Episode 42 · · 34 min
Norman Weekes From Contractor To Security Ops Analyst
TVM Operations (security scanning) at Salesforce
Episode summary
Norman Weekes is on the Security Operations Team at Salesforce. He is in charge of scanning their infrastructure and ensuring that everything is set up and operating properly.
Norman already spent almost a year in the information security world. This is also his first official full-time security job. After going through different job contracts, he believes that if everything's shut down early, there's no reason not to just get in a good routine and go after whatever certification or whatever job you want. This episode will undoubtedly inspire and assist job contractors who are considering a career in the information security world.
Before infosec: IT contractor, psychology graduate and retail worker
Chapters
- 0:00
Intro: Norman Weekes and the contractor path to Salesforce
Ayman introduces Norman, his TVM operations role and his contractor journey.
- 2:11
Working on the TVM operations team
Norman explains that he handles infrastructure scanning at Salesforce and that this is his first full-time security job.
- 2:56
Contractor roles: Mac deployment, Jira admin and enterprise security
He describes automating Mac setup with a bash script, learning to stay calm under pressure and administering one tool.
- 5:33
Day to day: alerts, scans and automation with APIs
Norman covers checking scan alerts, supporting requests and automating work with APIs and jq.
- 8:15
Growing up gaming, psychology and GameHeads
He recalls Humongous Entertainment games, dropping grad school plans and trying game development and DevOps.
- 11:32
CTFs, Mr. Robot and the National Cyber League
A team CTF at Merit College and Mr. Robot pushed him toward security, and the NCL gave him competition.
- 13:25
Hack the Box advice and the Merit College program
He recommends Hack the Box, warns against burning out, and explains why Merit's weekly class format works.
- 18:03
Bootcamp takeaways: Python, Splunk and security news
Norman says the bootcamp's Python, log analysis and daily news habit helped, and mentions his earlier General Assembly attempt.
- 22:07
Failing the OSCP three times
He walks through gaining one more machine each attempt and being held back by Windows command line skills.
- 25:46
Bug bounties and long-term plans
Norman explains why he has not started bug bounties yet and that he wants a red team role, OSWE and stronger coding.
- 29:20
Advice and the job search
He urges listeners to set the bar high, network, and describes how a referral finally led to his job.
- 33:11
Closing: Ayman's new community
Ayman thanks listeners and points them to the show notes link for his new community.
Key takeaways
- Automate repetitive work early, as Norman did with a bash script for Mac setup, because it builds scripting skills you will use in security.
- Contract and help desk roles teach you to stay calm when things break, which prepares you for real incidents later.
- Use Hack the Box for hands-on practice, but know when to step away so you do not burn out.
- Practice the Windows command line and PowerShell as well as Linux before the OSCP exam, since the machines are randomized.
- Network and ask for referrals, because most of Norman's applications went nowhere until a colleague referred him.
- Set the bar high and do not be afraid to fail a hard cert, since you learn useful skills even when you miss.
Notable quotes
really just go set the bar high and don't be afraid to fail.
as hard as it is in these times, network as much as you can. Talk to people.
Really no reason not to just get in a good routine and go after whatever cert or whatever job you want
Questions answered in this episode
- How did Norman Weekes get into security at Salesforce?
- He did about two years of IT contract work, including Mac deployment, Jira admin and an enterprise security tool at Salesforce. A colleague he met while contracting referred him for a full-time role on the TVM operations team.
- How many times did Norman try the OSCP?
- He attempted it three times, passing one more machine each time. He says he lost out on Windows machines and plans to practice the Windows command line and Hack the Box more before another try.
- How did Norman Weekes learn about cybersecurity?
- He attended GameHeads and the Merit College cybersecurity program in the Bay Area, where a team CTF got him hooked. He also took Ayman's bootcamp, competed in the National Cyber League and practiced on Hack the Box.
Show notes and links
Show the original episode notes
Norman Weekes is on the Security Operations Team at Salesforce. He is in charge of scanning their infrastructure and ensuring that everything is set up and operating properly.
