Episode 28 · · 31 min
Page Glave Professor of Kinesiology to Cybersecurity Analyst!
Cybersecurity analyst at a large K-12 school district
Episode summary
Page Glave was a tenured Associate Professor of Kinesiology with a focus in exercise science and was successful in her field. However, she came to the realization that she can't see herself doing this for the rest of her life. She offers lots of great advice on resume tips when switching, homelabs, certifications, and how she was able to break into the field. This is her story.
BIO
I am an analyst, project manager, ethical hacker, and tech consultant with more than 10 years’ experience with research and project management. I spent a while in higher education – long enough to get tenure and decide it was time to do something else. I have eJPT (eLearnSecurity Junior Penetration Tester), Security+ and Splunk User certifications. I love learning and tech, so digging into all of this stuff just makes me happy.
Notes:
5-months into her first security job!
Being in a small environment, she gets to do everything from governance to pentesting
Previous to this, she was a tenured associate professor in kinesiology, focusing on biomechanics and obesity.
Quotes:
"Pretty big adventure on a daily basis because no day is the same."
"Really is an environment where security is everyone's job."
"I think I'll always be in-house tech support for as long as I live." [7:08]
"I kinda got bored… I didn't want to keep doing something that wasn't challenging." [7:28]
"Do I really want to do this for the next 30 years?" [7:58]
"…going through the headers, that should have been a clue that maybe tech would have been a good fit for me."
"You'd be hard-pressed to find anyone in Information Security who was just thrilled with their budgets."
"Being able to translate that self-directed learning to something on my resume."
Before infosec: Tenured associate professor of kinesiology
Chapters
- 0:00
Intro: Page's switch from academia
Ayman previews her move from tenured professor to security and her resume tips.
- 1:31
Working security at a K-12 school district
Page describes governance, scans, pen testing and a team where security is everyone's job.
- 4:22
Leaving a tenured kinesiology career
She explains her ad hoc IT background, boredom and the 30-year question.
- 8:30
Self-study: labs, books and book clubs
Hack The Box, VulnHub, The Hacker Playbook 3 and the Breaking Down Security Slack helped her learn.
- 11:37
Meetups, conferences and the honeymoon phase
Networking in Houston and conferences gave her confidence and energy.
- 14:27
Interviews and job descriptions
Page talks about mock interviews, uncertainty about tools and confusing job postings.
- 17:04
A convincing phish and K-12 security challenges
She describes a Gmail-style credential phish and the insider threat from students.
- 21:08
What landed the job and how she reordered her resume
Self-directed learning, free resources and a skills-first resume made her case.
- 26:36
Blogging walkthroughs to learn and interview
Writing up labs deepened her understanding and helped her explain her work.
- 28:07
Certifications versus degrees
She calls certifications a useful tool for career switchers but not a replacement for skill.
- 29:32
Parting advice: avoid burnout
Keep learning but make it sustainable and take breaks when needed.
- 30:49
Closing plug for Ayman's community
Ayman invites listeners to join the new community linked in the show notes.
Key takeaways
- Build a home lab, such as an Active Directory domain, and work through Hack The Box, VulnHub and book exercises to gain hands-on skills.
- Reorder your resume to lead with a skills section and a list of security activities when your job title looks unrelated.
- Write up your lab walkthroughs publicly, because explaining the work helps you learn and interview better.
- Network at local meetups and conferences, which can confirm your direction and lead to resources like resume reviews.
- Treat certifications as a strategic tool for career switchers, and pick ones that match where you want to go.
- Make learning sustainable and step away when needed, because burnout is real.
Notable quotes
You just have to do something that gives someone a reason to take a chance on you.
If you can't show potential, then you're never going to get a chance to get your foot in the door.
Just make it something sustainable because burnout is real.
Questions answered in this episode
- How did Page Glave get into cybersecurity?
