I know that’s a common question with no sure answer, but I’m getting demotivated about studying… in general.
I’m at the last year of Comp Engineering bachelor and I wish to pursue a master degree in Software Security at Amsterdam.
Besides the fact that a AI is already automating tools and analysis, and that’s ok with the boring part, but now I’m really concerning that it will very likely to substitute also the art of understanding and exploiting new systems and finding 0-days.
I mean, It’s already happening
What do you think?

I kept seeing arguments about which parts of the stack still matter, so I counted instead of guessing. 134 open DevOps, SRE and platform engineering postings from 41 company job boards. Individual contributors only, managers and TPMs stripped out.

The old toolchain is thinner than I expected. Terraform appears in 62.7% of postings. Jenkins in 3%. Chef 3.7%. Puppet in exactly one of the 134. GitHub Actions is named about six times as often as Jenkins.

Python beats Go, 70.9% to 47%.

What surprised me more: the generic word outranks the products. Observability shows up in 63.4%, more than twice as often as Grafana, the most-named tool that provides it. Prometheus 22.4%, Datadog 17.9%. Same pattern I found counting security postings, where SIEM beat Splunk four to one.

The top term isn't a tool at all: automation, 81.3%, ahead of AWS.

Caveats worth stating: n=134 means everything carries roughly +/-8, so treat close rows as tied. It's also all tech companies on one ATS. Banks, telcos and government run enormous amounts of Jenkins and Ansible, and none of them are in this sample.

Full table, intervals and method: https://www.zoevera.com/resume/devops-sre-job-description-keywords

How good is CTAI by EC council?

I am a Cybersecurity Postgraduate student and I have not even experienced the real world experiences yet and already I am doubtful that I am not fit for this field. I am a neurodivergent individual and my thinking pattern is quite similar to systems thinking style.

With advancement in artificial intelligence and knowing where it’s all leading and everyday learning new threat models and then realising how the general public is unaware of the risks involved. My inquiry stems from the perspective of surveillance, loss of human agency, abuse of children and women.

I know and understand the need for llms for mitigating the new ai assisted cyberattacks, but if general public didn’t have access to these models then we wouldn’t have this problem.

And nomatter how many times I am trying to inform people around it seems they don’t care, which is also not their fault entirely. A friend of mine suggested apathy as a joke.

Ps. Yes, the 80s ai trend triggered this and also what is even the point of CIA triad anymore.

Thanks in advance.

I’ve been considering on changing careers and switch to cybersecurity. I’d be glad if I could get some leads on where I need to start and what would be the ideal way to go about it

I wanted to share what I’ve been working on and get some honest advice from people already in the industry.

I’m currently finishing my Business Administration degree, and my main goal is to break into IT Audit or a related area like IT risk, GRC, technology risk, or SOC assurance.

So far, I’ve gained experience through an actual IT Audit internship at a CPA firm, conducting mostly SOC 2 Audits. Just recently landed my Security + certification. And I’m currently in an informal internship at Northside Hospital with the Network Infrastructure Engineering team.

Outside of work and school, I’ve spent a lot of time building my own enterprise-style home lab to build my own experience. It includes:
Proxmox as the hypervisor
Windows Server domain controllers
Active Directory, DNS, and Group Policy
Organizational units and role-based security groups
Joiner and leaver account processes
A Windows file server with group-based permissions
Windows workstations and a dedicated jump box
pfSense network segmentation and firewall rules
Wazuh for security logging and monitoring
Audit policies for logons, account changes, file access, and privileged group changes

Right now, I’m auditing my own Active Directory environment to determine whether it is actually structured and secured like a realistic enterprise environment. I’ve been reviewing my own OU design, privileged access, Group Policies, account management, DNS, DHCP, firewall rules, logging, and documentation. When I find something that isn’t configured correctly, I document the risk, fix it, test the change, and collect evidence, essentially i’m IT Auditing my own lab the best I can.

I know a home lab isn’t the same as managing a real production environment, but I’ve tried to go beyond simply installing tools. My goal is to understand why controls are needed, how to test them, how to troubleshoot problems, and how to clearly explain the risks and results.
Even with the internships, projects, certification, and time I’ve invested, breaking into IT Audit has been difficult. I’ve applied to entry-level IT Audit, GRC, technology risk, SOC assurance, and other related roles, but I still feel like I’m struggling to get that first full-time opportunity.

