You Are Studying Cybersecurity WRONG (Stop Wasting Money)

0:00Band-Dool is now available everywhere in the U.S. So you can get in on the sports action no matter where you are, including these places. May this year most rewarding season ever with Band-Dool. Agent location restrictions apply. Product availability varies by market. C-FanDool.com for eligibility, gambling problem called 1-800-Gemma. This episode is brought to you by Google Chrome. You think you know a browser, but Gemini and Chrome? That's new. It can help you with practically anything on the web, like restoring a vintage motorcycle from a 50-page restoration block, or finally break down that long article you've had open for weeks. Gemini and Chrome is here for it. Ready to make anything online makes sense? There's no place like Chrome. Check responses set up require compatibility and availability vary 18 plus. If you're trying to break into cybersecurity right now, you're probably making a mistake that's going to end up costing you thousands of dollars.

1:04You see, most people collect certifications like Pokemon badges, but hiring managers all around the world are still ignoring their resumes. Today, Angie Karate, a senior threat intelligent analyst, and founder of the Ginger Hacker Initiative, joins me to break down why certifications alone will not get you hired. A lot of folks think I have to get the whole series to comp to you. Then I got moved to AWS. I need to move to Microsoft. I got to move to INE. And I'm like, no, I'm like, just stop. How to get free security plus vouchers? If you can show me that you're passing your resources and show me two passing practice exams, we can front load folks to get them their voucher to go and sit for their exam. And a simple five minute video trick that bypasses all the HR algorithms out there. I love this annual quick five minute video that shows all those skills that I can talk about on this challenge. So without any further ado, let's jump into today's conversation.

2:08Thank you for coming back on the channel once again. It's always a pleasure to have you on and just share all the amazing knowledge you got. Man, I'm so glad to be here. And I know we've been in communication throughout the entire year. But yeah, it's always good to come back on and talk to a good friend. Absolutely. And I want to kind of first step back a little bit for those who don't know who you are. You might just take in the quick, you know, couple minutes here and introducing you and what you do. Yeah, hey, everybody. My name's Andrew Cretty, also known as Ginger Hacker. And long story short, it's how I help folks break into cyber security. So just over a year ago, I had the decision to make a nonprofit called the Ginger Hacker Initiative, where what we do is we help provide scholarships throughout the year to help folks get into cyber security. So I did the hard work. I made a five one C three nonprofit, started reaching out to all the certification vendors because let's just face it, they all keep getting a little bit more expensive every year. And with some awesome partnerships, I now get to either get in kind training or discounted training that I provide back to the community.

3:08Now for my big boy job, I work through the work in cyber as a senior threat intelligence analyst with the federal government. And yeah, but the passion is really about giving back doing some mentorships and then having fun conversations like this with Dakota. Awesome. And you know, let's dive into it. Walk me through the gap you saw in the industry that made you want to start the Ginger Hacker Initiative. Yeah. And it's, it's something we've heard the last two, three years where we see these mid-level roles dropping out and the senior level roles getting put out onto the job market. But is more and more folks apply out. We're hearing through hiring managers and through the chain like, man, we can't find the right skill set. People are missing the skills and techniques that we need for them to fit this role perfectly. And there's this technical gap air quotes intended. And I kind of kept hearing this and I'm like, man, I'm like, well, what is it? Is it because folks don't have enough of the free to play where they're not doing enough CTFs? They're not doing enough training on their own to kind of get to where they need or are they hitting that paywall? And then is that where we're kind of stumped?

4:09Because now when they're looking for that next certification, even comp to your certifications have jumped up about $150. So if you're even just trying to get your baseline security plus certification just for the voucher alone, you're looking at $500, which is pretty expensive. Not to imagine you have your OACP, your CISSP, your SANS courses. They're all in the range of thousands to have not $10,000 worth $10,000, which some people, and let's just face it, within this economy, can't afford. So where I kind of saw that gap happening, I said, you know what? As much as we can corral and point to all the great free resources, skill bit, over under the water, Pico CTF, hack smarter, just hacking, anti-siphon training, all these awesome platforms. There's only so much you can do before you have to hit that subscription button or you get the pay for that next voucher. So that's where the ginger-accharinitiative kind of, I thought, you know what? As much as we can help with mentorship, creating a community, folks kind of go somewhere and talk and ask questions, we can also kind of help with that financial piece of it by getting our nonprofit status, getting all of our paperwork done, and then reaching out to those organizations, and just having honest conversations.

5:18These certificates are getting more and more expensive, and we're trying to get these for entry-level roles where some folks can't afford these prices. What kind of deal can we come up with to where we can then provide that training for in-kind or for free, or extremely low discounted rate to get folks kind of skilled up to that level that organizations are wanting for them to fit that perfect role? Absolutely, because let's face it, a lot of people who are looking to make a career change, they're looking to, you know, they're either in that, working for McDonald's, flipping burgers, wanting something better for their lives, don't have the budget to cover money for these expensive certifications, and sometimes, especially depending on what job you're going after in cybersecurity, a lot of these certifications, if you don't have them, employers aren't even going to look at you. So it's literally the barrier to entry, you know, you have to get over that hurdle to start working in the field. So I think it's an amazing thing that you guys are doing. And, you know, I was actually just looking at your website today, and you say you guys have helped 36 students who have earned certifications through the program. Is that correct?

