How to Land a Job in Cybersecurity

This presentation was presented to UMBC's Cyber Scholars May 6th 2016.

As Cyber Scholars, some fraction of you are absolutely certain that you not only want a career in cybersecurity, but that you want a specific role in it. If you're in that fraction, awesome--except, this talk isn't designed for you. This talk is for those scholars that have doubts. Doubts about whether cybersecurity is a good place to be long-term. Doubts about what role they want in cybersecurity. Doubts about how to actually get said role in cybersecurity. This talk addresses each of these doubts in detail. While some think it's best to "leave your doubts behind," you don't want to do that for this talk. Bring them, and watch them be systematically dismantled.

Transcript

1. HOW TO LAND A JOB IN CYBERSECURITY Nwokedi Idika, Ph.D. THE SILICON VALLEY EDITION
2. WHY THE SILICON VALLEY SLANT?
3. SILICON VALLEY IS THE CENTER OF THE TECH UNIVERSE
4. If you can make it into a Tier-1 Valley company, you can make it anywhere!
5. THE VALLEY IS WHERE I’VE SPENT THE MOST…
6. THE VALLEY IS WHERE I’VE SPENT THE MOST… INTERVIEWING (INTERVIEWER AND INTERVIEWEE)
7. BASIC JOB HUNTER QUESTIONS
8. BASIC JOB HUNTER QUESTIONS Is cybersecurity going to be in demand in the future?
9. BASIC JOB HUNTER QUESTIONS Is cybersecurity going to be in demand in the future? What do I want to do in cybersecurity?
10. BASIC JOB HUNTER QUESTIONS Is cybersecurity going to be in demand in the future? What do I want to do in cybersecurity? How do I get the role I want?
11. LET’S ADDRESS THESE QUESTIONS ONE AT A TIME
12. Q1: IS CYBERSECURITY GOING TO BE IN DEMAND IN THE FUTURE?
13. YES
14. YES How much are Venture Capitalists investing?
15. YES How much are Venture Capitalists investing? What’s the size (in dollars) of the market?
16. YES How much are Venture Capitalists investing? What’s the size (in dollars) of the market? What does the supply and demand look like for opportunities?
17. HOW MUCH ARE VCS INVESTING
18. HOW MUCH ARE VCS INVESTING VCs spent $3.3B on cybersecurity startups1 in 2015, up from $1.9B the previous year2
19. HOW MUCH ARE VCS INVESTING VCs spent $3.3B on cybersecurity startups1 in 2015, up from $1.9B the previous year2 Industry Amount Invested (2015) Cybersecurity $3.3B Commercial Space $1.8B Biotech $1.5B
20. THE SIZE (IN DOLLARS) OF THE MARKET
21. THE SIZE (IN DOLLARS) OF THE MARKET The cybersecurity market was $75B in 20156 The cybersecurity market is forecasted to be $170B by 20205
22. THE SIZE (IN DOLLARS) OF THE MARKET The cybersecurity market was $75B in 20156 The cybersecurity market is forecasted to be $170B by 20205 Company Market Cap Multiple of Cybersecurity Netflix $38B ~0.5 Starbucks $81B ~1 Oracle $165B ~2 Facebook $334B ~4
23. SUPPLY AND DEMAND OF JOB OPPORTUNITIES
24. SUPPLY AND DEMAND OF JOB OPPORTUNITIES We’re not generating enough cybersecurity professionals and won’t for a while (if ever)
25. SUPPLY AND DEMAND OF JOB OPPORTUNITIES We’re not generating enough cybersecurity professionals and won’t for a while (if ever) While some differ on projections8,9, they all point to more unfulfilled demand in the future
26. There were 209K unfilled cybersecurity jobs in 2015 there is expected to be 1.5M unfilled cybersecurity jobs by 2019
27. Q1 RESPONSE SUMMARY
28. Q1 RESPONSE SUMMARY VCs can’t get enough of cybersecurity startups
29. Q1 RESPONSE SUMMARY VCs can’t get enough of cybersecurity startups The size (in dollars) of the cybersecurity market is large and has been growing and is expected to continue growing
30. Q1 RESPONSE SUMMARY VCs can’t get enough of cybersecurity startups The size (in dollars) of the cybersecurity market is large and has been growing and is expected to continue growing The demand for cybersecurity talent is expected to grow