- Page was a tenured kinesiology professor who studied for about eight months using labs, books and book clubs after attending HouSecCon in 2018. She landed a security role at a K-12 school district.
- How should a career changer write a security resume?
- Page reordered her resume to start with a skills section and an activity section describing her home lab and projects. This made her security interest visible even though her job history was unrelated.
- Are certifications worth it for career changers?
- Page says certifications are a good way to show ability if you are breaking in or pivoting, and are less important once you are established. She advises choosing them strategically rather than collecting many.
Show notes and links
Show the original episode notes
Page Glave was a tenured Associate Professor of Kinesiology with a focus in exercise science and was successful in her field. However, she came to the realization that she can't see herself doing this for the rest of her life. She offers lots of great advice on resume tips when switching, homelabs, certifications, and how she was able to break into the field. This is her story.
BIO
I am an analyst, project manager, ethical hacker, and tech consultant with more than 10 years’ experience with research and project management. I spent a while in higher education – long enough to get tenure and decide it was time to do something else. I have eJPT (eLearnSecurity Junior Penetration Tester), Security+ and Splunk User certifications. I love learning and tech, so digging into all of this stuff just makes me happy.
Notes:
- 5-months into her first security job!
- Being in a small environment, she gets to do everything from governance to pentesting
- Previous to this, she was a tenured associate professor in kinesiology, focusing on biomechanics and obesity.
Quotes:
- "Pretty big adventure on a daily basis because no day is the same."
- "Really is an environment where security is everyone's job."
- "I think I'll always be in-house tech support for as long as I live." [7:08]
- "I kinda got bored… I didn't want to keep doing something that wasn't challenging." [7:28]
- "Do I really want to do this for the next 30 years?" [7:58]
- "…going through the headers, that should have been a clue that maybe tech would have been a good fit for me."
- "You'd be hard-pressed to find anyone in Information Security who was just thrilled with their budgets."
- "Being able to translate that self-directed learning to something on my resume."
Links:
- Page's Twitter: https://twitter.com/pageinsec (Thank her via Twitter)
- Breaking Down Security Podcast: https://www.brakeingsecurity.com/
- Pacific Hacker's Conference: https://phack.org/
- Sam Bowne's Class: https://samsclass.info/
- Skadi VM: https://www.skadivm.com/ (by Alan Orlikoski https://twitter.com/AlanOrlikoski)
- Marco Palacios: https://twitter.com/MPalacios_Cyber
- Keirsten Brager: https://twitter.com/KeirstenBrager
- Intro Music: https://trash80.com/#/content/133/weeklybeats-2012-week5
- Outro Music: https://www.youtube.com/channel/UCNXDIltPLbdcAavUtL00i7g
Getting Into Infosec:
- Follow Me on Twitter: https://twitter.com/coffeewithayman
- Subscribe To YouTube: https://www.youtube.com/channel/UCg6gV_gdfc188HZdN8LUx4A
- Checkout My Book: Breaking IN: A Practical Guide to Starting a Career in Information Security
- Sign up for updates and commentary: https://mailchi.mp/467573a314e5/gettingintoinfosec
- Website: https://gettingintoinfosec.com
See omnystudio.com/listener for privacy information.
Mentioned in this episode:
Full transcript
Transcribed from the episode audio. Spoof ads (Ayman's parody commercials poking fun at the industry) are marked.Download .txt
You know, when you sit in your office and you look around and it's like, do I really want to do this for the next 30 years? And you just kind of get that sense of, no, no, I do not want to do this for the next 30 years and
Welcome to Getting Into Infosec. I'm your host, Ayman Elsawah. My guest this week is Paige Glaive. Paige was a tenured adjunct professor of kinesiology when she realized this was not what she wanted to do forever.
Finding that I was really enjoying the statistical analysis and the programming aspects of that more than the kines side of things. It's like, okay, well, maybe I need to do a little bit more of that outside and formalize what I've always done and implicitly just find better choice.
When trying to switch, she got creative about her resume. What are your resume?