6:25That is, we actually got to uptake our security plus today by one of our new members actually just got his security plus voucher. So I think if you're looking at that still, I think we should have about 25 or 26 people that have gotten their security plus. And the goal was was I wanted to get 60 folks, their security plus by the start of our first year anniversary, which is November. And we've been upticking a lot lately. So fingers are crossed. We're still going to hit that mark. So huge shout out. If you're looking to get your security plus, hit up the Gentrak initiative. It's an easy process. You apply for our, we have a, we have a scholarship going on right now for the resources. But if you can show me that you're passing your resources and show me two passing practice exams of 75% or higher, we can front load folks to get them their voucher to go and sit for their exam. Awesome. And you know, again, I'm going back to your website looking at the amazing leadership team you guys have now and it's grown since actually the last time I realized, you know, you guys have some re who will powerhouse people in the industry supporting this amazing initiative to not just not just brands.

7:31I'm not even just talking about brands. I'm actually talking about some of the leaders in the industry. And so I think that's super cool. Yeah, Josh Mason, Danny Meyer, Jason, they're my, my right left hand man's that really helped me out this whole process. You moved on to our second row. We have Cassie Trowbridge. She's our director of marketing helps out with a lot of our marketing. She helped design our sign for black cat or business cards. And a lot of our stickers. We also had gen winners who also helps us here locally in Arizona for additional strategy helping set up our meetups. We then have the amazing Shannon Parker who's kind of like my East Coast marketing rep. And then we're going to show us who is amazing over its cyberspeak labs with program innovation for having just fun conversations. We have our GHI coming up in December. Derek Weasley who helps out a lot of our community inside the discord running certain meetings and groups. Jeremy who's our military first responder liaison to our first responders in military looking to get out of the industry from law enforcement or through military breaking in. And then Eduardo who is my I call my IT shadow in the rear because he is like my discord. S. Ami and a huge help on our back and keeping the discord kind of up and running and keeping it up to date with all the cool things.

8:43Bandool is now available everywhere in the US. So you can get in on the sports action no matter where you are, including these places. May this year most rewarding season ever with fan do. Agent location restrictions apply product availability varies by market. C fan do. Com for eligibility gambling problem called 1-800-Gemmar. This episode is brought to you by Google Chrome. You think you know a browser, but Gemini and Chrome that's new. It can help you with practically anything on the web like restoring a vintage motorcycle from a 50 page restoration block or finally break down that long article you've had open for weeks. Gemini and Chrome is here for it ready to make anything online makes sense. There's no place like Chrome check responses set up required compatibility and availability very 16 plus. That's that's so cool. And you know you guys focus heavily on students veterans and career changers. But I'm curious from you know your experience you know you guys are just share I should have a year.

9:52What has been the biggest hurdle for those groups that they are facing right now when trying to land their first security role. Yeah the one of the issues is just like as much as folks will apply for their security plus which you help them get there soon to be to realize that there's a key plus alone is not always the end all be all certification that's going to get them that role. So that's where we really emphasize in asking questions going to networking events and working on doing projects that they can talk about on their resume such as and I know we've talked about this before creating a YouTube channel like walking through the process on when you're doing your investigations or rooms. You're doing boss of the socks from Splunk he jumped to elastic maybe Google Chronicle and you're actually talking through and walking through the process of investigating a case going through logs and actually talking through how you're writing out your SQL language your queries. And then being able to back brief that to your audience or your YouTube video that you're making that you can private and then send off to a hiring manager when you're done with that first round everybody saying hey you're looking for someone that understands Splunk knows how do you look kind of like a risk analysis and knows how to use that analytical mindset I love this and you a quick five minute video that shows all those skills that I can talk about on this challenge.

11:06And then that's a small little piece that I think one really differentiates you from other candidates inside these roles that yes they have cover letters they have projects on their resume. But for you to go send a video like a quick five minute video or a 10 minute video to a hiring manager saying hey I have this timed out it's time stamped check this out and this is going to show you my analytical mindset how I do my investigations and actually walking through your process. It highlights several different skills on communication critical thinking query language the technical aspect of it that you can now kind of just show off on a quick five minute video where you and I both know even just messaging or talking to our wives when we're at the store and can't find something. A text can go into a five minute text conversation where a phone calls a quick 30 second call hey what did we need to grab oh it's in this aisle cool thanks boom 20 seconds. So having those communication pieces of a cool video ask a thing that you can provide within a conversation within a hiring management. I think it's huge and kind of a new thing I think that hiring managers should be asking for on top of hey do you have any call projects or hey do you have any videos or links that can showcase your work roles that you've mentioned in this before.

12:14One thing that is the biggest challenge that I feel like everyone is facing right now is there is so many people out there applying for these jobs you know trying to get into the field and it's easy to get lost in the noise you know especially like just cybersecurity is just feels like extra hot topic still you know. But do you have like let's break down some recommendations you have to try to help people stand out you know other than just trying to get certified what are some things people can do like to go above and beyond to kind of stand out from everyone else that's trying to go after that same job right now. The biggest thing I think that some folks like you said get they have 25 tabs open to videos playing a security see why say security Xbox in front of them another practice has going on their phone they're doing 10,000 things at once. The thing I like to tell folks to do to kind of really hone in in sharper that resume and sharp in their skills is depending on that next role they're looking for so let's just say they're looking to become a senior detection engineer.