31. Q2: WHAT DO I WANT TO DO IN CYBERSECURITY?
32. IT DEPENDS
33. IT DEPENDS The marketplace defines what’s available
34. IT DEPENDS The marketplace defines what’s available AND only you can determine the intersection of the marketplace demand, your preferences, and your strengths
35. A REGEX FOR CYBERSECURITY ROLES (Anti-Abuse|Compliance|Cyber(security)?|Forensics| (Anti-)?Fraud|Incident Response|(Anti-)?Malware| Penetration|Risk|Security|Threat|Trust (and Safety)?| Vulnerability) .*(Architect|Analyst|Consultant|Officer| Operator|Research (Engineer|Scientist)|Researcher| Solution Engineer|Specialist|Strategist|Tester)?
36. A REGEX FOR CYBERSECURITY ROLES (Anti-Abuse|Compliance|Cyber(security)?|Forensics| (Anti-)?Fraud|Incident Response|(Anti-)?Malware| Penetration|Risk|Security|Threat|Trust (and Safety)?| Vulnerability) .*(Architect|Analyst|Consultant|Officer| Operator|Research (Engineer|Scientist)|Researcher| Solution Engineer|Specialist|Strategist|Tester)? e.g., Chief Risk Officer, Malware Reverse Engineer, Information Security Consultant, Director of Threat Research
37. INFERENCES
38. INFERENCES There are lots of options
39. INFERENCES There are lots of options Role names are applied in a non-standard way (e.g., A vulnerability researcher at one place is a threat researcher at a another), so reading descriptions for patterns is important
40. INFERENCES There are lots of options Role names are applied in a non-standard way (e.g., A vulnerability researcher at one place is a threat researcher at a another), so reading descriptions for patterns is important The regex is great fodder for keyword web searches
41. ABOUT PREFERENCES When it comes to predicting what we’ll like, we generally suck
42. IMPACT BIAS10
43. END OF HISTORY ILLUSION11
44. 40-50% of US marriages end in divorce12
45. ABOUT STRENGTHS Best method for strength identification I’ve found:
46. ABOUT STRENGTHS Best method for strength identification I’ve found:
47. ABOUT STRENGTHS Capture Phase Best method for strength identification I’ve found:
48. ABOUT STRENGTHS Capture Phase Clarify Phase Best method for strength identification I’ve found:
49. ABOUT STRENGTHS Capture Phase Clarify Phase Confirm Phase Best method for strength identification I’ve found:
50. CAPTURE PHASE
51. CAPTURE PHASE “Powerful” “Confident” “Do it Again”
52. CLARIFY PHASE
53. CLARIFY PHASE Who? When? Where? Why?
54. CONFIRM PHASE
55. CONFIRM PHASE Success
56. CONFIRM PHASE Success Instinct
57. CONFIRM PHASE Success Instinct Growth
58. CONFIRM PHASE Success Instinct Growth Needs
59. IN CASE YOU’RE NOT PARTICULARLY GOOD AT ANYTHING
60. IN CASE YOU’RE NOT PARTICULARLY GOOD AT ANYTHING Just because you’re not good at something today, doesn’t mean you can’t be significantly better at it through appropriate practice15
61. IN CASE YOU’RE NOT PARTICULARLY GOOD AT ANYTHING Just because you’re not good at something today, doesn’t mean you can’t be significantly better at it through appropriate practice15 Most engage in “naive practice”
62. IN CASE YOU’RE NOT PARTICULARLY GOOD AT ANYTHING Just because you’re not good at something today, doesn’t mean you can’t be significantly better at it through appropriate practice15 Most engage in “naive practice” Purposeful practice gets us closer to mastery (e.g., Steve went from remembering only 7 random digits to remembering 82 random digits over 200 sessions)
63. CONNECT THE DOTS
64. Q2 RESPONSE SUMMARY
65. Q2 RESPONSE SUMMARY The cybersecurity space has many roles
66. Q2 RESPONSE SUMMARY The cybersecurity space has many roles The right one requires reading and strengths finding
67. Q2 RESPONSE SUMMARY The cybersecurity space has many roles The right one requires reading and strengths finding If your preference isn’t wrong now, it might be later—so don’t sweat it too much
