Getting Into Infosec, Episode 26: Nick Jeswald - Confessions of a Cybersecurity Recruiter (Part 1)
Published October 25, 2019 · 37 minutes
Episode page: https://www.gettingintoinfosec.com/episodes/nickjeswald-1/

[0:00] Nick Jeswald: If I am not going to bring you on my team or advocate for the next round of people to bring you on the team, then I think it's on me to at least provide you direction.

[0:28] Ayman Elsawah: Welcome to Getting Into Infosec. I'm your host, Ayman Elsawah. My guest this week is Nick Juswald.

[0:34] Nick Jeswald: Every single person has a bias, whether or not they want to admit it to themselves or anyone else.

[0:40] Ayman Elsawah: Nick is a cybersecurity recruiter. Now, I've always made it a point not to have recruiters on the show, but Nick and I have a special connection. I reconnected with Nick at an annual dinner amongst friends at DEF CON. Let me just say I'm bad with faces and names. So when I walked in and went to introduce myself, I said, hi, I'm Eamon. He's like, oh, Ayman Elsawah? Good to see you. I'm like, huh? How does somebody remember my first name, let alone my last name? Turns out he was a recruiter on the other side of an interview quite a long time ago.

[1:05] Nick Jeswald: Are you an internal recruiter who understands that, you know, their company will be in contact with these people later for better or worse? Or are you a gunslinger external third party recruiter who might do some security recruiting sometime in the future? And if they do, your name might pop up on their LinkedIn search.

[1:22] Ayman Elsawah: You really kept dropping wisdom throughout the interview.

[1:24] Nick Jeswald: And brilliant people tend towards eccentricity. And it's like the thing, like what I said to you the other night, you know, the higher order of the mind, the more prone it is to entropy.

[1:33] Ayman Elsawah: He laid out all the things he's looking for as a recruiter and common mistakes people make when applying for a security role.

[1:39] Nick Jeswald: I like to hear about your exploits as a recruiter. I really do. You want a CTF somewhere at a conference? That's awesome. Tell me about it.

[1:47] Ayman Elsawah: Nick is one of the most amazing human beings I've ever met. He's real, not fake. He understands the world and how it functions. If somebody says offends you, that's okay, but hear him out. Take a minute to gain understanding on his perspective. He's also a recruiter for a boutique consulting firm, so take that into consideration. I try not to filter my guests, so I think there is value for what each of my guests bring to the table. Okay, so this episode was really long, so I split it up into two parts. The next episode has a bombshell in it based on my past experience with Nick, so stay tuned for that. He also wrote up tons of notes on the job search process for infosec, so I have all that in the show notes, so go ahead and check them out.

[2:23] Ayman Elsawah: All right, on to the show. Hi, Nick. Welcome to the show.

[2:26] Nick Jeswald: Hi, man. Thank you so much for having me.

[2:28] Ayman Elsawah: Yeah, thanks for coming on. Of course. So this is going to be an interesting episode. Let's first start off and let everybody know, what do you do today in the security world?

[2:36] Nick Jeswald: Sure. I am the director of corporate development for Red Mesa. And we are a security services firm that specializes in being able to do state actor level red teaming.

[2:49] Ayman Elsawah: Okay. And what's your day to day like generally?

[2:52] Nick Jeswald: So my day to day... Is divided evenly between organizational developments and key accounts. So functionally, the way that looks is I maintain a network of high-level security professionals that we dip into both for contract work and also potential W-2 full-time recruitment. And then I also do Design of our organization development going forward. So the strategic side of helping to plan the shape of Red Mesa in 2020 forward. And then, of course, the other half of my work is key accounts. So I spend a lot of time with our clients, both at the executive and engineering levels. And I also develop all of our proposals, respond to RFPs, that sort of thing.

[3:43] Ayman Elsawah: Okay. And so what's interesting is I believe you've done some recruiting in the past. Is that right?

[3:49] Nick Jeswald: A lot. Yes. Both from an internal standpoint and third party.

[3:52] Ayman Elsawah: Okay. And what's the difference between an internal recruiter and external recruiter?

