THE

CYBERSECURITY CAREER

ROADMAP

AN UNCONVENTIONAL APPROACH TO STARTING YOUR CAREER IN TECH

Evan Lutz

DEDICATION

Thanks be to God for blessing me with the opportunity to help others with my gifts and abilities. For that, salvation through Jesus Christ alone, and my children, I am eternally grateful.

To my boys, I love and cherish you, and I could not be more proud of the men you’re both becoming.

To my younger self, we made a lot of mistakes and we can’t change the past, but we can help people avoid the mistakes we made.

And to the reader, I hope you find this book enlightening and impactful.

COPYRIGHT

Copyright © 2024 BowTiedCyber LLC
    All rights reserved.

ABOUT THE AUTHOR

Evan Lutz is an established and well recognized cybersecurity professional and has experience working for Cigent Technology, inc., Blueshift Cybersecurity, inc., and Rent Dynamcis, LLC. His 2+ year tenure at Cigent allowed him to build the SOC/SIEM that allowed for the real time monitoring of dozens of customer environments with extremely high degrees of success rarely even seen across enterprise products. At Rent Dynamcis, he brought the organization to SOC II TYPE II compliance in under 12 months with a fully qualified opinion (the highest rank).

Evan is a local news icon having been interviewed more than 4 dozen times, as well as having spoken on a dozen local panels for the Fort Myers Chamber of Commerce and other conventions.

Evan is a father to two boys, Caleb and Joshua. When not with his boys, you can find him at Krav Maga classes, attending church functions, or at the local cigar bars.

Evan enjoys working out at his Fort Myers home, riding his motorcycle, and working locally in the community to help others start their careers in cybersecurity and fellowship.

Why should I listen to you?

This is a fair question and one that everyone should be asking. Cybersecurity is a relatively new industry. Far newer than computers as a whole, which are themselves recent in the scope of human history.

We have about two decades of cybersecurity as an industry. This poses a ton of problems:

There are few real experts

The average experience level is low

There’s a vacuum for demand in the marketplace

So to meet that demand, companies are farming this cash cow of cybersecurity education.

White label boot camps for universities that teach you damn near nothing.

Self-proclaimed mentors who only know what has worked for them.

Online courses that promise vast riches with little work.

Sure, anyone in the industry can tell you what worked for them.

And therein lies the rub.

What WORKED (past tense) is not what WORKS today.

What does work today? That’s what we’ll discuss in this book.

BUT HOW DO WE KNOW IT WORKS??

Because I have the receipts.

As of the time of this writing, I’ve helped over 70 students start their cybersecurity careers:

Making an average of $80k/y in the US

With little to no college experience

With little to no technical experience In an median study time of 90 days

That’s why you should listen to me.

Not because I built a $10M+ Cybersecurity SaaS at my first firm.

Not because I’m an esteemed Cybersecurity Engineer and ethical hacker.

Not because I have a thrivig cybersecurity bootcamp and a top 3 substack in education.

It’s because I’ve tested this method time and time again.

And it’s working. Right now. My students get jobs every single month, and this book will show you how.

PREFACE

Who is this book NOT for

This book is not for you if you:

Are lazy

Are looking to get rich

Want to be a cybersecurity vigilante

This book was written for my younger self. The young, ambitious, hungry, intelligent, and driven young man that I was. When I was delivering pizzas and working two jobs to keep a roof over my son’s head. When I was out the door before anyone was awake and home after everyone was asleep. When I would have given and done ANYTHING to be successful. That’s who this book is written for.

I’ve worked with hundreds of people and interacted with tens of thousands in the past few years in my pursuit to become the greatest cybersecurity educator the world has ever seen.

Very few have what it takes to make it in this industry.

The likelihood that you are this person is low.

So who does make it in this industry?

It’s not the smartest people.

It’s not those with the most soft skills.

It’s not the master programmers or the silver tongued.

Those who make it around here do the following

Work hard

Don’t get distracted

Don’t get discouraged

Don’t give up

Many start the journey to begin their cybersecurity careers.

Few succeed.

Finally, this book is about efficiency. There are a million ways to start a tech career. My passion and goal is to help you do it as fast as possible. If YOU want to start your cybersecurity career, then buckle down, embrace that you’ll have to put in hundreds of hours grinding to learn a new trade, and let’s get to work.

Are you ready? Then read on.

TABLE OF CONTENTS

CHAPTER 1: WHAT IS CYBERSECURITY?

CHAPTER 2: IS THERE A JOB FOR ME?

CHAPTER 3: HOW DO I GET A CYBERSECURITY JOB?

CHAPTER 4: CERTIFICATIONS

CHAPTER 5: SKILLS

CHAPTER 6: STRATEGY

CHAPTER 7: CLOSING THOUGHTS

CHAPTER 1:

WHAT IS CYBERSECURITY?

"Cybersecurity" is a broad term that, in essence, refers to the protection of digital assets from cyber threats - a bit like a castle defending its treasures. But instead of physical walls and moats, cybersecurity employs firewalls, encryption, and secure networks. The "treasures" being protected vary, from personal data to business secrets.

Cyberattacks are continuous, complex, and evolving, making cybersecurity an ever-changing field. It's not just about building defenses but constantly learning, adapting, and staying ahead of potential threats. And it's not only corporations that need it; anyone with a digital footprint needs cybersecurity.

Here are a few of the domains in this massive industry:

Information Assurance: Ensures that data is accessible to authorized users (availability), protected from unauthorized access (confidentiality), and can be trusted to be accurate (integrity).

Ethical Hacking: Ethical hackers, or "white hat hackers," intentionally probe systems for vulnerabilities to fortify them before they can be exploited by malicious hackers.

