Getting Into Infosec, Episode 42: Norman Weekes— From Contractor To Security Ops Analyst
Published February 25, 2022 · 34 minutes
Episode page: https://www.gettingintoinfosec.com/episodes/norman/

[0:00] Norman Weekes: I think it was just good to have that happen early, especially as a contractor before that next fire came up when I was full-time. I already know how this works, already know what to do in this situation. So yeah, I think it's just good to make those mistakes early, get used to them, and you're more prepared for them when it does happen later on.

[0:35] Ayman Elsawah: Welcome to Getting Into Infosec. I'm your host, Eamon El-Suaf. My guest this week is Norman Weeks. Norman is on the TVM operations team at Salesforce. He's in charge of scanning their infrastructure and ensuring that everything is set up and operating properly. In today's episode, Norman will share his incredible journey from being a contractor to being part of the Salesforce operations team.

[0:56] Norman Weekes: Basically, I just handled the scanning of our infrastructure and making sure that's all set up correctly, scanned and running correctly, things like that. I'm still a contractor. I was doing sysadmin for Jira, just me and one other guy. Yeah, I liked that better, but they didn't like it better. It could just break for no reason sometimes. I did like that I got used to fires coming up. I think that's important to get used to early and not panicking and just staying cool under pressure. See, I did that for, that was about a full year, doing that as a contractor. Then after that, I went on another contract role at Salesforce.

[1:38] Ayman Elsawah: After going through different job contracts and trying multiple times for the OSCP, he firmly believes in not giving up on your goals.

[1:49] Ayman Elsawah: This episode will surely motivate and help others looking to obtain certifications in full-time careers in information security. Please share with us your greatest takeaways from this episode by tagging us on social at GetIntoInfosec. All right, onto the show.

[2:07] Ayman Elsawah: Hey, Norman, welcome to the show.

[2:09] Norman Weekes: Hey, I'm glad to be here.

[2:11] Ayman Elsawah: All right. Yeah. So for those out there that don't know you, can you tell us a little about what you do today in information security world?

[2:18] Norman Weekes: Yeah, definitely. I am on the TVM operations team at Salesforce. So basically I just handled the scanning of our infrastructure and making sure that's all set up correctly, scans are running correctly, things like that.

[2:34] Ayman Elsawah: Okay. And so what's like a typical date? And how long have you been in this role?

[2:39] Norman Weekes: Yeah, started in August. That's about almost a year, almost a year now. Yeah. Wow. That flew by.

[2:45] Ayman Elsawah: Yeah. So this is your first official security job, like your first full-time security job, right?

[2:52] Norman Weekes: Yeah. I was a contractor for about... Two years.

[2:56] Ayman Elsawah: Can you walk us through? So walk us through the journey of all the different roles you had and things you tried to do to get in.

[3:02] Norman Weekes: Yeah, I started in a really barely even call it. It was more just a deployment role where we set up Macs for new employees at the company. Yeah, we just set up, you know, all the applications, set up their account, and then we just ship it out if it needed to be shipped out. And my first, the one thing I did about that is eventually I automated a bit of it, which was my, yeah, that was my first time using what I learned on the job and seeing how much time that saved. It was really easy. I just made a quick bash script to install the applications from a flash drive and then check to make sure they were installed correctly.

[3:41] Ayman Elsawah: Nice.

[3:41] Norman Weekes: Yeah, it was pretty quick and easy.

[3:43] Ayman Elsawah: Okay. What prompted you to get that automation set up?

[3:47] Norman Weekes: I just got so tired of doing the same thing. I'm like, well, can't we just automate this? There's got to be a better way, right? Yeah.

[3:55] Ayman Elsawah: Okay. Good. Good. That's awesome. So you were in IT and then how did you walk us through the progression after that?

[4:01] Norman Weekes: Yeah, after that. So let's see, I did that. Then I moved up to, did it go right to Jira sysadmin? Yeah. I went to a store contractor. I was doing sysadmin for Jira. Just me and one other guy. And yeah, I liked that better, but they didn't like it better. It can just break for no reason sometimes. I did like that I got used to fires coming up. I think that's important to get used to early and not panicking and just staying cool under pressure. See, I did that for, that was about a full year doing that as a contractor. Then after that, I went on another contract role at Salesforce. This time, what role, that role was, well, I was only at enterprise security. So that was just, and really for that, I mean, even that one, I would barely call that security.