13:17Go and look up those roles and see what the top 10 skills are on job resumes on indeed on LinkedIn on job board sites on the website and see what skills and tools they're looking for a lot of folks think like I have to get the whole series comp to you that I got moved AWS then you move to Microsoft I got to move to I&E that need to move to T.C.M. Security and I'm like no I'm like just stop I'm like figure out the role you want to get or that next show you want to get and then look what those roles are looking for because some folks will be like oh I want to get the pen testing but I'm taking my name. Met plus Mike what would you argue that you need your net plus or they wanted to see something more of like maybe the EJPT or your O.S.C.P. or like all I get the GRC by studying for my PENTAG plus say Kate so you know reverse I'm like well to PNG or see I wouldn't say you need to have your PENTAG plus I would say you should have like your scissors like the sys room for your kind of like assessor certifications so but go look through those work roles and then actually go see like what some additional tools are looking for maybe they're looking for splunk. Elastic if you're looking into PENTAG maybe looking for Metasploit C2 control having an analytical mindset to be able to write out those PENTAG reports at the end of it good with end map burpsweep and then those are the tools used to you should be specializing in or kind of work on to heighten yourself on your resume so that when you have those conversations you're not just routing off the 10 20 different certifications that may or not be relevant to this role that's great you can pass certification but if it's not relevant to that next part of the day you're not going to be able to do that.

14:46So if you're looking for a specific thing you're going for you're putting hours into something that isn't needed at this time and that's where I try to tell folks where it's like hey go look on the job boards like right now and see what those top skills that managers are looking for or if the HR teams are writing the job wrecks depending on what you see. So you should be focusing on to get through those that HR algorithm to get to an interview and then your interview and that's a whole nother conversation and kind of like a talking point because interviews can be so odd because not always will be on topic sometimes it's just a conversation to see who you are sometimes right to wrap the first bad it's technical questions and then the next time it's more technical questions and the third okay now it's time for the technical interview I'm like man the first two interviews were the technical interviews. So it's it's just depending on every hiring manager and team is different on how they hire and so that's where it's like making it to that first round in like learning all the right skills to talk to. I mean we could probably round table for the whole next hour on different ways and techniques to plan for a resume and plan for an interview and then you sit for that interview and it's completely 180 of what you thought the questions were going to be.

15:54Absolutely no and you know I personally do that like so I my day job I'm a hiring manager and typically like my first interview is just trying to get a pulse on the person I'm just wanting to have a conversation with them see who they are what they're about and I'm not necessarily asking technical questions but the questions I'm asking are deciding whether or not that person is moving on to the next round because I'm looking at some of the most important skills in that first interview. Communication skills you know is you are you going to be a good fit with my team you know I run a small very small team and lots of time to cyber security you're working in a very tight knit team and you got to make sure that person you're hiring on is going to vibe with everyone else you don't want to throw the whole vibe of your team off because I can just be detrimental to the organization long term. So those are some of the things I'm trying to weed out within that first interview I don't even care about the technical skills at that point so that's why I'm always a big proponent of like your soft skills your communication skills your ability to talk to others things like that but you know it's challenging because people don't necessarily always prepare for that.

17:08So it can be it can be difficult so whenever I'm giving someone advice that's one thing I definitely talk about is you know being prepared for the unprepared and just be yourself you know they're going to ask you questions you're not going to have an answer to and that's fine don't let that trip you up I remember when I first started that used to trip me up so bad and once I got tripped up I don't just give up during the interview like I you know I didn't like quite why I didn't walk out but you know I was just like checked out like I'm not going to ask you to do that. Nope I've already flunked this one out no reason to keep on trying. Oh man. And it's difficult and you have to learn you know even if you don't feel confident about the interview it's always a learning experience with every single situation like that. I'll share two quick stories so one I had an interview for an insider threat like role and I get to the interview and I was sitting up all these like insider threat tools and methodologies in the process. I got in I got hit with nothing but network networking questions like how would you like do this network table like oh like what's this or it's like like oh like how would you write this out in a reject so Mike.

18:18I'm like I'm like is this for an insider threat role like yeah I'm like okay cool cool cool cool cool and like honestly and I tell folks to this all the time like networking is not my jam I am a Google Dorker when it comes to networking I have. I'm honest man I say that but I walked I walked away from that interview very humbled and what I did I got home and I studied for neck and ton of networking fundamentals and like even some other like probably mid to level things like that they asked me for like a month straight so I'm like that was just so embarrassing I obviously did not get the role but I think like you said anytime you walk away from a good or bad interview you're going to learn things to get better on another interview I had was. It just recently maybe like two months ago and the advice I'll give folks as well before I just like why is he interviewing an advice a mentor gave me is you should be interviewing at least once to twice a year or throughout the year and the why behind that is because one God forbid there's a riff or if there's an opportunity that comes up that you want to check out.