Incident Response: This involves planning for and dealing with incidents, like data breaches or cyber attacks, and swiftly responding to minimize damage.

Network Security: This domain involves protecting internal and external networks from threats.

Application Security: Involves securing software and services from threats at the application level, whether in development or deployment.

Security Architecture: This involves designing, building, and maintaining a secure infrastructure for an organization.

Cybersecurity Audit: This involves examining and evaluating an organization's cybersecurity policies, systems, and procedures to ensure they are effective.

Security Analysis: Security analysts assess and monitor systems for security breaches and when breaches occur, investigate the circumstances and damage.

Digital Forensics: The goal of this field is to gather and analyze evidence from computers, networks, or other forms of data storage devices to investigate incidents or attacks.

Security Engineering: This involves designing and implementing systems that can resist or tolerate malicious cyber-attacks, faults, errors, or failures.

Cloud Security: A specialization that focuses on securing cloud-based systems, platforms, and data.

Security Management: This domain is about overseeing and coordinating an organization's security efforts, including setting policies, and managing a security team.

Cryptography: This involves designing and implementing secure communication methods to prevent third parties from reading private messages.

Compliance and Risk Management: This involves assessing risk and ensuring that the organization is in compliance with the various regulatory standards that apply to their industry.

Unsurprisingly, there is a large amount of overlap between many of these domains.

CHAPTER 2:

IS THERE A JOB FOR ME?

Is there a job for you in cybersecurity? Absolutely.

So much so that, on the merits, this is the WRONG QUESTION.

Instead of a long drawn out chapter on cybersecurity and how it came to be, let’s just settle on some important figures you should know:

750k open cybersecurity jobs in the US at the time of this writing

10% increase annually

Doesn’t include all the tangential domains of IT that you’d qualify for (developer, systems administrator, network engineer, etc) that you’d qualify for after studying cybersecurity

750k? Is that a lot?

There are 200k open jobs for Registered Nurses in the US today.

We have almost 3x MORE open jobs in cybersecurity.

Yeah, that’s a lot.

The field is broad, catering to varied interests and skills, from problem-solving to coding. Roles are diverse and opportunities are abundant due to the ever-increasing demand for cybersecurity professionals.

However, it's worth noting that not all jobs in cybersecurity are equal; availability may vary based on market needs, location, and role requirements. Also, as cybersecurity is constantly evolving, so are the skills needed.

A career in cybersecurity calls for continuous learning to stay current with the ever-evolving tech landscape and emerging threats. So, yes, there's a job for you, but whether it's the right fit depends on your interests, commitment to lifelong learning, and your capacity to thrive in a dynamic, fast-paced field.

So what is the RIGHT QUESTION then?

Do you have what it takes?

If you do, then there’s a job for you. And once you have experience, there’s an entire sea of fully remote six figure jobs at your feet.

CHAPTER 3:

HOW DO I GET A

CYBERSECURITY JOB?

This is what we’re here for, right? Let’s dive in.

We can break this down into 3 main categories:

Certs

Skills

Strategy

In this chapter, we’ll give a brief overview of each and how they relate to each other. We’ll explain them in depth in later chapters.

Certs

Certifications are industry recognized exams that tell an employer that you objectively know something. The perfect analogy is if you’re trying to get into an Ivy League School, you’ll have to take the SAT. An objective measure of what you know. We do the same thing but instead of a glorified IQ test, they’re domain specific.

The certification you want are as follows and in this order:

CompTIA Network+

CompTIA Security+

Azure 900 - Splunk Core User

If you’re absolutely green to the world of computers and IT, you won’t likely be ready for the Network+ exam.

My recommendation to take you from absolute zero - we’re talking your grandmother’s grandmother, to someone ready to begin studying for the Network+ exam is to study for the CompTIA A+ certification.

Do not sit for this exam. It won’t help you in your career.

Once you start getting above 70% in the practice exams for A+ across all domains, you’re ready to start pursuing your Network+ certification.

These certifications prepare you in the following ways:

Network+: Fundamentals of Networking

Security+: Fundamentals of Security

Azure 900: Fundamentals of the “The Cloud” and the Azure platform

Splunk Core User: Fundamentals of using a Security Incident and Event Management (SIEM) tool and the Splunk platform

There are exceptions to this list of certifications but we’ll address those exceptions later.

Skills

This is where we learn some tricks of the trade to be useful in a variety of cybersecurity jobs.

The main skills to emphasize are:

Linux

Python

Traffic Analysis

Hacking

Active Directory

Linux: An open source operating system and a common form of server you’ll encounter on the job. Also comes in desktop form that I’m using to write this ebook, because I love Linux.

Python: A simple programming language that allows us to do incredible things with speed. You can pick any programming language, but if you’re looking to start learning a new one, Python is the way to go.

Traffic Analysis: This is when we start doing the “cybersecurity” stuff. We want to be able to look at network traffic and analyze if there’s a threat on the network. This is at the core of defensive or “blue team” roles.

Hacking: The counter to the blue team is the red team - active adersaray simulations to test a company’s defenses. This is where you’ll want to familiarize yourself with the tools in Kali Linux.

Active Directory: THE way of managing users and roles for ALL large organizations. Small businesses won’t likely have this, but any large shop is going to have to have this. There’s just no better way to manage groups of people (and their permissions) at scale.

The goal for each of these is to learn just enough that you could go into a job, identify what skills you need to MASTER for that role, and hone in on those skills.

We learn everything in cybersecurity at 10,000 feet, and dive down to ground level for the specific needs of that job.

