Hey everybody welcome to the next video.
So now we've gone ahead and found the job postings.
We know how to search for them.
Now we're gonna go ahead and analyze the stars that we found.
We want to make sure that they're right for us whether it's for the company or whether the position
is correct.
So what I've gone ahead and done is open up quite a few that were going to take a look at and if you
notice that this looks slightly familiar I changed it from split view which was what it was before.
The classic view so I can see a little bit more because there's a little bit more information in there.
And the posting itself which will show you that isn't always in the classic view or the split view.
So the first one to look at is security engineer two on a red team.
Now I want to take a quick second and kind of point out different things.
Normally what happens is they describe what they're looking for right describe what they're looking
for and about the company then in this case Amazon kind of takes it and kind of splits them together.
But let's take a let's take for example out here.
So about the company the team and what you'll be doing and then responsibilities.
This is the standard flow for one.
So Amazon tends to have it a little bit together when it comes to that.
So just take that with a grain of salt.
So we've got our description and what you kind of expect to doing.
So this is this.
Engineers in this role must show.
So this is part of your requirements.
This is part of your requirements.
So what I want to take you to up here is that the industry almost irrelevant job function probably almost
irrelevant.
It's not it's not quite what you are.
You wouldn't want to based just on that since Red is a very specific niche type role.
I wouldn't worry about this or the industry full time is important because there is some time where
it's a contract to hire and make sure that you're aware of any contract positions that are not full
time roles.
So you can be a contractor or a consultant but keep in mind that when you work as a consultant normally
you're hired full time by the consulting agency.
Make sure that when you apply to something if you want a contract role where you where you're only employed
for X amount of time and that's it then maybe it's a contract to hire temp to perm type position if
that's what you're okay with accepting.
Make sure you understand that for me personally I don't like to know that I might not have a job in
six months.
I like to have that consistent feeling of OK the money's coming and I've got I've got a job as long
as they don't fire me and I don't quit.
I've got a job so there's no like hard deadline that I have to worry about.
So that's important to me.
It might not be for you it depends on the situation.
But keep keep an eye on that normally it tells you in the first been the thing that's the first bit
of the description that it's a contract.
The permits normally in big bold letters up the top seniority level.
This is important but you also need to keep an eye that sometimes people mislabeled these.
It happens.
So for example on this time it's it's a level 2.
So they want a mid to senior level which makes sense so they probably have a plus one plus one or minor
or in this case probably a plus one to the level.
So if you come in and apply for the level 2 position and you really match your level three or a senior
in some cases the company is willing to bump up the position to match for that for you for the position.
It does happen sometimes is a plus or minus so they open up a level three and you're more of a level
two but you fit exactly what they're looking for.
Sometimes a bump up to a level two and hire you anyway it's always worth just double checking.
So making sure you understand the security level this is not on every job post.
So keep that in mind.
You're gonna have to look for keywords when it comes to what they're looking for.
Seniority levels are a good indication.
Sometimes they put the title in here and sometimes they say experienced.
So if you're looking if you see
enough experience or something about a lot of experience or a great deal of experience in anywhere in
the description they're probably looking for a level three to staff.
They're probably gonna be somewhere in that range.
So just keep that in mind when you're reading through this next as we have the responsibilities.
This is sometimes boiled into the description of the role up here in this case it's a it's a bullet
list.
So we've got our runs responsibilities which looks pretty standard for what you're going to be working
with on a red team.
Then we have basic qualifications and preferred qualifications.
What I want to stress right now is that I don't care if this says preferred and this says basic or if
it says desired qualifications it is all there look it treated as a required call qualification.
They want you to have all of this.
But keep in mind realistically most candidates that they come out to or even almost all candidates that
apply to this very very rarely are they going to find somebody that has all of these things they're
not looking for somebody that has every possible aspect to this if they find it great but chances are
that's not what's going to happen here.
They're going to look for somebody that matches the most bring them in and then do the interview process
and rinse and repeat for the next person.
Rinse and repeat for the next.
So when you see here basic qualifications for years of security experience.
So when it comes to X years of experience it's kind of variable.
So you could you could apply to this role with three years of experience and probably have a conversation
maybe two and a half.
You might have a conversation they might call you still anyway even though you applied.