Is what you're seeing on the front page is a job? It seems very unrelated.
I think you can help increase your odds a little bit though.
We also discuss things you can do to help employers see that you're committed or interested in the field.
You just have to do something that gives someone a reason to take a chance on.
And tactics for getting in the door.
If you're talking to somebody in cybersecurity and they can't really talk about their home lab, that's a bit troubling, especially for someone trying to break in because if you don't have systems to work on at work, how are you getting this experience? I would like to say that helps me break into the field.
All right. On to the show. Hi, Paige. Welcome to the show.
Hi. Thanks. I'm happy to be here.
Great. Yeah. Thanks for coming on. So from what I understand for listeners out there, you're relatively new to the information security field. Is that right?
I am. I've been officially in information security only since February. So I guess I'm up to five months now.
That's awesome. Well, congratulations. Welcome.
Thank you.
Yeah. So maybe you can give folks a little background on what you do today and how you got into the field.
So today I'm involved with the information security for a large K-12 school district, which is a lot of fun. You get to see a lot of different sides of things. It's I think we often don't think about schools as a critical target.
Yeah.
But when you look at the technology that most K-12s have and the number of users, it's really a great environment to work in lots of advantages. And one of the things that I like best is I get to play with a lot of different things. We have a much more A much more varied environment than I think you get in a lot of corporate settings. And that makes it a lot of fun for me. So I get to do everything from governance and policy development to pen testing. And being able to play with all the toys, get your hands on all the things is probably the favorite part of this job for me because it's really a pretty big adventure on a daily basis because no day is the same.
Nice. And well, I mean, it seems like every day is different for you.
I'm fortunate to be kind of in control of my schedule. So one day I may focus on working on developing our government's framework. Another, I may work on going through and doing bone scans on all of our external facing IPs. And then you also have the triage aspect when something doesn't look right. So it's nice to be able to touch on all the different pieces of the industry right now.
And is it a big team that you work in? Does everybody have, you know, similar roles?
The IT department is, I think, fairly large for a school district. But in terms of cybersecurity, we have a pretty small team, but I'm fortunate to have very security minded folks in other areas. We have a really solid infrastructure and
Who have really strong security mindsets. So it makes my life a lot easier when it really is an environment where security is everyone's job. It may be my primary job, but I think we do a good job of keeping it at the forefront of everybody's mind.
Yeah, there's something to be said about being in an environment where other co-workers have that security mindset and you're not just the only one out there. You know, it's a really good support system, wouldn't you say?
It is. And what I like is being able to bounce ideas off of other people. You know, sometimes having a focus team is great, but I think you can get a little insular and it's nice to bounce your ideas off of other people. I would, of course, take a bigger team. But for the situation I'm in, I think I'm really fortunate to work with some really great people.
Great. That's awesome. And so I met you before you were in information security. So, you know, walk us through how life was before you got this job. Interviews or trying to study and things are going. And, you know, what made you want to go into this field?
Well, I do have kind of a humorous background, I guess. So I think when we first started talking, I was a tenured associate professor of kinesiology with a specific focus on exercise science. My main areas were biomechanics and obesity. So not a lot of obvious overlap there. But for me, technology has always been a big part of my life. And with my specific focus, I did motion capture and things like that. So I was in a position where a lot of times I kind of functioned as an ad hoc network administrator with making sure that our systems are functional and doing what they were supposed to do. I'd taken basic in high school and learned...
That and i'd always enjoyed it and were you the go-to person when things went wrong yeah i was you know in-house tech support right it's funny because i'm like that i think i will always be in house tech support for as long as i live that's like i'm not getting my gmail messages right the internet is down yeah the internet is down i can completely fix your isps problem 500 miles away but You know, that's IT life, I guess.
Right.
But it's always done that, been responsible for that side of things. And then as funny as it sounds, I just kind of got bored. You know, I love teaching. I love doing research, but I didn't want to keep doing something that wasn't challenging.