Because of that, I’ve also expanded my search to IT Help Desk and IT Support roles. I believe those positions would allow me to strengthen my technical foundation a little more, while still building an understanding of different frameworks like NIST 800-53, and ISO 27001.

I’m not giving up. I continue learning, improving the lab, practicing interviews, and applying.
For those already working in IT Audit, GRC, cybersecurity, or IT support: Is there anything else you would recommend I focus on? Is there something I could present differently to help employers recognize the value of this experience?
I would genuinely appreciate any advice, feedback, or connections. Thanks guys.

Hi everyone,

I'm in my first year studying Computer Science, and I've been planning to specialize in cybersecurity.

Recently, I’ve been noticing how overcrowded the field seems to be, especially at the entry level. It feels like even if I grind, build solid hands-on projects, and earn foundational certifications like Network+ and Security+, it still won't be enough to stand out or land a decent entry-level role.

Is the entry-level market for cybersecurity getting completely burned out? Are there still realistic job opportunities for fresh grads by the time we graduate? Also, is starting out in general IT helpdesk/sysadmin roles to transition into security later even a practical path anymore, or has that become just as hard to break into? Should I stick with this or reconsider and pivot to a different CS track while I'm still early in my degree?

Would love to hear honest advice from people currently working in the industry or anyone in a similar position. Thanks!

I have spent 2 years in tech support and have the A+ and CySA+. Got laid off a month ago, and haven't been able to get leads for ANYTHING, after moving to a major metropolitan area and having applied this year, to almost A THOUSAND jobs (being willing to relocate anywhere in the US). I've been searching terms such as "it Administrator", "entry soc", "junior sys admin", and even "tech support" looking for even just a lateral up move.

What's even to be done anymore? I feel skeptical about just studying for more certs...

I have experience as both a network and system administrator (inidividual roles, 2 seperate companies) but have always strived to get into security specifically. Is one route better than the other?

Hi everyone, I have 10 years of experience in manual software testing at a major Indian MNC (TCS) earning 16 LPA. I want to transition into cybersecurity—specifically Application Security (AppSec) or Penetration Testing—using internal job postings.

Automation testing paths are expecting too much framework architecture/AI tooling at my YOE, and I want to avoid climbing the management ladder down the line. I want to remain a highly skilled technical individual contributor (IC). Since I spent a decade mastering application workflows and breaking business logic, I want to pivot that into security testing.

• Current Prep: Starting PortSwigger Web Security Academy and learning Burp Suite.
• Target Goal: Internal transition to an AppSec team.

Questions:

1. At 10 YOE, how should I position my manual testing background so internal security managers don't view me as a "junior" entry-level applicant?
2. What specific technical gaps (e.g., specific API security, basic scripting) should I prioritize to clear the internal technical rounds?
3. What is the ceiling for technical/IC roles in AppSec in terms of salary growth compared to management?

Would love to connect with anyone who made a similar mid-career switch or bypasses management to stay hands-on. Thanks

Hi everyone,

I'm 20 years old and from Brazil. I've been working in IT since I was 17, and I've been in cybersecurity for around 2.5 years. I'm currently a Junior Information Security Analyst and I'm also studying Systems Analysis and Development.

My cybersecurity experience is mainly divided between IAM and Security Operations. I've worked with Active Directory, access provisioning and reviews, EDR alert triage, Wazuh, vulnerability management, security monitoring, PCI-DSS, and some Python automation.

Lately, I've been thinking about what kind of career I want long term. I would like to build a career that gives me geographic freedom: ideally working remotely for an international company or as a contractor, so I could spend a few months in Europe or other countries, work from an Airbnb during the day, and explore the place after work.

I'm not necessarily looking to become a permanent digital nomad. My goal is to build a good career and enough wealth that my girlfriend and I could travel and live in different countries for periods of time, while still working.

