No Experience Required – Gaining Clarity for a Career in Cybersecurity

Key Takeaways

foreign welcome to no experience required uh gaining Clarity for a career in cyber security with the lovely Candace Williams um a little about myself I am the product marketing manager for cyber defense curriculum here at Sands which also includes the new to cyber courses and new to cyber kind of initiative that we have started in the last couple of years um I get to do lots of cool and fun things like talk to people that have made really awesome resources like Candace did I get to talk to people who have pivoted into this career from something totally and completely unrelated and made a huge success out of it um we are here to help you figure out what that right path is for you um as we'll discuss there's not one path into cyber um once you decide you want to be in cyber that opens up a huge world of where you want to go which can be very scary um but also really exciting and so that's why we're here today um so I'll kick it over to the lovely Jen hi so I'm so excited to talk about Candace and I have all these notes that I wrote to introduce her I actually forgot I was going to talk about myself so I am Jennifer Santiago I work on content for all of the Summits here at Sands which includes some of our technical ones like digital forensics and Pen testing hack Fest but also I get to do the stuff that I really love like talk about new to cyber and also work on our neurodiversity and cyber security Summit um and actually Emily and I co-hosted our new to cyber Summit earlier this year in March which was focused entirely on reskilling um and Candace is going to talk about so much of that um so I'm going to talk about Candace and I'm going to let you let her tell you a little bit about herself so um Candace started out serving in the U.S Air Force where she was stationed abroad in the UK and South Korea before coming back home and starting her career at Raytheon where she has been very happily since 2008 in a variety of technical roles and she's currently the associate director of cyber security leadership there uh she held an MBA from the University of Arizona and a CSO certification from no less than Carnegie Mellon along with certs from CompTIA and isaka she's done volunteer work with Empower cyber or species women in defense among other organizations um she does public speaking she is a prolific content creator on LinkedIn which is how we get to know each other and she posted about this book and I was like oh wow that's exactly the book that I wish we had had back in March for our new to cyber Summit reskilling and then I got the book and I read it and I'm like not only do I wish I'd had this book in March I wish I had written this book because it really is just a handy wonderful guidebook and touches on so many areas besides just cyber we're going to get into personality assessments and all kinds of things um but with that hopefully you are sufficiently um overwhelmed hearing all of your accomplishments and there's more that I didn't get to but welcome Candace thank you thank you I'll share a little bit more about myself so that's all the professional stuff but um on the personal side I'm also a mom of twin girls I'm a wife and I'm in Florida so I don't know anyone else who's out there in sunny Florida but I'm born and raised here um love it and yeah that's the personal side of Candace um outside of work so um yeah we'll pick up Jennifer well first um I want to ask you could have easily just sat on your butt and ate bonbons and not written in this book not taken the the time and the resources and and everything that it took to write this why was it so important for you to to write this guidebook for other people so I would honestly say initially it was selfish and here's why I say that right so I would get questions often like in my inbox and I would answer them initially and I'm like giving these long you know spiels and you know helping and after a while I said well I'm saying the same thing over and over again so how do I help myself not be repetitive and actually have a resource to kind of share to say what I would say in my voice right so that's what started it I said let me get these questions let me kind of itemize it and figure out you know if I were new to this field if I was just starting what makes the most sense right and one of the frequent questions was the what do I do like what do I do I have this this this you know what and I'm like you know I don't know I can't tell you that I'm Candice I've just met you over you know LinkedIn or whatever the medium was and so I said well there's a there has to be a way they know themselves figure out what they want to do and all this stuff and they'll have an awesome start so it was selfish initially but it turned out to be something that you know I'm hoping right is helpful to to everyone who kind of picks it up to be clear on what they're doing in the space because that's where that's where you get the most bang for your book and my mind so that's why the selfish initially I love that you said you wanted the resource to be in your voice because I totally do get your voice from the book it's like having like somebody at work that you look up to and are friendly with that you can go and ask for advice like it feels very warm and personal um and I have a whole ream of questions for you I'm not kidding but I want everybody watching to know that they can also use the Q a function and we'll try to get to your questions for Candace as well um but like I said we talk a lot about reskilling um or people who are trying to get into the industry for the first time and one of the things that you talk about was starting out um as a help desk Tech and I feel like that's somewhat of an overlooked pathway into cyber um so can you talk a little bit about that for people who are just brand new so I would say the military may be a little bit different because I was in a certain afsc which is like your specialty code so I was a three Charlie which doesn't even exist anymore so I told you how long ago that was but um a three Charlie was computer comms and so there were a lot of different disciplines that were under what a three Charlie would do um and so my initial role was the help desk I was taking calls putting remedy tickets um unlocking accounts changing passwords like that was my initial um you know role and then I went to small computer support where break fix you know moving hard drives re-imaging machines you know installing drivers whatever that needed to be done but that was my Foundation I didn't know that it would necessarily help me in information assurance which was what cyber security was called but it did right it gave me a basic understanding of um computers and that was the afsd in general right so um in the military when you're in basic training in tech school you get all the preliminary information about computers different disciplines like I mean it comes covers the gamut it just so happened I landed in the help desk and small computers but um to your point again it did help when I got into IA I mean I understood of course what systems were how it functioned and my role at that point was to assess um when I got into information assurance but help desk understanding the systems and small computer support it did it did help me but it was more an assignment versus me knowing this is going to be the next best step but now hindsight right we know that it can be a good first step into getting into cyber to understand that technical Foundation right so Emily you got a question ready or you want me to go