[4:50] Norman Weekes: I was really just an admin for one tool there. So I wasn't like really doing a bunch of things, but I was more just focusing on administering one tool.

[5:00] Ayman Elsawah: So you mentioned a little bit about working under pressure when you're in that general. Is that something that has helped you today or helps you today?

[5:07] Norman Weekes: Yeah. I mean, I think it was just good. To have that happen early, especially as a contractor, when that next fire came up when I was full-time, I'm like, I already know how this works, I already know what to do in this situation. So yeah, I think it's just good to make those mistakes early, get used to them, and you're more prepared for them when it does happen later on. I see.

[5:28] Ayman Elsawah: And walk us through the day-to-day that you do today. What are some things that you do?

[5:33] Norman Weekes: Yeah, today I would say, yeah, checking alerts to see like what needs, see if like a scan didn't complete or if, you know, a certain amount of hosts weren't scanned or have an alerting thing I check, kind of run through those first. Then it'll just be like run the business stocks. Maybe this person wants new agents installed here or they want, you know, seeing some type of scan issue on their host, some type of performance issue. So I'll be like more of the run the business type of stuff I do. Then outside of that will be like any projects I have going, which has mostly just been automation lately, which I like. I'm always trying to get better on my scripting skills. I've been automating quite a bit so far.

[6:14] Ayman Elsawah: So using APIs of your tools, for example?

[6:18] Norman Weekes: Yeah, I didn't use API until that first contract role at Salesforce. That was different. I'm like, well, okay, I've been coding, but now using an API was a big step up for me. Okay.

[6:28] Ayman Elsawah: Yeah. Rock us through that if you can.

[6:30] Norman Weekes: Yeah. Let me think of my, what was my API project like that one?

[6:36] Ayman Elsawah: But it probably involved learning JSON, REST API, like ingestion, right?

[6:41] Norman Weekes: I heavily used JQ to parse through JSON. It's tricky at first, but once you get used to it, you're like, this is one of my favorite tools.

[6:50] Ayman Elsawah: It is tricky. And then when you have different JSON, like one company might use a different structure than another. It's like, oh, man.

[6:57] Norman Weekes: Yeah, I just go heavy on JQ and then keys to see which set of data I have to iterate to get to where I want to go to. Mostly that API, I was just installing, oh, moving a set of hosts to a group. And then that group, I would upgrade them. And that would be the hosts that we were testing to see if upgrading them to this new version caused any issues. So basically, I made sure to only select a certain amount of hosts, move them to this group.

[7:24] Ayman Elsawah: Okay. And then do you find yourself not happy with the built-in dashboards? And are you building your own data dashboards, for example?

[7:31] Norman Weekes: Oh, no. You mean just like in terms of seeing outlay of all the hosts that we have and all that?

[7:38] Ayman Elsawah: Yeah, like sometimes I've seen people create their own data dashboards, basically, so that using APIs, I don't know if that's something you've done.

[7:48] Norman Weekes: Whoa, no, I didn't. Never thought about that. That'd be interesting.

[7:52] Ayman Elsawah: Yeah, sometimes when you have a whole bunch of different tools, you have dashboards in these different tools. But then what if you can just build one master dashboard with a little bit of data from each tool, right?

[8:04] Norman Weekes: Oh, okay. I see that maybe a little bit down the road. But yeah, for now, I've mostly just been like, okay, one tool, set a host, do that. I haven't gotten to the point where I'm pulling data from multiple tools yet.

[8:15] Ayman Elsawah: Okay. So walk us through your journey. So like early on, I know you were a Merit College student. So walk us through your tech journey in general, not necessarily security, but maybe your tech journey. Did you, were you always into computers or did you use computers when you were younger, for example?