Norman already spent almost a year in the information security world. This is also his first official full-time security job. After going through different job contracts, he believes that if everything's shut down early, there's no reason not to just get in a good routine and go after whatever certification or whatever job you want. This episode will undoubtedly inspire and assist job contractors who are considering a career in the information security world.
LINKS
Linkedin: https://www.linkedin.com/in/normanjr/
Security and Privacy Framework: iapp.org
Full Show Notes: https://www.gettingintoinfosec.com/
Mentioned in this episode:
Full transcript
Transcribed from the episode audio. Spoof ads (Ayman's parody commercials poking fun at the industry) are marked.Download .txt
I think it was just good to have that happen early, especially as a contractor before that next fire came up when I was full-time. I already know how this works, already know what to do in this situation. So yeah, I think it's just good to make those mistakes early, get used to them, and you're more prepared for them when it does happen later on.
Welcome to Getting Into Infosec. I'm your host, Eamon El-Suaf. My guest this week is Norman Weeks. Norman is on the TVM operations team at Salesforce. He's in charge of scanning their infrastructure and ensuring that everything is set up and operating properly. In today's episode, Norman will share his incredible journey from being a contractor to being part of the Salesforce operations team.
Basically, I just handled the scanning of our infrastructure and making sure that's all set up correctly, scanned and running correctly, things like that. I'm still a contractor. I was doing sysadmin for Jira, just me and one other guy. Yeah, I liked that better, but they didn't like it better. It could just break for no reason sometimes. I did like that I got used to fires coming up. I think that's important to get used to early and not panicking and just staying cool under pressure. See, I did that for, that was about a full year, doing that as a contractor. Then after that, I went on another contract role at Salesforce.
After going through different job contracts and trying multiple times for the OSCP, he firmly believes in not giving up on your goals.
This episode will surely motivate and help others looking to obtain certifications in full-time careers in information security. Please share with us your greatest takeaways from this episode by tagging us on social at GetIntoInfosec. All right, onto the show.
Hey, Norman, welcome to the show.
Hey, I'm glad to be here.
All right. Yeah. So for those out there that don't know you, can you tell us a little about what you do today in information security world?
Yeah, definitely. I am on the TVM operations team at Salesforce. So basically I just handled the scanning of our infrastructure and making sure that's all set up correctly, scans are running correctly, things like that.
Okay. And so what's like a typical date? And how long have you been in this role?
Yeah, started in August. That's about almost a year, almost a year now. Yeah. Wow. That flew by.
Yeah. So this is your first official security job, like your first full-time security job, right?
Yeah. I was a contractor for about... Two years.
Can you walk us through? So walk us through the journey of all the different roles you had and things you tried to do to get in.
Yeah, I started in a really barely even call it. It was more just a deployment role where we set up Macs for new employees at the company. Yeah, we just set up, you know, all the applications, set up their account, and then we just ship it out if it needed to be shipped out. And my first, the one thing I did about that is eventually I automated a bit of it, which was my, yeah, that was my first time using what I learned on the job and seeing how much time that saved. It was really easy. I just made a quick bash script to install the applications from a flash drive and then check to make sure they were installed correctly.
Nice.
Yeah, it was pretty quick and easy.
Okay. What prompted you to get that automation set up?
I just got so tired of doing the same thing. I'm like, well, can't we just automate this? There's got to be a better way, right? Yeah.
Okay. Good. Good. That's awesome. So you were in IT and then how did you walk us through the progression after that?
Yeah, after that. So let's see, I did that. Then I moved up to, did it go right to Jira sysadmin? Yeah. I went to a store contractor. I was doing sysadmin for Jira. Just me and one other guy. And yeah, I liked that better, but they didn't like it better. It can just break for no reason sometimes. I did like that I got used to fires coming up. I think that's important to get used to early and not panicking and just staying cool under pressure. See, I did that for, that was about a full year doing that as a contractor. Then after that, I went on another contract role at Salesforce. This time, what role, that role was, well, I was only at enterprise security. So that was just, and really for that, I mean, even that one, I would barely call that security.
