.png)
The Hacker's Cache
The show that decrypts the secrets of offensive cybersecurity, one byte at a time. Every week I invite you into the world of ethical hacking by interviewing leading offensive security practitioners. If you are a penetration tester, bug bounty hunter, red teamer, or blue teamer who wants to better understand the modern hacker mindset, whether you are new or experienced, this show is for you.
The Hacker's Cache
#63 Q&A: Outwork 1,000 Applicants to Break Into Cybersecurity
Breaking into cybersecurity isn’t about being “good enough.” It’s about outworking the 1,000 other applicants fighting for the same job. In this episode of The Hacker’s Cache podcast, I share the raw truth about competing in today’s cybersecurity job market, why certifications and hands-on projects matter more than ever, and how to stand out when everyone claims to have the same skills. Whether you’re chasing your first role or leveling up, this episode gives you the mindset and strategies to rise above the crowd.
Connect
---------------------------------------------------
https://www.KyserClark.com
https://www.KyserClark.com/Newsletter
https://youtube.com/KyserClark
https://www.linkedin.com/in/KyserClark
https://www.twitter.com/KyserClark
https://www.instagram/KyserClark
https://facebook.com/CyberKyser
https://twitch.tv/KyserClark_Cybersecurity
https://www.tiktok.com/@kyserclark
https://discord.gg/ZPQYdBV9YY
Music by Karl Casey @ White Bat Audio
Attention Listeners: This content is strictly for educational purposes, emphasizing ETHICAL and LEGAL hacking only. I do not, and will NEVER, condone the act of illegally hacking into computer systems and networks for any reason. My goal is to foster cybersecurity awareness and responsible digital behavior. Please behave responsibly and adhere to legal and ethical standards in your use of this information.
Opinions are my own and may not represent the positions of my employer.
There's thousands of people trying to break into cyber. There's tens of thousands of people trying to break into tech, and they have some serious skills. And I always say, I'll say it again, you are in a competition against other people in this field, and you have to be better than them.
If there's one open position, and there's a thousand people applying for it, you gotta be number one. You can't be number two. Right? If there's only one slot open and one person getting that job, you have to be the best out of 1,000 people.
You can't be number two, man. You cannot be number two. So you gotta put in the work, and you gotta demonstrate your skills, and you gotta get those certifications, because certifications do demonstrate skills.
Welcome to The Hacker's Cache, the show that decrypts the secrets of cybersecurity one byte at a time. I'm your host, Kyser Clark, and in this episode, I have another Q&A episode where you, the viewer slash listener, ask questions, and I answer them here on The Hacker's Cache podcast. If you want to know how to submit questions, just ask questions in the YouTube comments on any of my videos.
I will see them, and they are in contention for being highlighted on the show. You can also ask your questions in the Discord server. I have a specific channel called Hacker's Cache Questions, and if you want to ask your questions, feel free to drop them there.
So let's go ahead and dive right into it. Question number one. If the organization has strong security, and you couldn't get root access, isn't that great for them? You don't have to force finding root access because that's what you get paid for to test the security of the organization.
And this is an interesting question, and I think the reason why this one was asked is because I have said on multiple occasions why it is frustrating as a pen tester to not always get domain admin, not always get root access. It is a frustrating experience as a pen tester when this happens, and the reason why it's frustrating is because in training, in certification exams, you don't win unless you get root access or domain admin access. That's the only way you win the CTF challenge.
It's the only way you root the hack the box machine, pass the certification exam, and you are trained to always get root access or domain admin. And then when you go in the real world, it's completely different because in the real world, systems are not intentionally left vulnerable. And I also think it's frustrating because if you read about pen testers and ethical hackers of the past, like the people who were in this field 5, 10, 15, 20 years before I was in the field, you always hear them talking about how easy it is to break into systems and how it was a field day and they had a lot of fun doing what they did.
And I think the times have changed a lot, and a lot of people understand the cybersecurity risk. Cybersecurity is taken much more seriously than it was 5, 10 years ago. And because of that, it's harder to break into systems.