Were you at the top of your game at that time?
You know, it's, it's hard to define top of your game. I was doing well. I was on track to go up for full professor in a few years.
Oh, okay.
You know, in academia is kind of, I guess, top of your game.
Right.
But I was at a regional, I was at St. Houston state and I really, I really did enjoy it and loved a lot of things about it. But you know, when you sit in your office and you look around and it's like, do I really want to do this for the next 30 years? And you just kind of get that sense of no, no, I do not want to do this for the next 30 years.
Okay.
Doing statistics because that's a big secondary area for me and finding that I was really enjoying the statistical analysis and the programming aspects of that more than the Knie side of things. It's like, okay, well, maybe I need to do a little bit more of that outside and formalize what I've always done and implicitly just find better toys. Right. Because it's hard to justify a high-powered laptop when you're just writing documents.
Right.
But... Kind of got to that point where I'm like, oh, I need something. I need something else. And looking at academia, your trajectory is basically become full professor. And then if you want to advance anymore, it's go into administration. And looking at what deans and department heads and all that is not something that held a lot of appeal. Not saying that I would never consider going into management because I do enjoy project management and that sort of thing. But it was in the academic setting, you completely get away from kind of why you go into it in the first place. And, you know, sitting there going, well, I could do data science. I like that. But I also really like the security side of things.
I like breaking things. I like fixing things. So that was a good fit and stuff that I'd always done a little bit of on the side. I remember having Outlook Express back when it was kind of the thing or one of the things you could do email with. Levy virus came through and those things back in the early 2000s. Getting into Outlook Express back when you could right click on an email and pull up the entire email in its text format and going through the headers and things like that. That should have been a clue that maybe tech would have been a good fit for me. Basically just started studying as much as I could and jumping into things and was fortunate enough to get a ticket through a friend of a friend of HUSECON in 2018 and kind of decided at that conference oh yeah this
Is the direction i'm going to go into nice and just kind of studied my full head off for the next eight months or so and have continued that but yeah what kind of things did you do when you're you know quote unquote studying what are the things you did so i spent a lot of time on cyber and i've done a lot of bone hubs and pen test labs and all of these really cool online resources that
So those were big ones. You know, hack the boxes has come up several times. I've done some book clubs that have really been helpful at going through the hacker playbook three chapter by chapter and writing that up. And that was really educational because one of the aspects of it, you go and build out an active directory domain. And if you can do that on a small scale, it really helps prepare you to do it on a larger scale.
You said book clubs. How did you find these book clubs or like these like meetups and stuff?
Well, this one was actually through another podcast. Okay. Breaking Down Security. And they have a Slack and I just kind of jumped in there and found a book club. Nice. Yeah, it's a good resource. I think we're fortunate at this point in time in information security is that we do have a lot of really great resources. Resources for people to learn from yeah they're good folks i met i think it was brian blake at DEF CON last year really cool guy yeah they're good people yeah they are and there's a lot of good people on the slack that you know they'll help with resume reviews and things like that and then awesome do a ton of podcasts really i will say i wish your book had come out like six months earlier
Hey, what's up? I just want to step in here for a second and just let you know that I did not solicit this from Paige at all. She came up with this on her own. So there was no solicitation or anything about the book at all before recording. I mean, I do appreciate her comments, but yeah.
Really, I will say I wish your book had come out like six months earlier.
Because I think for people looking to get into it, it's such a concise overview of those insider things that it's a really great resource too. I've kind of been like, okay, if you really want to know about getting into information security, listen to these podcasts, read this book. It's crazy because there's so much information out there and it's channeled.
Yeah, I appreciate that. You know, I'm not trying to plug here, but I did write it, you know, for someone who's trying to start from zero. I really like all the stuff that's out there. I wish that was available for me when I was trying to get in.
Yeah.