[8:31] Norman Weekes: Yeah, I grew up in the nineties playing, I don't know if you've heard of them. It's Humongous Entertainment. It's these kids' Windows games that were extremely difficult. I downloaded one recently to see how hard it is, and I'm like, I don't know where to go or what to do. But basically, yeah, each game, one of them in particular was called Pajama Sam. And what I like about the game and how I see that logic thinking and how that plays in doing pen testing or CTF is... You were always just games back then were pretty simple. You could basically point and click. So you just had to find certain tools, certain just random items throughout the world, and then combine them with something else later to like get past the door or something.

[9:15] Norman Weekes: That was most of my, I mean, I was a big gamer growing up. We had basic cable that wasn't much on TV. So I was always just on the computer.

[9:22] Ayman Elsawah: So yeah. Nice. What was the earliest age you had a computer, access to a computer?

[9:26] Norman Weekes: Yeah, I was young. I think five. I started playing at like five.

[9:31] Ayman Elsawah: Really? Okay, awesome. And then so that use of the computer went throughout high school and then in college. What did you do?

[9:37] Norman Weekes: Yeah, college. I ventured off from the computers around high school, got into sports. Started focusing more on just running, playing basketball. See, I didn't really do too much computer stuff from high school up until actually after college. Went to college, did psychology. I was getting ready to go to grad school for that, but I had all my letters of rec all ready to go, everything. But yeah, last minute, I'm like, no, I don't. I actually don't want to. I just don't see myself listening to someone's problems every day and being happy. I don't think. I was there yet. So I changed my mind at the last possible minute and got super lucky. And my dad pointed me to a tech program in Oakland called Game Heads.

[10:22] Norman Weekes: And yeah, that's really when I started getting back into tech, not necessarily, well, computers in a way, but I started in the game development program. Yeah, they have two tracks, one for people who want to learn how to develop games. And then the other track is DevOps. So we had tried the gaming one for a bit, but eventually the mentor just told me straight up, like, I don't think you're creative enough to do this. Because the thing was, I didn't even get, the part I struggled on was coming up with the idea for a game. I could not think of a good idea. I'm like, everything's been done. That was actually a blessing in disguise because he's like, I was like, I don't think this is for me either.

[10:59] Norman Weekes: I want to drop out. But he's like, hey, check out the DevOps program. And so I went to that and then, yeah, I liked that a lot more. This was more of the logical thinking. What's the best way to get this done? So, yeah, I started doing contract work, just setting up, just like setting up networks or just random contracts. I did that for a little minute. Then eventually that led to security. That's how I heard about the merit program for that course. And yeah, went to Merit, did that for... What got you interested in security?

[11:32] Ayman Elsawah: So what was it that... How did you learn about it? Or was it that you were interested in security, then you learned about the Merit program? Or you just saw it and was like, hey, this looks like a really good opportunity? Or how did that go?

[11:42] Norman Weekes: Right. Yeah, it was a CTF that we did. In that class. Yeah, he set up this really cool like team CTF where it was one group of students versus the other group. And yeah, basically it was just try to get the flags before the other team. And he had like random questions like, hey, what's the command to do this? And whoever got it first would get a point. And that really just lined up with kind of me liking to compete through sports. I love being able to get in a team with people and work towards something. I like that.

[12:11] Ayman Elsawah: CTF just opened up a whole new world there.

[12:13] Norman Weekes: And then Mr. Robot really solidified that. That was out around that time. I saw that show. I'm like, yeah, this is the guy. This is what I want to do.

[12:21] Ayman Elsawah: That's awesome. I've heard that more than once.

[12:24] Norman Weekes: Yeah, at first I was a little ashamed saying that. I'm like, ah, is that really a legit thing to get inspired from? But now I hear it as well.

[12:30] Ayman Elsawah: No, I mean, either Mr. Robot or before it was Hackers the Movie or read a book or heard about something. No, it's definitely nothing to be ashamed of because I think this journey is about discovery, right? Life's all about discovery and you discover something through any medium. So you discovered CTFs and got that itch there and then learned about the Merit College. And so that was a cybersecurity program.