68. Q3: HOW DO I GET THE ROLE I WANT?
69. BE WHAT THE MARKETPLACE IS LOOKING FOR
70. BE WHAT THE MARKETPLACE IS LOOKING FOR Accumulate the right experiences
71. BE WHAT THE MARKETPLACE IS LOOKING FOR Accumulate the right experiences Interview well
72. JOB DESCRIPTIONS DESCRIBE IDEAL CANDIDATES
73. JOB DESCRIPTIONS DESCRIBE IDEAL CANDIDATES
74. COMMON KNOWLEDGE/SKILLS SEEN FOR SECURITY ENGINEERING ROLES
75. COMMON KNOWLEDGE/SKILLS SEEN FOR SECURITY ENGINEERING ROLES Applied Cryptography TLS/SSL HTTP Penetration testing Code auditing Cross-site scripting/Cross-site Request Forgery Build security-relevant tools
76. A GREEDY STRATEGY FOR CHOOSING SKILLS FOR ACQUISITION
77. A GREEDY STRATEGY FOR CHOOSING SKILLS FOR ACQUISITION Find the intersection of skills across all companies
78. A GREEDY STRATEGY FOR CHOOSING SKILLS FOR ACQUISITION Find the intersection of skills across all companies Sort the skills by the size of their intersection
79. A GREEDY STRATEGY FOR CHOOSING SKILLS FOR ACQUISITION Find the intersection of skills across all companies Sort the skills by the size of their intersection Attain the skills in descending order
80. INTERVIEW WELL
81. INTERVIEW WELL Phone screen(s) Project 
 (increasingly) On-site
82. PHONE SCREENS
83. PHONE SCREENS Recruiters Hiring Managers
84. PHONE SCREENS Recruiters Hiring Managers Coding Online Your Past
85. PROJECTS
86. PROJECTS No real rules
87. PROJECTS No real rules Some are nominally not timed, but they all are timed
88. PROJECTS No real rules The quicker you can get it done the better Some are nominally not timed, but they all are timed
89. PROJECTS No real rules The quicker you can get it done the better Some are nominally not timed, but they all are timed If they say “People usually finish it in a week,” you should finish the project in a week to be considered serious
90. ON-SITES ARE LIKE STANDARDIZED TESTS… so treat them as such
91. MODELS OF PREPARATION16
92. MODELS OF PREPARATION16
93. MODELS OF PREPARATION16 Music Model
94. MODELS OF PREPARATION16 Music Model Chess Model
95. MODELS OF PREPARATION16 Music Model Chess Model Sports Model
96. MUSIC MODEL
97. MUSIC MODEL “Dividing and Conquering”
98. DIVIDING AND CONQUERING
99. DIVIDING AND CONQUERING Problem Solution
100. DIVIDING AND CONQUERING Problem Solution being put on the spot
101. DIVIDING AND CONQUERING Problem Solution being put on the spot understanding the problem
102. DIVIDING AND CONQUERING Problem Solution being put on the spot understanding the problem recognize what type of problem it is
103. DIVIDING AND CONQUERING Problem Solution being put on the spot understanding the problem recognize what type of problem it is can you state the solution in plain English
104. DIVIDING AND CONQUERING Problem Solution being put on the spot understanding the problem recognize what type of problem it is can you state the solution in plain English can you translate your plain English solution into code quickly and accurately
105. DIVIDING AND CONQUERING Problem Solution being put on the spot understanding the problem recognize what type of problem it is can you state the solution in plain English can you translate your plain English solution into code quickly and accurately can you analyze the complexity of your solution