I was really just an admin for one tool there. So I wasn't like really doing a bunch of things, but I was more just focusing on administering one tool.
So you mentioned a little bit about working under pressure when you're in that general. Is that something that has helped you today or helps you today?
Yeah. I mean, I think it was just good. To have that happen early, especially as a contractor, when that next fire came up when I was full-time, I'm like, I already know how this works, I already know what to do in this situation. So yeah, I think it's just good to make those mistakes early, get used to them, and you're more prepared for them when it does happen later on. I see.
And walk us through the day-to-day that you do today. What are some things that you do?
Yeah, today I would say, yeah, checking alerts to see like what needs, see if like a scan didn't complete or if, you know, a certain amount of hosts weren't scanned or have an alerting thing I check, kind of run through those first. Then it'll just be like run the business stocks. Maybe this person wants new agents installed here or they want, you know, seeing some type of scan issue on their host, some type of performance issue. So I'll be like more of the run the business type of stuff I do. Then outside of that will be like any projects I have going, which has mostly just been automation lately, which I like. I'm always trying to get better on my scripting skills. I've been automating quite a bit so far.
So using APIs of your tools, for example?
Yeah, I didn't use API until that first contract role at Salesforce. That was different. I'm like, well, okay, I've been coding, but now using an API was a big step up for me. Okay.
Yeah. Rock us through that if you can.
Yeah. Let me think of my, what was my API project like that one?
But it probably involved learning JSON, REST API, like ingestion, right?
I heavily used JQ to parse through JSON. It's tricky at first, but once you get used to it, you're like, this is one of my favorite tools.
It is tricky. And then when you have different JSON, like one company might use a different structure than another. It's like, oh, man.
Yeah, I just go heavy on JQ and then keys to see which set of data I have to iterate to get to where I want to go to. Mostly that API, I was just installing, oh, moving a set of hosts to a group. And then that group, I would upgrade them. And that would be the hosts that we were testing to see if upgrading them to this new version caused any issues. So basically, I made sure to only select a certain amount of hosts, move them to this group.
Okay. And then do you find yourself not happy with the built-in dashboards? And are you building your own data dashboards, for example?
Oh, no. You mean just like in terms of seeing outlay of all the hosts that we have and all that?
Yeah, like sometimes I've seen people create their own data dashboards, basically, so that using APIs, I don't know if that's something you've done.
Whoa, no, I didn't. Never thought about that. That'd be interesting.
Yeah, sometimes when you have a whole bunch of different tools, you have dashboards in these different tools. But then what if you can just build one master dashboard with a little bit of data from each tool, right?
Oh, okay. I see that maybe a little bit down the road. But yeah, for now, I've mostly just been like, okay, one tool, set a host, do that. I haven't gotten to the point where I'm pulling data from multiple tools yet.
Okay. So walk us through your journey. So like early on, I know you were a Merit College student. So walk us through your tech journey in general, not necessarily security, but maybe your tech journey. Did you, were you always into computers or did you use computers when you were younger, for example?
Yeah, I grew up in the nineties playing, I don't know if you've heard of them. It's Humongous Entertainment. It's these kids' Windows games that were extremely difficult. I downloaded one recently to see how hard it is, and I'm like, I don't know where to go or what to do. But basically, yeah, each game, one of them in particular was called Pajama Sam. And what I like about the game and how I see that logic thinking and how that plays in doing pen testing or CTF is... You were always just games back then were pretty simple. You could basically point and click. So you just had to find certain tools, certain just random items throughout the world, and then combine them with something else later to like get past the door or something.
That was most of my, I mean, I was a big gamer growing up. We had basic cable that wasn't much on TV. So I was always just on the computer.
So yeah. Nice. What was the earliest age you had a computer, access to a computer?
Yeah, I was young. I think five. I started playing at like five.