I got more I mean if you've got another follow-up I I just like listening to Candace talk about her her life well another thing that I saw in your book so we talk about this a lot so I am what I call cyber adjacent like I am not a technical person I don't have technical cyber security skills but through my work at Sans and other positions before this I work with cyber Security Professionals all the time um and so I think that you know there's this big misperception that you have to be deeply Technical and one of the things that's really attractive I think is the area of GRC and you mentioned that in your book so I'm hoping you can explain what GRC stands for what it is what those kinds of roles are like yeah so um GRC is governance risk and compliance and it's more here's what I say right and this in this discipline you need to understand technology at some level right you can't just not know what a network is know what a file you have to understand it at some level um but it's when you get into policies and procedures and actually assessing risk like what risk what certain vulnerabilities pose this type of risk to this system and then what do you do to mitigate it right how do you track it how do you make sure the system stays operational um I know we're familiar with the CIA Triad uh confidentiality Integrity availability but it's really just about making sure that system is compliant to standards and risks are mitigated when it comes to GRC um and there's different disciplines right of GRC I mean you have Auditors right you have the managers um I'm in the Aerospace and defense industry so it's a little bit different to me because it's still aligned with DOD and so I sometimes think the different Frameworks and different um overarching like csas or organizations who kind of manage DOD versus more public versus private DOD versus you know this um sometimes it's a little bit different so um in my role I started out from Cradle to grave in this GRC space within Raytheon as an ISO which is an information system security officer and I was in charge of auditing systems that's when we didn't have scene tools I was in Windows in the event logs with these little scripts um auditing the system weekly I interface with users made sure they had the right accesses my interface with program management to make sure that they gave the permissions to do things on the system because they're the owners right and then I made sure everybody was adhering to the policies as they use the system so um in the defense space and I'll just say this and I'll pause in the defense space when you have a system uh depending on the classification of it you have to make sure it meets a certain standard and it has to be approved that way and so part of our responsibility was to make sure it maintained that compliance level that it was approved at um so that we again mitigated risks didn't have any issues and it was good so I was an ISO and then a tech lead verifying the system supporting the isos um and then I moved it to the ism role where I was actually certifying the systems um and submitting it for an ATO and then on and on and on but that's the role I I had in GRC it was more um auditing compliance um again risk management uh and supporting the team so once I got to the ism role I was managing a team and then as Raytheon kind of transformed I moved into different roles and had a different level of responsibility across the business but that that's GRC within this space and some it differs it depends on maybe the company the industry right Aerospace infants may be different than the healthcare industry and how they Implement things but it's all you have a framework it's just a different name for the framework but it's what you adhere to for this discipline specifically so it helps to give you a guide post in my mind to have a framework and something to follow so so I'm going to back us up a little bit yeah um so Emily and I both geeked out over the format of your book because it's really this slow build where you start with the very basic building blocks of who you are and then you find out what kind of role you want to see yourself in and I see ashtar your question that you put in thank you about so many entry-level jobs in cyber require years of experience how do you get your first get your foot in the door with cyber we're gonna get to all of that but according to Canvas and all the great stuff She lays out in her book that's that's a question for a ways down the road still so can you just kind of talk about how you laid it out and your five y's and some of this really great foundational stuff you have in the book yeah so the so the five why's and the what's and all that came from really want to make sure people knew why they were getting in the field so when I would get questions previously about wanting to get this cyber I would ask them why like what do you want to do and why and they wouldn't know right they just said I want to get in cyber security and I was like well yeah that's great but there are a lot of things that happen in this field different disciplines Beyond GRC where if you're not sure why you're here and really what you want to do you're going to jump around you're not going to be happy and just because you have you know a nice paycheck however that is for you it's you're not going to be fulfilled in this in this industry and in my mind what we do in terms of protecting data and really being vigilant to keep that part of our Lives safe right it's important you need to really enjoy it and know why you're doing it or you're just going to be like a placeholder and you may let things kind of slip by and not really pay attention and have the right type of intention behind the work that you do so that was why I started out with the why like why are you even here is this really what you want to do are you trying to get paid you just want to kind of you you know say that you're in cyber and it's kind of sexy now so you know what do you want um so that was first it was the why and then the what was okay well now you know why and you're gonna figure out who you are we talked about the disc assessment um and I could share a story about that too where I kind of got that piece from but when you figure out why you're doing it then what right because if I'm I'm out to share my type right so are we gonna get to that I don't want to jump ahead of myself if I share my type um I would love to talk about the disc assessment because okay you just discovered it yesterday so maybe you can tell people what it stands for and what it is and how they can find it so the disc assessment is on truity.com uh and it's one of many assessments and don't get so don't get me to trying to say the acronyms because I always forget I have to pull it up I'm the worst there's so many acronyms in my field I'm the worst at remembering all of them but um it was the why and then it was the who you are and um it's important just because for me my primary type was influence right and the secondary was supportive our steadiness they changed the name a couple times but um I'm my personality is being collaborative I'm a team player I love working with other people I like actually following I like following rules to a point right I like being creative like all these things are a part of my personality and if I were someone who's sitting at a computer coding I would pull my hair out I I wouldn't be able to do it right I there are certain things I need uh for me to be able to thrive and one of them is people and a lot of what I do in GRC is collaborative I'm always talking to people we're connecting