Example: I had never heard of Suricata IN MY LIFE when I started my job as a Network Security Engineer. Now, I’m a Suricata expert and used it to build a $10M+ SaaS for my former employer. This is how it happens for almost everyone. Don’t focus on mastering any one skill, because you probably won’t use it much at that job. Become a generalist so you can become a specialist for your company.

Strategy

Even if you have skills and certs, unless your approach is correct, you won’t get a job.

Here’s the basic strategy to securing your first cybersecurity job:

ePortfolio

Strong Resume

1000 Applications

ePortfolio: A WordPress server showcasing what you know. This is going to be projects applying the things you learned in the skills section. You could be setting up a linux server or writing a script that solves a problem or setting up Active Directory. Take screenshots and explain the process you used to do it. Here’s a link to my redacted ePortfolio I used to get my first job.

Strong Resume: Most resumes suck. A resume is like a dating profile. It should be short, to the point, showcase all of your good sides and none of your bad. What does a good resume look like? Here’s a link to my free resume template.

1000 Applications: Sounds like a lot? It is, if you’re filling them out manually. Don’t do that. Instead, use things like indeed quick apply, linkedin quick apply, and zip recruiter to apply for jobs effortlessly.

You may intelligently retort, “Isn’t everyone applying for those jobs if they’re so easy to apply for?”

And the answer is yes, however, the proportions are in your favor.

Quick apply jobs may have a thousand applicants. Long form applications may have hundreds.

But a quick application takes 30 seconds. A long form application can take 30 minutes.

Your odds of getting a call back are FAR BETTER by applying to 120 quick apply jobs in an hour than 2 long form applications.

Long form applications should be reserved for those that you have another reason to think the application is worthwhile. Maybe you have a reference from a friend or family member in the company. Maybe they’re in an area you really want to be in. Maybe their required skills are exactly your skillset. Whatever it is, if it’s worth the time, then do it. Just know the tradeoffs.

Now that we’ve established a baseline for how to get a job, let’s dive into each of these in depth.

CHAPTER 4:

CERTIFICATIONS

I want to keep this chapter intentionally short. This is not intended to be a study guide for these certifications. That’s 3000 pages of material all by itself. Rather, I want to highlight why we get these certs and what other options there are available to you both now and in the future of your career.

CompTIA Network+

This IS the CROWN JEWEL of entry level certifications. It’s HARD. But NOT impossible.

How hard is it? For context, I FAILED at passing my first actuarial exam. Advanced statistics is HARD. But the Network+ is MOSTLY memorization based with SOME application.

Here’s a good example question from the Network+ exam:

You are a network administrator responsible for maintaining a large enterprise network. One of the departments in your organization is experiencing intermittent network connectivity issues. The department's computers are connected to a local switch, which is then connected to the core switch. Other departments on the same core switch are not reporting any connectivity problems. Which of the following could be the most likely cause of the intermittent connectivity issues in the department?

A faulty network cable between the local switch and the core switch. (correct answer)

Incorrect VLAN assignment on the department's computers.

Outdated network adapter drivers on the department's computers.

Insufficient bandwidth on the uplink port connecting the local switch to the core switch.

To appropriately answer this question, you have to know what each of these things are and what they do. But none of them individually are that hard or complex. It’s rather the extreme volume of information that you need to know a sufficient amount of, enough about to pass the exam.

And don’t worry about scoring a perfect score. You’re not gunning for a network administrator job (although that’s certainly an option) rather, you’re looking for “good enough” to start your cybersecurity career.

For some, this leads to a large amount of imposter syndrome. And I have news for you.

No matter who you are or what you do, unless you’ve been in this industry for a decade, you’re going to feel like an imposter at your new job. Period. The way you overcome this is by mastering the skills that you need for your new role once you’ve been accepted and the ink is dry. This is why we learn everything from 10,000 feet. If we learn every detail of everything up front, it’ll take YEARS to start a cybersecurity career. Don’t waste months learning something you don't actually need for the job you get. And there’s no way to predict what that’ll be.

At the end of the day, if you study for the cert and pass, then you know enough networking to be able to do the job.

How should you go about studying for this exam? You can reference this guide here for study strategies and suggested resources.

Note: DO NOT use brain dumps as a primary method to pass your exams. You should use test questions as a supplemental tool to learn, not as the primary tool to pass an exam. The point is to learn. If you’re not learning, you’re setting yourself up for failure. This applies to all exams.

Cisco CCNA

Cisco is one of the world's largestest networking equipment vendors. While the Network+ is a “vendor neutral” certification (meaning it doesn’t focus on how to use the equipment of any one vendor in particular), the Cisco CCNA is “vendor specific,” meaning you’ll have to learn how to program and use Cisco networking equipment, alongside networking concepts.

Folks often ask if they should get the CCNA instead of the Network+? You can, but I don’t recommend it, all else equal. It’s harder and takes more time. It will open a few more doors than the Network+ exam, but you’re not getting a job with one cert alone. On the whole, it’s less efficient, but not by much.

Hence, I would recommend getting one, but not both.

Your time would be better spent getting a Network+ in 30 days and a Security+ in 15 days than a CCNA in 45 days. Network+ and Security+ together will open far more doors than the CCNA alone.

CompTIA Security+

This is the second cert that I recommend for (almost) everyone.

Similar to the Network+, this will give you a foundational understanding of it’s domain.

But this has a substantial overlap with Network+. Not enough that it would render the Network+ unnecessary, but enough that if you pass your Network+, you should jump STRAIGHT into the Security+ exam. This exam can be completed in about 2 weeks after successfully passing your Network+.

Certified Ethical Hacker (CEH)

This is the prime example of peacocking in our industry. The exam itself is a joke. Do not study for this cert for knowledge. Only get this cert to posture for HR. We’ll talk more on this later when referring to job hunting strategy.