Really? Okay, awesome. And then so that use of the computer went throughout high school and then in college. What did you do?
Yeah, college. I ventured off from the computers around high school, got into sports. Started focusing more on just running, playing basketball. See, I didn't really do too much computer stuff from high school up until actually after college. Went to college, did psychology. I was getting ready to go to grad school for that, but I had all my letters of rec all ready to go, everything. But yeah, last minute, I'm like, no, I don't. I actually don't want to. I just don't see myself listening to someone's problems every day and being happy. I don't think. I was there yet. So I changed my mind at the last possible minute and got super lucky. And my dad pointed me to a tech program in Oakland called Game Heads.
And yeah, that's really when I started getting back into tech, not necessarily, well, computers in a way, but I started in the game development program. Yeah, they have two tracks, one for people who want to learn how to develop games. And then the other track is DevOps. So we had tried the gaming one for a bit, but eventually the mentor just told me straight up, like, I don't think you're creative enough to do this. Because the thing was, I didn't even get, the part I struggled on was coming up with the idea for a game. I could not think of a good idea. I'm like, everything's been done. That was actually a blessing in disguise because he's like, I was like, I don't think this is for me either.
I want to drop out. But he's like, hey, check out the DevOps program. And so I went to that and then, yeah, I liked that a lot more. This was more of the logical thinking. What's the best way to get this done? So, yeah, I started doing contract work, just setting up, just like setting up networks or just random contracts. I did that for a little minute. Then eventually that led to security. That's how I heard about the merit program for that course. And yeah, went to Merit, did that for... What got you interested in security?
So what was it that... How did you learn about it? Or was it that you were interested in security, then you learned about the Merit program? Or you just saw it and was like, hey, this looks like a really good opportunity? Or how did that go?
Right. Yeah, it was a CTF that we did. In that class. Yeah, he set up this really cool like team CTF where it was one group of students versus the other group. And yeah, basically it was just try to get the flags before the other team. And he had like random questions like, hey, what's the command to do this? And whoever got it first would get a point. And that really just lined up with kind of me liking to compete through sports. I love being able to get in a team with people and work towards something. I like that.
CTF just opened up a whole new world there.
And then Mr. Robot really solidified that. That was out around that time. I saw that show. I'm like, yeah, this is the guy. This is what I want to do.
That's awesome. I've heard that more than once.
Yeah, at first I was a little ashamed saying that. I'm like, ah, is that really a legit thing to get inspired from? But now I hear it as well.
No, I mean, either Mr. Robot or before it was Hackers the Movie or read a book or heard about something. No, it's definitely nothing to be ashamed of because I think this journey is about discovery, right? Life's all about discovery and you discover something through any medium. So you discovered CTFs and got that itch there and then learned about the Merit College. And so that was a cybersecurity program.
Yeah from there yeah that was great because they also had the ncl going and that's just a and what is that for those that don't know yeah that's the national cyber league so it's just a ctf competition for colleges just all across the country yeah that has ranking and all that so i did that and that was just loads of fun yeah i forgot what we placed but we placed pretty well our first year and i think they're still consistently placing Like in the top three. So that's good to see.
Do you still do CTFs now?
I do Hack the Box, which I guess you could call that CTF, but it's different. I think CTFs are a little more out there and a little, even a little more or less, a little less real world than even Hack the Box, I think. So I don't. Yeah, I feel like a lot of them will have some type of, or the ones I've seen, they'll have some like inside hacker joke knowledge of like what quote is this or like something like that. Maybe I'm just not looking at the right CTFs, but I have not been, or at least lately, I haven't liked CTFs as much.
Are there any CTFs that you would recommend for folks out there?
Yeah, I guess if you can't hack the box, it's like a CTF. Definitely, definitely check out Hack the Box. And my advice would be on that is to... Know when to quit and come back. Don't burn yourself out on it. Don't beat yourself up too much and say, hey, I have to get to this rank by this time or I failed because this is my third attempt at going for pro hacker rank. And I'm almost there. So I think you just really need to know when to take a break from it and come back.