[3:55] Nick Jeswald: There are a lot of differences. I'm glad you're asking. So let's start out purely with motivation. OK, anytime somebody is engaging you with what they term as an opportunity, it will really benefit you to stop and think about their potential motivations. You know, that's sort of the core of social engineering, right? Understanding the motivations and how to play with those levers of your targets. And this is no different. So the motivations of an external recruiter are going to be number one, to meet their agreed upon SLAs with their client, and to number two, secure the commission for the hire of a resource. So in order to meet those SLAs, I, as an external recruiter, am motivated organizationally

[4:45] Nick Jeswald: To just put butts in seats, so to speak. I'm going to try to just do the cattle call effects. I'm going to get out on LinkedIn. I'm going to fire those out a whole bunch of messages, try to get people who fit the job description loosely enough to make it into the pipeline internally. I am going to hope, cross my fingers, that something falls out of that pipeline because, hey, your client wants to hire somebody or they would not have engaged your services. So they want to hire somebody. You want to see somebody hired. And then, of course, comes the commission for that hire. So you like to see them work out long enough that you get your money for that resource being hired.

[5:29] Ayman Elsawah: And what's that commission like?

[5:30] Nick Jeswald: You know, it depends. If you are just a bulk IT recruiter out there, you know, those comp plans are usually complex. They are stacked. You know, they'll have different goals for different, you know, hiring silos that they're working on because they're probably not dedicated just to hiring that security unit. If you're talking about one of the big recruiting firms, these people are generally not specialists. They're generally hiring from many different IT positions. Your security position, if you're the client that they're hiring, is just one of many. They're trying to make a commission.

[6:04] Ayman Elsawah: But like, what's an example? Is it like 20% of yearly salary?

[6:08] Nick Jeswald: 20%? Okay, that's the high end. Now that's something that you get when you are headhunting. So if I am doing targeted recruiting for somebody like, hey, we need a very senior resource who can, you know, grow into a CISO role at, you know, let's just say a power generation utility. If that's what you're coming to me with, okay, then you and I need six months of time. You're paying me a retainer and I'm getting 20% of that person's first year total compensation, including their benefits package.

[6:39] Ayman Elsawah: Oh, and that's like after they work for like, what, three months, six months?

[6:43] Nick Jeswald: Generally speaking, I will take half of my money in three months and 100% of the rest at six months.

[6:51] Nick Jeswald: Okay that's how i work when i'm when i'm freelance though and this is still discussing it as an outside person yeah and so the internal recruiter completely different animal okay so internal recruiter that's the position i want to be in i don't want to be an external recruiter i've done it is very necessary role because there are many small companies boutique size that simply do not have The internal recruiting capabilities. You know what I mean? And it's not that they have to go through a lot of structure. They're too small for the equal opportunity type structure requirements or auditing that would go on. But at the same time, these folks just don't have the time to bring a whole bunch of names into their recruiting pipeline.

[7:35] Nick Jeswald: So there are times when that third party approach is very highly necessary. But that being said, I want to be on the inside because my motivation is completely different. So at Red Mesa, where I am now, when I'm recruiting people, I am looking at them through the eyes of someone who will be sitting next to them. I want this person to be someone I want to work with for the long haul. We're not a company that wants to grow and shed and grow and shed our workforce. We are moving towards a much more solidified W2 model. So when I'm looking at people, I want to work next to this person for 20 years. I want this person to be happy and growing with me for 20 years at the company. And in order to do that, it has to have been a very holistic approach to the recruiting in the first place.

[8:26] Nick Jeswald: We have to have had a sort of a consultative exchange with this person that we're bringing Understanding where they want to go with their career, where their skill set wants to be next year, five years, 10 years, all that sort of thing. And make sure that this is a good fit for both of us. And only after these people have been in the saddle for far longer, a number of months beyond, I would have taken my commission on an external. Only at that point do I get a bonus at Red Mesa. So until I am really genuinely confident and it's an agreement between the president and myself, by the way, you know, if he's bringing somebody in, he's already got the connection and we already know this person in the market.