And in my opinion, from my perspective, in the real world, it's just not as fun as it used to be. And I might have put this ethical hacking and penetration testing thing on a pedestal. And thinking like, Oh, yeah, I'm going to be rooting all the machines getting all the shells in and being as coolie hacker in these networks in the real world.
And it simply just doesn't happen that way. Now, don't get wrong, I still find critical findings, I still see domain admin, I still get SQL injection, and I can still dump databases and all this stuff. But it just doesn't happen as often as you might think it does.
And it definitely, from what I understand, doesn't happen as much as it used to. If you go back and listen to some of the forefathers of ethical hacking is the best way I can put it, you know, like I said, they would always tell stories on how easy it was back in the day to break into systems and I just don't think it's easy anymore. I don't think it's easy anymore.
And maybe I just suck. And maybe that's, that's what's frustrating about is because it feels like you suck because you hear about all these people wrecking havoc in these networks and in these applications. And it seems like it's easy for them because they have all these stories on breaking into these these networks and these devices.
And then you get in there and it's just it doesn't feel that way for you. So that's been the frustrating part because it feels like I'm not as good as what I should be for someone who literally spends all day, every day doing this. I mean, like I have a full time pension job where I'm doing this eight hours a day.
And then after work, I'm putting in multiple hours into training. And then I'm also spending another 20-30 hours on content creation telling people how to act. And it's, I literally live, breathe and sleep this profession.
And when I come up short, it's frustrating. So I think that's where the questions come from. So I know that was a long winded, like backstory there, but I just wanted to set the scene for you.
So the question here is being asked if the organization has strong security posture, and you couldn't get root access, isn't that great for them? And the answer is yes, absolutely. It's great for them. Right? The organization wants to win.
And when you have a professional penetration tester, such as myself come in and they, I don't have any high findings. I didn't get root access. I didn't get domain admin.
That's an absolute one for them. They did a lot of good there. And that means that if a threat actor was in an environment, the threat actor is not going to have an easy time getting whatever they want out of that network or the application.
And they're more likely to move on to another target because as a pen tester, I'm spending a week or two or three weeks pen testing a network pen testing application. So if a third actor got in there, they're going to have to spend a lot of time to, to find on a vulnerability. If I, if that's the case, now I'm not talking about the applications and networks that where we do find critical vulnerabilities, because those absolutely still happen.
Like I said, it just, I feel like it happens less often than what I thought it might be. And maybe, maybe my experience is different than a lot of people's. Maybe it's a lot the same from the people's of the past.
And maybe they just have select stories that sound cool. You're going to get this on the darker diary. There's like something cool going on all the time.
And it's just not the case guys. It's, and I do want to stress that enough. If you want more information on, on why that's not the case, I have a video called watch this before you become a penetration tester.
It's one of my most watched videos. It's definitely worth watching. If you are considering becoming a penetration tester, or even if you already are a pen tester and you are facing similar struggles, just know you're not alone.
Watch that video and you'll see, you'll find out. So yeah, that's absolutely great for them. And that's a win for them.
But when it's a one for them, guess what? It's a loss for you as a pen tester, ethical hacker, red team, or whatever you are in offense security. And when it's a loss for you, it stinks, especially if you're like me and you're a competitive person and you like to win, you love to win. And matter of fact, I hate losing more than I like winning.
So when I come up short, it's extremely frustrating to bash your head against the wall and come up short. So that's that's where the frustration comes from for me. But yeah, it's absolutely great for them.
And that's good enough for them, for their company for the client that you're testing. The back in that question says you don't have to force finding root access because that's what you get paid for to test security organization. Even if you can't find a way to root or you can't find a way to domain admin right away, easily, you still have to try, you still have to put in effort, like if the vulnerabilities aren't popping up in front of you immediately.
That's where it gets frustrating because you're like, dang, dude, I don't know what I'm doing. Like I don't know how what else to try. Like I've tried every technique that I know.
And that's where like bashing your face against brick wall comes in. Because every technique that you know, and every technique that you used in the past to get domain admin or root access isn't available to you. And you still have multiple days left on a pen test, like you still have to try they are paying you to, to break in for a set amount of time.