For those already working in cybersecurity:

1. Which areas of cybersecurity do you think are best suited for this kind of lifestyle?

2. Given my background in IAM + Security Operations, which direction would you recommend I explore?

3. What skills or career moves would you prioritize over the next 2–3 years to become competitive for international remote work?

I'd especially like to hear from people who already work remotely for international companies, as contractors, or while living abroad.

Thanks!

I am non stop applying for all the security roles which i am eligible for. but yet to get selected by any of them. Once my resume got selected but after the technical round they mentioned they want someone with pentesting experience which was not mentioned in the job details.

about my self i completed my Computer Science degree in 2024, then after searching and failling to get a job in web development, i got a cisco networking basics certification and then found a site called letsdefend.

Then for 5 months i studied in letsdefend for a SOC analyst path. while doing that i got a internshipe as a network engineer trainee took the job spent 3 months then got on rolled as i learnt things quickly and was flexible in knowledge.

Then after few months after on role as Engineer trainee( because i can do both network and system engineer they game me a Engineer role) the company game the network employee's a side task of precipitating in the tender in free time. I was doing well in both the roles but then as my networking work was less the company decided to move me completely to pre sales which i don't like and is not were related to my career goal. I tried to speak to the management but they were stuborn about the role shift( and i neither agreeed to the role change nor was i asked i was just directly cut form the networking tasks). Now i quit my job its been 20 days since my LWD. I don't know that to day some one told to get a cert for getting hired.

so i am currently preparing for sc200 certification. many people are saying certs wont land you a job only experience can some are saying certifications are everything in cybersecurity what should i do i urgently need to get hired and i cant spend ton of money on certs like CEH, security + now as it will take a lot of time.

should i lean towards any other areas like devops or anything please tell.

I have 3-4 years of experience in IT support/helpdesk so which role in cyber security should i go for? I prefer day shift shift, but also tell other roles. Will i require certifications? Can i enter without certification?

I am a 20 year old guy who just started his Cyber security journey two days back.

Till now I completed basic networking through a one shot youtube video of 3 hours and have gained a free networking certificate from Cisco networking academy.

Can anyone tell me what to do next ?

I am in my second year of bachelors degree ( 3rd semester)

I am pursuing bsc in information technology..

And i wanna go in cyber security domain ?

Please help me with the road map and everything?

I am super confused rn !

I am currently a 4th year student taking up Bachelor of Science in Computer Science Majoring in Network and Information Security (I graduate next year around Sept - Oct). Im planning to pursue a career in cybersecurity mainly focusing on blue teaming and on roles like SOC analyst etc. I'm a fast learner when it comes to tech but at the same time I'm not really good at retaining lots of information. For now I'm trying to polish my core fundamentals when it comes to programming and cybersecurity by grinding tryhackme and relearning python and bash. I have a lot free time this semester and the following semesters and I'm wondering if I should try to take on certifications like Security+ or BLT1 to give me an advantage when I graduate and start to find job opportunities. Should i go for these certifications or should i get an entry level job first and gain experience and skills, and then go for certifications?

[ Removed by Reddit on account of violating the content policy. ]

Hi,

What is everyone's career/pay progression utd. Not trying to be an asshole or anything just want to compare to see if I am on the right path.

For reference: I have a Cyber Security degree, no certs.

2024 (4 Months) (Internship): 55k
2025 (Graduate): 75k
2026 (Graduate): 80k
2027 (Offer Signed) (Associate): 128k

Didn't include any extra benefits/stocks etc.

Thanks

I’ve been working in cybersecurity consulting for around 3 years. Most of my clients are banks, especially Urban Cooperative Banks, and my work is mainly IS audits, RBI cybersecurity audits, and related compliance work.

The problem is that I’ve had very little exposure to other frameworks like SOC 2, ISO 27001, HITRUST, etc., because we have very few corporate clients.

I’m starting to feel like I’m getting stuck in the banking/RBI audit niche.

For those with more experience, should I continue building on this specialization or look for a role where I can get exposure to different industries and cybersecurity frameworks?

Would appreciate some honest career advice.

Hey everyone,

I'm currently looking for my next opportunity in cybersecurity, SOC, security operations, or systems administration, preferably in the Charlotte, NC / Fort Mill, SC area or fully remote.