Yeah, that's definitely good advice. And then I think you, do you mind if I ask you about your OSP journey?
Oh, yeah, absolutely.
Okay. And then when did you do the bootcamp? Was it during Merit College?
Yes, I remember talking about that with the Merit College students, I believe.
Okay. Which order of operations?
Oh, from like boot camp, OSCP. Well, it was boot camp and then the OSCP. It was Merit boot camp.
Oh, was it after Merit?
It was near the ending of it.
So I've heard really good things about the Merit program. I've met some of the stakeholders there. So it's really cool. And I think we had Christine on the show before. As well. So how long is the merit program?
It's two years, depending on if you get the classes you need within that time.
Is it full time? Do you have to completely dedicate?
No, that's the cool thing about it. It was only once a week for like six hours. So it's a long Friday, once a week.
Oh, really? Once a week? Once a week. Oh, interesting.
Okay.
So that's very work life.
Oh, yeah, you could definitely work and do that program.
And is there a reason why it's so popular in this area in the Bay Area?
Yeah, that's a good question. Because I've heard, I know, I think cities in City College, San Francisco also has a program. But yeah, that's not talked about as much as merit. I haven't been to the city programs. I don't know how big they are or anything like that. But merit being popular, I would say, probably the numbers are just so each class is packed, because it's one class, which I think is actually good, because in security, there's so many different ways you can go. So you're bound to find someone that's also interested in the route that you want to go, which is what happened to me. I found other people that were like, I want a pen test. I want to, you know, get a certain that direction.
We would, you know, work together through the CTS. Yeah, I would say the side that I would. I don't. Yeah, I guess I don't know how big the other schools are, but they were the classes. They're pretty big, which I like.
Yeah, City College, they have Sam Bowman and Elizabeth. They're a really good powerhouse. So City College definitely has a really good program too, mainly because of the teachers there. And they have a good, like, I've talked to an advisor. They have a good program working with employers and stuff. So yeah, I just wanted to know, what is it that other schools in the nation or around the world can take away from Merit and from some of these others? What is some advice that you would give for the ideal security program, education program?
Yeah. I like to think that they all have this similar structure of the teachers work in the industry, which is always great. What else is there that they need to know? It's hard to say. I mean, yeah, from Merritt, we got, and I don't know what other schools are necessarily lacking. I just, at Merritt, I just really like that each teacher was doing something different in security. So you could always go to someone different. If you wanted like a specific question, like I know at the ending of my merit experience, one of the teachers was a pen tester and he was like offering a pen testing class. But yeah, they didn't have that when I was there. So I would say mostly just have a wide range of professionals at your program.
Okay. And you were working as what at the time? I think I was just doing retail.
I was, let me think.
Yeah, no, just working at SportsBase.
Cool. So what were some of the next steps after that, after Merit?
I went to, yeah, I was doing contract work in IT from there. Yeah, that's when I started working after that. Got into IT, doing the contract role thing.
And I think we met at a boot camp, I think. So we had a boot camp. Christina, I think episode three, she was also part of that boot camp. That was like, do you remember that bootcamp?
Oh, yeah. That was a great time. I missed that bootcamp.
Yeah. I hope I wasn't too hard on you guys.
No, not at all. As long as you were motivated, I think the workload wasn't too demanding. I do remember going, because I had quite a commute there, coming from the East Bay to San Jose. But I was lucky in the Amtrak, I always had Wi-Fi. And I remember I would just work a little bit on the, what was it, learn Python the hard way. I would just be hammering that out to and from on my commute. And I almost prefer this hour or so commute over the shorter one, because there's Wi-Fi and I'm just getting work done. I always get a seat.
Yeah, you're definitely an attentive student. You have some good questions. So I think for me, going into teaching, I learned that there is something as being a good student, like asking the right questions and following up on the homework. I think I assigned you guys the SANS Daily podcast.