[9:12] Nick Jeswald: It's going to be a much shorter process, much easier for us to bring this person in, you know, far less work on my end.

[9:18] Ayman Elsawah: Okay.

[9:19] Nick Jeswald: Again, back to that motivation, it's going to be highly different for me just in terms of I'm not an external recruiter who's going to cut and run. I'm the person who's going to be talking to this person every week. Not only that, because I'm in a position of handling key accounts. When I'm hiring somebody, it's in my mind that I will be at some point in the following week speaking with a client and saying to myself, I'm hearing technical items that will be on projects in this conversation. That individual that I just hired can actually do those tasks. And I can communicate that back to this client. Hey, I just recruited an amazing person who has that skill set. And you're selling them the bench.

[10:03] Ayman Elsawah: Yeah.

[10:03] Nick Jeswald: I mean, any consulting firm is only as good as this bench, right?

[10:07] Ayman Elsawah: Right.

[10:07] Nick Jeswald: You know, so it's the people who are actually doing the work. Well, if I can tell you about this great, you know, man or woman who's going to be doing the work, that's what they're going to want to be looking for. They want to hear that from us because we're a boutique company. We're specialists. So for me, that very much fits my model.

[10:24] Ayman Elsawah: Okay. So what are some missteps that people have done during interviews?

[10:28] Nick Jeswald: Oh, boy. Yeah.

[10:34] Nick Jeswald: Well, okay. I mean, if you want to be very surface on it, generally speaking, okay, from the top, most common misstep, arrogance, total arrogance. I know I'm interviewing with you, but I already know people on the inside. I know I'm going to get hired anyway. I'm smarter than you. Let's get this over with. If that's the attitude, I'm sorry, I can't let you sit next to my guys either. If you're treating me that way, how are you going to be treating clients? How are you treating the rest of your team? And immediately, I'm going to recommend do not hire. And it happens quite a bit. A lot of gunslingers, because for our model right now, we are only hiring senior resources at the moment. That's the way our company began.

[11:17] Nick Jeswald: We began with a group of specialists who were doing very sensitive work. And as the company grows, we are going to build our ability to mentor and build our ability to bring in mid-level and then eventually more entry-level folks. So for us right now, we're only really interviewing senior resources. So a lot of these folks... Have very overblown opinions of themselves. And that happens. People know they're very good at their role. Sometimes arrogance happens. But the problem is, I can't bring that arrogance into our culture. I can't bring that arrogance onto a client site. If they're going to speak to me that way, how will they speak to the business unit managers to whom they're delivering results?

[12:04] Nick Jeswald: And that's going to be a huge problem. It's going to translate into a loss of revenue for the company. Second big misstep. How can I put this? I like to hear about your exploits as a recruiter. I really do. You want a CTF somewhere at a conference? That's awesome. Tell me about it. How'd you win? What happened? What were the vulnerabilities that you spotted that nobody else did before anybody else? How did you win? I love hearing those things. Collegiate cyber defense, I love hearing those stories. It's applied. People went and got their fingers dirty And really got in there and simulated some real conditions. I love hearing those things. Don't tell me about illegally hacking somebody's website.

[12:44] Nick Jeswald: Don't tell me those things. The minute you tell me that, I have to, one, end the call immediately. Two, fill out a report. Three, submit it to the company president. Okay, we have specific knowledge that this recruit has admitted to a felony.

[13:02] Ayman Elsawah: Wow.

[13:02] Nick Jeswald: Sigh, we can never speak to this guy again. You know what I mean? There are cases. I'm not saying everything is unredeemable. I'm not saying that at all. We have people on our team who made mistakes when they were 17. Of course, we all did. But the problem is, if you don't have the decorum to exclude that from a conversation with a recruiter, no matter how much rapport you're building with that recruiter, then you just simply misunderstand the space.

[13:31] Ayman Elsawah: Yeah.

[13:32] Nick Jeswald: So I cannot move forward with that person. So those are the two biggest missteps that I see. And they're more common than you think they are.

[13:41] Ayman Elsawah: Wow.