But if you do get this cert, it’s not necessary to get your Security+ for posturing reasons. It’s still useful to have it for knowledge purposes, but with a comprehensive learning program, it’s not essential.

Therefore, if you’re doing self study and looking to best position yourself for a job and to learn everything you need to succeed, you should get your Security+ first, and then your CEH. Just know your Security+ won’t add anything to your resume once you have your CEH.

AZ900

This is my preferred entry level cloud cert. The reason is simple:

There are a smaller number of applicants for azure jobs relative to the number of open positions than would be comparable for AWS jobs.

AZ900 is the basic Azure cloud cert. The purpose of this is to get you familiar with some of the basic terminology of the Azure cloud environment, but more importantly, it shows Karen in HR that you “do cloud.” As completely nonsensical as this sounds (and is) this is the game we must play to get past the gatekeeper to get to the final boss (the technical interviewer).

You can see my 72H Azure 900 Game plan here.

AWS CCP

The AWS CCP is the AWS equivalent of the AZ900. It’s not a bad cert and can be swapped out for AZ900, but AZ900 beats it out by just a hair due to current market conditions. It’s also reported to be a touch easier. Both tell Karen in HR that you “do cloud.”

Splunk Core User

This is the final cert I recommend for entry level. Splunk is a SIEM (Security Incident and Event Management tool). SIEMs are used in a SOC (Security Operation Center) which oversees all of the security events and responds to them in real time. This is the work done by a SOC analyst. So getting the Splunk Core User cert tells Karen in HR that you “do security analysis.”

Analyst work is actually fun and rewarding but the foundations of being successful in it are not in the SIEM, but rather in the learning that leads up to it. The SIEM is simply a dashboard to parse unholy amounts of data.

OSCP

This is BY FAR the HARDEST cert on this list and the ONLY one I recommend if you want to become a pentester. The OSCP is a real life simulated exam where you hack into a network and get points for flags you capture. This is a hard certification but one that gives you clout with both HR and the technical interviewer.

Furthermore, if you can pass this, you’re likely to pass a technical interview. It’s that good.

Google (or Microsoft or IBM) Cybersecurity Cert, ePJT, Pentest+, Linux+, Cloud+, etc

All other certs fall into the same bucket for entry level applicants. They’re not necessary and your time is spent accumulating the certs already mentioned or learning more skills.

CHAPTER 5:

SKILLS

Here’s the basic list of skills that we’ll go over, in depth, that you’ll want to learn:

Linux

Python

Traffic Analysis

Hacking (optional)

Linux

Linux is an open source operating system, often seen in the wild as a server distribution. A server distribution is what we call a “headless” operating system, meaning it’s just a terminal. There is no Graphical User Interface (GUI - the thing where you can point and click).

If your cybersecurity skill set is a cake, Linux is like the platter - the foundation on which you build your real skills. Linux runs on a series of commands that do everything from run services to adjust user permissions to editing files and everything in between.

Cybersecurity is a vast field with a range of requirements and skill sets. It involves securing data from threats, unauthorized access, disclosure, disruption, modification, and destruction. Below are some Linux-based skills that you can focus on for cybersecurity:

1. Linux Command Line Proficiency: Learn to navigate, manage files and directories, and understand and manipulate the Linux filesystem.

2. Linux File Permissions & Ownership: Learn how permissions work for different user types (user, group, others) and how to modify them.

3. Scripting Languages: Python (preferred), Bash, Perl, or other scripting languages are important for automating tasks, log analysis, exploit development, etc.

4. User and Process Management: Learn to add, delete, modify users and groups and managing processes in Linux.

5. Linux Networking Commands: Netstat, nmap, tcpdump, Wireshark and other networking commands/tools are important to understand and troubleshoot networking issues.

6. Firewalls and IP Tables: Understanding how to set up and configure firewalls in Linux for securing the system.

7. System Monitoring Tools: Learn how to use tools like top, htop, ps, free, and vmstat to monitor system activities and performance.

8. Log Management: Understand syslog, log files, log management, and analysis as they play an important role in understanding and preventing cyber threats.

9. Package Management: Familiarize yourself with package managers like apt, yum, rpm, dpkg for installing, updating, and removing software.

10. Linux Hardening: Techniques to secure a Linux system, including minimal installation, removing unnecessary services, securing boot processes, etc.

11. VPN & SSH: Familiarize yourself with secure communication protocols like VPN and SSH. The remainder are “nice to haves”:

12. Knowledge of Linux Kernel: Understand the kernel, kernel modules, and their impact on system security.

13. Penetration Testing Tools: Tools like Metasploit, Wireshark, Nessus, John the Ripper, Aircrack-ng, and others are often used in the cybersecurity field.

14. Knowledge of Docker and Containerization: Understanding the security aspects of containerization technology.

15. Intrusion Detection Systems (IDS): Tools like Snort, Suricata, or Bro (Zeek) can be useful.

16. Working with REST APIs: Many security tools have APIs that can be manipulated via the command line or scripts.

17. SELinux: Learn about Security-Enhanced Linux (SELinux) for managing mandatory access controls.

Python

The first question I always get is “Why Python? Can I use X language instead?”

The answer is a resounding YES! Python is a means to an end. That end is scripting and automation. If you’re repeating tasks over and over again or need things to happen automatically, this is also a great opportunity for a script.

This will make you 10x more efficient at your job because you’re automating your own job away.

But don’t worry - you won’t ever automate so much that you’ll lose your job. You’ll just simultaneously make your life easier AND everyone will love you more.

Python is a powerful, flexible programming language that's popular in cybersecurity due to its readability, efficiency, and wide range of libraries.