19:19It's nice to stay within kind of like the realm of like hey what's the what's the hot topic right now interviews. So and it's also it's also a great resume post check hey it's my resume up to up to par to even go get interviews right now and that's always at another touch point of always keeping resume up to date baking so that it's still getting changed when you're doing these interviews so so on so forth I go to the second of the seconder of you and the question was reference bold vulnerability management who owns the vulnerability and I'm like well it's a loaded question so I'm like I would argue that sometimes folks don't know who owns the vulnerability or when you find that you're trying to figure out the team that owns it hey is this your host nope sawdars go check with like the firewall team okay go take a look at your guys is nope sawdars looks like it's part of the sales group so go check the sales HR team hey is this your guys is host nope sawdars and it's just like oh my God who owns this machine so I can push it to that man you're saying hey this is out of compliance and he's get patched and I kind of gave my good answer is like oh there's

20:20really no wrong answer that question I kind of wanted to hear your methodology and your thought process on it and that's I think a great another example too like sometimes hiring just just wanted to hear your thought process and your analytical thinking of like hey how would you solve a problem to maybe a very open ended broad question which to a sense I'd say that kind of was because someone say oh well you just figure out who the host belongs to or what group and then boom it's that group well it's not always that easy and I know with your chuckling you can easily agree with me on this so yeah 100% you got to just be prepared for the unprepared when it comes to you know the different interviews and things like that now I actually want to kind of jump back to the ginger hacker initiative and what you're doing and you you kind of briefly touched on scholarships and the mentorship programs you guys run but you know can you kind of give us some more details and then also how does someone get involved with that you know what does that process look like yeah so I mean we have all the socials you can think of we have x instagram facebook all those things that we try to say we try to say is active on as we can but we would I would say

21:26predominantly are pretty hyper focused on youtube x and LinkedIn so that's where we kind of post content we post for free training resources inside the discord we have job boards we have asked me anything channels we have different forums which we've now grown to roughly about a thousand and 50 users on we have certain mods we have hiring managers C so directors on that in that discord that will jump on for like ask me any see any ask me anything sessions quick fireside chats and ideally it's just like a a a backboard that you can just shoot questions to and then there's an entire community that can give you inside I'm like oh well here's my experience here here's what I would do hey here's my thought process on this or oh you're trying to get in the cloud you should check out AWS or hey here's some great resources for Azure and so there's that piece of it right there where get involved obviously shout out to the YouTube channel ginger hacker that's also where we post a lot of our videos and we have folks on like Dakota and other great practitioners that share their OG stories of how they broke in great resources that

22:27they're using and just kind of another way to kind of like drive listen to a podcast on the commute and kind of check that stuff out as well when it comes into getting involved and like getting involved in the scholarship or the community now for the scholarship aspect of it it all comes down to funding just like any nonprofit we are a nonprofit so our scholarship only goes on about once or twice a year and it just depends on how well we're funded so great news is we should be having it going back on for December for the start of the year of 2027 so please keep your eye out for it probably the first or second of December you should see a new tab on the top of the ginger hacker dot org website that will allow you to see a certification scholarship application which is a quick and easy name email dress linked in profile kind of where you're at in your career and then five open ended questions that you could to write me a short story on of why you're trying to break into cyber and what certification you're trying to go for now the other question you asked Dakota that we get a lot of the time is like hey I want to give back I want to help what can I do to get back or get involved with GHI and I tell people

23:33that there's three ways to do this. Fatter hat coming on we're always looking for partners and scholarships and those that want to support that through their organizations or if you're in a happy place in your career and you want to get back and maybe sponsor five network analysts to get their net plus or five security analysts get their CYSA we're always happy to talk to those individuals for individual donations to specifically sponsors certain tracks or certifications. Fatter hat off but if you're not wanting to get money to the organization which I totally understand there's the other two ways we ask one reach out to me reach out to me on discord linked in any of my socials and jump on the YouTube channel and share your story of how you broke into cyber many times folks think like what my story is not cool or it's not organic but the thing I always tell folks is if there's someone that's watching that video that can relate to how you did it sometimes that's the voice of the person they need to hear it from to get started I asked about five of my friends when I was trying to break in how I broke in and until I heard the exact same thing that my first friend told me that my

24:35fifth friend told me for some reason it was my fifth friend's time telling me the same advice if I can go back to school get your security plus just start doing stuff that's when it clicked and that's when I started trying to break into cyber so sometimes it might be your voice that gets the change someone's idea of like me what that's I'm going to do it and I'm going to get started today. The third is just sharing out what we do you hear somebody that's maybe in passing like I'm really trying to break into cyber but I can't find the right resources. Hey have you heard about the ginger hack initiative maybe you're at work and when you're IT help desk folks is super frustrated because their work won't pay for this security plus. Hey have you heard about the ginger hack initiative. So just good word of mouth and share what we do direct them to the website direct them to the discord and have them be a part of the community and that's pretty much the top ways for folks to jump in get back get involved and help folks breaking the cyber. Van Dool is now available everywhere in the US.