But I think now it's kind of overwhelming, all the stuff that's out there. And so I wrote it in such a way that it's kind of a methodical step by step. But anyway, I don't want to talk about my book.
Yeah, it's a big thing. And then we can stop talking about it. Probably the thing in there that would be most, I hate to say most valuable, but was incredibly valuable is talking about the different roles and different aspects of information security. And I think it's easy to see information security and just think it's pen testing.
Oh, my God. Such a pet peeve of mine.
Exactly. Yeah.
You know, I want to do infosec.
Right, right.
Good luck with that.
Yeah, it's almost as bad as the black or gray hoodie.
Yeah, exactly. Yeah, but it's a hard thing to kind of learn the ins and outs of an industry without being in it. And I think you've just got to kind of put yourself out there. Meetups are great. Being in the Houston area, there's some really good ones. And I was fortunate, fairly early. Early to go to one and Kirsten Brazier was talking about it and met a couple other women there that we've kind of been supporting each other as we either continue in information security or get into it. And those in-person networking things I think are invaluable, both getting in and then after you are in.
Absolutely. I mean, you said it yourself when you, I think you were thinking about the field, but until you went to that one conference in 2018, right, is when you're like, okay, I can do this or I want to do this. Yeah.
Yeah, that was, it was, I'm pretty sure I want to do this.
Right.
I have no idea how long it's going to take me to learn what I need to know, you know, to take the foundation that I have and learn enough to actually do the job and then going to Hughes at Con. Okay, yeah, I know I have some gaps, but I feel like I can fill them in relatively quickly instead of going and going, oh, there's no way I could do this.
Yeah. And even for folks who have been in the field for any number of years, I think conferences are a good way to re-energize because... You kind of get drained because security is sometimes almost a lot of times an uphill battle, depending on the environment. And going to a conference just kind of helps reenergize you and kind of reinvigorate you, in my opinion. I don't know.
Oh, yeah, definitely. And it's I made the comment, I think last week, like, you know, being in
Morning thinking, okay, is this the day that everything's going to hit the fan? I didn't mean it in as pessimistic way as it sounded because that challenge is part of what I like about the job. But it does wear you down. You do this for, I can imagine, five, 10, 20 years. And there comes a point where waking up and going, man, today could be the day where everything falls apart. It's no longer challenging. It's completely disheartening and
Are a great way to help save that off.
Yeah. So you've been in the field, quote unquote, for what, five months? Yeah. Are you still feeling the honeymoon period or is it wearing down on you?
I think it's still pretty much the honeymoon period.
Okay.
And who knows how long that may last, but it's one of those where you get to come in and you're learning so much.
Yeah.
I don't really have time to sit around and be like, wait, is this what I thought it was going to be or Is this what I want it to be? And being in a little different position, I think, than a lot of people who transition over mid-career, I still have a lot of autonomy. And I'm able to have more control than say in what I do than maybe your typical SOC analyst. And I think that's been a big advantage for me from coming from a place where I didn't really have anybody who was kind of telling me what to do on a day-to-day basis.
Yeah. And how was it getting into the field? Interviews? Can you walk us through some good or bad interviews that you had and your experience in that?
I had a couple of phone interviews and then the job that I got was my first in-person interview. I think the interview process is about what you're going to expect in anything.
About tech that you just don't know like have you worked with this piece of technology and you're Mm-hmm.
Like no i've worked with this that i think is kind of sort of similar even though i don't think it Really is and that uncertainty i think is always a little traumatic but at the same time it's Impossible to know all the tools in the field just there's no way yeah and And the big thing for me with interviewing, doing some, I did some mock interviews and resume interview and that helped a lot that just being able to go and talk to people about infosec, you know, I thought it was fun. It's like, okay, I'm going to go on an interview, but I'm talking about the stuff that I really enjoy. So it doesn't necessarily matter if I get the job or not, because I get to go geek out for a little bit. You know, that's certainly a position of privilege because I was in a job that I may not have enjoyed as much as I once did, but it wasn't.
