Search for a command to run...
Miguel is a Principal Engineer and the author of the “Serverless Security” book. He has worked on multiple serverless projects as a developer and security engineer, contributed to open-source serverless projects, and worked on large military systems in various engineering roles.
No comments yet. Be the first to comment.
Protect your system from vulnerabilities
How I saved my company $1 million
This YouTube video series provides quick overviews of the top 10 cybersecurity risks for serverless applications. Each video covers the risk and some recommendations on how to address it. Why is the OWASP Serverless Top 10 important? In this video, I...
![Overview of the OWASP Serverless Top 10 [videos]](/_next/image?url=https%3A%2F%2Fcdn.hashnode.com%2Fres%2Fhashnode%2Fimage%2Fupload%2Fv1636408504092%2FBcNttK9q2.png&w=3840&q=75)
A little over one year ago, I published my first book thanks to Apress and author Nihad Hassan. I am in a cybersecurity writing group with Nihad, where he shared he had published his 4th book; this was back in 2019. I was impressed by his accomplishm...
You may have heard, “If you build it, they will come.” Have you heard, “If you build it, I will break it?” This is a skill I developed over my career to build better systems. It is a skill that took me a while to learn I had. Shortly before I graduat...
Miguel's Blog · Serverless · Security
49 posts
Miguel A. Calles is the author of the Serverless Security book, and a Cybersecurity engineer who works on serverless and cloud computing projects.
Cybersecurity is a red hot field right now, there are so many resources and activities you can leverage to make the jump into the cybersecurity field.
I admit, it took me about four years to get my foot in the door. There were not as many resources available then as there are now. I truly believe anyone can make the switch in 12 months with some hard work and effort.
I highly recommend identifying the cybersecurity job you want. There are so many roles within the field. Some roles are better suited and more interesting to your preferences. If you have no basis for the type of job you want, how can you prepare for it? Learn about the different roles and try to work out which will suit you and lend themselves to talents you already have.
Go to Indeed, Monster and USAJobs and start doing searches. Make a list of the jobs that sound interesting to you. Also note the skills listed for which you lack — this skills will be part of your development plan. If, a job posting requires a certification such as US DoDD 8570.1, go investigate the requirements for obtaining that certification. The US DoDD 8570.1 has a list of specific certification you can obtain to comply. For your convenience, this is the link. I obtained the CompTIA A+ CE certification because it met the DoDD 8570.1 for my current role and it was the easiest to earn.
Also note if the skill is a required skill or if it is a desirable skill. The required skills will be your highest priority. Keep a tally of how many times a specific skill is listed as required and desirable. This will help you prioritize.
Now that you know what your job wants, it is time to start building skills you can include in your resume.
Prioritize your list. Put all the skills that were listed as required in one group and those listed as desired in another group. If a skill was listed as required once and listed as desired a dozen times, it will go into the required skills.
Order the required skills by the number of times it was listed as required. For example,
If there is a tie, use the number of times a skill is listed as desired as the tie breaker. For example,
RedHat wins because it had 4 desired counts and Ubuntu only had 3.
Do the same process for the desired skills.
Plan to address one desired skill after completing three to four required skills. The desired skills will give you and advantage over other applicants.
You will need resources to help you check off those skills in your plan.
If one of your required list items is to get a certification, see if there are online training programs and practice questions. I used the CertMasters program because it had an online training program and it included a voucher for the A+ exam.
Take online training classes. Cybrary has numerous free courses. It has course on topics and also for certain certifications. Find a mentor or ask your current employer if there are resources you can use. Ask the #infosec community on Twitter if they know of any specialist resources related to your chosen field.
Experience is king. Having a certification without experience is less credible. Don’t get me wrong, the certification is important. It is more important to be able to say something like, “I have hardened a Linux server” versus saying, “I have read all the procedures for hardening a Linux server.” Having done something has more value than having read about it.
In the example of hardening the Linux server, the documentation seems straight forward enough. But you may not realize that some settings conflict just from reading. You may miss that some settings are not permanent without some additional actions taken.
Actually trying to harden a Linux server will expose you to issues. If you take the time to solve those issues, it will show a prospective employer you can solve problems. It will also teach you to plan to roadblocks and how to troubleshoot. You cannot get this knowledge without doing.
But how do I get experience without having a job? Get hands on experience on your own.
There are many ways to get experience.
Get Linux hardening experience by installing CentOS Linux on a PC or virtual machine and follow the RedHat Security Technical Implementation Guide (STIG).
Get penetration testing experience by watching YouTube videos about Kali Linux. Ask your manager or a connection at work if there are cybersecurity tasks that you can help with.
Get creative. I had started working a side job as a web developer. When I found rogue code, I suggested to the owner that it would be wise to do a cybersecurity assessment. This and the remediation was valid experience I spoke about in my interview for my current position.
After you have a few required skills under your belt and you have started building some experience, it is time to start applying. It may take weeks to months to get an interview — so you will want to continue to get more skills and experience. If you continue to improve you will be an even better candidate than when you apply.
When you interview, be confident.
If you don’t know something, admit it. If it’s on your training plan, mention it. If it’s not, say you will add it to your training plan.
If they ask about a skill you are in the process of completing, say you are in the process of building that skill.
Be passionate about cybersecurity and your willingness to learn and you’ll do great. Even if you don’t get the job, you may have learned about new skills to add to your training plan — it was still a worthwhile effort.
Originally published on Medium.com
Photo by Christina @ wocintechchat.com on Unsplash
