US Cyber Games’ Post

The cybersecurity job market clearly has its challenges, and there's no disputing that. However, something that genuinely perplexes me is the path that many people decide to follow in order to try and land a role in the industry. 1. Create an account on THM or HTB. 2. Learn the fundamentals. 3. Study for CompTIA Security+. 4. Build a home lab. 5. Apply for loads of jobs on LinkedIn. 6. Consider the gamified platform experience. This is literally what 80-90% of people do when trying to get into the industry. The thing is, if you observe someone following that path and struggling to land a role, why would you then follow the exact same path and expect different results? Here's what a ton of people don't do: 1. Bug bounty programs. 2. Responsible disclosure. 3. Real security research. 4. Reverse engineering. 5. Malware analysis. Or whatever activities are relevant to your niche. I know this post is going to get met with a ton of comments like: "Good luck getting a job in cybersecurity without a certification!" But it's quite clear that people have certifications and still cannot land roles because virtually everyone has CompTIA Security+ and a THM account. I'm not trying to discourage people; what I'm trying to do is get people to forge their own path and not copy everyone else. To give you a practical example, someone I know recently chose a responsible disclosure program and kept reporting vulnerabilities to that program. After about three months, he asked the CIRT team that he'd been making the submissions to for an internship (unpaid). That internship ended, and he was then given a full-time role. He did not have certifications, and he did not have what you'd expect him to have. Sometimes when you do things that don't follow the traditional routes, you end up creating your own path, and that's what will make you different. I have nothing to gain by shouting the same advice, but this is my perspective. If you do what every other person is doing, you're literally just lining yourself up in a very large queue. Disclaimer: I am fully aware that employers value certifications and degrees, or whatever else exists, but this post is not about that. It's about encouraging people to try and do more challenging things that will differentiate them from other people.

The cybersecurity job market clearly has its challenges, and there's no disputing that. However, something that genuinely perplexes me is the path that many people decide to follow in order to try and land a role in the industry. 1. Create an account on THM or HTB. 2. Learn the fundamentals. 3. Study for CompTIA Security+. 4. Build a home lab. 5. Apply for loads of jobs on LinkedIn. 6. Consider the gamified platform experience. This is literally what 80-90% of people do when trying to get into the industry. The thing is, if you observe someone following that path and struggling to land a role, why would you then follow the exact same path and expect different results? Here's what a ton of people don't do: 1. Bug bounty programs. 2. Responsible disclosure. 3. Real security research. 4. Reverse engineering. 5. Malware analysis. Or whatever activities are relevant to your niche. I know this post is going to get met with a ton of comments like: "Good luck getting a job in cybersecurity without a certification!" But it's quite clear that people have certifications and still cannot land roles because virtually everyone has CompTIA Security+ and a THM account. I'm not trying to discourage people; what I'm trying to do is get people to forge their own path and not copy everyone else. To give you a practical example, someone I know recently chose a responsible disclosure program and kept reporting vulnerabilities to that program. After about three months, he asked the CIRT team that he'd been making the submissions to for an internship (unpaid). That internship ended, and he was then given a full-time role. He did not have certifications, and he did not have what you'd expect him to have. Sometimes when you do things that don't follow the traditional routes, you end up creating your own path, and that's what will make you different. I have nothing to gain by shouting the same advice, but this is my perspective. If you do what every other person is doing, you're literally just lining yourself up in a very large queue. Disclaimer: I am fully aware that employers value certifications and degrees, or whatever else exists, but this post is not about that. It's about encouraging people to try and do more challenging things that will differentiate them from other people.

The cybersecurity job market clearly has its challenges, and there's no disputing that. However, something that genuinely perplexes me is the path that many people decide to follow in order to try and land a role in the industry. 1. Create an account on THM or HTB. 2. Learn the fundamentals. 3. Study for CompTIA Security+. 4. Build a home lab. 5. Apply for loads of jobs on LinkedIn. 6. Consider the gamified platform experience. This is literally what 80-90% of people do when trying to get into the industry. The thing is, if you observe someone following that path and struggling to land a role, why would you then follow the exact same path and expect different results? Here's what a ton of people don't do: 1. Bug bounty programs. 2. Responsible disclosure. 3. Real security research. 4. Reverse engineering. 5. Malware analysis. Or whatever activities are relevant to your niche. I know this post is going to get met with a ton of comments like: "Good luck getting a job in cybersecurity without a certification!" But it's quite clear that people have certifications and still cannot land roles because virtually everyone has CompTIA Security+ and a THM account. I'm not trying to discourage people; what I'm trying to do is get people to forge their own path and not copy everyone else. To give you a practical example, someone I know recently chose a responsible disclosure program and kept reporting vulnerabilities to that program. After about three months, he asked the CIRT team that he'd been making the submissions to for an internship (unpaid). That internship ended, and he was then given a full-time role. He did not have certifications, and he did not have what you'd expect him to have. Sometimes when you do things that don't follow the traditional routes, you end up creating your own path, and that's what will make you different. If you do what every other person is doing, you're literally just lining yourself up in a very large queue. Disclaimer: I am fully aware that employers value certifications and degrees, or whatever else exists, but this post is not about that. It's about encouraging people to try and do more challenging things that will differentiate them from other people.