But if you have no years of experience and they want four you're going to have a little bit more of
a tougher time advanced knowledge on things.
Most of them are have some sort of languages that you should be able to learn or already know we've
taught python in Assembly already as well as Bash if you already know Python.
You could realistically pick up Ruby or Perl relatively quickly if you're already a normal developer
than you might already know Java or some version of C.
So between this you should be able to grab at least one of these but be proficient in at least one so
the next thing is is that they want you know NWS which makes sense for an Amazon Company.
Let's see here.
Familiarity with some tools met this boy and that burp sweet.
Make sure you know more than just that.
So those are just the basics which is pretty standard for most of the positions you're going to look
for preferred qualifications.
This seems to be a little bit more than what is typically out there.
Analytic skills concrete progression.
OK.
That's fine.
Skills like experience and mentorship.
That's that's an important one.
Communication skills again hardware hacking.
They're saying knowledge about so it doesn't mean you necessarily have to be pop zero days out left
and right but understanding what hardware hacking is to be able to talk to it for a few minutes is probably
more than enough for the role at least to get your foot in the door.
You can always learn things from that point knowledge of fuzzing memory corruption exploit development.
So some of the basic stuff out of the way a few tutorials should be able to get you on a talking point
for most of it.
Experience reverse engineering and using tools such as ITER again.
They're not saying how much experience you want but you want to be able to talk to at least a little
bit of it to others to let them know that you're familiar with it you've worked with it slightly it
might not be your forte but it's something you worked with.
Same thing with wireless network and enterprise experience with web and mobile assessments if you haven't
done that that's fine.
Capture the Flag CDC research bug bounty.
So a lot of this stuff is pretty standard that you would do as a security security person in general
for the most part such as like looking.
Capture the Flag events normally that's a lot of times people will go to those you know finding bug
bounty stuff that's hit or miss depending on the person you're talking to.
But what I want to quickly go and talk about this particular job description before we get in the rest
of them because I'm going to go over those pretty quickly is that I go with a 60 to 70 rule.
If you match and you understand and can do 60 to 70 percent of what they're asking for you to do apply
for the roll if you're hitting between 40 and 60 percent it's entirely up to you.
But don't be surprised if you don't get a response back but also don't be surprised if you do it's it's
it's what it's that gray area where it depends entirely on recruiter.
If you find yourself under 40 percent of what they're asking for.
Find a different role or apply to it anyway.
Worst thing they can do is say no or not answer you if they do answer you at least you can have a conversation
and normally get past getting past the.
The H.R. filter there once you had the conversation with them is relatively easy.
Sometimes they'll ask you one or two questions sometimes they'll have an actual assessment where they
give you VPN access to actually go from there.
Entirely depends on the company but 60 to 70 rules kind of what I tend to play by.
If you have 60 70 percent of what's on here go ahead and apply and it's more of a spitball thing you
could take every every bullet point you know added up.
Find out which ones that you qualify for than actually do the math.
If you really wanted to but you'll have a general idea.
So if you come in here and you like yeah this is fine this is fine.
This is fine this is fine that's all standard.
Got that.
That's iffy so I would mark that as not.
Let's say you mark that is not you don't have advanced knowledge you got basically knowledge you got
this you got this you worked with GW asked you know those tools you're familiar with the tactics you've
done social engineering you haven't done this you haven't done that you've done this haven't done that
you done this haven't done that done this done this done this at that point I would if you're just looking
at it based on that I would go ahead and apply for the rule number 60 to 70 percent it's kind of where
you're going to want to fall for the most part if you match more than that great.
Better odds as long as what you're what you think you match is on your LinkedIn profile in some way
shape or form you should be golden gun and go to the next job posting here.
So this is the one for Teradata.
Again we have their company.
This is a mid to senior level most of time additional C job functions engineering.
You have our team which normally indicates about the offensive team or the security team in general
sometimes it's about the red team.
What you'll be doing and then you have your responsibilities and qualifications in this case.
They don't have any preferred qualifications they just have these are what you're gonna be responsible
for and this is what qualifies you and you see this as they talk about some of the generic stuff but
they change the wording change the phrasing and you can see here that they have certificates so you
see ONDCP and some sand certs.
So this is more of a generic puzzle what you're looking for.