Here are some key Python skills to focus on for cybersecurity:

1. Python Basics: Data types, variables, loops, conditionals, functions, and error handling.

2. Python Libraries: Understand how to use Python's extensive standard library and third-party libraries. The built in libraries are going to be the most powerful and most common ones you use.

3. File Manipulation: Be able to read from and write to files, which is especially useful for tasks like log analysis.

4. Python Scripting: Understand how to write scripts to automate common tasks, such as log analysis, network scanning, testing, etc.

5. API Interaction: Be able to interact with REST APIs, which is a crucial aspect of many modern security tools and services. The rest are “nice to haves”:

6. Web App Testing: Learn about libraries and frameworks such as Selenium, Django, and Flask for web development and testing.

7. Penetration Testing Tools: Learn how to use and script for tools like Nmap, Wireshark, Metasploit, Burp Suite, etc.

8. Ethical Hacking with Python: Understand how Python can be used for ethical hacking to identify vulnerabilities and build security solutions.

Traffic Analysis

This is the process of analyzing the traffic to find the stuff that could indicate a compromise or threat on the network.

Traffic analysis involves the interception and examination of communications in order to deduce information from patterns in communication; it's commonly used in cybersecurity to identify anomalies, attacks, or other potential security issues. Here are some skills to learn:

1. Network Fundamentals: Understand TCP/IP, DNS, HTTP/HTTPS, FTP, and other protocols. Understand packet structures, ports, IP addresses, and network devices (e.g., routers, switches).

2. Traffic Capture: Familiarize yourself with tools for capturing network traffic, such as tcpdump and Wireshark.

3. Traffic Analysis Tools: Learn to use network traffic analysis tools like Wireshark, tcpdump, Network Miner, and others. Know how to interpret the data these tools provide.

4. Packet Analysis: Understand how to dissect a network packet and what each part means. Know how to spot anomalies in the packets.

5. Encryption and Tunneling Protocols: Understand VPNs, SSL/TLS, and other encryption and tunneling protocols.

6. Firewall and IDS/IPS Logs: Know how to interpret logs from firewalls and intrusion detection/prevention systems (IDS/IPS).

7. Security Information and Event Management (SIEM) Tools: Get familiar with one of SIEM tools like Splunk, LogRhythm, AlienVault, etc.

8. Behavioral Analysis: Understand the normal behavior of a network so you can spot anomalies. This involves things like understanding baseline traffic patterns, times of high/low traffic, common protocols, etc. (note that this comes with time)

9. Threat Intelligence: Learn to use threat intelligence feeds/platforms to correlate with your traffic analysis findings. 10. Scripting and Automation: Use scripting languages (like Python) to automate the analysis, parse logs, identify patterns, etc.

11. Understanding of Cyber Attack Techniques: Know common attack vectors and techniques such as DDoS attacks, phishing, Man-in-the-Middle (MITM) attacks, etc.

12. Data Visualization: Visualizing data can make it easier to spot trends, patterns, and anomalies.

Remember, effective traffic analysis also depends on having a solid foundation in cybersecurity principles and best practices. You should understand the various types of threats, know how to prioritize and respond to incidents, and stay up-to-date on the latest security trends and threat intelligence.

Hacking I’m going to label this as optional, but you should at leasty try it for a few reasons:

You might fall in love with it and want to become a pentester

Having some hacking knowledge will make you a better defender

Even if you don’t love it, spend a week studying and solving Capture the Flag challenges (CTFs) from places like hackthebox.com or cybertalents.com.

"Hacking" typically refers to identifying and exploiting weaknesses in a system or a network. Ethical hacking, or penetration testing, is done by cybersecurity professionals to identify and patch vulnerabilities before malicious hackers can exploit them. Here are some skills to learn for ethical hacking. Since this is an optional domain, everything in this list is a “nice to have” so don’t get overwhelmed:

1. Programming: BASIC knowledge of programming languages like Python, JavaScript, SQL, C, and C++ are important. Each language can be used in different scenarios during hacking.

2. Operating Systems: Understand the ins and outs of both Windows and Linux systems, as both are widely used. MacOS is also important, but to a lesser degree.

3. Networking: Understand networking concepts, protocols, and how data is transferred across the internet. Knowledge of TCP/IP, DNS, HTTP/HTTPS, FTP, etc., is essential.

4. Web Technologies: Understand how websites work, including technologies like HTML, CSS, JavaScript, PHP, and SQL. Also, understand web servers (Apache, Nginx), and databases (MySQL, PostgreSQL).

5. Cybersecurity Fundamentals: Understand basic concepts such as encryption, firewalls, intrusion detection systems (IDS), intrusion prevention systems (IPS), etc.

6. Vulnerability Assessment: Use tools like Nessus, OpenVAS, Nexpose to scan systems for known vulnerabilities.

7. Penetration Testing: Use tools like Metasploit, Burp Suite, Wireshark, and Nmap. Understand the methodologies used in penetration testing.

8. Web Application Security: Understand OWASP Top 10 vulnerabilities and how to identify and exploit them.

9. Reverse Engineering: Learn how to reverse engineer software to find hidden vulnerabilities.

10. Social Engineering: Learn about human hacking techniques, such as phishing, pretexting, and baiting.

11. Wireless Network Security: Understand WEP, WPA, WPA2, and how to exploit their weaknesses.

12. Mobile Security: Understand the security aspects of Android and iOS systems.

13. Cloud Security: Understand the vulnerabilities and security measures in cloud-based systems.

14. Legal Knowledge: Being familiar with CCPA, GDPR, and compliance regulations are a plus, but recognize that you’re not expected to be a lawyer.