[13:41] Nick Jeswald: I would say the third one comes with the in-person meeting of the teams. OK, so when I am going to talk to one of our recruits and we're pretty sure that we're going to bring somebody onto this team because we are a very low turnover company. I want to fly to that person and no matter where they are and meet them, I want to sit down with this person and understand them because without that in person, you know, you can be anybody. Right. And when I sit down with you, I want you to be who you are, but understand not to wield your difference or your otherness like a blunt object.

[14:19] Ayman Elsawah: What does that mean?

[14:20] Nick Jeswald: Okay. I got a bunch of tattoos. You probably didn't know that.

[14:24] Ayman Elsawah: No, no.

[14:25] Nick Jeswald: You've met me on several occasions too with short sleeves and you had no idea I had a bunch of tattoos, but I do. So if you're going to get face tattoos and things like that, I appreciate that. You know, I have some friends who are amazing artists, but don't forget, it might make you difficult to put on site. If there's something in your appearance that might shock you, The old men of the Fortune 50 boardrooms, let's be frank, it might be difficult to put you in a client facing position where you're going to be walking in there and delivering that sort of assessment.

[15:05] Ayman Elsawah: I guess that's kind of unique, I guess, for your world, right? From the consulting world where in some other positions, you know, they might be full time remote, especially the senior ones, right? Or, you know, they may be in the Bay Area or whatever, where they're kind of more leaning on those kind of things.

[15:20] Nick Jeswald: Sure. Sure. But don't forget, you work in the Bay Area. I really might need you to go to Birmingham for me. You know what I mean? Like there might be a really big project in Birmingham and you're going to have to deliver some results to, you know, city executives, municipality executives. Gotcha. They don't really want to have to filter through their personal shock at, you know, wow, this guy's got a pretty strong sense of his appearance or her appearance, whatever it may be, to sort of wade through your results. You sort of want to lessen that blow a little bit. You're going to be scaring the heck out of these people.

[15:56] Ayman Elsawah: I guess your mileage may vary in that sense, right?

[16:00] Nick Jeswald: How do you mean your mileage may vary?

[16:01] Ayman Elsawah: Because there's this whole thing about like accepting people as they are and all that kind of stuff.

[16:07] Nick Jeswald: Oh, yeah. That's the other part of what I was saying. Never forget who you are.

[16:11] Ayman Elsawah: Gotcha.

[16:12] Nick Jeswald: That's the other big mistake that people make.

[16:14] Ayman Elsawah: Oh, OK.

[16:15] Nick Jeswald: They get into the interview process. They start forgetting who they are. And they start being okay with getting into a role that's not them.

[16:22] Ayman Elsawah: Oh, I see.

[16:23] Nick Jeswald: And that's a big, big mistake. You realize that you're meeting this team of people and they're definitely too stodgy for you. This feels like IBM, you know, in the late 80s. And it's everybody's got a black eye and you're really, really stodgy. And that really just doesn't communicate with you. Or there's something about the role or the potential work. That simply doesn't work for you. You have to be strong enough to back out of that interview process, no matter how well it's going.

[16:49] Ayman Elsawah: So you mentioned something, the Halloween mask. Yeah. What does that mean exactly?

[16:53] Nick Jeswald: The Halloween mask. So everybody I know in information security is different, is unique in a very sharp way. In some way, you know, they're, Almost always brilliant, you know, and brilliant people tend towards eccentricity. And it's like the thing, like what I said to you the other night, you know, the higher order of the mind, the more prone it is to entropy.

[17:16] Ayman Elsawah: That's really interesting. I love that quote.

[17:18] Nick Jeswald: Thank you. And it's the absolute truth in my experience, you know, and I've experienced some people who are absolutely brilliant in the technical world. I have worked with people who are brilliant in the physical world, teaching martial arts for many years, and it's the same. It's the same. Anytime you find a higher order mind that's incredibly gifted in something, they're very much oriented toward disorder as well. And so for me, I love my disorder. OK, my life is far more wacky and crazy than any of my coworkers know. And I talk a lot. I have no, as you notice, you know, talking to you, I don't hold a lot back. But here's the thing. I know the value of the Halloween mask and I don't give away any of myself by wearing the Halloween mask.