Again there's not really any real experience or looking for one in offensive security or three in security
so if you have two in security you should be fine.
Or if you're in one in security that you've done offensive work while in that position I would still
apply.
So but they have you'll notice that they're talking about different things.
So this guy is talking about where was it active directory administration which the other on 8 of us
was not.
So it's important to understand that you're working with a D and attacking a d possibly just based on
this job description.
So it's important understand kind of get a better idea of what their architecture is based on what you've
seen here.
So go and grab the next one so this is a consultant role for NCC Group again great great company.
They pull up a lot of consultants.
They're very very smart people I've worked with plenty of them.
They're looking for a mid to senior.
So again the role the responsibilities the culture the research of what you can do.
The years of experience that they're requiring again they're working with software harbor security and
then delivering technical results of solutions.
AK report writing and then kind of working with everything under the sun.
Consultants you never know what you're going to work with but as a consultant or as a red team or general
you should be willing to be able to have that interpersonal skill where you can go out and talk to people
write reports etc. And what's also important about consulting is that you need to be willing to travel.
That's just part of the job you might be at a client site for two or three months.
It's entirely depends on contract and what they have but be prepared to travel when you're looking at
a consulting job make sure that you take a look at the employment talk type does this.
In this case it's your full time working for NCC Group but other companies you might just be contract
to hire or you might have a six month or three month contract.
Grab the next ones.
This is another one from Amazon which is a penetration test tester finance operations.
This is where they're going to want.
They're wanting a little bit more of the preferred qualifications aren't quite red team.
It's more on the other side but at the same time you're performing different things different tests
as part of a team.
But they want more experience on this seems to me like a much more advanced role than the level to one
which is what we're looking at before even though this doesn't say a level at all you can just tell
based on it saying five years experience there's much bigger list here even some strong experience of
offensive security.
So this tells me that this is going to be a more advanced role they're probably looking for a senior
or a little bit more even at this particular role.
So we also have internships where you'll see entry level quite a bit.
Again keep my entry level does not pay an entry level in I.T. but it is entry level for offensive security
in this particular case.
So a little description about the job in the company what you'll be doing participating in this.
Looking for things minimum requirements you're pursuing your degree you have functional knowledge essentially
getting through this red team blueprints you more than well prepare you for any internship that you're
going to want to do mindset of a breaker and penetration tester you should already got that by now if
not you're developing it and being able to write phasers working towards Seabees or bug bounties and
a little bit more about the company so you can see the interns are more a much more specific they get
a lot more people applying for the internships than not.
So just keep that in mind I tended to avoid internships because again I like to have that employment
time being with no end point specifically talked about and with interns there's always going to be some
end point at some point whether it's an end and you get hired or you end and you don't there's no guarantee
that you're going to get hired.
So for me I stay away from them.
But if you have if you don't have bills or anything else that you have to keep track of that aren't
a massive amount that you could do a part time or you maybe live with your parents or with a relative
in between this you go do your internship and hope you get the job if not you just go back and you're
good to go you continue your job hunt then this is a good way to get experience but if you're already
out in the world you are working full time.
Normally you've got bills you've got mortgage you've got kids whatever the case might be if that's the
case.
This might not be the option for you to quit your job that's stable to go to an internship for five
six months and then not have a job possibly when you get back.
That's not.
It's not a feasible solution for everybody.
Just keep that in mind.
So we'll look at this one again this is co-star group and this is for a senior offensive security engineer.
I keep in mind this says senior put it says an associate level.
So this was a mess up on the postings so this is why it's important to always double check the titles
and everything else we're looking for passionate security engineer.
We look down here they want a bachelors degree a minimum of six years but it's an associate.
So again always keep an eye on that.
They want OSTP OS DWP for the wireless one G pen or similar and then technical skills.
It looks like they're just naming a bunch of different tools and an OS inside of the tools list for
some reason.
It looks to me like this might not have been written by somebody on the team per say or it was but somebody
mixed it up a little bit.
I'm not sure what happened here but this is why you should always double and reread things two or three
times make sure that you understand exactly what they're asking for.
Obviously I know what they're referring to here they want you to understand Kelly but Kelly I guess
can be considered a security tool but it's an operating system.