15. Forensics: Knowledge of digital forensics can be useful for post-exploitation analysis.

16. Scripting and Automation: Automate repetitive tasks using scripting languages like Python, Bash, or PowerShell.

17. Encryption and Cryptography: Understand how encryption works and how it can be exploited.

Remember, ethical hacking should only be performed with proper authorization. Unauthorized hacking is illegal and unethical. It's also important to keep your skills and knowledge up-to-date, as the field of cybersecurity is always evolving.

CHAPTER 6:

STRATEGY

As we discussed in Chapter 3, the basic premise of finding and securing your first cybersecurity job is as follows:

ePortfolio

Strong Resume

1000 Applications

Let’s dissect how we should approach the creation of each of these.

ePortfolio

Why do we need one? It showcases that you know how to APPLY the knowledge and skills you’ve accumulated. If we have 2 candidates, one CLAIMS that they know Linux (which is itself incredibly ambiguous, almost like saying you know Math) and the other has an ePortfolio with a project where they create and implement a Linux backup solution, all else equal, who do you think is going to get the call back?

So how do we make an ePortfolio? It’s comprised of two components:

A WordPress Site

A GitHub

WordPress Site

WordPress is a free and open source “drag and drop” website builder that requires no coding. Most commonly used for blogging, there are over A BILLION WordPress sites in the world (and counting). They’re also a FEASTING GROUNDS for vulnerabilities, but that’s not as much of a concern if you’re using it as an ePortfolio. Much more of a concern if you’re using it for ecommerce like I do at bowtiedcyber.com.

The default model for WordPress is to be a BLOG. So we’re going to make our ePortfolio a blog.

There are two main ways this can be done:

Self hosted

Third party hosted

If you’re going self hosted, you’re creating your site out of a server in a cloud environment (digital ocean, AWS, Azure, etc). The process of creating your own self hosted WordPress server is a phenomenal exercise and one I recommend everyone do on digital ocean since it’s so easy. You can see a full guide on how to do that here (note this is a paid post for members of the substack).

Or you could go the route of third party hosting. This is like using WordPress.com, dream host, or WP-Engine to manage your WordPress server for you.

Either way, once you have a server to login to, the next step are going to be the same:

Pick a theme

Write blog posts

BUT WHAT DO WE WRITE IN THESE POSTS?

Technical write ups. Take something that you know how to do, or learn how to do something, and create your own guide on how to do that thing.

This is ambiguous. As it should be. The best portfolios that make the most money are those which have unique projects that solve a specific problem.

Here are some examples of portfolio project ideas:

Writing a ransomware server

Creating a Next Generation Firewall

Writing a data scrubber

Creating and implementing a linux backup solution

Using a custom password cracker

Capture the flag solutions

Malware analysis

Threat hunting

Capturing and finding passwords in a pcap file

        Writing a password cracker

All of these involve you demonstrating how to solve a problem. Find a problem and solve it. The more creative the better.

GitHub

This could not be simpler. Make a repository for your cybersecurity projects. Commit your code to those projects. This can literally be done in 10 minutes. You’re just posting your code.

On the note of your code that you’re posting for your GitHub, make sure to comment your code.

The point of the scripts you write for you are to solve problems. The point of posting your code to GitHub is to get you a job. To do that, your code must be readable to others. The easiest way to do this is to comment your code. Comment thoroughly. Make it as easy as possible for someone to see what you did and why.

WordPress Portfolio Q&A:

Q; How long should your portfolio be?

A; Between 3 and 10 posts. 5 is the sweet spot.

Q: How complex should your posts be?

A: The more complex the better. HOWEVER if you have long posts, break them up into 2 or 3 posts for more portfolio volume.

Q: How much effort should I put in?

A: Enough to get the job done. And remember the 20% rule. Only the first 20% of your posts will be read. And only the first 20% of those posts will be scrutinized. They don’t have time to look at all of the details. This doesn’t mean to put WRONG OR BAD INFO into the parts that aren’t in the top 20%. What that does mean is to make sure that the first 20% is PERFECT.

Q: Can all of my posts be explaining code?

A: No. Variety is the spice of life. Don’t be a one trick pony.

Q: Can none of my posts be code?

A: Surprisingly, yes. However, explaining your code is low hanging fruit, so use it if you need more volume.

Q: I hate hacking. Do I have to do a Capture the Flag?

A: No, but it can be beneficial, especially if you’re doing an easy 1 or 2 step compromise.

Q: Should I have my own domain?

A: I would, but I got a job without it.

My WordPress link on my portfolio was evanlutzcybersecurityportfolio.wordpress.com and I got a $90k/y offer. But having a clean domain looks and functions so much better. A word on domains: don’t buy the super cheap ones. They get flagged as malware on a lot of websites (especially Linkedin). Skip the .xyz or .co domains. Pay the $8 and get a .com. You can get creative with it. The shorter the better so long as it doesn’t miss the point. MattSmithPortfolio.com or CyberMatt.com are both perfectly fine.

Github Portfolio

Q&A: Q: How many scripts do I need in there?

A: Even if it’s just 2 or 3, that’s better than nothing. The mere existence of it on your resume will lend itself to credibility with the hiring manager. It’s just another box that’s been checked.

Q: I feel like my code isn’t good enough. Should I post it anyway?

A: Did it work? Did it solve the problem? Then post it. Simple code that achieves the same result as complex code is actually better. Anyone who works in software engineering will tell you this. Writing simple code is a strength, not a weakness.

Q: How can I fill out volume on my GitHub?

A: Do challenges at hackerrank.com and post your code solutions.

Strong Resume

The resume is one of the most easily misunderstood elements of the job application process.