And if you run out of techniques early on, like that's where it gets frustrating. So you can't throw your hands in the air and give up. You have to keep trying.
Like that's where the try harder mantra comes into play. And sometimes you try harder and try harder and try harder. A lot of times you come out short, especially if it's an organization that takes security very seriously.
And they have been through multiple pen tests, and they have all the defense measures in place. And it's very easy to go into situations and lose and get frustrated. So if you're a pen tester, just know that you're probably gonna run into these same frustrations.
And I think that's pretty normal. And the modern cybersecurity, it's not like it used to be. I wasn't in the field, as long as some of these other guys that talk about how easy it was to break in back in the day.
But it just feels like it's a lot harder now. Because I think organizations are starting to realize that yes, cybersecurity is important. And even the basics can prevent a pen tester who has a lot of skills and a lot of experience from breaking in.
Alright, before we dive into the next question, I just want to simply ask you the viewer slash listener for a couple of things. If you're listening, hit the five star rating if you think the show deserves if you've consumed multiple episodes and you enjoy it, hit the five star rating would help the show out tremendously. I don't run ads.
And the only way for the show to grow is if you hit the five star rating and if you're on YouTube, same thing applies. Hit the like button and hit the subscribe button. And yeah, hopefully you're doing a show and if you're not leave a comment let me know I could be doing better.
Move on to the next question. When did you do the CompTIA cloud plus? Why did you choose that cert? I did the CompTIA cloud plus in November 2022. So that was about three years ago.
And actually it's about to expire. I actually got a notification email saying that's about to expire. And I've actually technically already done enough to renew it.
I think the OSCP was like one of the things you can do to renew it. And I've done the OSCP and I think five or six, maybe seven certifications on top of that since the cloud plus, maybe eight or nine. It's been a lot.
It's been a lot of certifications since I got cloud plus. So I've done the training I've put in the time to renew. I just got to pay the fee and you get it renewed.
But more importantly, why did I choose that cert? It's a good question. Why did I choose a cloud plus? Well, for starters, it's important to know the cloud as a cybersecurity professional. And I made an entire video on this about why the cloud is important for cybersecurity and how to learn the cloud as a cybersecurity professional.
So if you want more information, definitely check out that video. So it's important to know the cloud because a lot of companies, a lot of organizations are now using the cloud. Even companies who have their own data centers are still using the cloud.
The cloud is pretty much everywhere and it's here to stay and it's going to get bigger. And as more small businesses get brought up, there's going to be more companies that are using the cloud. So the cloud, cloud skills, cloud knowledge is essential.
And you don't have to be an expert. I say that in the video, but having a basic level understanding of the cloud is essential. And that's why I decided to go out to cloud plus because cloud plus does give you a little bit higher than the beginner knowledge.
Like it's not like a super beginner level cert, but it ain't like an expert level cert either. And I would say it's like somewhere between like the, like the beginner to intermediate, right? It's not quite an intermediate, it's probably just below intermediate. And it's definitely above the beginner slash intermediate level.
So it's somewhere in there. And the reason why I chose is because it's vendor neutral, right? There's three major cloud providers out there. We got Amazon Web Services, that's AWS.
We got Microsoft Azure and we got Google Cloud Platform or GCP. And it doesn't, it doesn't focus on either one of those. Each one of those providers have their own certifications.
And I didn't want to double down or go into a certain specific platform because when I was in the military, that's when I got the certification, I was actually doing the military. I didn't know what services my future employer was going to be using. So I didn't choose one.
I just like, okay, let me just use a vendor neutral option because it will set me up for success in whatever direction I want to go from here. I can go AWS, I can go Microsoft Azure, I can go Google Cloud Platform, and I already have the basic understanding and then I can expand upon this later. And I never actually expanded on the knowledge yet, although I do am heavily considering going after the IC2 CCSP, that's the Certified Cloud Security Professional.
That's also a vendor neutral cloud certification, but that's more focusing on cloud security, not just cloud configurations. Like Cloud Plus isn't, there is security, like that's a section in Cloud Plus, but that's just a section. And it's more about just understanding terms and definitions and how to configure certain things in the cloud at a high level.