[12:56] Norman Weekes: Yeah from there yeah that was great because they also had the ncl going and that's just a and what is that for those that don't know yeah that's the national cyber league so it's just a ctf competition for colleges just all across the country yeah that has ranking and all that so i did that and that was just loads of fun yeah i forgot what we placed but we placed pretty well our first year and i think they're still consistently placing Like in the top three. So that's good to see.

[13:25] Ayman Elsawah: Do you still do CTFs now?

[13:27] Norman Weekes: I do Hack the Box, which I guess you could call that CTF, but it's different. I think CTFs are a little more out there and a little, even a little more or less, a little less real world than even Hack the Box, I think. So I don't. Yeah, I feel like a lot of them will have some type of, or the ones I've seen, they'll have some like inside hacker joke knowledge of like what quote is this or like something like that. Maybe I'm just not looking at the right CTFs, but I have not been, or at least lately, I haven't liked CTFs as much.

[13:58] Ayman Elsawah: Are there any CTFs that you would recommend for folks out there?

[14:01] Norman Weekes: Yeah, I guess if you can't hack the box, it's like a CTF. Definitely, definitely check out Hack the Box. And my advice would be on that is to... Know when to quit and come back. Don't burn yourself out on it. Don't beat yourself up too much and say, hey, I have to get to this rank by this time or I failed because this is my third attempt at going for pro hacker rank. And I'm almost there. So I think you just really need to know when to take a break from it and come back.

[14:28] Ayman Elsawah: Yeah, that's definitely good advice. And then I think you, do you mind if I ask you about your OSP journey?

[14:34] Norman Weekes: Oh, yeah, absolutely.

[14:35] Ayman Elsawah: Okay. And then when did you do the bootcamp? Was it during Merit College?

[14:39] Norman Weekes: Yes, I remember talking about that with the Merit College students, I believe.

[14:43] Ayman Elsawah: Okay. Which order of operations?

[14:47] Norman Weekes: Oh, from like boot camp, OSCP. Well, it was boot camp and then the OSCP. It was Merit boot camp.

[14:53] Ayman Elsawah: Oh, was it after Merit?

[14:55] Norman Weekes: It was near the ending of it.

[14:58] Ayman Elsawah: So I've heard really good things about the Merit program. I've met some of the stakeholders there. So it's really cool. And I think we had Christine on the show before. As well. So how long is the merit program?

[15:09] Norman Weekes: It's two years, depending on if you get the classes you need within that time.

[15:14] Ayman Elsawah: Is it full time? Do you have to completely dedicate?

[15:17] Norman Weekes: No, that's the cool thing about it. It was only once a week for like six hours. So it's a long Friday, once a week.

[15:24] Ayman Elsawah: Oh, really? Once a week? Once a week. Oh, interesting.

[15:28] Norman Weekes: Okay.

[15:29] Ayman Elsawah: So that's very work life.

[15:30] Norman Weekes: Oh, yeah, you could definitely work and do that program.

[15:33] Ayman Elsawah: And is there a reason why it's so popular in this area in the Bay Area?

[15:37] Norman Weekes: Yeah, that's a good question. Because I've heard, I know, I think cities in City College, San Francisco also has a program. But yeah, that's not talked about as much as merit. I haven't been to the city programs. I don't know how big they are or anything like that. But merit being popular, I would say, probably the numbers are just so each class is packed, because it's one class, which I think is actually good, because in security, there's so many different ways you can go. So you're bound to find someone that's also interested in the route that you want to go, which is what happened to me. I found other people that were like, I want a pen test. I want to, you know, get a certain that direction.

[16:16] Norman Weekes: We would, you know, work together through the CTS. Yeah, I would say the side that I would. I don't. Yeah, I guess I don't know how big the other schools are, but they were the classes. They're pretty big, which I like.

[16:26] Ayman Elsawah: Yeah, City College, they have Sam Bowman and Elizabeth. They're a really good powerhouse. So City College definitely has a really good program too, mainly because of the teachers there. And they have a good, like, I've talked to an advisor. They have a good program working with employers and stuff. So yeah, I just wanted to know, what is it that other schools in the nation or around the world can take away from Merit and from some of these others? What is some advice that you would give for the ideal security program, education program?