[18:03] Nick Jeswald: I'm not harming myself. I'm not selling myself out. But I have the Halloween mask on now when I'm working with anyone where I am comfortable letting, you know, X amounts of myself out. Through that mask for anyone. Because at the end of the day, I, you know, as different and as other as I really am, you know, behind closed doors, we're all trying to make some money together. And the last thing I need getting in the way of us being able to do good business and discuss the problems we have to discuss. And, you know, I don't need it getting in the way of you hearing my message. I don't want you to focus on my otherness. The fact that I do have a bunch of tattoos or if I decide to leave the piercings in or whatever, I can put on a Halloween mask for you for a little while.

[18:54] Nick Jeswald: And I don't feel like I've sold myself out. And I would counsel people who really are brilliant and eccentric and sort of feel like, well, you know what? To hell with people. This is who I am. You're right. I agree. That is who you are. Never, ever forget who you are. Also, the people wearing the Halloween mask effectively will be heard on the merit of what they have to say much more clearly than someone who has to sort of struggle through, you know, how others are processing their behavior, their appearance, their affectations, that sort of thing.

[19:35] Ayman Elsawah: Interesting. Yeah. So decide when you want to share parts of yourself.

[19:38] Nick Jeswald: Exactly. Exactly. And if you already do that, anyone out there who might be feeling a little bit like offended by what I'm saying, you already do this. If you don't think you do this, you're lying. Everybody filters. Everybody uses the Halloween mask a little bit. I'm saying when you're interviewing, make sure you understand what the Halloween mask is letting through in that moment. You know, if you've done some illegal hacking when you were 17 and Probably keep that behind the Halloween mask.

[20:04] Ayman Elsawah: Yeah.

[20:04] Nick Jeswald: Because if I never find out, then there's no rapport for me to write, right?

[20:07] Ayman Elsawah: Right.

[20:08] Nick Jeswald: Nothing. Exactly. And I probably wouldn't care. Just keep it to yourself. Keep it to yourself till room con next year at DEF CON. How about that?

[20:15] Ayman Elsawah: There you go.

[20:16] Nick Jeswald: Yep. You can tell us all. And then you're already in the club and you can't get rid of it. So, you know, there's that kind of idea.

[20:22] Ayman Elsawah: Right.

[20:23] Nick Jeswald: And really, honestly, I think the best description of this idea is forget who you are. But don't forget the value of the Halloween mask. One of my favorite musicians. Fat Mike from NoFX. Fat Mike from NoFX lives the BDSM lifestyle. Now, you would not know it if you were a record exec meeting him and shaking his hand because he's going to be recording or producing an album for you. Because, as he said in an article that I read a few years ago, not everybody lives that most expressive side of their life 24-7. Everyone has their own personal

[21:04] Nick Jeswald: Keep their oddness. You know, no one has to actually know that I'm a total fiend for all the old Godzilla movies.

[21:12] Ayman Elsawah: Right.

[21:13] Nick Jeswald: And that's one of my things. Like, I have Godzilla stuff everywhere. It's true. Mothra. Love it. You know, I'm actually, you know, my next tattoo is going to be one of the Godzilla monsters.

[21:22] Ayman Elsawah: You know? Nice.

[21:23] Nick Jeswald: Exactly. I'm a total lunatic for this stuff. I love it. But you know what? I don't have to wear it on my sleeve.

[21:28] Ayman Elsawah: Right.

[21:29] Nick Jeswald: And not all the time. But that's, and it's a minor example, right? Not very shocking that I love old

[21:36] Ayman Elsawah: Interesting.

[21:37] Nick Jeswald: Yes, be who you are. Don't forget who you are. But remember, just let the right things through the Halloween mask, right? If you're interviewing, if you're getting into this, you're trying to build confidence on your skill set on your merits. Don't let things distract from that necessarily.

[21:57] Ayman Elsawah: That's interesting. Yeah, it's still the courting period, right?