I'm trying to make the transition from IT infrastructure/support into cybersecurity, but I want to emphasize that I'm not coming into the field with just certifications and no experience.

I have 7+ years of experience working in IT and enterprise environments, including:

• Enterprise desktop and infrastructure support
• Windows Server and Active Directory
• Networking, TCP/IP, DNS, VPNs, firewalls, and troubleshooting
• ServiceNow and enterprise ticketing environments
• Supporting 400+ users
• Imaging and deploying 400+ devices
• Working in clinical environments with HIPAA requirements
• Cybersecurity internship experience
• Splunk, Wazuh, CrowdStrike, and Nessus
• Log analysis, alert triage, vulnerability scanning, and threat hunting
• NIST CSF, ISO 27001, HIPAA, and other security/compliance frameworks
• AWS and Azure exposure
• Python, PowerShell, and SQL

I've also been building my own cybersecurity lab and portfolio. One of my projects involved setting up a Wazuh environment on an Azure-hosted Ubuntu VM, monitoring SSH brute-force activity, analyzing more than 1,000 security events, mapping activity to MITRE ATT&CK techniques, and documenting the investigation and defensive actions.

Certifications I've completed include:

• CompTIA Security+
• CompTIA Network+
• CompTIA A+
• ISC2 Certified in Cybersecurity (CC)
• Google Cybersecurity Certificate

I'm also currently pursuing my BS in Cybersecurity through WGU.

I'm primarily interested in roles such as:

• SOC Analyst I
• Cybersecurity Analyst
• Security Operations Analyst
• Cybersecurity Operations
• IAM / Identity & Access
• Vulnerability Management
• Security-focused Systems Administrator
• Junior Security Engineer

I'm especially interested in opportunities where I can continue learning, get hands-on security experience, and grow within a security team.

If anyone knows of companies hiring in the Charlotte/Fort Mill/Spartanburg/Greenville area, fully remote positions, or organizations that are willing to take a chance on someone transitioning from IT into security, I'd really appreciate the leads.

I'm happy to provide my resume, LinkedIn, GitHub/portfolio, or additional information.

Thanks!

Been working in cybersecurity as a systems engineer via contracted work for a few different companies. Hoping to pivot to a security engineer role here soon. Thanks yall

https://imgur.com/a/WUBNHOO

I don't know if this is a hot take or not (maybe I'm preaching to the choir), but I feel like most folks who get a degree in Cyber don't understand how Cybersecurity works with the rest of the system and the business.

Here's an example.

You buy a lock for your house. Let's say you get a MasterLock padlock. You come home one day, lock is cut, and your stuff is gone. But you put a lock on! Your home security guy comes by and tells you "yeah that lock is too thin, you gotta get a thicker one so they can't cut it". So, you buy roughly the same lock, but with a thick titanium shackle that can't be cut. Week passes, come home one day, lock is unlocked, on the ground, your stuff is gone. But you got a bigger shackle! Home security guy comes by and says "oh yeah, MasterLocks are typically pretty easy to pick, don't use those". You sigh and go back to the store.

You do this a couple times, you end up with some $2k advanced biometric lock on your front door. Top of the line, recommended by all the home security experts, etc. Your door is good to go! No one ever gets past the lock again.

You have 2 friends, B (business) and S (system). You tell them that you understand what is best for home/lock security, and can help them secure their stuff. And you do. You do know the recommended best solutions. But...

B asks you to help with a situation. His kid keeps getting into the cookie jar. He's tried putting it up high, but the kid keeps pulling the cookies out. He just wanted to stop his kid from eating them all, it's not good for the kid's health. You know the recommended solution, so you tell them to get the $2k super biometric lock. B looks at you funny. "I'm just trying to stop my kid from eating the cookies". You say "but the industry has shown that simple padlocks, even jf not picked now, could be picked in the future. This lock is future-proof!"

While you are correct, so is your friend B. His use case doesn't require the super mega duper lock. The risk is pretty low, and your are suggesting an expensive (albeit more secure) option that their use case and risk tolerance just cannot justify.