[16:54] Norman Weekes: Yeah. I like to think that they all have this similar structure of the teachers work in the industry, which is always great. What else is there that they need to know? It's hard to say. I mean, yeah, from Merritt, we got, and I don't know what other schools are necessarily lacking. I just, at Merritt, I just really like that each teacher was doing something different in security. So you could always go to someone different. If you wanted like a specific question, like I know at the ending of my merit experience, one of the teachers was a pen tester and he was like offering a pen testing class. But yeah, they didn't have that when I was there. So I would say mostly just have a wide range of professionals at your program.

[17:37] Ayman Elsawah: Okay. And you were working as what at the time? I think I was just doing retail.

[17:41] Norman Weekes: I was, let me think.

[17:45] Norman Weekes: Yeah, no, just working at SportsBase.

[17:47] Ayman Elsawah: Cool. So what were some of the next steps after that, after Merit?

[17:52] Norman Weekes: I went to, yeah, I was doing contract work in IT from there. Yeah, that's when I started working after that. Got into IT, doing the contract role thing.

[18:03] Ayman Elsawah: And I think we met at a boot camp, I think. So we had a boot camp. Christina, I think episode three, she was also part of that boot camp. That was like, do you remember that bootcamp?

[18:14] Norman Weekes: Oh, yeah. That was a great time. I missed that bootcamp.

[18:17] Ayman Elsawah: Yeah. I hope I wasn't too hard on you guys.

[18:19] Norman Weekes: No, not at all. As long as you were motivated, I think the workload wasn't too demanding. I do remember going, because I had quite a commute there, coming from the East Bay to San Jose. But I was lucky in the Amtrak, I always had Wi-Fi. And I remember I would just work a little bit on the, what was it, learn Python the hard way. I would just be hammering that out to and from on my commute. And I almost prefer this hour or so commute over the shorter one, because there's Wi-Fi and I'm just getting work done. I always get a seat.

[18:50] Ayman Elsawah: Yeah, you're definitely an attentive student. You have some good questions. So I think for me, going into teaching, I learned that there is something as being a good student, like asking the right questions and following up on the homework. I think I assigned you guys the SANS Daily podcast.

[19:06] Norman Weekes: Oh, yeah, yeah. No, I still use it. That's where I almost forgot where I got that from. I'm like, you know, I check this site all the time, but who told me to do this? And I'm like, oh, that's right. Bootcamp.

[19:17] Ayman Elsawah: And I'd quiz you guys. Yeah, so that's good. Was there anything in the bootcamp that helped you, any knowledge in the bootcamp that you learned that you took away that you used in your security world?

[19:29] Norman Weekes: Definitely the Python portion where I definitely have saved a lot of time scripting things out and wouldn't be where I'm at today if I wasn't able to automate at some point. So definitely that. What I do remember from the bootcamp was Splunk. And looking through logs on that, which I haven't yet used Splunk, so I haven't gotten to leverage that yet. Well, the news thing, drilling that at me, definitely. I feel like it's just, it's not like a straight, I listened to the news and then brought this to work, but it's more just like the side talks you have. With your employees? Like, hey, did you hear this? And you don't want to look like you just don't like, oh, no, I didn't. I never watched the news.

[20:09] Norman Weekes: You kind of occasionally want to say, yeah, I did hear about that and then be able to talk about it with your co-workers.

[20:14] Ayman Elsawah: That's right. That's a really big thing in the security industry, actually. I don't think we talk about it too much. But have you noticed that's a thing, like being on top of the latest security news?

[20:23] Norman Weekes: If someone does do that, usually someone would have, if it's big, they would have talked about it in Slack or would have made, or, you know, you just check the SANS podcast. I think it's definitely important to keep up just so you know what's going on.

[20:36] Ayman Elsawah: It's funny. Python, learn Python the hard way. The website no longer the same as it is. So it's no longer free.

[20:42] Norman Weekes: What?

[20:43] Ayman Elsawah: Yeah i can't find it 2020 just keeps getting worse why would they not make that free it was a great yeah i don't know i can't find it anymore so if you find another resource that's like it and maybe walk us through what python learn python the hard way was for you yeah i'm trying to remember what i know

[21:04] Norman Weekes: Really, for me, I really just used it to, because I already had a little bit of program experience. So in Python, it's pretty easy to pick up.