[21:59] Nick Jeswald: It is. And that's another reason why when I was just giving you some general thoughts the other day, I said, don't put your picture on your resume. Simply don't. You're actually making my life harder as a recruiter.

[22:12] Ayman Elsawah: So let's talk about that, like bias. I mean, there's some people that can't avoid it, right? There's women or underrepresented races, things like that.

[22:20] Nick Jeswald: Every single person has a bias, whether or not they want to admit it to themselves or anyone else. You grew up with certain faces around you somewhere deep inside your mind. You've got a bias. And as a recruiter, it's your job to extinguish every possible area where that bias can creep into your world. Do not send me your picture. I just don't. Just don't even let that enter into my mind. I want to see your accomplishments. It's like I said, would you like to get into the things that I actually want to see as a recruiter? Would that help people, do you think? Remember I gave you a short list of the things I really do want to see as a recruiter. As the recruiter, I want to be as unbiased and all about your accomplishments and merits as I can be.

[23:08] Nick Jeswald: So please help me by only giving me those things that speak to your merits. When you write your resume for me, I want one page. One page. The example I love to give, my dad was in HR for 47 years, and he ended up as the EVP of a Fortune 50 financial services firm.

[23:34] Nick Jeswald: You know what i mean okay right off the top i don't care about things like your greek system affiliations i don't really care about what sports you like i definitely don't care about your appearance i really honestly okay it's just me i don't care about your gpa at all like don't care i like to see you got a degree it's cool that you finished something you started and that's awesome Certifications, I'm iffy. Don't know if I care about certifications that much. I mean, it's nice to see that somebody finished their CISSP. There are a couple of offensive, OSCP, I guess I like to see that one. I mean, I think that takes a bit of effort. But generally speaking, It's just a checkbox item in comparison with things like CVEs, zero days, anything you can tell me about that is original art in that sense.

[24:25] Nick Jeswald: That's what I want to see. I want to see that you have an active GitHub. You're coming to me because you want to do security assessment? What are you hacking now?

[24:32] Ayman Elsawah: Mm-hmm.

[24:33] Nick Jeswald: You know, let me see what you're hacking at the moment. Those are the things I want to see. I don't care who we know in common. That doesn't matter to me. You know, nothing about your personal life matters to me because if you volunteer those items, I'm not allowed to ask about your personal life. So when you volunteer those items, just kind of tell me those things and somehow work them in. Wonderful. You've just set me up now for potential bias. So don't set me up.

[25:02] Nick Jeswald: The hard details. And I know sometimes that's hard. And, you know, you may have some people in your audience who are coming from the agency side and they are not able to talk about who they work for, what they did. So there's this nice, big, weird hole in their resume. Right. OK. And I have spoken to people who feel like that's kind of an issue because it kind of relegates them to a position where they can get in with companies where they know someone knows someone who can explain things. But I guess what I'm saying is if you're in that position and you sort of got that hole in your resume because you can't exactly talk about what you did, number one, make sure you're applying for a role with a company that understands that work.

[25:47] Nick Jeswald: Because if that's the case, like if you're applying with us, for example, we still have connections to that world forever.

[25:56] Nick Jeswald: Track you back and say, hey, is this a real person? Yes, that's a real person. Yes, they have some experience that you probably would like. Okay, great. And that's as much as we probably ever get through that whisper network. But honestly, the right company will understand the hole in that resume. And if you're speaking to a company that has some sort of problem in the interviewing process with that missing information, It's probably not the right fit for someone coming out of the federal world.

[26:24] Ayman Elsawah: How does one tactically put that on their resume? You just put redacted or something?

[26:30] Nick Jeswald: No, a lot of times. So what I have seen, well, okay, the ones I really liked. So it was a list of work experience entries and there was one that was essentially blank. It said company role in like quotation marks and it had a set of years and under where the person was listing the details of what they did It said unable to share or something like that. And it immediately struck me as, oh, I think this person did some work we're very, very interested in. And I immediately passed it along to our president and said, hey, have a look at this. And that's how things get taken care of.

[27:07] Ayman Elsawah: Gotcha.