And the CCSP is more about, it's actually all about security. So, which is what I do, I'm a cybersecurity professional. So it's important for me to understand cloud security.
So that's why I'm considering that one. And I think I'm going to get that after I do some hands-on search. I'm going to do some more hands-on certifications and I'll probably go after that one because it's one that I'm eyeballing.
But another reason why I chose Cloud Plus, and this might actually be the number one reason, but this is a huge driving factor of why I went to Cloud Plus is because I had the CompTIA Linux Plus. And when I had it for three years, I think it was like two and a half or something like that. It was about to expire.
I was like, I need to do something to renew Linux Plus. And the Cloud Plus was the only CompTIA certification that would fully renew Linux Plus. So I got Cloud Plus.
It automatically renewed Linux Plus. I didn't have to pay a fee or anything. I just had to pay for the voucher for Cloud Plus, take the exam, pass it, automatically renew my Linux Plus.
So that was a huge driving factor too, because I wanted to renew Linux Plus because I spent a lot of time, effort, and energy getting Linux Plus and I didn't want that to expire. So Cloud Plus, because having the cloud knowledge is essential and because Linux Plus expired, it just seemed like a good idea to do. And it was a good idea to do.
I don't regret it. I'm totally glad I took a time out from my pentesting studies because I was on this like pentesting track, right? And I got the Cloud Plus and it's, I don't want to say it paid dividends in my career, but it's definitely helped out, right? It's not a huge certification that like changed the trajectory of my career or anything like that. I don't lean on my Cloud Plus knowledge that much, but when conversations about the cloud come up, like I'm not, I'm not confused.
You know what I mean? So it has helped a little bit and I'm totally glad I did it. So that's why I chose the Contio Cloud Plus and I would recommend it. I think, I think the Cloud Plus is a certification all cybersecurity professionals should have.
And by the way, it also fully renews A Plus and Network Plus as well. So if you have A Plus, Network Plus about to expire or Linux Plus like I did, the Cloud Plus is a great certification to just renew all of those at the same time. So if you are trying to be versed in cybersecurity, which I believe you should, because there's a lot of risks out there and the cloud, everyone's using it.
Cloud Plus definitely a solid certification, or you can go for the IEC2 CCSP. That's the Certified Cloud Security Professional, like I said, and that's one that I'm eyeballing and I'm probably going to get pretty soon. I would say, I would say in the next half year or so, I'm probably going to get that certification, but don't, don't mark my words on that because I change what certifications I'm going to do all the time because the landscape cybersecurity is constantly changing and I get the certification that makes the most sense for my career at that particular time.
So if something huge comes up or something comes up that changed my trajectory, I might, I might put it off, but it is one that I'm eyeballing. Next question. What are the prerequisites before learning malware development in red teaming? So full disclaimer, I'm not a red teamer.
I'm a pen toucher. I would like to be a red team or something I strive to become every single day. It takes a lot of time and energy to go from pen tester to red teamer.
In my opinion, some people skip over right over the pen testing part. I don't think it's a good idea. It's possible.
I mean, you can do if you want to, but in my opinion, I think it's, it's important if you want to be a good red teamer, you have to be a great pen tester first. And I'm still working on becoming a great pen tester because I'm still at that mid-level pen tester. I'm not a senior pen tester.
I'm not an expert pen tester yet. I mean, once maybe once I hit three to five years as in my pen testing role, maybe you can consider me a senior, or maybe you consider me a great pen tester, but I've only been a pen tester for, for not even a year and a half, about a year and a half now. So I'm still working on it.
So with that disclosure out of the way, if you want to get into malware development, I would say the biggest prerequisite is you got to be a, you got to be a coder and you don't need to be a developer or anything, but you need to have at least an intermediate understanding of how programs work and understand programming at an intermediate level. It doesn't really matter what language, but also pay attention to the languages that malware is being developed in. So like, I would say like C, C sharp, maybe even assembly, dare I say assembly, understanding those is going to help a lot in malware development.