Oh, yeah, yeah. No, I still use it. That's where I almost forgot where I got that from. I'm like, you know, I check this site all the time, but who told me to do this? And I'm like, oh, that's right. Bootcamp.
And I'd quiz you guys. Yeah, so that's good. Was there anything in the bootcamp that helped you, any knowledge in the bootcamp that you learned that you took away that you used in your security world?
Definitely the Python portion where I definitely have saved a lot of time scripting things out and wouldn't be where I'm at today if I wasn't able to automate at some point. So definitely that. What I do remember from the bootcamp was Splunk. And looking through logs on that, which I haven't yet used Splunk, so I haven't gotten to leverage that yet. Well, the news thing, drilling that at me, definitely. I feel like it's just, it's not like a straight, I listened to the news and then brought this to work, but it's more just like the side talks you have. With your employees? Like, hey, did you hear this? And you don't want to look like you just don't like, oh, no, I didn't. I never watched the news.
You kind of occasionally want to say, yeah, I did hear about that and then be able to talk about it with your co-workers.
That's right. That's a really big thing in the security industry, actually. I don't think we talk about it too much. But have you noticed that's a thing, like being on top of the latest security news?
If someone does do that, usually someone would have, if it's big, they would have talked about it in Slack or would have made, or, you know, you just check the SANS podcast. I think it's definitely important to keep up just so you know what's going on.
It's funny. Python, learn Python the hard way. The website no longer the same as it is. So it's no longer free.
What?
Yeah i can't find it 2020 just keeps getting worse why would they not make that free it was a great yeah i don't know i can't find it anymore so if you find another resource that's like it and maybe walk us through what python learn python the hard way was for you yeah i'm trying to remember what i know
Really, for me, I really just used it to, because I already had a little bit of program experience. So in Python, it's pretty easy to pick up.
From the gamer heads thing?
From that and from another boot camp. Oh, okay.
You took another boot camp. Yeah.
I wanted to be a software engineer at first.
Oh, tell us about that. Yeah, that was early. Yeah. So I forgot about that.
I was like 20, that was before Merit, that was before all that. I went to General Assembly, tried that out. They would learn after two weeks, they said, you now have master JavaScript. I'm like, no, but eventually it was too fast paced for me. It was really drinking from the hose. And yeah, at that time, it was my first real exposure to coding or anything like that. Yeah, it didn't work out for me, but it definitely helped in the long run, just in terms of knowing how much work it takes to make it.
So it seems like all these little experiences culminated all together.
Yeah, it's a very off the rails track, but I definitely benefited in a different way from everything I tried out.
And was that software bootcamp after you decided not to go to grad school?
Yep.
Okay, cool. And then I think you attempted the OSCP a couple of times when I saw you at DEF CON. DEF CON, sorry. Yeah, so I think you've attempted OSCP a couple of times, if I understand correctly. When I saw you at DEF CON, you were talking about it. So walk us through that journey. If you can.
Yeah, OSCP has been the most, it's a lot like running a lot, because I'm a runner too, right? So the OSCP, because it's a 24-hour test, you have to hack four out of the five machines to get it. And each time I've taken it, I've gotten one more machine than the last time. I've taken it three times and it's shit. I'm really over-preparing this time. I want to do ProHack or Unhack the Box, even possibly considering taking this mentorship class they offer. That's a 13-week course, and they basically just check in with you once a week, ask you many questions. It's daunting, and each time I fail, the first time I was just happy I even got one. Second time, I was a little like, eh, kind of wanted to pass.
And third time, I just could not pervask on Windows to save my life. I mean, I got four of the five machines I got were Windows boxes, and I found out the hard way that my Windows skills weren't up to par back then.
Was that because the labs had all Linux or was it?
No, they had some windows, but I just didn't, I didn't get, I should have just gotten more in the labs. I got about half of the machines, all the hard ones. So I'm like, I'm probably prepared enough to fudge my way through it. I definitely should have just practiced more just in the windows command line. Even those commands are just insane compared to Linux. I think in terms of just how intuitive they seem.