Job. So I didn't have to have that kind of fear of not getting a job. I knew I could hang out in my current one and do the job well, but also knew that it was coming to an end. Trying to think if anything else stands out, you know, it's just being prepared, doing your homework on the companies, knowing what you're getting yourself into. And I still kind of chuckle at job descriptions. You look at them and you're like, obviously HR wrote this because These certifications do totally different things. And I like seeing that you could have SecPlus or a CISSP, but that also tells me you don't really know what you want.
Yeah. Like having three to five years experience for a junior position. Really?
Yeah. We will take SecPlus or CEH. It's like those, okay, I understand there's both kind of entry-ish level certs, but very different focus.
Young in some ways that we don't really know what we want in job descriptions a lot of time. That's a tough thing to write.
Absolutely. Yeah. Any bad interviews?
None that I left just going, wow, that was horrible. And I may be fortunate that I don't mind public speaking and I'm usually okay talking to people in those interview settings. I listen to one of my phone interviews just going, I don't even know why you were talking to me because you're looking for somebody with five years of experience on a specific tool. And I don't have that. And I can't think of anywhere where I may have given you that impression, but it's a good learning experience.
Yeah, I think with every interview, there's always something to add. I sometimes tell folks, interview jobs that you don't plan on getting or you don't want to get just to get the experience. Yeah. After a couple then save the interviews for the ones you want to get because then you're really built up yeah get the awkwardness out of the way right early exactly yeah awesome any war stories that you can talk about publicly talk about i could i think i can talk about this one it's amazing to me how good fishes are getting because it's always kind of i guess fun
I can't believe people fell for that. We had one come in and we were collateral damage. I don't think we were the specific target, but cred harvesting thing. And looking at it, it was exactly the way that Gmail abbreviates messages. So, you know, when you view a message on your phone in Gmail.
Mm hmm.
Or a long thread in Gmail web access, and it'll truncate them and basically just say message clips.
Oh, yeah.
It was indistinguishable to the human eye.
Oh, wow.
That it was different. And it was sad because I'm sitting there going, this was really well done. Seriously, this was a great phishing campaign. And it's like, I wish you would not be so excited about this. I'm like, no, I mean, we shut it down.
That's funny, isn't it?
This was a really well done one. And then the same week I got one on my personal email, looked exactly the same. And I'm like, you've got to be kidding me. I'm like, okay, I have to click on this because I have to see if it's actually that. No, it was the real one, but looked exactly the same. The only difference was the legit ones, instead of just expanding to show you the message, the fish took you to a sign-in page. And that was a pretty ingenious campaign. And I completely understand how people fall for it, because when you're checking email on your phone, it's not unusual to click on a link or something like that and get redirected to a login page.
Right. Yeah. And, you know, what are some unique challenges that you're facing in the K-12? I know I had Jared on before and he runs OPSEC EDU, like a nonprofit for security and education industry. So, you know, what are some unique challenges that you're facing there? Yeah.
Probably the biggest one is, you know, we have all of the students who are old enough to really be online are a huge insider threat. It's a little bit different type of insider threat than you get in the corporate world. But yeah, it's just like, think about it for some of us. What would we have done sitting with a laptop in front of us for eight hours a day?
Right.
And high speed internet access.
Oh, man.
I mean, I can just imagine. And it's like, oh, these kids, like, it's hard to resist that. So the number of insider threats is a challenge. One of the other things that's kind of unique is in the typical corporate world, you see maybe two or three login floods a day where you've got just everybody getting on their system. And maybe the start of the workday and then again at lunch in the K-12 space, you're likely to see that in higher education as well. You see that almost hourly because as people transfer classes or shift classes, they're shutting down and then reconnecting. So you have to kind of norm your environment differently to deal with that. You know, when you're dealing with a large industry sized environment on a sled budget, that's
Of course, a challenge as well. But I think you'd be hard pressed to find anyone in information security who's just thrilled with their budget. So that's probably not unique.