So yeah, I would say that's a prerequisite. Being an intermediate coder programmer is the number one prerequisite in my opinion. Also, I would say the next prerequisite is you need to be a hacker.
You need to be, you need to be a good ethical hacker, pen tester. And once you have pen testing at intermediate level and coding at intermediate level, then yeah, you can start making malware and go into that red team malware development route. There's malware development courses that I made.
There's a podcast episode. It's literally called red teaming and malware development. And that's with Nathan Rice.
And that was episode number nine. So go back and watch that episode, listen to that episode. And he will tell you how to learn malware development because I actually asked him that.
And I know, I know MalDev Academy was one thing he mentioned, but there's also some other resources that he mentioned in that one. Moving on to our fourth and final question. I'm currently in college for cyber.
I have my sec plus net plus a plus Linux plus in testing for SSCP. I actually don't remember what SSCP stands for security certified professional. I don't know what the first S stands were, but that's from ISC two.
It's equivalent from my understanding, equivalent to like a security plus, maybe, maybe a little harder, maybe a little easier, somewhere around in there. But it's, it's like the certification before the CISSP from ISC two. And he says, trying to get into tech currently, any advice? So yeah, here's my advice.
You have a good start, but it's not enough. You're going to have a bunch of people tell you oh, you're good. You got five certs.
How many you got here? One, two, three, four, five. Yeah. Once you get SSCP, that'd be your fifth cert.
And you're going to have people like, oh yeah, you're set. You got five certifications. You got your college degree.
You're good to go into workforce. You got this. You're going to go out there and kill it.
And that's not the truth. The truth is you need to get like another five certifications. You need to be doing projects on the side.
You need to be doing hack the box. You need to be doing try hack me. You need to be making educational posts, whether that's blogs or videos and showcasing your skills.
You need to have some kind of demonstration of you doing actual cyber content or cyber security activities. And I like to do that in content. That's actually the reason why I started my content.
I started my content because I wanted to prove that I had hands-on skills to employers. That's why you see my early videos with me doing try hack me and hack the box machines because I want to show that I had hands-on skills to employers. And there's another, that's another reason why I wore my, my college shirt with a tie, because I wanted to wear what I would wear in an interview.
And that's why you see my early videos, why I wear the college shirt with tie is because those videos was made to impress employers, to showcase my skills to employers and to show that I'm a professional in this field. Now, after I got in the field, I still wore the tie and the college shirt because that was kind of like my thing. And I want to show that I was professional, but then I got rid of it because of my content.
I shifted from trying to impress employers to helping you and everyone else in a community to either a break in the field or B level up in their existing career or C make a pivot from tech into cybersecurity or whatever you're doing, some kind of pivot. Maybe you're going from one side of the world to another side of the world. And when I decided to stop impressing employers, cause I'm, I'm in a position that I really like, I like my job and shifting it more into helping other people and feel I'm like, okay, let me get rid of the tie and the dress shirt and just wear some normal clothes because I'm going to be more relatable.
And that's, that's been the case. I think I feel, I feel more relatable to people because like, this is what I would wear to a lunch with you. You know what I mean? Whereas the shirt with the, the college shirt with a tie, that's what I would wear in an interview.
So, um, that's kind of a long winded answer, but of saying like, yeah, make content or write a blog or do something. You need to be doing something that proves undeniably that you can do what you say you can do on your resume. And for me, that was trying to hack the box.
Like if I say, oh yeah, I know how to hack things. Well, prove it. Well, here is 20 videos of me doing 20 hack the box machines.
It's undeniable. Like you can literally watch me do it. So that's why, that's why I started this channel.
Like I said, now it's me more helping you guys on your careers. So if you're trying to break in or trying to level up and trying to impress employers, I would recommend taking a similar approach to what I did, you know, make videos, make a blog post where if an employer watched it, like, oh yeah, this guy's got skills. He knows what he's talking about or she knows what she's talking about.
So I would recommend doing that. And like I said, find more certifications. I don't know what five you should be going after.
Cause I don't know what role you want in cybersecurity. There's different roles right now. You got a great foundation and you can go blue team.
You can go red team. You can go office security, event security, cybersecurity, analysts, GRC, pen tester. I mean the world's your oyster.
