. And I talk a lot. I have no, as you notice, you know, talking to you, I don't hold a lot back. But here's the thing. I know the value of the Halloween mask and I don't give away any of myself by wearing the Halloween mask.
I'm not harming myself. I'm not selling myself out. But I have the Halloween mask on now when I'm working with anyone where I am comfortable letting, you know, X amounts of myself out. Through that mask for anyone. Because at the end of the day, I, you know, as different and as other as I really am, you know, behind closed doors, we're all trying to make some money together. And the last thing I need getting in the way of us being able to do good business and discuss the problems we have to discuss. And, you know, I don't need it getting in the way of you hearing my message. I don't want you to focus on my otherness. The fact that I do have a bunch of tattoos or if I decide to leave the piercings in or whatever, I can put on a Halloween mask for you for a little while.
And I don't feel like I've sold myself out. And I would counsel people who really are brilliant and eccentric and sort of feel like, well, you know what? To hell with people. This is who I am. You're right. I agree. That is who you are. Never, ever forget who you are. Also, the people wearing the Halloween mask effectively will be heard on the merit of what they have to say much more clearly than someone who has to sort of struggle through, you know, how others are processing their behavior, their appearance, their affectations, that sort of thing.
Interesting. Yeah. So decide when you want to share parts of yourself.
Exactly. Exactly. And if you already do that, anyone out there who might be feeling a little bit like offended by what I'm saying, you already do this. If you don't think you do this, you're lying. Everybody filters. Everybody uses the Halloween mask a little bit. I'm saying when you're interviewing, make sure you understand what the Halloween mask is letting through in that moment. You know, if you've done some illegal hacking when you were 17 and Probably keep that behind the Halloween mask.
Yeah.
Because if I never find out, then there's no rapport for me to write, right?
Right.
Nothing. Exactly. And I probably wouldn't care. Just keep it to yourself. Keep it to yourself till room con next year at DEF CON. How about that?
There you go.
Yep. You can tell us all. And then you're already in the club and you can't get rid of it. So, you know, there's that kind of idea.
Right.
And really, honestly, I think the best description of this idea is forget who you are. But don't forget the value of the Halloween mask. One of my favorite musicians. Fat Mike from NoFX. Fat Mike from NoFX lives the BDSM lifestyle. Now, you would not know it if you were a record exec meeting him and shaking his hand because he's going to be recording or producing an album for you. Because, as he said in an article that I read a few years ago, not everybody lives that most expressive side of their life 24-7. Everyone has their own personal
Keep their oddness. You know, no one has to actually know that I'm a total fiend for all the old Godzilla movies.
Right.
And that's one of my things. Like, I have Godzilla stuff everywhere. It's true. Mothra. Love it. You know, I'm actually, you know, my next tattoo is going to be one of the Godzilla monsters.
You know? Nice.
Exactly. I'm a total lunatic for this stuff. I love it. But you know what? I don't have to wear it on my sleeve.
Right.
And not all the time. But that's, and it's a minor example, right? Not very shocking that I love old
Interesting.
Yes, be who you are. Don't forget who you are. But remember, just let the right things through the Halloween mask, right? If you're interviewing, if you're getting into this, you're trying to build confidence on your skill set on your merits. Don't let things distract from that necessarily.
That's interesting. Yeah, it's still the courting period, right?
It is. And that's another reason why when I was just giving you some general thoughts the other day, I said, don't put your picture on your resume. Simply don't. You're actually making my life harder as a recruiter.
So let's talk about that, like bias. I mean, there's some people that can't avoid it, right? There's women or underrepresented races, things like that.
Every single person has a bias, whether or not they want to admit it to themselves or anyone else. You grew up with certain faces around you somewhere deep inside your mind. You've got a bias. And as a recruiter, it's your job to extinguish every possible area where that bias can creep into your world. Do not send me your picture. I just don't. Just don't even let that enter into my mind. I want to see your accomplishments. It's like I said, would you like to get into the things that I actually want to see as a recruiter? Would that help people, do you think? Remember I gave you a short list of the things I really do want to see as a recruiter. As the recruiter, I want to be as unbiased and all about your accomplishments and merits as I can be.
So please help me by only giving me those things that speak to your merits. When you write your resume for me, I want one page. One page. The example I love to give, my dad was in HR for 47 years, and he ended up as the EVP of a Fortune 50 financial services firm.