with programs across different actions right I'm able to give new ideas and be creative on Solutions or so many things that play into my personality with what I do and so knowing that is important because I we spend nine to ten hours of our day at work and if we don't like what we do you you're going to be miserable money only goes so far right it's important yes but once you get to a certain level I forgot that study it it's it's no longer that much of a differentiator right in your quality of life so really loving what you do and enjoying it was important so that was the why and the who you are which led to the what what you're going to do and really looking at that and assessing it um and doing your best it's not perfect it's not a science right it's an art to just saying okay here's why here's who I am here's all these roles um and I like these they sound good you know it resonates it fits so let's pick this and kind of move forward that way you at least started that preliminary discovery of yourself so you're not just doing something just to do it I worked at McDonald's when I was 14. I hated that it was horrible right I'm not I'm not doing that again right you just you have to know um you know what works so um the other just to share because I have it pulled up I had to bring it back up for myself the other three so I was influenced and steadiness and then let me see there were I can't find it I hope I didn't close my window I was in I was too which is funny because I think that makes sense I think that's why we We Vibe with each other and another thing that it said when you when you find out influences your type it means that you're kind of somebody who likes to Hype up others make things fun find ways to motivate your team which I think is a perfect tie-in with this book that you've written and the way you approach the information you shared so I got the other three was dominance dominance conscientiousness and steadiness so and those for sure aren't me right conscientiousness is structure organization data-driven dominance focused I guess it can't be inspirational independent um and steadness with patients persistence thoughtfulness right so mine was influenced like Jennifer said that's what it is right and I thrive best with people um so when you do your assessment and kind of get that um laid flat you just kind of see things will align I actually um learned about disk through Empower so uh T actually has um and Empower you program that she runs and a part of that was that particular assessment and I've done several more in the past um but when I saw that when I was like this is a really it's a really good one to use when it comes to work it was specific to that so that's what kind of drove me to really look deeper into it and take it along with the 50 000 other personality assessments I've done but they all when I read them they all align in some way it's really weird it's really weird I've done several um will you say more about TF for people who don't know who Tia is and where they can find her because she is also she's incredible weird yeah uh and tia Hopkins she's everywhere so um she actually founded Empower cyber security um and she works at Easton Tire as the chief resilience officer so she's phenomenal I mean if you haven't bumped into tea I'm not sure how you missed her in this industry so um she was phenomenal and initially helping me kind of understand just in general how to kind of communicate when it comes to being on social media she sat with me when I started this whole process and gave her time gave her energy she's warm open so I mean she was she's very instrumental in um and just cyber security in general if you see her you hear her you're inspired 100 so I'd love to you so yeah that's it feels great she did uh two years ago at the new to cyber Summit about you know what you can expect a day in the life for a cyber security professional to look like and having um maybe some taking your rose-colored glasses off to really understand you you as a person and what kind of role would be good for you um because she was saying if you can't handle stress being a sock analyst is probably not the the place for you um which you talk about in your book a little bit too personality types and strengths and weaknesses and things like that um can really help you guide where you want to go um but I have a question so people some people are better than others at being self-aware of you know these are my strengths and these are the things I've done in previous roles that could translate to a role in cyber so if you're maybe not a self-aware what would you recommend somebody do or who to ask or things like that to to get a little more awareness around it if they they can't come up with it themselves so I would hope you have somebody you trust that's close enough to you because I've asked um when I think I'm a certain way I have two sisters so I would ask them like hey do you think that I'm actually you know kind or influential whatever right I'd ask them and they hopefully they're honest so it takes someone else who you trust to give you that outside opinion you've got if you don't have that voice um then you gotta get it right connect with someone find a mentor someone who you can kind of start building rapport with to actually help you see yourself because you are sometimes you can't seat on your own but you got to get someone else in there to kind of help you see yourself so I say a mentor or a coach if you don't have a sister or like I do a friend or someone else who can be honest with you right it's the honesty part don't tell me I'm you know so great and so creative like you know whatever and I get in front of someone they're like yeah no you're not what was that show um the singing show where they get on there and you're like no one told you you couldn't sing remember that like is it American Idol like no one told you before you got on this stage that you couldn't sing so you have no friends no loved ones so it's kind of that same idea someone needs to tell you you're not quite that friendly person to be in front of a room trying to influence right you're not the person inspired you're probably the person that can you know support help right be a you know a partner so hopefully you have somebody so to follow up on Emily's point so I think that often when we take these assessments maybe it's even less about not having no self-awareness but more about having the weird humility like when I took the assessment it was like your type is influence you influence people at work and I was like oh my God do that so so there's there's that and so when we talk about people who are brand new to the industry whether it's because they're just getting out of school or just getting into the workforce or because they're changing from something totally different transferable skills are the biggest thing we need to talk about how you can convey your experience your skill sets when you have literally no experience as the title of your book says so I highlighted this one quote on page 20 of your book where you said we often downplay what we've done to be humble or not appear overly boastful or because someone told us it wasn't enough and I see that all the time especially with women who underplay their achievements particularly women of color who have you know not historically had a seat at the table um and also for people who are brand new who think you know we had somebody who attended our March event who had been in working as a dog groomer and I love that we love we need all kinds of people to come in and make us better in cyber but of course