You can go any way you want cause you got a great foundation security plus net plus a plus Linux plus the best foundation you can get, but it is only a foundation. Those are just the beginner. That's just, that's the prerequisite knowledge you need to get into cyber, right? You can get a tech role with, with that stack of search you got there with your, with your college degree, you can definitely get a tech role.
You can get a desk role. And that's crazy to say like, Oh yeah, I worked this hard for tech to help desk role, but that's just reality situation. Employers want you to have stupid amounts of skills.
And the reason why they want you to have stupid amounts of skills is because the talent pool has just increased. There's thousands of people trying to break into cyber. There's tens of thousands of people trying to break into tech and they have some serious skills.
And I always say, I'll say it again, you are in a competition against other people in this field and you have to be better than them, right? If there's one open position and there's a thousand people applying for it, which many cases there are, there's always almost always at least a hundred people. And very, it's not uncommon to see a thousand people applying to the same role. You got to be number one.
You can't be number two, right? If there's only one slot open and one person getting that job, you have to be the best out of 1000 people. You can't be number two, man. You cannot be number two.
So you got to put them to work and you got to demonstrate your skills and you got to get those certifications because certifications do demonstrate skill. That's another reason why I have a lot of search because having a certification is the undeniable proof that you have a certain skill set, a certain knowledge set, right? I mean, take security plus, for example, you go in, it's a proctored exam. They literally record you while you're doing it.
And it proves that this person went into the testing center or they did it from home and they knocked that exam out of park. And then that, that exam has certain categories information, right? There's a lot that goes into security plus, obviously. And same thing for OSCP.
This is a much harder certification, but it's also a great example. You know, you have to break into six machines within 24 hours and you're getting watched the entire time. Like you have to have your camera on the entire time.
Like there's no fake in that. There's no faking that certification, which is why I like certifications that are proctored. Now, there are certifications that are not proctored.
I have a little bit of an issue with that, but that's a debate for another time. This is why I think it's important to have at least a handful of proctored exams on your boat. I think that's what science is about, like the CompTIA search and the, the offset search.
So search are great, undeniable proof that you have certain skillset, assuming that they are proctored exams, which those, all those certifications you have are, but those aren't hands-on search. So start getting hands-on search. So if you want to go blue team and start doing the, the try hack the SA01 or go do the hack the box.
I forget the acronym, but they have like a defense security certification. If you want to go pen testing, go again, try hack the PT1 or get the EJPT or the TCN security PJPT and get those hands-on search that require hands-on keyboard time and a professionally written report. Cause it proves that you have the hands-on keyboard skills and also proves that you can write a report, which is essential skills in cybersecurity.
So that would be my advice for you. You're going to hear people say, Oh yeah, you got enough. And you know, when I had three, four certifications, people were like, Oh yeah, you're going to get out.
You're going to get a six figure job out of the military. You're set. And I just don't buy it.
And I kept, I kept getting certifications because I didn't want, I thought every certification I got, I would have a bargaining chip to, to raise my salary rate. That was what motivated me for me to get so many certifications to be quite honest with you. And while it did help me have that negotiating power, the reality is I didn't get the salary that I thought I was going to get.
I thought it was going to be a lot easier to get a higher salary. And really what it did was help me get my foot in the door, having 12 certifications. So keep getting your certs, showcase your skills and a college degree in five certs.
Unfortunately, everyone's got a college degree in five certs. There's a lot of people out there, not everybody, but there's a lot of people out there that have them. And even if you are top five out of the 1000 people applying for that position, guess what? You're not number one.
So if you serious about breaking the field, you got to be number one, dude. And to be number one is you need five more certs, maybe even a degree and you need to showcase your hands-on skills and network. I didn't say this yet, but network.
And this is what content creation did for me because I didn't attend any conferences until I was seven years in the field, six and a half years in the field. And I just made content and I connected with people online on LinkedIn, mostly LinkedIn. LinkedIn's where the recruiters and the hiring managers are at, guys.
