MAINSAIL Group’s Post

Just came across this must-read article detailing the career in Incident Response (IR) within Unit 42. For those curious about what it takes to succeed in IR or looking to advance their career in Unit 42, this piece is packed with invaluable advice and perspectives Palo Alto Networks Unit 42 Palo Alto Networks #lifeatpaloaltonetworks

Question for anyone out there either running or working in an IT security operations team: What kind of changes to the team personnel have you seen in the last 2 years? I am used to seeing a blend of security analysts and security engineers. Most of the tasks happening between those team members will include: -Developing/implementing security controls -Direct incident response -Vuln Mgmt/Attack Surface Mgmt -Running the security stack (email/endpoint/cloud) -Detection/SOAR development and log collection oversight Am I missing something in my world view that needs to be factored into a more future-proof team design, or even a change to the types of work I expect to be done within a SOC team?

So what makes a CV stand out? It’s the ability to effectively highlight the tangible outcomes and impacts of your contributions, demonstrating how you’ve improved the company or environment. If you’re an incident responder, your outcomes might look like this: 🔹 Developed IR playbooks with IBM Resilient to cut response times by 30%, enhancing rapid threat mitigation. 🔹 Used CrowdStrike Falcon for forensic analysis to speed up incident closure by 25%, reducing the impact of breaches. 🔹 Automated routine incident management tasks with Splunk Phantom, saving up to 40% of time for strategic security analysis. Understanding and articulating your impact and outcomes is crucial in showing a hiring manager how you can add value to their team and organisation. If you’d like some support with this, send me a DM and we can arrange some time to go through your CV😊 #CyberJobs #BlueTeam #CVBuilder

#hirethishuman Hello LinkedIn community and all those in my network. I have the pleasure of recently connecting with Robert Fernandez after engaging on a post about attitude and integrity, and how that relates to customer service and support. How you conduct yourself professionally matters. Robert exemplifies the best of professional integrity, and believes in delivering white glove, top shelf support to the customers he serves no matter how difficult the issue or customer. I'm making this Call To Action from my network to help Robert find his next dare-to-be-great opportunity: "I am a dedicated Technical Support Professional with a passion for problem-solving and a proven track record in technical support. My experience includes providing first-level technical support for industry-leading companies such as Q2 Software and Eagle Eye Networks. I excel in maintaining effective relationships with clients and possess in-depth knowledge of various technical tools and procedures. My experience extends to database configurations, troubleshooting, and ensuring seamless implementations. I am adept at communicating technical information to clients and customers alike and have a strong foundation in network hardware and commands. With certifications in CompTIA Security+ and ongoing progress in CompTIA Network+ and SQL, I am committed to staying current in the Technical Industry. Education-wise, I hold a Cybersecurity Certification from the University of Texas at Austin, along with a Bachelor of Science in Criminology from Texas A&M University-Kingsville. My background equips me with a multidisciplinary skill set, essential for navigating IT, networking, and information technology. I thrive in collaborative environments, bringing strong communication and organizational skills to every project I am assigned. My goal is to leverage my technical experience and problem-solving acumen to drive success in the fast-paced world of technology." #networkoperations #technicalsupport #professionalintegrity #allclassalltheway

Your infrastructure is already compromised. So is ours. And, indeed, any that fundamentally interacts with the outside world. Rare exceptions might be specially guarded isolated nodes with air-gaps, where every terminal's USB ports are filled with epoxy, and an unfriendly security officer stands watch. When it comes to normal business operations involving real people, prepare yourself for the inevitable: you will be attacked. Moreover, if all still seems well, you probably just haven't realized it yet. According to IBM research, it takes organizations an average of 187 days to discover they've been hacked. Every additional day a successful attack goes unnoticed increases the damage and the attacker’s control over the infrastructure. IBM's report also states that the average cost of data breaches in 2023 was $4.45 million. Yes, the numbers might be less staggering for smaller corporations, but the outcome will hardly be less painful for the business. Schedule a free consultation with our experts at WiseOps to discover how we can strengthen your defenses and minimize potential risks. Secure your infrastructure before it’s too late. #WiseOps #DevOps #SoftwareDevelopment #247Support #DevOpsConsulting #DevopsAudit #InfrastructureAudit

The Eight Domains of CISSP. 1. Security and Risk Management 2. Asset Security. 3. Software Development Security. 4. Security Architecture and Engineering. 5. Security Operations. 6. Comminication and Network Security. 7. Security Assessment and Testing. 8. Identity and Access Management.

The best advice to become a smart contract developer or security researcher: "Show up" Everyday. And get 1% better than yesterday.

The CrowdStrike outages are another reminder of how critical it is to demand rigor and excellence in your patch management process (In CrowdStrike's case) as well as the importance of your on-the-ground incident response team (In 70% of F100 companies' case) Most of the fixes/work arounds to critical systems affected by the outage had to be done hands-on with machines by on-the-ground teams. Let's hope there's not a next time, but in case there is IT Leaders should consider where their staff/consultants who can respond to incidents like this are physically located. If you are looking into how to find & select top-tier US-Based Security, Incident Response, Software, or Infrastructure staff let's discuss how Software Resources can partner with you. #IncidentResponse #PatchManagement #ITTalent #Staffing #Recruiting #LocalTalent

A strange experience. A couple weeks back, I interviewed for a Network Systems Admin role. 2 minutes in the call, they handed me a warehouse blueprint and said, "Design a NOC." Challenge accepted! In 10 minutes, I whipped up what I thought was a solid design - routers, switches, APs, security cams, the works. Then dove into a tech deep-dive on TCP/IP, DHCP, VLANs - you name it. The panel (including the CTO) seemed impressed. They promised feedback in 5 days. Fast forward 15 days... GHOSTED. I've reached out multiple times. Nothing. Nada. Look, I get it. Companies are busy. But ghosting after a candidate invests time and energy (and gives away free consulting)? That's not cool. Am I expecting too much to want at least a "thanks, but no thanks"? Is this very common for post-interview communication? Has ghosting become the new norm? #TechInterviews #NetworkingCareers

Human beings will take only so much pain before they do something about it. In security operations, that means there’s a strong link between alert volume and alerts getting ignored. That impacts both your ability to stop attacks, and the motivation of your detection engineers… no one wants to create content that gets ignored. I’ve found that setting an “alert budget” can help by setting a measurable expectation and making it clear that breaking that expectation means taking on more risk. Going from 2,000 alerts a day to 20 may require the team to temporarily declare “alert bankruptcy” but desperate times call for desperate measures. And if your analysts are scrolling through alert queues, filtering only for critical alerts, or just hoping that an MSSP will sort it out, the times are desperate indeed. Learn about alert budgets and how to make them a helpful part of your detection engineering program at this week’s blog post.