if you've done something like that you're going to be like well I worked in a hair salon I don't have transferable skills I think you can call BS on that and talk about how you convey your trans verbal skills yeah so I think you have to look at at least soft skills when it comes to just leading or managing or reviewing right there are certain things that don't require any sort of technicality to it so if I'm a dog groomer um and you had a business I'm pretty sure you had um Financial records or something you had to audit and review I'm pretty sure someone came to you and said I have this kind of dog that kind of dog this kind of dog and you had to put something together through their hair right there's something you have to do to find a solution for that thing so so when I say don't downplay it's not to say I'm just a dog groomer I'm just I'm just a music teacher or I'm just this it's okay well what did you do in that particular role that required critical thinking that required you to pay attention to detail that requires you to collaborate or lead right thinking it from that Vantage Point not just that I was this thing but how did you use that thing to run your business lead a team right so it's just shifting that perspective um to what you did to take ownership of that of that role or in that role um so I've seen a lot of hair stylists and teachers music teachers um people might even say me in the military right who've figured out what those things were and and not to bring AI into it but I actually I I did that at one point I asked what are some skills that a teacher can do in cyber security and I got a list I've Googled it what are some things that um someone who was a hair stylist can do who own their own business can do in cyber um and so you can get that initial list and start looking at what you've done too and again some basic ones are leading um being able to again pay attention to detail looking at things from a solution-oriented perspective right um because cyber is about finding Solutions and figuring things out and identifying problems to be able to correct it before someone else can expose that vulnerability so there are things that didn't require me to say oh I understand how to code no but I can look and see that that doesn't quite align all right that that isn't quite right or I can rally a team and provide support so I think it's just really owning what you did and it doesn't doesn't matter right there isn't anything better than it's just what you've done in your experience that can lend to what you can do in cyber so just don't have a whole time in here this whole list of transferables yeah an example used was somebody who was working in retail so can you talk a little bit about how you position the the person who was working at Hobby Lobby yeah so I I think I had the audit example um where they're inventorying for the the organization right so I think in one example I said well yeah inventory for the year and you know that was really it well what does that really mean right quantify what you did don't just let that go because if if I know that you've inventory 3 000 items and you were able to chronologically put them in this order and put them in a database and know that that database was functioning and know the data was correct I know that you again pay attention to detail that you are actually um focused and you can actually look at that type of data at that scale because 3 000 items is a lot to audit and put that data into a database right and so it's being able to quantify what you're doing and say you know here's how it impacted the organization right what did that do um when I inventory those items at Hobby Lobby right and so it seems small but nobody is gonna boost you up or give you the Marquee to say I am phenomenal like you would and only you know what you did it so that's the example I gave and that was why because again I think I worked at Hobby Lobby who cares well what'd you do right did you manage a team were you a team leader Hobby Lobby right did you do anything else that um could have added value that you can easily use in this space so that was that's that's my biggest thing for everybody don't do not downplay what you've done um and or let anyone else tell you that it's not enough because who are they into your career you mark your path you create these things for yourself um and you're gonna build your brand to Showcase how that actually mattered and how it actually plays into who you are and how you can be an asset to a company so you you write that story no one else tells you so that's where that comes from the example was to try and take a basic role and and just say you know it's more than just um inventorying right so I love that um throughout the book you have all of these worksheets to kind of help help the reader build up to a plan of this is what I want to do um are these short-term plans of one year three or five year um I think a lot of people in coming into the industry say I want to be a pen tester and I think the first job they're going to get out of the gate is pen tester which is not the case most of the time we're probably like 99 of the time so um what is that kind of realistic timeline that you think of for I want to become a pen tester and how long is that going to take how many roles are in between the you know the first one and finally reaching that goal and then a little caveat to that is like you could be wrong right you can start your your journey and decide that that was totally not what you wanted to do um do you have any recommendations for kind of pivoting pivoting your plan once you're you know three down three years down the road and um decided maybe that's not quite quite the path for you yeah so a part of the book when it came to actually figuring out what you want to do was to say okay we're gonna do a quick Gap analysis here's what I want to do and then here's the things I have to do to get there right and what those iterative steps look like so there may be a time where when you look for that initial contest your job because you don't have experience you have to do something else but that I'm not a pen tester so I might try and pretend to know what those steps look like but but the point of saying is is you find someone who is a pen tester right you find someone who has done it to kind of help you build build those steps to understand what that path looks like um I gave a resource um it was the the Knicks website and on that website it's it's a um it's like a Workforce um in the same module that kind of helps you break down all these 52 roles that were outlined in the nist and they have these alternative titles for positions and they kind of give you different Pathways as a resource to help you kind of say well if I start as a pen tester are there really entry-level pen testers I maybe right if there aren't then what is that pre-step so that's the part of the exercises to really kind of get you to to think through that um and to look at those resources because oftentimes we want someone else to give us an answer and sometimes that's okay right sometimes it's okay because it's totally foreign to you but other times it's just a matter of you taking that initiative to kind of dig in there so you understand it for yourself because I can tell you anything don't listen to Candace I can say whatever to you but you saying all right this is what I want to do and I'm going to research it and now I have this little you know idea of what I think it should be now let me go to this person who I think can help me and confirm what I've understood and what I've dug into right