People are like, oh, Discord, oh, Reddit. And while you can get a lot of information from Reddit and Discord, and you can make a name for yourself in the Discord rooms. But the thing is most people use those Discord rooms, they don't use their real names.
So no one knows who you are in Discord because you got this cool hacker name, which is fine, but no one knows who you actually are. Same thing with Reddit, you don't know people's real names. So you need to make content under your real name.
And that's why I chose to make content under my real name because it's easy to figure out who I am and what I do. So yeah, Reddit, I think Reddit's overrated. I mean, yeah, you get a lot of good information there, but a lot of people are anonymous on Reddit.
I think everyone is. I think it's like, don't they just give you, I don't even use Reddit, dude. I don't get on it much.
I mean, sometimes I find some decent information if I do a Google search. I don't post on Reddit, dude. I think Reddit's overrated.
I think Discord's overrated and that's people who are in my Discord server are probably mad at me because I don't get on my own Discord server that much. I get in there and check the Hackers to Cash podcast question section before I do these episodes. And I don't post a lot in there because the truth is guys, the LinkedIn's where it's at when it comes to being discovered by hiring managers and recruiters, because that's where hiring managers and recruiters are at.
Hiring managers and recruiters, they are not in Discord. They are not in Reddit. They are on LinkedIn.
That's where the professionals are. And this, if you want to be a professional, which you do, if you want to get a job, job equals profession, then LinkedIn is the networking website you got to be going to. And then if you can afford it, and if you are the capability to go to conferences, go to as many conferences as you can.
And that's what I'm starting to do myself. I'm starting to go to conferences and see these people face to face. And you can build much stronger connections to a face-to-face conversation than you can over the internet.
But if you can't make the conversations, the internet can do the job for you. And I'll prove that because I didn't attend a conference until I was already a pen tester for over a year. So that's the best advice I can give you.
Just keep working and don't stop. That's really all it is. And a lot of people were like, oh, but I got all this other stuff going on.
I got family stuff. I got to watch my football game. I got to play my video game.
I got to play bingo. Whatever it is, whatever hobby it is, you got to be willing to sacrifice it, dude. And there's a lot of hobbies that I sacrificed for my cybersecurity career.
And I'm glad I did because if I didn't, I would not be in the position I'm in right now. If I didn't take it as seriously as I did, then I wouldn't be a full-time pen tester. I'd probably be, you know, get out of the military and in a help desk role.
Which most people that was in my position in the military, like we all had the same job description. We all had the same qualifications. You know, most people got out of the military, they got out and became help desk people.
They went from being help desk in the military to being help desk in the civilian world. And not me because I wouldn't got total certifications. I wouldn't got my degree.
I wouldn't made the content. And instead of me going from help desk in the military to help desk in the civilian world, I went from help desk in the military, administration in the military, to pen tester. And the only way I did that is from sacrifice.
I gave up video games. I gave up a couple other hobbies, football. And I stopped partying.
I had to cut back on the drinking. And yeah, the sacrifices are real, but they're totally worth it if you're serious about breaking this field. Because once you break in, you land those six-figure jobs, it changes your life.
You know, life is a lot easier when you're making good money. And if that's not motivation for you to give up on the stuff that matters to you, then I don't know what is. Because I used to be broke.
I used to be very broke. And not having to worry about money is really nice. Let me just put it that way.
And if you want that luxury, then you need to bust your butt. And there's no way to get around that. There's no way to sugarcoat it, dude.
Because these employers, they expect you to have a lot of skills. And the people you're competing with do have a lot of skills. And the people you're competing with are willing to sacrifice the things that you're not willing to sacrifice.
And I'll leave it at that. So thank you so much for watching. Thanks for listening.
Hopefully you enjoyed this episode. Once again, hit the subscribe button. If you're on YouTube, hit the like button.
And if you're on audio, rate the show five stars. If you have enjoyed this show for more than a couple of episodes. And if it's your first time here, go listen to another episode.
And yeah, give me a shot. Because there's a lot more information that I'm going to give you. A lot more wisdom I'm going to give you every single week.
So stay tuned. Hopefully I'll see you in the next episode. Until then, this is Kyser, signing off.