Is it PowerShell or straight?
I was just in straight CMD. Back then, I didn't even know how to send a PowerShell show with Netcat. So I was just doing CMD.
Okay. So looking back, you would say you just didn't prepare enough. Is that right?
Yeah. And it just got really unlucky. I feel like if I had half Linux boxes, I would have been okay. But I only had one. Yeah, it's just luck of the draw. They switch them out every time. I see.
How are you feeling now with OCP?
I'm feeling pretty good. I'm not going to lie. I'm about 79% to ProHacker right now. You've earned ranking by hacking machines on Hack the Box. They have 20 active boxes that they rotate. They rotate one every week. So to get to ProHacker, you need to hack 45% of the active boxes and the challenges. So I'm at 37% for overall completion of Hack the Box right now.
Okay. 37. But then the other one was 70 something. What was that?
That just keeps track of like how close you are to leveling up.
Oh, I see. I see. Gotcha. Just trying to break it down for those that are not familiar with the program. Yeah, it's good. So it seems like it's more of a marathon than a sprint, would you say?
Oh, yeah. I mean, if you're sprinting through this, then you have a gift and should be happy.
Okay. And so after you get the OACP, what are your thoughts?
Yeah, that's a tough one. I was kind of thinking about it. I'm like, huh, because I want to sign up for the labs again, end of this month, do about two months of that. That'll take me to about October. Then after that, we'll definitely vacation.
Yeah, definitely vacation. Don't know where, don't know what will be open, but hopefully something. After that, it's hard. I either want to get my coding skills a lot better in terms of terms of like a long-term planning for the AWE, Advanced Web Application Certificate offered by OffSec as well. But that one, you really got to know what you're doing. So that's long-term. But yeah, probably just get better at a language. Probably just get better at Python or possibly even JavaScript.
Do you do any bug bounties?
No, not yet. That's a long-term one too. I don't want to start that yet. I don't know if I'm quite there yet.
What's stopping you? No, just jump into it. There's nothing to prevent you from looking at the bounties that are out there and trying.
Yeah, I could. I just don't know. What that's going to lead to at the moment. I'm kind of more about timing right now. Because if I start it, and if I get one, or if I don't, I get experience, of course, that's the main benefit, right? But besides that, well, I guess it would look pretty good on a resume too. That is a strong resume bill too. But I don't know. Something about bug bounties just doesn't feel right now. Maybe I am ready for it.
I think you're ready for it. I mean, it would be a good change of pace from doing OCP stuff as you prepare. But I definitely would say, like, focus on the OCP. Get that done. Hey, why not? Like, install Burp and... As you're browsing and you see something weird on some janky website, take a look. Even writing to them in security. Just even reporting something. Or even just going through bug bounty reports. I think that's probably just the easiest thing to do. You don't even have to do anything. You just read the bug bounty reports and how people did things.
Yeah, and I've done that. I've seen... There's definitely some easy wins out there in terms of bug bounties. But yeah, something... I don't know what it is about bug bounty. This isn't... I feel like I just really need to build my skills. But that is a way to build your skills, right? But I don't know, maybe because there's no cert behind it. I don't know. Oh, I see. Yeah, I think right now I'm really just more focused on getting certs and building skills to make sure this is something I want to do.
I see. Yeah, my advice would just be, depends. Where do you see yourself in five years? What work do you want to be doing? Maybe five years is too long, maybe three years. Three.
I mean, definitely on a red team somewhere. I love researching something and then immediately be able to use it. I love being able to change pace and not just doing the same thing over and over. So I would love to be in a role where, yeah, they just have a lot of different
Yeah, I mean, if you, I guess I'm switching to advice mode right now. But yeah, getting into or being in a consulting position or being a pen tester at a consulting company definitely is, you're always in a new environment all the time. But a lot of the stuff out there, from what I've seen, is web app. So a lot of the work that's out there is all web app. But there is some network pen testing out there.