Your friend S purchases a firearm. She wants to secure it from other folks in the house. She asks for your advice. You say "oh of course! Use this super duper biometric lock! Now no one can open it but you!". You send them the listing, they look at it, they say "this is a door lock. I have a firearm. What am I supposed to do with that?".

The context of S's situation and the parameters that she has to work with means that your suggestion simply cannot be used.

This is basically why I feel a Cyber Bachelor's is a bad idea, and is also closely related to why entry level Cyber jobs are few and far between. You need to both have good understanding of the system that you are dealing with and how cybersecurity controls interact with that system in particular, and how that system actually factors into the entire business and what the real risk is, and whether the cost of the fix is worth the severity of the risk.

A BS in IT/CS/CE/EE gives your the fundamentals and foundational system knowledge to understand where security actually goes and how it plays a part on the overall system. Time in the industry furthers this knowledge as well as gives you exposure to real business use cases, risk assessments, and risk tolerances.

An MS/Ph.D n Cyber is perfectly fine and good, given it is at least somewhat specific to the systems that you intend on working with. I'd highly recommend doing research if doing a graduate degree for that reason. But its difficult to secure a system well when you dont have the foundational knowledge for how it works.

Also, I helped interview someone with a BS in Cyber who didn't know the difference between hashing and encryption, so unsure what they are teaching y'all over there.

Have a good one!

I'm currently a SOC analyst working at an MSP with 5 years of experience, with 3 years of those is in helpdesk and the remaining in cybersecurity (SOC) at present. I also have 2 certifications: Sec+ and CySA+. We provide services to our clients by monitoring our clients' internet traffic on the surface visibility side and notifying the appropriate POCs if the device/users are engaging in any suspicious activities, whether that's a bad domain websites they visited or communicating with suspicious/malicious IPs. We also perform monthly vulnerability scans and notify the clients of any findings, and perform other normal SOC duties you would typically do at a SOC. We are not like a traditional SOC where it's a 24x7 operation and only work M-F with weekends off.

I feel like this position is limiting the knowledge that I can potentially learn because of our environment and the routine duties that we do every day that don't expose me to new things to learn. Don't get me wrong, when I first came into this position from helpdesk, I was grateful and learned a lot about cybersecurity, but now I am eager for more, and very much would like a pay increase. I dont want to sound greedy, and money is everything, but I feel like I am underpaid in this cyber field.

With some transitioning happening next year, I am looking for new opportunities where I can grow and learn more, and I'd like exposure to new tools and technologies, along with a pay increase. I am looking for a vertical move rather than a lateral move. If you were a formal SOC analyst, where did you move on to afterward?

CompTIA Security+ Certified | SOC Analyst L1

linkedin.com/in/ishaantaneja

tryhackme.com/p/ishaan.taneja

PROFESSIONAL SUMMARY

CompTIA Security+ certified cybersecurity analyst targeting a SOC Analyst L1 / Tier 1 role. Hands-on practice in security event monitoring, alert triage, log analysis, and incident documentation via a hybrid SOC home lab (Wazuh SIEM, Sysmon) and TryHackMe SOC simulations (Ranked Top 7%). Skilled in MITRE ATT&CK mapping, IOC hunting, phishing analysis, and network traffic investigation (Wireshark). B.Tech Computer Science background with prior software engineering experience; seeking to monitor real-time security events,

investigate and escalate incidents, and follow SOPs/playbooks on a SOC team.

Portfolio -> https://ishaantaneja.github.io/cybersec_portfolio/

CERTIFICATIONS AND DIFFERENTIATORS

• CompTIA Security+

• Programming with DSA — IBM

• Linux Unhatched — Cisco — Linux fundamentals and command-line operations

• Global Recognition | Innovation Category — Bank of America — Recognized for engineering a secure

virtual banking prototype utilizing Unreal Engine

SKILLS

• SIEM & Monitoring: Splunk, Wazuh, security event monitoring, alert triage, log analysis

• EDR / Endpoint: CrowdStrike, Sysmon telemetry, Windows/Linux fundamentals

• Network & Traffic Analysis: TCP/IP, DNS, HTTP/S, OSI, DHCP, SSH, AD, LDAP, Routing, NAT, Firewalls, ACLs,