It helps us to start with our end goal and work our way backwards:

Get an offer <- Pass an interview <- Get an interview <- Submit a resume

Hence, it stands to reason that the purpose of the resume is to get you an interview. In the majority of cases, your resume holds no value past there. Particularly for an entry level position. They’re not hiring you for your skills, they’re hiring you for your potential.

Therefore, everything on our resume should be geared towards only one thing: helping you get an interview.

Case in point: consider two candidates, A and B. A has the perfect resume, and B has a resume that was just enough to get him into the interview. A performs terribly during the interview. B exceeds every expectation in the interview. Who do you think gets the offer? Undoubtedly, B will.

Here’s my recommended resume template, which can be copied here for free:

You may have heard that the best resume template is the traditional plain layout similar to this one:

While these do better with being automatically parsed by the resume scanners (Applicant tracking software, or ATS for short) I find that for the purposes of getting a first tech job, they’re relatively high risk, high reward.

When done right, they perform slightly better. When done wrong, no one will ever read your resume.

In addition, I find that the flow of my resume template lends better to someone getting a general idea of who you are at a glance while sparing no details. A professional resume service will deliver something closer to the second that is optimized for an ATS while mine is for mass appeal.

The elements to consider when making a strong tech resume are as follows:

1. Large name and best cert In the same way that pretentious doctors put PhD after their name, you too should put your most relevant certification at the end of your name because it immediately identifies you by your highest achievement in the industry.

2. Sublime Subline: This is the line below your name that says who you are in a few words. I always used “Network Security and Python Software Engineer”

3. Overt Objective: This is where you can flex a little and show some personality while still being professional. There’s no mystery that your future employer is hiring a human being so tell them what makes you special but in a professional context. “A determined leader and certified cybersecurity professional with a passion for programming, problem solving, and automation.”

4. Clear Contact Information

It should contain exactly the following:

City

State

Zip Code

Do not list your entire address. You gain nothing by giving this information.

Phone Number

If you don’t want spam calls for a year after you stop job hunting, use a google voice number.

Email

Doesn’t have to be a personal domain (but is really cool if it is). Make sure it’s at least professional. No one is going to send an email to hedgehoglover89@yahoo.com. Acceptable emails are ones that include your name, your profession, or some combination of the two. cyberjames89@gmail.com is perfectly acceptable. hackerdave404@gmail.com would also be great. As would netsecbob27@gmail.com. You get the idea. Just make sure you’re not losing points for your email.

5. Robust skills section: This is an area that most get wrong. I’ve seen resumes where they’ll have a decade of experience and list 5 skills. If you’re being hired to do a technical job, you need to be able to list your technical expertise. Don’t skimp here.

6. Concise list of degrees and certifications: Let it be just that - a list. It doesn’t need an in depth explanation of what your test scores or GPAs were. We don’t need a list of courses you took. If you learned a skill in a class or exam, list that in your skills section.

7. Experience with intent: My resume template has your first job listed as cybersecurity self-study. That’s not a mistake. Assuming you have no previous experience, you’ll want to list the projects you did during your self-study as your bullet points under that experience. If you follow the sub stack, you should have plenty of projects to list there.

8. Your non tech experience: Pick one job to list and keep it short. This isn’t a tech job so it shouldn’t be front and center. Talk about project management, leadership, problem solving, or any other aspects that would lend itself to success in your new career. This may mean leaving off some of your greatest accomplishments at your previous job because they’re no longer significant in the scope of your new goal. Did you paint a house faster than anyone else at your company? Doesn’t matter. Did you lead a team of 4 people and that team completed jobs faster than anyone else at the company? Now we’re onto something. You’re clearly driven by the rest of your resume. Leave the job duties expansion to stuff that’s relevant to your new career.

9. Appropriate links

You’ll want all of the following on your resume:

Linkedin

GitHub

ePortfolio

How to make a good LinkedIn

This is more of a list than a section. Making a professional linkedin profile is simple.

Professional photo

Sublime Subline (same one from your resume)

Stock footage cover photo (something vibrant and techie) - Updated resume

Links to portfolio

Listed education and certs

List as open to work

1000 Applications

Let’s go back to math class for a minute.

The expected value of something is the likelihood of success x the number of attempts.

If we have a 20% chance of making a 2 point shot in a game of pickup basketball, and we need 10 points to win, then reason dictates that we need to take 5 shots to get one basket, 5 baskets to win, so we need to take 50 shots to win, on average.

We can look at the job application process in the same light.

Say any one job application has a 1% chance of calling you back. And any one interview has a 10% chance of converting to a job offer.

Then reason would dictate that it takes 100 applications for one interview and 10 interviews for 1 offer. So we’d need to submit 1000 applications, on average, in order to receive an offer.

In other words, the expected value of a 1000 applications is one job offer. So that’s our target.

But note that these success rates are only applicable when you’ve done everything up to this point:

Certs

Skills

ePortfolio

1 Page Resume

If we could bypass the need to learn anything with more job applications, I would tell you so. But sadly, we still have to do the work in order to qualify for a job.

But how do we apply for 1000 jobs?

Quick apply.

Each platform has their own way of doing this. Zip Recruiter has mobile apply and one tap apply. Indeed has Easy Apply. Linkedin has Easy Apply. These are the in app short form applications where you answer between 1 and 30 questions and then it sends those answers and your resume to the hiring manager.

Do these applications have a lower success rate? Yes. But we need to look at it in context.

How long does it take to do a short form application? Probably 60 seconds on average. How long does it take a long form application on average? Probably 30 minutes. What are the odds of getting a call back on a long form application? 2%? 3%? Let’s give a number that’s greatly exaggerated and say 5%. So how many long form applications would it take to get a call back? 20. How long would that take to fill out all those applications? 10 hours, or 600 minutes. How many short form applications could you do in 600 minutes? 600. What’s the expected value of 600 short form applications? 6 calls back.