Right. Yeah. And have you ever had to work with law enforcement in the time you've been there?
Not yet.
Mm hmm.
I know that it can happen. And we do have an internal police department.
Oh, really?
A big ISD is basically a city. And we have 40 plus different sites and a lot of challenges associated with that sort of thing. But no police involvement yet, thankfully.
Okay, that's good. Cool. And so what are the top three things that helped you in particular in landing where you are right now?
Probably the biggest one is just being a very self-directed learner because being able to go out and research and that research background certainly paid off because I was able to dig in and find resources and find free trials of things or free tools online. That I could learn as much as possible. So that just being a self-motivated learner. And I think that holds for the industry in general. The second thing would be using the free resources, the online resources.
And Professor Messer and all these other things, you have a ton of tools at your disposal. So you have to have that motivation and then you get the resources. And then the last thing that I think helped me was being able to translate that self-directed learning Into something on my resume. And that seems to be something that as I'm involved in hiring now, that I'm seeing some disconnectives. If you've built up a home environment where you've set up Active Directory and you have run different pen testing scenarios, that needs to be on your resume as you're trying to transition in to demonstrate that you have those hands-on skills.
Yeah. Where does someone put that in the resume though? That's kind of a tough place to put.
So for me, when I was interviewing, I basically turned my resume on its head.
Okay.
Instead of leading with employment, which is I think your norm, my resume started with kind of a skills section.
Okay.
And then for my current job at the time, I picked out items that were relevant to my
Like with research studies, data security comes into place and risk management. So I highlighted things like that.
Oh, interesting.
Then I also had an activity section where I talked about, I've worked through this book. This is my home environment. This is the setup that I have. These are some of the tools I've worked with. I wasn't coming into it as, oh, I want to do information security and I want you to hire me so I can learn how to do it. It's, I'm learning, I'm doing, I'm just not getting paid for it yet. And that's one of the things that I heard on, and I don't even know where at this point, podcasts or whatever. It's if you're talking to somebody in cybersecurity and they can't really talk about their home lab, that's a bit troubling, especially for someone trying to break in. Because if you don't have systems to work on at work, how are you getting this experience?
I would like to say that helps me break into the field.
Okay. Yeah. I think employers want to see that you've taken some initiative to start some of this on your own.
Yeah, definitely. And I think not being afraid to reorder your resume is important because when you're just looking at resumes and you're having to do it so quickly, if all you're seeing on the front page is a job that seems very unrelated.
Yeah.
You're going to have trouble getting looks, but if you can find a way to highlight the work you're doing with information security, I think you can help increase your odds a little bit. Though, realistically, probably the best thing you can do is network and talk.
System. But making sure your resume is on point has got to help.
Yeah, I think that's a really great piece of advice. Just reordering your resume so that it highlights right in the beginning what is relevant to the job. Because if you're trying to be a career switcher, you know, being a specialist in exercise science might not be directly... No.
I would hope that people look at that and go... This has nothing to do with this job. What are you thinking? Because that's kind of my fault about it. So I had to really be mindful of that and show, well, how does what I've done connect with this? And how have the things that I've done in the past prepared me to work in this field? I bring the things every day that benefited me going through and getting a PhD. You learn certain skills.
To work every day. It may not look exactly the same, but being able to relate that to information security, I think helps me quite a bit.
Yeah. And it's kind of like a tournament, right? At the end of the day, the resume, you're trying to just get that first phone interview. And then after the phone interview, you want to get to the next stage and in-person interviews. So these are all part of the steps, right? You know, the
You just have to do something that gives someone a reason to take a chance on you. And when you turn in a resume that may look very much like what you've turned in the past, it doesn't give anybody who's looking to interview a reason to say, this person may have potential. That's one of the things that you see as people debate the whole, is there a talent shortage in cybersecurity thing? Well, is it or is it other issues? Is it just people... There's a job shortage, there's a skill shortage, but a lot of people talk about wanting to hire on potential and enthusiasm and talent. But you have to give the people who are looking for that a reason or justification to at least interview. And if nothing, there looks promising.