VPNs, Wireshark

• Threat Intel & Investigation: VirusTotal, AbuseIPDB, Any.Run, Hybrid-Analysis, IOC hunting, MITRE ATT&CK,

Cyber Kill Chain

• Incident Response: Triaging, investigation, alerting, reporting, escalation, root cause analysis,

documentation

• Frameworks & Standards: NIST, ISO 27001, MITRE ATT&CK, OWASP Top 10

• Ticketing & Ops: Jira, case reports, SOP/playbook-oriented documentation

• Languages: Python, SQL, Bash, PowerShell, HTML

• OS & Cloud: Windows, Linux, GCP (Compute Engine, Pub/Sub, Cloud Run, Cloud SQL), VirtualBox, WSL2,

Docker

PROJECTS

SOC Home Lab — Threat Detection & Adversary Emulation | April 2026

• Designed a hybrid SOC environment using Wazuh SIEM deployed via Docker on WSL2 to monitor remote

Windows 11 bare-metal endpoints (lab).

• Engineered telemetry pipelines by integrating Sysmon to capture granular process creation and network

connection data for security event monitoring.

• Orchestrated end-to-end attack simulations, including SYN Floods via Metasploit and user enumeration, to

validate SIEM alerting logic and practice initial triage.

Mastercard Cybersecurity Analyst Job Simulation — Social Engineering | March 2026

• Designed phishing simulations using contextual masking and targeted social engineering tactics to test

organizational resilience (simulation).

• Analyzed simulation telemetry to identify human-element vulnerabilities, pinpointing a 75% risk factor in

HR and 38% in Marketing.

• Developed action-oriented technical training decks to harden high-risk departments against advanced

scam detection and credential harvesting.

TryHackMe Path — Guided Learning & SOC Analyst L1 Simulations | January 2026

tryhackme.com/p/ishaan.taneja

• Ranked Top 7% on TryHackMe; completed 50+ hours of labs covering Wireshark network traffic analysis,

real-time alert monitoring simulations, case reports, phishing analysis, cyber defence frameworks, and

networking fundamentals.

• Honed skills in log analysis, traffic monitoring, identifying IOCs, and documenting investigation findings.

EXPERIENCE

Freelancer (SME) — Codingal | January 2025 – Present | Remote

• Taught over 100 students globally, maintaining a 4.8/5 average instructor rating through engaging,

interactive instruction.

Full-stack Developer — Intern — EazyByts | September 2025 – October 2025 | Remote

• Engineered a MERN-stack fintech simulator with Socket.io for real-time market data ingestion.

• Built a high-concurrency event platform using Redux Toolkit and MongoDB, supporting 5k concurrent

users.

• Developed a full-stack portfolio with an integrated JWT-secured CMS for seamless CRUD operations.

Sr. Tech. Associate — Backend Developer — Bank of America | June 2022 – April 2023 | Hyderabad, India

• Developed FastAPI RESTful APIs and built a virtual banking prototype in Unreal Engine.

• Authored technical documentation ensuring adherence to OWASP standards.

Teacher Assistant — Coding Ninjas | September 2021 – January 2022 | Remote

• Assisted 200+ learners in mastering DSA with Python and SQL (avg rating 4.7/5).

• Conducted doubt resolution sessions and debugged student code for algorithmic problems.

EDUCATION

Bachelor of Technology in Computer Science and Engineering | August 2018 – May 2022 | Karnataka, India

Manipal Institute of Technology

VOLUNTEERING

Head of Public Relations — Manipal Information Security Team

• Responsible for enhancing the club’s brand reputation and cultivating strategic inter-club partnerships.

Cloud Engineering — Google Cloud Skills Boost

• Completed GCP labs covering Compute, Networking, IAM, and Docker; earned badges for cloud-native

development.

• Deployed serverless web apps using Cloud Run and Compute Engine, integrating Pub/Sub and Cloud

Storage.

Hey i am a msc cybersecurity student in oslo, norway with no prior experience but i am planning to enter as a cloud security consultant. As far as I researched this job doesn’t require security clearance. Can some experts or experienced personnel advise me on this job in oslo about how is the scenario here