25:37So you can get in on the sports action no matter where you are including these places. They this your most rewarding season ever with fan do agent location restrictions apply product availability varies by market see fan do dot com for eligibility gambling problem call 1 800 camera. This episode is brought to you by Google Chrome you think you know a browser but Gemini and Chrome that's new it can help you with practically anything on the web like restoring a vintage motorcycle from a 50 page restoration block or finally break down that long article you've had open for weeks Gemini and Chrome is here for it ready to make anything online make sense there's no place like Chrome check responses set up require compatibility and availability vary 18 plus. That's so awesome and you know you I think you briefly mentioned in passing but you have the ginger hacker initiative con coming up here in December and what is that about you know I know you know I I was there with you you know last year but I feel like this

26:43year is going to be even more exciting. So if you're looking at the photo on the website the theme this year is die hard double down and it is a my marketing has a lot of fun they they put me in a John McCain like tank top with a Yippee KIA cyber security quote and ideally what we're doing this year is on top of how we did it last year which was like a four hour stream with our final countdown of bringing folks on just talking about kind of breaking the cyber we're actually turning it into an online conference so we did a call for papers we're going to have two tracks going will likely be also streaming on your channel as well for Blair to that he dad and on top of the stream going on with two talk tracks. We will also have some amazing raffle item prizes in our baskets like we did last year now the basket items will be roughly priced out to about $100 the $300 starting but the good news with this is every basket is going to be roughly valued about $500 and our target audience are students those trying to break in and for those not trying to break the bank to get good resources in cyber security.

27:53Now some some little hints in ideas of what's going to be in the basket this year we're going to have sans classes comp T a certifications. E C council anti-siphon training TCM security hack the box and so much more so if you're looking to a cert you're really excited but you can hold off till December December 12 will be when the auction ends at the end of the stream but the silent auction will be going live December 1 through the 12th and yeah it's going to be a fun day it's like I said it's die hard themes so there'll be some cool die hard throwing jokes and puns. And should be a pretty fun exciting day so yeah I am so looking forward to it you know I used to do something similar not quite to your level every year and you know it just takes so much to put that on I like mad props you for all the work you guys I'm sure are putting in behind the scenes right now to try to gear up for that but it's so great that you're able to also help out the community with that so I'm super excited to hopefully help out where I can with that.

29:02Yeah I'm excited to go to might have you on as a guest speaker for some small stints of it but we're going to talk more to figure out where you're best going to fit in I'm so excited. Absolutely now let's kind of step back into the career path you know the career reality check you know we hear a lot about a massive shortage of cyber security workers but then on the same hand people are like well the field saturated there's so many people going after these jobs you know how can you even get hired. Why is there such a disconnect there you know in communication. I think we're in weird times right now 100% I say we're in the weird AI era where some organizations are trying to fully engulf themselves into the AI algorithms say man AI can now take over the work role in the workforce but my my assessment or belief is I think we're going to be inside this in the next year or so. Just like kind of like the like a snap back process where we're going to see a lot of jobs coming back out to hands on folks rather than they're trying to be automated with AI and the piece of why say this is because there's that human in the loop that a lot of organizations are realizing for their GRC compliance aspects and for all the hallucinations that AI are having or the risk into concerns the areas it's causing onto the workplace.

30:26So I had a really good talk here maybe a month or two ago with a fellow a gal on my YouTube and she's like yeah the the race to get AI and to an organization there's one of two ways organizations are doing it one there go in full force let's go give it full privileges the Pia. Let's go you then have the other organizations are tip towing that are kind of behind the power curve but they're just taking a lot more time trying to get into it. And then you have all your teams and your chair ones that have these fears that a AI is going to replace us what's going to happen if we can't adapt and what I like to try to tell folks is yes the market right now it's weird it's it's saturated but it's not and it comes back down to the roles that organizations are looking for right now not only are looking for the those more technical level skills where we can go back to that talent gap that we're talking about from the beginning of the conversation. But now we have AI integration how are you now preparing yourself with new AI world that we're living in and what happens and I've had in the past six months probably nine months to interviews where it's like hey what are your thoughts on the AI in the workplace and how would you leverage it.

31:40Do you use it continuously would you limit it would you set certain parameters would you let it do all your tasks you let it do none of your tasks how often would you it's it's such a weird give pull because one depending on the organization you don't know if that's a check on there and I'm like oh well you guys like AI like oh yeah we love it I go okay well then cool then yeah but use it the best I can and as much as I could. To automate the simple task compared to the company is like no we're really kind of we're really moving slow with AI so then get to now kind of almost tune your answer and sometimes you won't even know this it's going to be doing a lot of research to figure out how or what's going to help you get onto that plate or that same level what these organizations are looking for. But when you're trying to break into this field the thing I tell folks to is because I've talked to some other folks as well this past month where it's like me I've applied to a hundred positions I only got 10 callbacks I'm like okay well what's what's been the positive thing that they told you why they called you back did you ask. Because is it the resume you're missing training or you missing certifications did you retailer that resume per application submitted we're using a generic one every single time.