[21:12] Ayman Elsawah: From the gamer heads thing?

[21:13] Norman Weekes: From that and from another boot camp. Oh, okay.

[21:16] Ayman Elsawah: You took another boot camp. Yeah.

[21:17] Norman Weekes: I wanted to be a software engineer at first.

[21:20] Ayman Elsawah: Oh, tell us about that. Yeah, that was early. Yeah. So I forgot about that.

[21:24] Norman Weekes: I was like 20, that was before Merit, that was before all that. I went to General Assembly, tried that out. They would learn after two weeks, they said, you now have master JavaScript. I'm like, no, but eventually it was too fast paced for me. It was really drinking from the hose. And yeah, at that time, it was my first real exposure to coding or anything like that. Yeah, it didn't work out for me, but it definitely helped in the long run, just in terms of knowing how much work it takes to make it.

[21:52] Ayman Elsawah: So it seems like all these little experiences culminated all together.

[21:56] Norman Weekes: Yeah, it's a very off the rails track, but I definitely benefited in a different way from everything I tried out.

[22:03] Ayman Elsawah: And was that software bootcamp after you decided not to go to grad school?

[22:07] Norman Weekes: Yep.

[22:07] Ayman Elsawah: Okay, cool. And then I think you attempted the OSCP a couple of times when I saw you at DEF CON. DEF CON, sorry. Yeah, so I think you've attempted OSCP a couple of times, if I understand correctly. When I saw you at DEF CON, you were talking about it. So walk us through that journey. If you can.

[22:23] Norman Weekes: Yeah, OSCP has been the most, it's a lot like running a lot, because I'm a runner too, right? So the OSCP, because it's a 24-hour test, you have to hack four out of the five machines to get it. And each time I've taken it, I've gotten one more machine than the last time. I've taken it three times and it's shit. I'm really over-preparing this time. I want to do ProHack or Unhack the Box, even possibly considering taking this mentorship class they offer. That's a 13-week course, and they basically just check in with you once a week, ask you many questions. It's daunting, and each time I fail, the first time I was just happy I even got one. Second time, I was a little like, eh, kind of wanted to pass.

[23:04] Norman Weekes: And third time, I just could not pervask on Windows to save my life. I mean, I got four of the five machines I got were Windows boxes, and I found out the hard way that my Windows skills weren't up to par back then.

[23:16] Ayman Elsawah: Was that because the labs had all Linux or was it?

[23:19] Norman Weekes: No, they had some windows, but I just didn't, I didn't get, I should have just gotten more in the labs. I got about half of the machines, all the hard ones. So I'm like, I'm probably prepared enough to fudge my way through it. I definitely should have just practiced more just in the windows command line. Even those commands are just insane compared to Linux. I think in terms of just how intuitive they seem.

[23:41] Ayman Elsawah: Is it PowerShell or straight?

[23:43] Norman Weekes: I was just in straight CMD. Back then, I didn't even know how to send a PowerShell show with Netcat. So I was just doing CMD.

[23:52] Ayman Elsawah: Okay. So looking back, you would say you just didn't prepare enough. Is that right?

[23:56] Norman Weekes: Yeah. And it just got really unlucky. I feel like if I had half Linux boxes, I would have been okay. But I only had one. Yeah, it's just luck of the draw. They switch them out every time. I see.

[24:06] Ayman Elsawah: How are you feeling now with OCP?

[24:09] Norman Weekes: I'm feeling pretty good. I'm not going to lie. I'm about 79% to ProHacker right now. You've earned ranking by hacking machines on Hack the Box. They have 20 active boxes that they rotate. They rotate one every week. So to get to ProHacker, you need to hack 45% of the active boxes and the challenges. So I'm at 37% for overall completion of Hack the Box right now.

[24:37] Ayman Elsawah: Okay. 37. But then the other one was 70 something. What was that?

[24:41] Norman Weekes: That just keeps track of like how close you are to leveling up.

