Tactics, Techniques, and Procedures (for jobseekers)

Hi everyone,

I'm currently applying and interviewing for security roles, particularly for roles with a focus on DFIR activities (in a SOC, etc). I'm wondering if anyone has any advice for interviewing and upskilling. I have industry certification, both vendor neutral and some vendor specific certs, and I have around 3 years experience in a security consulting role. Also, I'm currently unemployed.

To give some info as to where I am, I have experience with configuring and implementing security solutions, with real-world experience in some of the fundamental tools (wireshark, procmon, some scripting and programming languages, fairly comfortable with Linux distros, MDM and endpoint protection), but nothing major. I regularly set up labs for myself to keep myself up to date and learn new skills and tools, but I'm just worried that this won't be enough to get across the line in interviews. I also am not great in interviews generally due to anxiety, but that's something I'm currently working on.

So, onto my questions - 1. Do I need to have real-world experience using a gamut of tools for entry-level positions (which is what I'm mainly applying for), or will labs and my current consulting experience suffice? 2. Are vendor certifications generally worth it E.g. from the likes of Splunk, IBM, Palo Alto, etc? Or am I wasting my time doing these certs? 3. Regarding interviewing, especially if I feel like I can't answer a question adequately due to lack of skills or experience, how should I really answer these questions? Would a portfolio of personal projects and research carry sny weight in an interview?

Very sorry for the wall of text, but just want to reach out and see if I can change what I'm doing. Thanks all! submitted by /u/_anxiety_wolf_
[link] [comments]


http://dlvr.it/T3KvGh