32:51And the quite in the answers very and you've had the same conversation with folks where it's like yeah you think the same one for 25 of the rolls and I started changing the last 50 it's like well you should be changing every time slightly. But I usually tell people like look if you're if you're not hearing back on certain roles it's one of two things one it's a job it's a it's a it's a ghost role where it doesn't exist. And it's just out there for metrics for an organization or two your resume still missing something that's just not getting you past is the best candidate. And that's where I tell folks to kind of really sit down grab a mentor to not just have one person have several go through your resume and say hey. highlight my top three things that you think are the best thing out of this and where the three worst. And then that's where I tell folks to kind of take those three things and I'll go find certain skills or tools or projects that would then fit that role you're looking for or applying out for. And if you get a decent analysis or kind of like a round idea of what's the weak pieces of your resume that's what you can replace with more targeted tool.

33:54Skills that hopefully will get you a tighter resume to break through that HR algorithm to get that first round now let's walk that back even further let's say someone comes to you they have zero tech background but they know they want to pivot in the cyber security. What is your advice to them where should they be starting right now. Oh man. So that's a great question and the way that I like to get these conversations in with it comes into those trying to break in I go I go like patent paper old school level like hey we're going to pick your if you had to get a job in cyber tomorrow. And you had your dream title or at least a title you'd be happy working for the next two to five years. What would those three work role titles be and I always pick on these roles so a sock analyst blue team a junior pen tester red team a GRC analyst GRC. And I say okay perfect you find those three roles now depending on people's a bell building because this can be done in the span of a week it can be done in the span of a month.

34:56By tell people hey now with that first work role go ahead and find the most top or current skills most common tools most common certs and make a list of that and then on an interest rate of one to five score what that position would actually be you've enjoyed doing. Rinse wash repeat do that for role two so do that for the junior pen tester role three the GRC analyst now once you've combined on your little word your word pad your VS code your chat to TLM of your choice or even the old school legal paper. Look at your interest rate of okay like which one has the highest score what I love to do the most. And if it's that GRC analyst well then when you come back to your mentor back to the when I talk to my folks that I kind of run my this assignment through. And they come back me saying hey I want to be a GRC analyst or hey I want to be a pen tester I say perfect well now that I know that that's kind of your interest now we can start to kind of pinpoint directly into that path and start I can start sending you resources training material.

35:59Certifications I think you should be targeting to if you're trying to get into that specific role to get yourself started. And another one of my my mentees like well hey while this is happening can I still be applying out to like I teach here when help desk Mike absolutely. I like don't feel like this is like a hard stop on what you're doing applying out please do but just keep in mind. The success I've seen with running this kind of exercise or challenge to folks to get them into specific training pipelines to match that role they want. And then once obviously that happens and we get some training under their belt now comes back down to the resume hey let's get your resume back in front of us not that you've done like a month or two of these specific tailored projects tailored to this job role. Now let's match up all these skills into your projects and things you've been doing and that's going to make you even more of a hot topic for this job role and the prospectus of you trying to get into these organizations. And that's where I see a lot of my folks are trying to break in have more success compared to the shotgun spaghetti on the wall method of

37:04certification training you get every certification under the sun you can you might it might be a mastercard certification because there's these random one off cyber certifications you get from other orgs which are great it's cool you get a badge you can get like a skill brew a skill like a skill badge out of it put it on the LinkedIn it's great but is it relevant and for that hour to you spent on that could you've been doing something specific to the role you're trying to get into. And that's another big thing that when folks are trying to break in it's that it's the Tism it's a plain stranger dinosaurs and they have they have they have they have a thousand things open at once they're multitasking and I say hey when that starts to happen take a step back have like a little sticky note on your desk and right out your top three priorities hey first priority get my security plus second priority work on blue team tools and projects will make me a better security analyst step three call back my mentor and then tighten up my resume to match a blue team analyst role.

38:11And those that follow through kind of like my my process there's a method to my madness but when they follow through that process that's when I say hey I got like five interview calls this coming month and it's ever since we kind of retweet this resume and I started doing these projects like a fantastic that's what I want to hear. And then the cool thing with the hi where I start to say we try to differentiate ourselves from other like nonprofits trying to help with Rick and the cyber. We really try to keep with our community and like rather than like a cohort that you pay the five hundred thousand dollars to your five grand to get your security plus. They then say okay good luck use our network and then it's just to get ghosted. We really try to push through with our follow on with like hey keep keep in touch with us on discord reach out to us on the info email head sub linked in. And let us know where you're struggling or if you need more of that mock interview press practice. If you need more one on one time with us or one of our mentors so we can kind of chat with and talk to to have as long as we have the time because I mean once again working it on profit.

39:13This is me and a bunch of my friends on top of our full time jobs with our families trying to find time to hit this skill gap that we have we have we have observed with this technical gap. And we're really just trying to help kind of fill avoid which many organizations could should be doing. And that's the best we can try to do and that's why I know you're very familiar with this code with a lot of your platforms as well is the one to many methodology. Where that's why we have the discord that's why we have the YouTube that's why we have the LinkedIn where we can kind of post out to everybody in all. And there's only one of me in only 24 hours in the day and unfortunately as much as I love to talk to 35 people with an hour each day there's not enough hours there. So that's one of the principles we always try to see and what we're trying to do to really make folks understand it like it's it's not just learning the material it's knowing how to have that conversation those soft skills. Knowing what resources and tools you should be really focusing on rather than a bingo card method and you're just dotting every single box trying to get every certification like all the Pokemon badges.