106. DIVIDING AND CONQUERING Problem Solution being put on the spot understanding the problem recognize what type of problem it is can you state the solution in plain English can you translate your plain English solution into code quickly and accurately can you analyze the complexity of your solution can you critique your solution
107. CHESS MODEL
108. CHESS MODEL “Think, act like the masters”
109. THINK, ACT LIKE THE MASTERS
110. THINK, ACT LIKE THE MASTERS Competitive Programming Websites Codewars Topcoder Hackerrank
111. THINK, ACT LIKE THE MASTERS Competitive Programming Websites Codewars Topcoder Hackerrank Mimicking the editorials > Getting a high rank
112. SPORTS MODEL
113. SPORTS MODEL “Use it to not lose it”
114. USE IT TO NOT LOSE IT Regularly Review Algorithms/Data Structures Networking CISSP (10 Domains) …
115. TRUE FOR ALL MODELS
116. TRUE FOR ALL MODELS Having no goal is least ideal
117. TRUE FOR ALL MODELS Having no goal is least ideal Having only an outcome goal is better
118. TRUE FOR ALL MODELS Having no goal is least ideal Having only an outcome goal is better Having an outcome goal AND a process goal is best
119. Q3 RESPONSE SUMMARY
120. Q3 RESPONSE SUMMARY Be what the marketplace is looking for
121. Q3 RESPONSE SUMMARY Be what the marketplace is looking for Figure out what the marketplace is looking for and become that
122. Q3 RESPONSE SUMMARY Be what the marketplace is looking for Figure out what the marketplace is looking for and become that Train for your interviews like a musician, a chess player, and athlete
123. IN CONCLUSION
124. IN CONCLUSION Cybersecurity is an excellent area to have a career in for the foreseeable future
125. IN CONCLUSION Cybersecurity is an excellent area to have a career in for the foreseeable future Finding what role you want will take effort and will likely change over time
126. IN CONCLUSION Cybersecurity is an excellent area to have a career in for the foreseeable future Finding what role you want will take effort and will likely change over time Accumulating desired experiences and training in earnest will get you the job
127. THANK YOU
128. REFERENCES 1. https://www.technologyreview.com/s/545626/venture-capitalists-chase-rising-cybersecurity-spending/ 2. http://www.csoonline.com/article/2968438/security-industry/investors-pour-billions-in-to-cybersecurity-firms.html 3. http://fortune.com/2016/02/22/vcs-invested-more-in-space-startups-last-year/ 4. http://nvca.org/pressreleases/58-8-billion-in-venture-capital-invested-across-u-s-in-2015-according-to-the-moneytree-report-2/ 5. http://www.marketsandmarkets.com/PressReleases/cyber-security.asp 6. http://www.gartner.com/newsroom/id/3135617 7. http://www.csoonline.com/article/2953258/it-careers/cybersecurity-job-market-figures-2015-to-2019-indicate-severe-workforce-shortage.html 8. http://peninsulapress.com/2015/03/31/cybersecurity-jobs-growth/ 9. http://www.cisco.com/c/dam/en/us/products/collateral/security/cybersecurity-talent.pdf 10. Blumberg, S., Gilbert, D., Pinel, E., Wilson, T., (1998) “Immune Neglect: A Source of Durability Bias in Affective Forecasting”, Journal of Personality and Social Psychology 75, 617-638 11. https://www.ted.com/talks/dan_gilbert_you_are_always_changing?language=en 12. http://www.apa.org/topics/divorce/ 13. http://nautil.us/issue/35/boundaries/not-all-practice-makes-perfect 14. https://books.google.com/books?id=JV-mMBK8q-0C 15. http://nautil.us/issue/35/boundaries/not-all-practice-makes-perfect 16. http://geoffcolvin.com/books/talent-is-overrated/