So by spending your time doing far more lower quality applications, you’re far more likely to land a job faster by virtue of the expected value of an application relative to the time it takes to submit that application.

What jobs do we apply to?

Everything. But more specifically, apply to ANY JOB that has a cert OR skill that you have listed.

Willing to relocate anywhere? List your location on your job searches as “United States.” Then find more jobs listed in specific areas where you’d want to relocate to.

Let’s do an example.

Say you have your Network+, Security+, AZ900, and Splunk Core. And you have skills in Linux, Python, Traffic Analysis, Hacking, and Network Security. And you’re willing to relocate anywhere, but you’d like to stay in Atlanta, but Miami would be a second choice. You’d do searches for all of the following on all 3 of the listed platforms:

With the location set to United States:

Network+ Linux

Network+ Python

Network+ Traffic Analysis

Network+ Hacking

Network+ Network Security

Security+ Linux

And so on

Then the same thing for all the jobs in Atlanta.

Then the same thing for all the jobs in Miami.

Additionally, you can add in the key words:

Entry level

Remote

Senior

Hybrid

On Site

To give another layer of dimension to your searches. But you should be just fine to find enough jobs to apply to without it.

You may be wondering, “What business do I have applying to a senior level job?” For the purposes of getting that senior level job, nothing at all. But you’re not going after those jobs.

Remember that only half of all open jobs are posted.

By applying to a job that you have no business applying to but one that shares some of your skillset, you then open yourself up to the possibility of having your resume seen by a hiring manager who says, “Gosh, this goober has no business applying to this. But his experience might be a good fit for that junior position we’ve been meaning to post for a while. Let’s give him a call and see if he’s interested.” It sounds crazy, but I’ve heard this exact story from my students dozens of times. It works.

Job Hunting Q&A:

Q: Will I hurt my reputation by applying to too many jobs?

A: No. Not only is there no database that companies reference to see how many jobs you applied to, but you can even apply to the same job multiple times, just with an updated resume and get success.

Q: How long does this take?

A: How long will it take you to submit 1000 job applications? That’s probably your answer. In general, it can be done in about a month.

Q: Can I get a remote job immediately?

A: If you’re lucky, extremely well qualified, and willing to accept less money.

Q: Do I need to be open to relocation?

A: Probably. You can always try to get a job in your local area but if you’re in a small town, you may either need to be open to commuting a long distance or relocation if that’s not panning out.

Q: How much MONEY can I make?

A: With no previous experience, you’re looking at $80k/y average among my students in the US.

Q: Can I lie on my resume to get a job.

A: No. The truth always comes out. Furthermore, there’s no need.

Q: Do I need a college degree?

A: No. Just certifications, skills, and a portfolio.

Interviewing

Interviewing is an entire skill. This is part of the reason why it takes 10 interviews to get an offer, because when you first start interviewing, you’re not good at it yet. Once you learn how to play the game and get some experience interviewing, you get much better at it.

Here are some general ideas to keep in mind when interviewing to help you be successful:

Be early

Smile

Refer back to your strengths

Send a follow up email

Be prepared with questions about the company, the role, and their expectations

Be open to the idea that this role might not be a good fit for you

Negotiation

The first question everyone asks when getting an interview is, “How much do I say I’m looking for.” The best approach you can use is one that I developed when I started job hunting. Use the “Soft Target” approach. Say your “Soft Target” is 15% above the max they have posted for the role.

Let’s use an example of a network security engineer job whose posted range is $60k-$80k/y. When the hiring manager asks you, “How much are you looking to make?” Say this:

“Well, a lot of factors play into accepting a job offer, but I’m looking for soft target $90k/y.”

This does a few things:

1. The number pushes the top of their range

2. The “Soft Target” language gives them room to negotiate you down

3. You’re showing that you’re open to a variety of offers and that salary isnt’ the only thing you’re considering

Similarly, when you do get an offer, if you’re happy with it, you can always accept immediately.

And they offer you what you asked for, do not try to negotiate it higher. You’ll lose the offer.

But say they didn’t offer you your soft target. Sticking with our example, say they offer you $80k/y. Here’s how to possibly negotiate an extra $10k?

Thank

Consider

Counter

Thank them for the offer. Tell them at that rate, you’ll need a week to consider, but if they can increase the offer to $90k, you’ll sign today.

“Thank you so much for the offer and I’m incredibly grateful that you see the value in me and want me to be a part of your team. I have other positions that I’m interviewing for at the moment, so at that rate, I’ll need a week to consider. However, if you can increase, the offer to $90k/y, I’ll sign today.”

Then shut up. The first to talk after this loses. Don’t lose.

This puts the ball in their court with a high incentive to keep you as a future employee.

And when they grant your counter offer, take it. You only get to push them higher one time and up to your soft target. This is why we start 15% above their listed maximum.

CHAPTER 7:

CLOSING THOUGHTS

People often ask me if they can start a career in cybersecurity.

This is one of those rare moments in life where this old adage rings true:

“Whether you can or you can’t, you’re right.”

Those who insist that they can’t succeed surely won’t.

If nothing changes, nothing changes.

But I’ve never seen a student complete my bootcamp and fail to get a job.

Not. One. Time.

Those are the odds you want in a cybersecurity bootcamp.

If you want those kinds of odds, then apply for the Zero to Hoodie Cybersecurity Bootcamp at bowtiedcyber.com or with the QR code below and see why we have the best bootcamp the world has ever seen.