40:22And I think I think that's one thing that I have a lot of strong conversations with people saying hey look you're over. Soaking in too much stuff and you have two firehoses turn out at the same time and you're not controlling it well. So let's step back let's focus and figure out what exactly you need to do to be successful. 100% and you know it's it's difficult because there's just so much information out there I feel like we're kind of in this age of information overload. Everyone claims to have the cheat sheet or the the hack to get in and everyone's telling you you gotta go do this right now. Oh, wait a minute you gotta go do this right now. So you try to do 20 different things and you end up failing at all of them where if you just took some time and focused on the individual task and broke it down into those sections. You'd find that you'd be much more successful. You know, I've done coaching and mentoring through the years as well. And that's one thing I always tell people is don't try to do it all at once. Let's focus in and do one thing. Are we in our study session right now? Are we in the age of you know applying for jobs.

41:34Okay, you're applying for jobs. Okay, what's what's the biggest hurdle? You're applying for jobs and not hearing anything back. Well, let's look at your resume because if you keep on throwing the same resume out there expecting the results. You know, it's not going to happen. So let's break down your resume and see what's going wrong. And you know, I've gone through that and lived it myself. So I understand and can relate and when you're in that moment of trying to find a job, you kind of get blind to those things. Yeah, because it's a get it like get the pain mortgage, you have bills to pay, you can only only have so long of a severance. And yeah, the time timeline's ticking. So, but I think you're right. It's remembering the small little details to not fall into bad habits, which I think a lot of folks sometimes will just out of desperation and just time. They can just like know what shotgun method I will hear something. I'm sure out of like one out of these 500 applications. I'm bound to get two interviews. That's a way. I don't know if that's my way, but that's a way you and you know, a thousand of the people doing you know, trying to do that for the exact same job.

42:43It goes back to like, what are you doing to differentiate yourself from all the other noise out there. Yeah, and that's that's one thing to you words like I've talked to my manager about it to now. It's it's and that's why I think when you initially asked to like giving back and finding the right nonprofit or giving giving time back to students or high school students even it's it's not as hard as you think. And honestly, the growth you can see out of that and I'm actually giving a talk on this next week to one of my local meetups is how volunteering can really open up your career advancement is huge. By me having my nonprofit to get to reach out and talk to amazing people like yourself other practitioners here in the network in cyber security. John Hammond Phillip Wiley Michelle Khan, Rihanna Schultz Josh Mason, John Strand, like all these folks that now like I have like on first name basis with I see them at conferences are going on. And it's like the cool impact we're also seeing with our community with folks in their first certification first getting their first job.

43:47And then then coming back saying, Hey, what can I do to help with this nonprofit because this is so cool, which has your doing and I want to help. And half the answer is just be present like there's someone going to the same challenges you're going through, which they may be on day one, but you're on day 60 year 59 days ahead of them where they got started and they're probably just as scared and nervous. On doing this career pivot or this career change or studying for their exam and you just did it and were successful. So sharing tips and tricks, whether you're a day two days into your journey or 260 days into your journey with someone that's working on that same path as you go such a long way. And whether that's going to a local meetup your local B sides other nonprofits in your area or community or joining even a cyber discord like just hacking simply cyber anti-siphon training, GHI. All of them is just like there might you might find one person that has a question that's on general chat and you ping in like, Oh, wow, thanks so much. You just help somebody and so is that sounds it's not a bad thing to reach out to the founders and say, Hey, I'd like to help you a mod or I'd like to help kind of get more feedback when I can or get back.

44:59And with the right with the right time about you doing stuff to you. I mean like I'm more than happy to have folks do that and then say, Hey man, go ahead on your resume. Just put the you do volunteer work with DHI like you're doing three to five months, three to five hours a month. You help with XYZ tasks. And to me if I was a hiring manager, seeing that you're part of doing things with the community, to me that would stand out like, wow, like you're not even in yet and you're helping run study groups. Just helping folks get their security plus or, Hey, you're helping run folks with AWS or net plus or just like basic like a mock interview practice. Like that's a pretty big deal for someone still trying to break in. That to me, if I was in when I've said on interviews with my boss and seen those certain things in my case, we should ask him about that and see how they got into it or the why behind it. Because that's showing a lot of dedication to someone that may not even be in the field yet or with something that isn't the field and just seeing how they get back. It's a to me a pretty important thing to see and recognize on a resume. Well, and let's be honest, address the elephant in the room. Sometimes it's not what you know it's who you know in this industry. And you know, it

46:00absolutely infuriates me like I've seen it happen. I've seen good people get passed up for jobs that they really were the best qualified candidate I feel for. And only because someone knew someone's you know, friend and they got the job even though they weren't necessarily better qualified. So going by going out there and making these connections is going to only open up doors for you. You never know when a connection, you know, or meeting someone might open up a job opportunity years down the road. So and then you also mentioned, you know, kind of like documenting your your process in a sense like, you know, like on YouTube. Let's say creating a video you learn something and turn around and teach others. I actually just did a podcast episode yesterday recorded a podcast with Keith Barker from CBT Nuggets. And we were talking about that. And you know, talk about building a portfolio for yourself and doing something to stand out, you know, and you don't have to get on the camera and show yourself.