so I think that's really the the the key to the exercises is you're working to get an understanding for yourself and you're working to be able to ask valuable questions to confirm what you're discovering not to tell you what to do right because it's your it's your journey so that's the first one when it comes to the gaps and you know what they should do and how they reach to that next level and then pivoting I I always say you you can pivot if you want to you but I say give it time so if you take the time to really say at the Forefront I'm doing what I want to do cool and when you get into it you realize it's not what you thought there's nothing wrong with pivoting I think it's easier to Pivot when you're in something than um then not knowing initially so I know what I want to do I'm in cyber got my first job that's great nah I don't quite like GRC it's boring I'd rather I would rather be in a sock being excited whatever um and you can this I think the same steps you take to understand what it takes like if I'm in GRC what is it going to take to Pivot into being a sock analyst I'm pretty sure more skills and more things will have a line now right because you've been doing the work um but it's the same idea what you want to do next what is what certs or what tasks or what things do you need to do to make sure you can pivot to that next um level but don't be afraid um a lot of people have lived many of lives this is what I call it I met a lot of people who've been artists and business owners and here's the like in the same Lifetime right so you're not stuck in any in anything it just takes um thus the assessing piece and really knowing yourself and keeping track of it um is another part of it so I hope that answers it I feel like I went rambling but I hope it answers it that is such a good answer and it gets to the main thing that I want to cover but I didn't want to say two things we're more than halfway through our time already and I do want to get to some of the attendee questions and also one of us Emily or I will drop a link in here because we do have um of course it's Sans we have a feedback form for you um because we'd like to know not only if you found this valuable any comments you want to share with Candace but also what kind of stuff you'd like to see from Sans near to cyber uh in the future and we have Emily has five copies of Candace's ebook to give away so if you do complete our eval form and leave your contact information we'll have random drawing and five people we'll get a copy of the book and the main thing I loved about the book is the way that it takes you step by step through this journey of self-discovery because you just said answering Emily's question sometimes you just want someone to tell you what to do and I see that so often with people who are new to cyber like how do I do this exact thing for myself and like you said you can't you can't tell them I can't tell them they've got to figure out they've got to go through this whole process of figuring out their skills their disposition how they're going to fit in a high stress or low stress a very extroverted role or an introverted role um and so I think a lot of times people get frustrated because they don't know how to figure that stuff out and I mean this is a tool for you right here Candace's book but you say in here when you reach out for support you must be clear about what you'd like guidance on it would be best if you asked specific questions that are open-ended and manageable so if you can talk a little bit more about the best way to approach somebody in the industry for help instead of just saying I want to get into cyber what do I do what would you like someone to come to you with so I'd first say this right we're all still humans okay I'm not no one's a machine right we all want to feel like you want to get to know me as a person not just what I can do for you right so first try and actually connect with someone whether it's engaging with their post or whatever else and just seeing how someone's doing right not just busting out the gate I want to get inside where you help me like no I don't no one owes anyone anything right we do these things because we want to to share so I say I always come with that tone first please right and then I would say um just specific question so you do want to be in GRC so hey Candace you know I've been in cyber security or I've been pushing and starting my career in cyber security and decided on GRC I've you know taken this certification and I've taken what like my Security Plus uh and now you know what what can possibly be next to kind of help me land that first role so now I know you've gone to school you want to be ngrc you've taken the certification and there is a next a Next Step that I can advise you on or something I can say to that right versus I want to get in cyber I took my masters in cyber um you know what do I do now well that's super open-ended right I don't I have no idea because there's I don't even know how many disciplines to kind of jump into but saying you know what you've done so far you know what you want to actually get into and if I'm the right person to even help with that because I don't know about pin testing I'm not a red team or purple blue team or I'm not that person right so can I really help you um so knowing who to go to with those questions as well is is important um but but I already know like you know have those answers unless it's someone who you you're working with as a mentor or coach who's helping you get to the point where you know you're what but if you're reaching out to someone random really um understand what what you're doing and what you need to ask them so they can answer because it's overwhelming even for me when I get these paragraphs of support and I'm like I want to help but I I don't I don't really know and I don't I'd hate for you to take what I say and run with it and it really didn't even it wasn't even what you needed to hear from me um just based on general information so just be clear on what you want to do and ask say hi first and you know try to connect a little bit and then you know ask those specific questions because it can't help right that one answer can kind of help pivot you would be specific can be kind so you mentioned certs and so I wanted to ask uh Nicholas's question here in the chat so certs are the age-old question obviously I'm a little biased I think certifications are great but so there's the whole certification versus experience versus where do you invest your your resources you know somebody else asked about balancing how you prepare and study for search when you also have family responsibilities so Nicholas studies thinking about taking a boot camp uh for cyber security would be a six month long commitment and then he'll he'll get a certification so does that give him a better boost versus starting out in a Help Desk position um is the boot camp is the assert is it worth the time and the the cost financially and you know emotionally so just kind of you know if people have limited resources as we all do especially people who are not yet working in cyber security and don't have employer backing you know what's the right way to allocate those resources to something like a boot camp versus working your way up through it job so I think it depends on you and your time so if you have the time to to take a boot camp I mean take it just to get the fundamentals it's not required though so nothing is necessarily required until it is so if you if you're just taking um a bunch of certifications just because you think it's going to help you and you're not