[27:08] Nick Jeswald: You know, OK, when it comes back to me that I'm still supposed to be talking to this person, I'll continue talking to this person.

[27:13] Ayman Elsawah: And I think that's useful advice for other recruiters to help identify that where, you know, they might not have that experience. So that's pretty useful.

[27:21] Nick Jeswald: If anybody's taking either what I have to say, if you see those weird gaps and the person's being sort of circumspect about how much they'll tell you, it's highly likely this person is doing some agency type work. However, you want to contextualize that for the role that you're trying to place.

[27:37] Ayman Elsawah: Right. That's great. This is good information. And so what about those that are more junior though?

[27:43] Nick Jeswald: So for people more junior? Yeah. Sure. Right. So people Getting Into Infosec, let's talk about that. Because I have recruited for a number of information security firms. You and I first met while I was recruiting for one, and then I recruited for several after as an external recruiter. And now I'm back as an internal recruiter of Of course, with Red Mesa, in addition to my other roles and role responsibilities. So I did recruit entry level folks in every role except for this one. In fact, it was very heavy on that entry level recruiting for the last two places I was recruiting for. So first of all, to you folks Getting Into Infosec, Number one, if you are the genuine article and you know who you are, you're the folks who actually understand code as well as networking.

[28:33] Nick Jeswald: And, you know, in your spare time, you're hacking things, you're breaking your own networks, you're voiding warranties. Pretty much you're trying every door handle. Those are the folks who really are living the infosec even before getting into the field. For those folks, you are in competition with an army of low-skilled counterfeits. I'll just say it. They're everywhere. There are so many people out there who I've interviewed who call themselves pen testers. They have all this project work listed on their resume, and they get stopped cold by the simplest of questions. You know, what's just, you know, offhand, and I'm not even a technical interviewer, you know, at any of these companies, you know, I was more just in the semantics.

[29:18] Nick Jeswald: And I would just kind of toss out one or two pseudo technical questions that even I could answer, you know, here's my favorite. What's your favorite cross site scripting attack?

[29:26] Ayman Elsawah: Mm hmm.

[29:26] Nick Jeswald: And people would just go blue screen and just blink in 12 at me.

[29:29] Ayman Elsawah: I love it. Blue screen.

[29:31] Nick Jeswald: So what are you, are you kidding? You know, what's your favorite persistent or what do you, what do you like? Well, I don't know what you mean. Okay. Well, I don't even know what to say at that point. You know, if you can't even chat with me about the OWASP top 10, I'm not sure you're a band tester that's out there. And it's out there in droves because everybody who's paying attention knows that That information security is a very stable vertical to get into. There's always going to be more work than there is, you know, talent to deliver that work. And it's sexy. There's a gleam to it. It's hacking. You know, it's more fun. You know, people see what their security teams do Within their firms, and they think that looks a heck of a lot better than developing one behavior for one object going into one particular distributed system that they may never even see in action.

[30:30] Nick Jeswald: It sounds a lot more interesting. So everybody wants into this field, obviously, and there aren't that many genuine, highly skilled entry-level folks to go around.

[30:43] Ayman Elsawah: Mm-hmm.

[30:43] Nick Jeswald: So if you are out there wanting to get into this, first and foremost, understand how to code. In a couple languages, not just one. Find something that's, you know, widely in use. Pick one simple and one more complex to really work with. You know, I would say understand, you know, Python's a great one to play with, right? Real simple to get into. There are all these, all kinds of websites online where you can just do beginning Python stuff. You know,.NET's great to work with. You know, I'm not saying it's a wonderful language. Let's not all attack me for that, but....NET, I mean... I'm saying it's a great one to learn.

[31:21] Ayman Elsawah: Well, Go, I guess Go is very popular. We can start there.

[31:24] Nick Jeswald: Sure, there's that. I'm saying something that's widespread in use in business enterprises today.

[31:30] Ayman Elsawah: Right, okay.