You know what i mean okay right off the top i don't care about things like your greek system affiliations i don't really care about what sports you like i definitely don't care about your appearance i really honestly okay it's just me i don't care about your gpa at all like don't care i like to see you got a degree it's cool that you finished something you started and that's awesome Certifications, I'm iffy. Don't know if I care about certifications that much. I mean, it's nice to see that somebody finished their CISSP. There are a couple of offensive, OSCP, I guess I like to see that one. I mean, I think that takes a bit of effort. But generally speaking, It's just a checkbox item in comparison with things like CVEs, zero days, anything you can tell me about that is original art in that sense.
That's what I want to see. I want to see that you have an active GitHub. You're coming to me because you want to do security assessment? What are you hacking now?
Mm-hmm.
You know, let me see what you're hacking at the moment. Those are the things I want to see. I don't care who we know in common. That doesn't matter to me. You know, nothing about your personal life matters to me because if you volunteer those items, I'm not allowed to ask about your personal life. So when you volunteer those items, just kind of tell me those things and somehow work them in. Wonderful. You've just set me up now for potential bias. So don't set me up.
The hard details. And I know sometimes that's hard. And, you know, you may have some people in your audience who are coming from the agency side and they are not able to talk about who they work for, what they did. So there's this nice, big, weird hole in their resume. Right. OK. And I have spoken to people who feel like that's kind of an issue because it kind of relegates them to a position where they can get in with companies where they know someone knows someone who can explain things. But I guess what I'm saying is if you're in that position and you sort of got that hole in your resume because you can't exactly talk about what you did, number one, make sure you're applying for a role with a company that understands that work.
Because if that's the case, like if you're applying with us, for example, we still have connections to that world forever.
Track you back and say, hey, is this a real person? Yes, that's a real person. Yes, they have some experience that you probably would like. Okay, great. And that's as much as we probably ever get through that whisper network. But honestly, the right company will understand the hole in that resume. And if you're speaking to a company that has some sort of problem in the interviewing process with that missing information, It's probably not the right fit for someone coming out of the federal world.
How does one tactically put that on their resume? You just put redacted or something?
No, a lot of times. So what I have seen, well, okay, the ones I really liked. So it was a list of work experience entries and there was one that was essentially blank. It said company role in like quotation marks and it had a set of years and under where the person was listing the details of what they did It said unable to share or something like that. And it immediately struck me as, oh, I think this person did some work we're very, very interested in. And I immediately passed it along to our president and said, hey, have a look at this. And that's how things get taken care of.
Gotcha.
You know, OK, when it comes back to me that I'm still supposed to be talking to this person, I'll continue talking to this person.
And I think that's useful advice for other recruiters to help identify that where, you know, they might not have that experience. So that's pretty useful.
If anybody's taking either what I have to say, if you see those weird gaps and the person's being sort of circumspect about how much they'll tell you, it's highly likely this person is doing some agency type work. However, you want to contextualize that for the role that you're trying to place.
Right. That's great. This is good information. And so what about those that are more junior though?
So for people more junior? Yeah. Sure. Right. So people Getting Into Infosec, let's talk about that. Because I have recruited for a number of information security firms. You and I first met while I was recruiting for one, and then I recruited for several after as an external recruiter. And now I'm back as an internal recruiter of Of course, with Red Mesa, in addition to my other roles and role responsibilities. So I did recruit entry level folks in every role except for this one. In fact, it was very heavy on that entry level recruiting for the last two places I was recruiting for. So first of all, to you folks Getting Into Infosec, Number one, if you are the genuine article and you know who you are, you're the folks who actually understand code as well as networking.
And, you know, in your spare time, you're hacking things, you're breaking your own networks, you're voiding warranties. Pretty much you're trying every door handle. Those are the folks who really are living the infosec even before getting into the field. For those folks, you are in competition with an army of low-skilled counterfeits. I'll just say it. They're everywhere. There are so many people out there who I've interviewed who call themselves pen testers. They have all this project work listed on their resume, and they get stopped cold by the simplest of questions. You know, what's just, you know, offhand, and I'm not even a technical interviewer, you know, at any of these companies, you know, I was more just in the semantics.
And I would just kind of toss out one or two pseudo technical questions that even I could answer, you know, here's my favorite. What's your favorite cross site scripting attack?
Mm hmm.
And people would just go blue screen and just blink in 12 at me.
I love it. Blue screen.
So what are you, are you kidding? You know, what's your favorite persistent or what do you, what do you like? Well, I don't know what you mean. Okay. Well, I don't even know what to say at that point. You know, if you can't even chat with me about the OWASP top 10, I'm not sure you're a band tester that's out there. And it's out there in droves because everybody who's paying attention knows that That information security is a very stable vertical to get into. There's always going to be more work than there is, you know, talent to deliver that work. And it's sexy. There's a gleam to it. It's hacking. You know, it's more fun. You know, people see what their security teams do Within their firms, and they think that looks a heck of a lot better than developing one behavior for one object going into one particular distributed system that they may never even see in action.