sure then to me that's a waste of time but if you said I'm taking this initial boot camp to get this foundational knowledge to to then build on it to figure out what I want to do or where I want to go that makes more sense to me than just taking it just to take it and oftentimes that happens um so if you do take it and you have the time you have the bandwidth and you know why you're taking it don't just take it and take it then I would say Do It um that can be just as helpful as starting out working in a help desk right because certain jobs will pay for certification so that can be Avenue as well if you don't have the funding some organizations have educational benefits and you can get certifications as long as it aligns with the role um I know Raytheon does that they have educational benefit to get a certain amount per year to go towards certs so I think that could be a way you know if I don't have the money I don't have the time but I need to work I need to you know feed my family or what have you so I want to start out at the help desk see what benefits the company has before you you get there that's a part of it too um knowing the company you want to work for and the culture and what they offer so you can see how that benefits you um because yes we work for companies but there has to be a reciprocity in that relationship right so if I work for a company what can I what can I get from it as well right I know we get paychecks but other benefits and that's one of them so it all depends um if you do want to start working now and have some experience it could be the help desk and then using that company to take those certifications so I think I kind of beat that one but it just it depends truly but those that's they're both options and if the third is free as well so I know there are a lot of free certifications out there boot camps out there that are free um that you could take just to kind of get the understanding but it takes your time so time is not free we don't get that back so just make sure it's kind of worthwhile um I have something else I want to talk about but uh Jared just asked a really great question so uh they said once you get your certification what can you do to get relevant experience prior to getting your first job what are those things that you can do that will give you some kind of experience to put on your resume maybe they're free maybe they're not but what are those things you can do um to have some kind of cyber experience um so that you you don't just come with those soft skills which are super important but um you know get a little bit of a leg up as well um so I've seen a lot of different resumes and one thing I I saw it was I think it was earlier this year it was pretty cool I was like oh this made sense to me it actually kind of gave me an idea of what they worked on um they didn't have necessarily relevant experience but what they did is they kind of broke down their courses and they took a few courses and they highlighted what they learned in that course so I've seen that before which was again helpful to me as someone reviewing a resume to actually you know put in for an interview and I actually interviewed that person because I saw that but um you can break down the courses you took and what you did in that course if you're doing projects I know we talk about cyber projects all the time um you can say in you know in this environment in this particular project I did this thing and explained what you did and how you did it how you resolved it whatever that looks like but that's really the way it's either expounding on what you learned in those boot camps from those courses or sharing and being um clear on how you solve problems in your projects and what you did in those with those particular projects so those are two ways without having any experience at all uh and wanting to kind of showcase here's what I'm doing and here's what I'm learning here's where I am and hopefully it helps and one other thing that I used to always kind of frown on but I kind of just felt it was Antiquated that now I no longer do because there's so many applicants looking to get into these entry-level roles um cover letters I used to be like well who does cover letters anymore like why what's the point and that was my stance um and then I saw a few start coming through and I'm like this really helped me kind of see you know what they're looking to do it wasn't long it wasn't you know arduous but it was just a nice little paragraph of why I want to get inside but here's what I've been learning here's what I've been doing I'd be open to this opportunity um and it it caught my attention so it used to be cover letters all the time then they kind of waned away and now that we're in this kind of um I don't say error but it was helpful so those are some ways you can um present your case with a cover letter share who you are and then your education and projects putting it on your resume I I would say that that helped that's great I think cover letters are are a great way to Showcase your personality whereas resume is kind of the you know the checkoff list of your your skills and things uh there's a reason we have interviews right like just because you have the perfect resume to fit that job description if you're a total jerk they're not gonna hire you or you could maybe be lacking some of the skills that they're looking for but you seem very approachable and teachable that that goes a really long way um I saw actually today I saw a post on LinkedIn that said stop hiring the resume start hiring the attitude um which like really spoke to me you can find someone who doesn't know a thing about you know the sock but is willing to learn and eager to learn um you can teach any kind of technical skill to someone if if you're willing to put in that work and time with them um but as the marketer I would be remiss to not talk about your whole uh chapter on branding which I think was yeah super great um but can be a little scary for people especially I'm a more reserved introverted person um and have through the the help of Jen and other people at Sands that um really Champion me have pushed me to be a little more out there but what would you say to someone who says I don't have anything unique to say or shouldn't I leave that to The Experts who you know know this field better than I do um what would you say to someone who has that kind of attitude as aligned with my influence I would encourage them to not to not take that stance right everybody has something to say so I although my personality type is influence I definitely feel nervous and whatever else when I post and share especially starting out I would post and run I post and I'd be like I'm out of here I'm not looking at anything shut my phone down I don't want to see um and you get used to it right um if you're coming from a place where you really want to help or you're really just trying to Showcase and share you're not going to feel so um uh what's the word I guess pressed to need to see a certain result because you're really just trying to Showcase it and if you also understand when you post it it's a part of your your online resume or your proof that you know you're doing what you're doing and you are who you are and you're showing your personality it's it's a lot of things so building your brand and your voice online can have um a lot of positive impacts because it exposes you to people that can actually help you and offer you a job or you know provide opportunities to you so just just post post and run if you have to post and shut your phone down until like the next day and then go look