If you can't show potential, then you're never going to get a chance to get your foot in the door.
Yeah. So let's talk about two things. One, your blog, you have a lot of walkthroughs on your blog. Would you say that helped you in getting into the mindset, right? Like writing up the walkthroughs of activities you did? Oh, definitely.
You know, it's one thing to read a book or to go through some tutorials and, oh yeah, I get this. But then when you're writing it up and putting it out for public consumption, even though we
That it's solid and put it in a way that people could understand. One of the targets that I have is other people trying to break into information security. I want to give them enough information to get where they need to go, but not so much that they don't have to do some research on their own. And being able to communicate that, I think also really helped me prepare for interviews because I'd already written down what I was doing. And once you've written it down, talking about it becomes much easier.
Yeah. Just like anything, if you want to really learn something, teach someone else that item and you'll learn so much faster and thoroughly. So that's good. I recommend everyone check out your blog, apageinsec.wordpress.com. I'll have the link in the show notes. Thanks. One last thing, you know, it's always controversial, but I do see it listed in here about me, but certifications. What's your hot take on certifications?
Oh, that's...
So controversial.
Certifications versus degrees. No, that's...
I think it really depends on who you are and where you're at in your career. Because for me, I wasn't going to invest in doing a degree while I was working in another industry. It wasn't to me the right thing, but a certification was a good way to demonstrate that. If you're in the field, you're working your way. And you're not having trouble getting into the roles that you want, certifications probably aren't that important. And degrees may or may not be depending on the situation. But if you're trying to break in or you're trying to pivot in your career, as much as we like to malign certifications, it's a good CYA thing for the people who are hiring. And unfortunately, I don't think we'll ever completely get away from that gatekeeping.
You know, if you're just a prodigy who can do whatever they want behind the keyboard, Probably don't need them. You may be able to get away without them for a good deal of time. But if you need something to demonstrate ability or give some people some confidence or reasons to call you in, they're a good tool for that.
There you go. It's a tool.
It's a tool just like anything else. And you should use them strategically. I see people sometimes with certifications and 20 different things and Ooh, that would be fun. But you also have to think about where you want to go. Is a particular certification the best for getting you where you want to go?
Really well said. I really appreciate that. Thanks.
That's a soapbox topic right there.
Yeah, it is. Any parting words and advice for folks out there?
I think the biggest thing is just keep learning and know when you need to step away. It's easy in infosec for it to turn into a 24-7 job. And you have to keep learning or you're going to fall behind. But it's OK to take a day or a week or a month and just step back and enjoy life and get back into your normal learning routine. Just make it something sustainable because burnout is real.
Yep. Did you experience any burnout when you were learning?
Not really with learning. I've had burnout in the past. I kind of know what to look for with it. And when I get to the point where I start to recognize.
Just putting it aside. And it's hard because you want to learn everything and you want to get better and you want to do things. But there are periods of time and periods of your life where it's, you know, I'm going to do my learning and do my job. And outside of work hours, I need to be focused on other things. And it's just getting to know yourself well enough to know whether that's an excuse or a need.
Interesting. Well said. Thank you. Well, Paige, thanks for the words of wisdom. It was really fun talking with you.
Oh, thanks. I've enjoyed it.
And yeah, look forward to meeting in person.
All right. Yeah.
Awesome.
Sounds good.
All right. Thanks. Hey, thanks for listening. So I built a lot of things and I'm building something new. I'm working on a new community. I want to bring everyone together with all the things that I've done into just one space. So I'm really excited about it and would love to stay in touch and get some early adopters or feedback. So check out the link below in the show notes and send me a hello. And that's about it. I hope you're having a wonderful day. Thanks. Talk to you soon.