[31:31] Nick Jeswald: Okay, get into it. Understand the ramifications of using a virtual machine. Just really understand writing code. Understand doing code review. Understand how vulnerabilities are introduced in the code. You know, the OWASP top 10 should be just second nature. I mean, it really, that shouldn't be something that's fresh or new for you. That should be sort of an eye roll. You got to understand network security to go with it. Anytime you're doing a composite assessment, you know, the red teaming sort of assessments that we perform a lot of, there will almost always be within the digital portion of that assessment, there will almost always be some amount of network and some amount of web app I would also counsel, it's not a bad idea to familiar yourself with RF, radio frequency in general.

[32:19] Nick Jeswald: I mean, what do you think Wi-Fi is? It's little radios. What do you think your Bluetooth is? It's little radios. Wrap your mind around that. Understand not just how to use Aircrack or something to try and get onto somebody's Wi-Fi. That's good, but also understand RF in general. That's something that we specialize in and we find that's all over the place. Companies have problems related to systems running on legacy RF protocols. And it's out there. It's all over the world. And people need help with this stuff. And there are very, very few people who are Getting Into Infosec who even look at a radio. So something to think about.

[33:00] Ayman Elsawah: Yeah, a couple of things to dissect there. One is a majority of the positions out there are defensive, right?

[33:07] Nick Jeswald: Yeah, that's true.

[33:07] Ayman Elsawah: We have SOC analysts and things like that. So have you ever recruited for like entry level corporate positions?

[33:14] Nick Jeswald: Yeah, I absolutely have. In fact, I recruited for a SOC.

[33:17] Ayman Elsawah: Okay.

[33:18] Nick Jeswald: It's absolutely true. And I gave them the same exact advice. Understand code. I'm glad that you understand network security. Let me tell you how short the shelf life is for somebody who's ambitious to sit in that sock. You are running a very high risk of extreme boredom and loss of job satisfaction. If you just stay in the stock for a long, long, long time and you're very passionate about security. I've seen it happen to a lot of people. I know a lot of really good people who started in the stock and broke out and they carried that experience with them. And to red teaming, and it makes them highly dangerous because they understand what goes on in the side. So that's good stuff. But I've also known a lot of people who let that role crush them.

[34:05] Nick Jeswald: And they're no longer in security, frankly.

[34:08] Ayman Elsawah: Oh, wow.

[34:09] Nick Jeswald: So people going on to the blue team.

[34:14] Nick Jeswald: Be hacking and the quickest way into security is through the SOC. Okay. I completely understand that. Foot in the door, get your career rolling. In that time, it is on you to go and start building your skills on the offensive side. That's the best advice I can give. Start building your offensive skills. If you're in the SOC, you can't see yourself Just sort of directing traffic forever and then becoming a manager, you know, doing the same thing on and on up the chain on that blue team, then it's definitely on you to start and start early. Start when you're a stock analyst working on that offense side. There are many ways to do that. Definitely be involved with your local 2600. Be involved with your local tool.

[34:58] Nick Jeswald: Be involved with your local DEF CON chapters. You have to have that community involvement, you know, to help bring you up on that red team side.

[35:09] Ayman Elsawah: There you have it. That's part one of confessions of a cybersecurity recruiter. Nick was really honest in a lot of parts of that. I really appreciated his honesty there. The last part there, I just want to comment that he, you know, he's looking for red teamers. So that's his perspective on hiring, right? So that's not going to be the majority of positions out there. A lot of the majority of positions out there, as I said before, are internal security folks that are playing a defensive part in a company. But yeah, there are a lot of red teaming security consultancies and also for larger outfits. There are internal red teamers as well. In any case, I hope you liked it. I am just going to end it here and we'll do all the ending pleasantries in part two.

[35:58] Ayman Elsawah: Connect with me on Twitter in the meantime. All right. Thanks. Bye. Hey, thanks for listening. So I built a lot of things and I'm building something new. I'm working on a new community. I want to bring everyone together with all the things that I've done into just one space. So I'm really excited about it and would love to stay in touch and get some early adopters or feedback. So check out the link below in the show notes and send me a hello. And that's about it. I hope you're having a wonderful day. Thanks. Talk to you soon. Thank you.