at it um it it happens and if you really you know are that nervous about it that have someone take your phone but you got to do it you got to use your voice and speak out um because that's that's just I would it just I don't know what else to say about that you have to um uh unless you are into networking in person um but your online brand is is a it's a big deal how you present yourself The Voice you put out there um and doing that in in the most you know Open professional manner that you can it's just it's just it's important it shows what you can do um more even more so we talk about your resume saying what you can do and maybe not having that experience well I saw one young lady that I can't think of her name right now but she would share her full projects on on LinkedIn and go through like the Frameworks and kind of share what she did in a very clear and she laid it out really well it was aesthetically pleasing but she was showing her work and she had a lot of Engagement she was brand new to the field but she was putting it out there and um she ended up Landing her first role not necessarily because of that but it was a part of her branding and what she was sharing on on LinkedIn um so so you just have to kind of try and get out of it just try your best and if you can't get out of it just do it just do it and run I still have to do stuff and run now when I posted that book I almost had a whole anxiety attack guys so I'm still a whole grown person in this career field for 20 some odd years and when you do anything new it's going to scare you um but there's a book I read years ago was called Feel the fear and do it anyway it and it it is honestly when you say that it's that simple and if I get scared I'll say it just feel the fear and you got to do it because if you don't your voice your what you have to offer all those things get stuck with with you and you never know who you're going to touch but there's one person two people five 57 who are on the you know on the zoom right so you just gotta do it that's it do it do it to influence so you mentioned networking in person um and we always have this whole conundrum of like how do you get experience when you have no experience to get somebody to take you seriously in this field so Alfredo asks a great question here he says do you have tips for finding cyber security organizations to volunteer with to gain experience which is an outstanding pathway I think do you have any um any tips on identifying the right kinds of orgs to reach out to who will let you volunteer I'm not sure um but I would say this so sometimes if you find a list of organizations in your community right small businesses where it's just you know maybe a small five to ten percent organ maybe nothing huge um and ask them right ask them or offer your services to kind of say hey would you mind if I came in and helped with this and maybe it's a family friend Maybe not maybe it's someone you know but that may be a way right if it's a small business and you know normally small businesses don't have the budget for large security team and those sorts of things so it may be um just connecting and pitching to those organizations I'm I'm sitting to cyber but here's what I'm learning here's what I'm doing in cyber security I wondered if I could you know volunteer to help support you in this way right and have some sort of you know plan or some sort of um once they pitch to make it sound formal but find some way to offer that service to them and see if they would allow you to volunteer but I'd say more I say more a small business in my mind it makes sense to kind of approach um versus you know like I don't know like a Raytheon or a Lockheed or you know something like that so that may be the way um to volunteer that's a great angle because I wasn't even thinking like that I was thinking more like the kind of industry organizations which is also a good pathway something like black girls hack or the cyber security gate Breakers Foundation or racist cyber um you know there's lots of groups that are doing this kind of stuff who are reaching out to um other people who are trying to be new to cyber so you can teach and learn at the same time and serve the community but I think Ken is your point about you know maybe you go to your local animal shelter and you say on the cyber security student and I'd love to help I'd love to look at your systems I'd love to look at your password policy or something like that um and you know they probably have no resources financially to devote to cyber security so that's a great way to get in you can share what you did I went to this boot camp I got certified by whoever you know since I got these certifications and you know here's what I can do because I can offer um that's smart or if they have an I.T person who has some security duties maybe they would let you Shadow them too yeah partner with them but and start small it's okay it doesn't have to be a big organization but you doing cyber security work does not mean it has to be a Fortune 500 or whatever certification body it could be like you just said your local animal shelter it could be right they need to keep data secure too so um another thing we've heard is um people volunteering for like cyber security conferences um you know b-sides or a big one like black hat they need people to you know man or not man what's the uh the correct word for that now uh sit at a table and hand out the you know Badges and things like that um which sounds kind of mundane but you are there for free because you're volunteering and then you get to meet all of the people coming in and that's a great way to um Network in a way that you probably wouldn't get otherwise to yeah wheezes which is women in cyber security has a huge annual conference they need dozens if not hundreds of volunteers and they've got lots of great programs so by volunteering you're going to get access to those conference sessions you're going to meet people it's definitely a foot in the door where you're going to get to talk to people that you would not otherwise have access to so that's a really good point it's kind of fun and I would say get involved in your community locally right find out what organizations are there I'm sure there are whether it's large or small just figure out go to Eventbrite um meet up right and see what other I even if it's I.T right it's adjacent um and just go and show up and tell them what you're doing and you never know where that'll kind of lead you so be a part of your community locally too and then also you know what you normally shared so for sure so we're coming close to the end of our time and this has all been really good advice and I firmly believe that if people work through the process that you lay out in the book and do the worksheets there are worksheets y'all like actual roadmaps for you to use I really think that you will get to a place where you have much more clarity on what your cyber security Journey should look like however real talk now almost at the end let's get real real and I know you're one person you're sharing your perspective you don't know the answers to every problem in the workforce but so what about the people and there is one person in particular who is on this webcast I won't call her out but um she's gonna know I'm talking about her so she has gone through one of the Sans academies she has certs she has professional experience with transferable skills she has a fantastic personality great soft skills I met her on his zoom and I was immediately impressed with her and invited her to come to a summit um and she has done all the right things