So we'll keep going through here and business skills so being able to work with the skills being able
to talk to people et cetera reports this is where they have competitive pay.
Of course and I can sometimes they'll tell you the actual range for for for a position but it's not
that commonly seen.
So you see here they have health insurance paid vacation for one K office benefit.
So most of time you're not going to see this inside of a job description you're going to see it from
Glassdoor which will go over later.
Beautiful work top scenery et cetera et cetera.
Gold certificate so you can see here that there's they're looking for a senior position in Washington
D.C. So make sure you keep an eye on where the locations are.
So this is the one for Facebook like we've already talked about so I'll brief you go over this they
want you to publicize tools which we've kind of art talked about in the python module you want to keep
you want to open source things as much as possible for the security community especially when something
unique.
This is a pretty standard job descriptions but it looks like they say they don't really say in a position
title.
It doesn't say it's looking for an experienced engineer.
So this tells me that it's probably again a more open one you apply for the position and based on your
interview and your background they will if they extend an offer they will extend it at whatever level
is appropriate.
And here we go we got the data dog one which is in New York.
So this says entry level.
So if we take a look here I don't see any position experience required.
It doesn't say anything about an extensive background or anything along those type lines.
And it says familiarity with and instead of expert knowledge in there using words like competency instead.
So this tells me that there probably are looking for an entry level person.
So this might be a level one to two give or take.
So this is kind of what this is but this is telling me.
But you always want to make sure once you contact a recruiter or they contact you for this type of position
you want to just double check make sure it's not a contracted position.
Make sure that what they're kind of looking for experience level wise you want you don't want to waste
your time or their time if they if you think that it's junior level but they're looking at it as the
staff level.
There's no point in trying to go through that process unless you're at a staff level it's going to be
very obvious when the person recruits it and then it's go look bad on the recruiter it's going to look
bad on you just double check make sure that you're all on the same page.
So this is the one for ring which keep in mind this is remote.
So this tells you that you can work from almost anywhere so this isn't always the case but it's good
to just double check.
They're looking for entry level.
So can should be able to do security risks looking for information security engineer.
Great.
So they're looking for red team responsibilities.
They want a minimum of three years of pin testing or red team experience.
So entry levels is probably not what they're looking for.
They're probably looking for a level two to three give or take which might might be able to consider
that entry level because it's not technically mid to senior yet.
That might be accurate for their metric and their rubric.
So keep that in mind.
They do though leveling based on their rubrics and their years of experience.
There's companies out there where three years of experience is a level two.
So it's just it's based on their rubric but they pay in accordance to what your experience.
If you've got five years experience.
But they have leveled you of a level two you're not going to get the same pay most likely as a level
two at a different company where a level 2 over there is one and a half years.
So just keep that in mind.
And that's where we kind of go over the salary requirements in future videos where we'll talk about
something like that technical proficiency met Boyd all all of this looks pretty standard and we've hit.
Believe it or not just based on the red team blueprint most of this stuff we've hit or I have told you
to hit or research on your own past that point like social engineering toolkit.
If you haven't looked it up look it up burp look it up.
Quality is a paid tool so that's that's up for debate on whether you want to look at that or not but
like cross-eyed scripting we've definitely gone over CSR if we have not.
But I have mentioned it and provided links on it.
So it's always good to just double check and the last top 10 we've already gone through here.
Which CSR is part of that.
So by that point if you've done the additional research you should have this guy out of the way this
guy out of the way this guy out of the way minus these kind of briefly talked about them leased this
out of the way burp and social engineering tool it can be learned relatively quickly.
You've already got this out of the way.
This out of the way that's kind of halfway through because we didn't quite go over hardening packet
level forensics is a skill set to jiggle in relatively quickly as well.
Same thing with this and understanding of age GDP and how it works.
We've kind of gone over that and knowledge of cloth and Sambo and IDP is something we haven't gone over
but you can see here that just by the Red Team blueprint without having to go that extra mile you've
gone through a lot quite a bit.
So this is how you analyze a job post and how I kind of look at them and always take it one step at
a time and do a quick check on we're going to go over how to look a little bit more for the companies
themselves but make sure that you agree with what the company's mission sounds like a good company.
Nothing looks shady to you.
It's always good to just do that extra bit of research.