47:03You can just share your screen. But having not only are you hoping others that are still, you know, learning along with you, you're learning the knowledge more and you're creating a portfolio when like an employer asks you like, Hey, you know, have you have you dealt with this before? Actually, yeah, I actually created a whole YouTube tutorial on how to solve this issue. You know, things like that. So it does wonders for you in multiple different ways. And it's one way I feel like you can do accomplished multiple goals with one action. Bandool is now available everywhere in the US. So you can get in on the sports action no matter where you are, including these places. May this your most rewarding season ever with Fandool, agent location restrictions apply product availability varies by market.

48:04C Fandool dot com for eligibility gambling problem called 1-800-Gemmar. This episode is brought to you by Google Chrome. You think you know a browser, but Gemini and Chrome, that's new. It can help you with practically anything on the web, like restoring a vintage motorcycle from a 50 page restoration block or finally break down that long article. You've had open for weeks. Gemini and Chrome is here for it. Ready to make anything online makes sense. There's no place like Chrome. Check responses set up required compatibility and availability varies 18 plus. Yeah, and I think the best way, I mean, even like medium or doing a blog is so, some folks can get so, so little like, oh, I didn't even think about doing that. And it's just like sometimes when you're in the heat of the moment, like I was talking to my friend today that's trying to now pivot in. They were talking about this like before we went on, on live. And it's like, there's things I told him is like, wow, I didn't even think about that. Just like little, little nuggets where it's just like, I think you're so, there's like I said, you're reviewing all the jobs, you're looking at all the training platforms and like, you just, you overthink something.

49:07And it's like, you don't kind of just take a step back to say, hey, like, have you just started like writing out like projects or things that you think you'd be interested to do within cyber is like, oh man, I never actually thought about that. Or like, hey, open up a word doc and just like, like I said, going through three work roles is like, oh shoot, that's a really good idea too. I'm like, yeah, like none of these things are new, like state of the art, 2027, we're ahead of its time on how you need to break in. But I think it's going to be kind of like a new, it's weird. We're in such a day now where it's like, I think, and this is me projecting here for 2027. I think what one of the new questions will be is going to be a, hey, it'll be something along lines of like, hey, what's something you've used AI to build? And I mean, I've even already seen this question actually. It's like, hey, explain something that you've used on your personal life that you now have AI helping you do. Or what if you used AI or have you built a process or a website or a training or some cool tool and explain us that process of why and how you did it. And I think that's going to be one of like, I think that'll be one of the new embedded questions in 2027 with us in this LLM work role.

50:14To in tandem with the positions you're in, because a lot of organizations are jumping into it now. And so now it's going to be a K now and on top of seeing who's the best analyst, who's the best analyst that can also leverage AI to enhance their work role is going to be that new metric to help someone get through and break in. 100% Andrew, you know, I'm sure we could spend hours just diving into this. But you know, if people want to connect with you, if they want to find out more, where can they find you online? Best way is gingerhacker.org on there. You have pretty much my entire link tree to the LinkedIn, the YouTube, the discord. Also on the YouTube channel, Ginger Hacker, it has my LinkedIn there as well, the entire link tree. Please connect. Don't don't worry if you can't message me a cool little note. Except most of my connections because I love to kind of have fun conversations and shavvy sir, how you broken or higher trying to break in. That's so cool. I'll make sure and definitely leave all the links down in the show notes below.

51:16Now I got to ask, what is the single worst piece of advice you see beginners following right now that they shouldn't be? Oh man, that is a good question. I would say the worst piece of advice I see folks that will they still fall into this trap is they go join these paid for cohorts or courses. That's like $3,000, $5,000. You're guaranteed like a sec plus and one other small certification that by itself only costs maybe like 800, $500. And at the end of that, you're just kind of left with two certifications. There's no there's no network. There's no group. There's no community. They they've taken your money. You've gotten the certifications. Hopefully. And then you're kind of just left on your own saying, hey, good luck. Hope you break in. So that I'd say to be the worst piece of advice. Now just reverse that saying make sure you find your people in your community and just use that and leverage it the best you can. Andrew again, thank you so much. It's always a pleasure. It's just like I think the third or fourth time I've had you on the channel and definitely going to have you back and looking forward to all the amazing things you're doing over there at the Ginger Hacker initiative and

52:26you know, just glad to be a part of it and hopefully support more as the future grows. Of course, Dakota. We're so glad to have you as part of our friends and associates helping us with what we do and always a pleasure to come on and talk to you and your viewers. Absolutely. Everyone, I really hope you enjoyed this episode. Let me know what is the one piece of advice you took away from today's interview that you're going to go out there and start applying again. Hope you enjoyed and until next time everyone. Bandool is now available everywhere in the US. So you can get in on the sports action no matter where you are, including these places. You're most rewarding season ever with fan. Agent location restrictions apply product availability varies by market. See fan do dot com for eligibility gambling problem called 1 800. Imagine if having your cake and eating it too was about banking not baking Silicon Valley Bank and first citizens bank have created a recipe that blends decades of

53:34innovation economy experience with more than a century of stability. Now you don't have to choose between deep sector expertise and lasting financial security. Instead, you can enjoy them both. Silicon Valley Bank and first citizens bank. It's the best of bank worlds. Keep learning.