like she has done everything you would advise her to do and knows what she's looking for and knows her strengths and weaknesses and still is not getting any traction with her job search and I've heard versions of that from lots of other people um so what's going on and if people are just sitting here being like everything's Candace says is so smart but I did that still no one's calling me back what's what's happening so I I saw this video last week um it was I feel like it was Olivia Rose I feel like that was her name and I hope it's right because if not I feel bad but she her the point of the video was um that there aren't any level jobs which and I know the reason she said it in her video but I don't think that that's true right they're still there but there are a lot of people who are coming in entry level and so the time it takes now to land a job may be a bit longer than six months or a year it could take time and that's something that you gotta assess and say do I have you know a year to really continue working this and you know networking and looking at organizations having my list of orgs that I would want to work for and connecting with them and attending a bit like do I have that time um because I don't I don't think at least from what I'm seeing and hearing along with what you're saying Jennifer is it's not coming around quickly right sometimes it's taken people a year a year and a half I sat with someone um it was like May June we were at the Tampa Club and she was sharing one of her friends had the experience had the search it took him almost two years to land his first cyber security specific role um and so that's that could be sobering right I've gotten this education I've taken these serves I spent this money and it's going to still take me time to get a role now because a lot of people um are you know coming to the field and to the point of one of the video I talked about our economy right it's shrinking so there aren't as many open jobs there's been layoffs there's all kinds of things impacting where we are now um so that was really kind of good to hear but it may be especially where we are now that you're not going to start out with a cyber specific role out the gate it may take time um and just accepting that continuing to do those right things like don't stop networking in with the organizations you want to work with and with the people and the who are in the field you want to work with don't stop it because it takes a little bit longer you just have to be persistent um and still keep doing those things so I would say to anybody you know getting in and want to take the jump don't quit your job tomorrow and say I'm about to get into cyber let me get this certain go get these degrees and I'm about to get a job like ASAP no like really say okay you know here's my plan I got I have a job now can I take two years to really do these things to transition and be thoughtful about it um but don't be discouraged because it just it just may take more time um but that doesn't mean you're not going to land Your Role uh just it just may take time that so that's my answer doing the right things I mean it's going to happen overnight um but it all it's all it all builds up yeah yeah so keep your fingers crossed and it could be that too sometimes it is just opportunity you find the right person that is opening and you slide right in and you get it right sometimes it is that way unfortunately but um sometimes it's not sometimes it's just the opportunity comes when it comes I was sharing this with someone else because they asked me kid is you know how did you move up in your career like what did you do and I just said I whenever I thought I want to do something I got what I needed to get before the opportunity came so like if I knew I want to be you know in Islam at the time I went in I was like well what certifications Google really wasn't well still a thing I'm not that old but I would look it up and say okay well what certifications fit this role or whatever it was and I would get it and I didn't need it but I knew that it was the next step for that thing right so being prepared for the opportunity is not a bad thing and it doesn't mean it has to come tomorrow but being prepared for it just means when it arrives there are no excuses you know no excuses to say I can't get this I got the third I got the this I have this so now I can step into the opportunity um so hopefully that helps because I mean I know how you know I've been getting a lot of that Jennifer and people have been saying it and some people said it was a field a week or so ago one guy was in my comments and he said well cyber's not for us this isn't for us anymore and I was like oh no like don't take that stance right it is still for you it just may take longer but he was completely discouraged um and you can hear it in his writing um so just um look at be realistic right and we're gonna look at the big picture and just say this is how long I I'm willing to invest in this thing um and just don't just don't give up on that um because you don't know where your opportunity comes from so and then she person online too make sure you're you're online you're showing up right and you're still connecting don't stop so do not stop that's it that's right he needs everyone who wants to be in it um yes for sure uh unfortunately we are at the end of our hour Candace thank you so much for joining us this was a great discussion um your book is awesome I'm glad you uh posted and ran and Jen said it really worked out so nicely for us um so as a reminder um I put the eval Link in the chat it is sansurl.com n 2 C Dash survey um please fill that out we love to hear from people about how you felt about this session um and anything that you think would be valuable in the future um you know we have lots of ideas of what we think you might want but it's always best to hear from the community um and really know that you know a certain resource or a conversation with somebody is is really what you're looking for um and if you fill that out you also will be entered to win a free copy of Candace's book so it's a win-win-win all around for sure on that one um another exciting thing we have solidified the date of next year's new to cyber Summit it was going to be April 4th um it's a one day free virtual Summit um we have just gotten a date so we don't have any particulars on speakers or anything like that but you can expect to see more conversations like this and and really helpful um tactical applicable kinds of things that you can you can take back with you and and hopefully get that job down the road however long that may be um hopefully quickly but as as we said sometimes it takes a little bit longer and you just have to have the patience but there's room for you in cyber security uh we need each and every one of you and your unique backgrounds for sure and then lastly you can follow new to cyber on LinkedIn on Twitter and we are also on Instagram um for updates and and things like that hopefully we have another one of these soon and hilarious memes Emily is the meme Queen on Instagram she kills it that's my creative Outlet is the new to cyber Instagram so go go check that out uh Jen do you have anything to say no it's been a pleasure Candace and please because we want to know we want to share whatever you'd like us to share with Candace for feedback but also what you want to see more of in the future we these are for you gonna be free virtual resources so let us know what you need what you're looking for thank you thank you both so much thank you thank you everyone have a great rest day bye-bye bye