[24:45] Ayman Elsawah: Oh, I see. I see. Gotcha. Just trying to break it down for those that are not familiar with the program. Yeah, it's good. So it seems like it's more of a marathon than a sprint, would you say?

[24:55] Norman Weekes: Oh, yeah. I mean, if you're sprinting through this, then you have a gift and should be happy.

[25:01] Ayman Elsawah: Okay. And so after you get the OACP, what are your thoughts?

[25:04] Norman Weekes: Yeah, that's a tough one. I was kind of thinking about it. I'm like, huh, because I want to sign up for the labs again, end of this month, do about two months of that. That'll take me to about October. Then after that, we'll definitely vacation.

[25:18] Norman Weekes: Yeah, definitely vacation. Don't know where, don't know what will be open, but hopefully something. After that, it's hard. I either want to get my coding skills a lot better in terms of terms of like a long-term planning for the AWE, Advanced Web Application Certificate offered by OffSec as well. But that one, you really got to know what you're doing. So that's long-term. But yeah, probably just get better at a language. Probably just get better at Python or possibly even JavaScript.

[25:46] Ayman Elsawah: Do you do any bug bounties?

[25:48] Norman Weekes: No, not yet. That's a long-term one too. I don't want to start that yet. I don't know if I'm quite there yet.

[25:53] Ayman Elsawah: What's stopping you? No, just jump into it. There's nothing to prevent you from looking at the bounties that are out there and trying.

[26:02] Norman Weekes: Yeah, I could. I just don't know. What that's going to lead to at the moment. I'm kind of more about timing right now. Because if I start it, and if I get one, or if I don't, I get experience, of course, that's the main benefit, right? But besides that, well, I guess it would look pretty good on a resume too. That is a strong resume bill too. But I don't know. Something about bug bounties just doesn't feel right now. Maybe I am ready for it.

[26:28] Ayman Elsawah: I think you're ready for it. I mean, it would be a good change of pace from doing OCP stuff as you prepare. But I definitely would say, like, focus on the OCP. Get that done. Hey, why not? Like, install Burp and... As you're browsing and you see something weird on some janky website, take a look. Even writing to them in security. Just even reporting something. Or even just going through bug bounty reports. I think that's probably just the easiest thing to do. You don't even have to do anything. You just read the bug bounty reports and how people did things.

[27:02] Norman Weekes: Yeah, and I've done that. I've seen... There's definitely some easy wins out there in terms of bug bounties. But yeah, something... I don't know what it is about bug bounty. This isn't... I feel like I just really need to build my skills. But that is a way to build your skills, right? But I don't know, maybe because there's no cert behind it. I don't know. Oh, I see. Yeah, I think right now I'm really just more focused on getting certs and building skills to make sure this is something I want to do.

[27:29] Ayman Elsawah: I see. Yeah, my advice would just be, depends. Where do you see yourself in five years? What work do you want to be doing? Maybe five years is too long, maybe three years. Three.

[27:40] Norman Weekes: I mean, definitely on a red team somewhere. I love researching something and then immediately be able to use it. I love being able to change pace and not just doing the same thing over and over. So I would love to be in a role where, yeah, they just have a lot of different

[27:58] Ayman Elsawah: Yeah, I mean, if you, I guess I'm switching to advice mode right now. But yeah, getting into or being in a consulting position or being a pen tester at a consulting company definitely is, you're always in a new environment all the time. But a lot of the stuff out there, from what I've seen, is web app. So a lot of the work that's out there is all web app. But there is some network pen testing out there.

[28:25] Norman Weekes: Well that lines up with cert i want to get long term after the ocp that one's just web app hacking you got to look at source code getting into debugger things like that so but that's a really hard cert from what i hear so like i said i really want to master a language before i go that route gotcha that's good you said you play with python have you played with go at all too Go, no, the only Go related thing I've used is Go Buster. That's, which is a great tool, but yeah, I've not looked. Go Buster, it's just a directory brute forcing tool. You basically just run it against the URL and it'll run through a word list and it will just find directories. Yeah, it's a good alternative. So when I first started, I was using something called Derb, which I forgot what language it's written in, but it's significantly slower than Go Buster.