It sounds a lot more interesting. So everybody wants into this field, obviously, and there aren't that many genuine, highly skilled entry-level folks to go around.
Mm-hmm.
So if you are out there wanting to get into this, first and foremost, understand how to code. In a couple languages, not just one. Find something that's, you know, widely in use. Pick one simple and one more complex to really work with. You know, I would say understand, you know, Python's a great one to play with, right? Real simple to get into. There are all these, all kinds of websites online where you can just do beginning Python stuff. You know,.NET's great to work with. You know, I'm not saying it's a wonderful language. Let's not all attack me for that, but....NET, I mean... I'm saying it's a great one to learn.
Well, Go, I guess Go is very popular. We can start there.
Sure, there's that. I'm saying something that's widespread in use in business enterprises today.
Right, okay.
Okay, get into it. Understand the ramifications of using a virtual machine. Just really understand writing code. Understand doing code review. Understand how vulnerabilities are introduced in the code. You know, the OWASP top 10 should be just second nature. I mean, it really, that shouldn't be something that's fresh or new for you. That should be sort of an eye roll. You got to understand network security to go with it. Anytime you're doing a composite assessment, you know, the red teaming sort of assessments that we perform a lot of, there will almost always be within the digital portion of that assessment, there will almost always be some amount of network and some amount of web app I would also counsel, it's not a bad idea to familiar yourself with RF, radio frequency in general.
I mean, what do you think Wi-Fi is? It's little radios. What do you think your Bluetooth is? It's little radios. Wrap your mind around that. Understand not just how to use Aircrack or something to try and get onto somebody's Wi-Fi. That's good, but also understand RF in general. That's something that we specialize in and we find that's all over the place. Companies have problems related to systems running on legacy RF protocols. And it's out there. It's all over the world. And people need help with this stuff. And there are very, very few people who are Getting Into Infosec who even look at a radio. So something to think about.
Yeah, a couple of things to dissect there. One is a majority of the positions out there are defensive, right?
Yeah, that's true.
We have SOC analysts and things like that. So have you ever recruited for like entry level corporate positions?
Yeah, I absolutely have. In fact, I recruited for a SOC.
Okay.
It's absolutely true. And I gave them the same exact advice. Understand code. I'm glad that you understand network security. Let me tell you how short the shelf life is for somebody who's ambitious to sit in that sock. You are running a very high risk of extreme boredom and loss of job satisfaction. If you just stay in the stock for a long, long, long time and you're very passionate about security. I've seen it happen to a lot of people. I know a lot of really good people who started in the stock and broke out and they carried that experience with them. And to red teaming, and it makes them highly dangerous because they understand what goes on in the side. So that's good stuff. But I've also known a lot of people who let that role crush them.
And they're no longer in security, frankly.
Oh, wow.
So people going on to the blue team.
Be hacking and the quickest way into security is through the SOC. Okay. I completely understand that. Foot in the door, get your career rolling. In that time, it is on you to go and start building your skills on the offensive side. That's the best advice I can give. Start building your offensive skills. If you're in the SOC, you can't see yourself Just sort of directing traffic forever and then becoming a manager, you know, doing the same thing on and on up the chain on that blue team, then it's definitely on you to start and start early. Start when you're a stock analyst working on that offense side. There are many ways to do that. Definitely be involved with your local 2600. Be involved with your local tool.
Be involved with your local DEF CON chapters. You have to have that community involvement, you know, to help bring you up on that red team side.
There you have it. That's part one of confessions of a cybersecurity recruiter. Nick was really honest in a lot of parts of that. I really appreciated his honesty there. The last part there, I just want to comment that he, you know, he's looking for red teamers. So that's his perspective on hiring, right? So that's not going to be the majority of positions out there. A lot of the majority of positions out there, as I said before, are internal security folks that are playing a defensive part in a company. But yeah, there are a lot of red teaming security consultancies and also for larger outfits. There are internal red teamers as well. In any case, I hope you liked it. I am just going to end it here and we'll do all the ending pleasantries in part two.
Connect with me on Twitter in the meantime. All right. Thanks. Bye. Hey, thanks for listening. So I built a lot of things and I'm building something new. I'm working on a new community. I want to bring everyone together with all the things that I've done into just one space. So I'm really excited about it and would love to stay in touch and get some early adopters or feedback. So check out the link below in the show notes and send me a hello. And that's about it. I hope you're having a wonderful day. Thanks. Talk to you soon. Thank you.