Well that lines up with cert i want to get long term after the ocp that one's just web app hacking you got to look at source code getting into debugger things like that so but that's a really hard cert from what i hear so like i said i really want to master a language before i go that route gotcha that's good you said you play with python have you played with go at all too Go, no, the only Go related thing I've used is Go Buster. That's, which is a great tool, but yeah, I've not looked. Go Buster, it's just a directory brute forcing tool. You basically just run it against the URL and it'll run through a word list and it will just find directories. Yeah, it's a good alternative. So when I first started, I was using something called Derb, which I forgot what language it's written in, but it's significantly slower than Go Buster.
And I've heard that's because it's written in Go and that's just a faster language.
Gotcha. Cool. Cool. So what is some advice out there that you'd recommend for folks out there that are trying to get into the industry?
Don't... Quit, but then don't permanently quit. Like it's okay to go after something you're unsure of if you can get, which is what I did with the OACP. That was my first or my second certification I attempted. I didn't really have that much experience at the time, but I knew going that in that even if I failed, I would learn so many skills, which I did. So I'd say really just go set the bar high and don't be afraid to fail.
Okay. Yeah. Are you referring to just certs or jobs? When you were applying for jobs, I guess you were applying for a lot of jobs. Actually, let me step back. So like, how was your job application experience?
It was rough. I applied to quite a few. Most of them, you know, that felt like the interview went well. They said the interview went well, but I wouldn't hear back. And it really wasn't until I got referred to jobs that I really started getting anything out of it. So I say as hard as it is in these times, network as much as you can. Talk to people. It's real easy to get in that zone, that shell of just work, work, work. But networking is just as important.
Okay. And you were referred by who? One of the... Like people you met at these networking groups?
One at the contracting job I had before Salesforce, actually. I met him there. We were just talking about the OSCP and he was thinking about taking it too. I'm like, oh yeah, I'm taking it now. He's like, wait, what? You like just started in the industry. You're going right for the OSCP. I'm like, yeah, it seems fun. Why not? Nice. Yeah. And then, yeah, from there, you know, we just walked, had lunch one day and yeah, eventually he said, hey, there's an open position here if you want to apply. I'm like, yeah.
And so what kind of positions were you applying to?
Anything they had really. I don't know if they're I wasn't like, okay, I wouldn't do that. I was more like, I just need to get in the field. What were the positions? They were just blanket security engineer positions and then just like a different job description. I can't recall any specific position I applied for back then.
And would any companies tell you why they didn't go with you?
One said they were looking for someone with more experience, which I'm like, eh, all right. But besides that, let me think. Yeah, no, not really. They just said, yeah, we can't hire you at the time. It's pretty general reasons.
General reasons and you just were left to kind of guess to figure it out.
I think you just, I mean, you don't need a referral, but if you don't, I feel like you definitely need either decent job experience or some type of certification that holds a good amount of weight. Oh, I see. Yeah.
And yeah, is there anything else you wanted to cover?
Let me think. Nothing is jumping out at me.
Let's see.
Box, OSCP, next plans, told people to network. Yeah, no, I think that bot does it for me.
Okay. Well, Norman, this has been informative. I think a lot of people can definitely relate to your journey and some of the struggles and some of the things that you've been trying to accomplish, kind of just a jig-jag throughout the career. Any parting advice for folks out there?
I feel like now's the perfect time to really get after it, right? I mean, pretty much everything's shut down. Really no reason not to just get in a good routine and go after whatever cert or whatever job you want so i say you make the best of this situation awesome well thank you so much and look forward to meeting again in person at some point yeah one of these days yeah all right thanks a lot norman cool thanks
Hey, thanks for listening. So I built a lot of things and I'm building something new. I'm working on a new community. I want to bring everyone together with all the things that I've done into just one space. So I'm really excited about it and would love to stay in touch and get some early adopters or feedback. So check out the link below in the show notes and send me a hello. And that's about it. I hope you're having a wonderful day. Thanks. Talk to you soon.