[29:16] Norman Weekes: And I've heard that's because it's written in Go and that's just a faster language.

[29:20] Ayman Elsawah: Gotcha. Cool. Cool. So what is some advice out there that you'd recommend for folks out there that are trying to get into the industry?

[29:29] Norman Weekes: Don't... Quit, but then don't permanently quit. Like it's okay to go after something you're unsure of if you can get, which is what I did with the OACP. That was my first or my second certification I attempted. I didn't really have that much experience at the time, but I knew going that in that even if I failed, I would learn so many skills, which I did. So I'd say really just go set the bar high and don't be afraid to fail.

[29:56] Ayman Elsawah: Okay. Yeah. Are you referring to just certs or jobs? When you were applying for jobs, I guess you were applying for a lot of jobs. Actually, let me step back. So like, how was your job application experience?

[30:09] Norman Weekes: It was rough. I applied to quite a few. Most of them, you know, that felt like the interview went well. They said the interview went well, but I wouldn't hear back. And it really wasn't until I got referred to jobs that I really started getting anything out of it. So I say as hard as it is in these times, network as much as you can. Talk to people. It's real easy to get in that zone, that shell of just work, work, work. But networking is just as important.

[30:36] Ayman Elsawah: Okay. And you were referred by who? One of the... Like people you met at these networking groups?

[30:42] Norman Weekes: One at the contracting job I had before Salesforce, actually. I met him there. We were just talking about the OSCP and he was thinking about taking it too. I'm like, oh yeah, I'm taking it now. He's like, wait, what? You like just started in the industry. You're going right for the OSCP. I'm like, yeah, it seems fun. Why not? Nice. Yeah. And then, yeah, from there, you know, we just walked, had lunch one day and yeah, eventually he said, hey, there's an open position here if you want to apply. I'm like, yeah.

[31:08] Ayman Elsawah: And so what kind of positions were you applying to?

[31:11] Norman Weekes: Anything they had really. I don't know if they're I wasn't like, okay, I wouldn't do that. I was more like, I just need to get in the field. What were the positions? They were just blanket security engineer positions and then just like a different job description. I can't recall any specific position I applied for back then.

[31:30] Ayman Elsawah: And would any companies tell you why they didn't go with you?

[31:34] Norman Weekes: One said they were looking for someone with more experience, which I'm like, eh, all right. But besides that, let me think. Yeah, no, not really. They just said, yeah, we can't hire you at the time. It's pretty general reasons.

[31:49] Ayman Elsawah: General reasons and you just were left to kind of guess to figure it out.

[31:52] Norman Weekes: I think you just, I mean, you don't need a referral, but if you don't, I feel like you definitely need either decent job experience or some type of certification that holds a good amount of weight. Oh, I see. Yeah.

[32:05] Ayman Elsawah: And yeah, is there anything else you wanted to cover?

[32:10] Norman Weekes: Let me think. Nothing is jumping out at me.

[32:16] Ayman Elsawah: Let's see.

[32:18] Norman Weekes: Box, OSCP, next plans, told people to network. Yeah, no, I think that bot does it for me.

[32:27] Ayman Elsawah: Okay. Well, Norman, this has been informative. I think a lot of people can definitely relate to your journey and some of the struggles and some of the things that you've been trying to accomplish, kind of just a jig-jag throughout the career. Any parting advice for folks out there?

[32:45] Norman Weekes: I feel like now's the perfect time to really get after it, right? I mean, pretty much everything's shut down. Really no reason not to just get in a good routine and go after whatever cert or whatever job you want so i say you make the best of this situation awesome well thank you so much and look forward to meeting again in person at some point yeah one of these days yeah all right thanks a lot norman cool thanks

[33:11] Ayman Elsawah: Hey, thanks for listening. So I built a lot of things and I'm building something new. I'm working on a new community. I want to bring everyone together with all the things that I've done into just one space. So I'm really excited about it and would love to stay in touch and get some early adopters or feedback. So check out the link below in the show notes and send me a hello. And that's about it. I hope you're having a wonderful day. Thanks. Talk to you soon.