JOB HUNTING ON LINKEDIN

Kip Boyle: 

Hi everyone. This is Your Cyber Path. This is the podcast that helps you get your dream cyber security job. I’m Kip Boyle. Wes Shriner is with me here, and we are experienced hiring managers. We’ve hired a lot of cyber security professionals, we interviewed even more of them, so we’re here to share what we know with you. If you want to give us feedback on the show, or if you want us to answer your question on a future episode, that’s easy. Just go to our show page at anchor.fm/yourcyberpath. When you get there, there’s going to be a message button on the page, it’s super obvious. Click that and make sure your microphone’s working, start talking, and we will absolutely hear from you, and we’d love to.

So as we did on the last episode where we had a guest hiring manager, Wes and I think it’s really valuable for you to hear from other cybersecurity hiring managers, because hey, everybody does their job a little differently, and even though this is a highly regulated activity, hiring people, interviewing people, even though it’s highly structured, we still bring different perspectives and takes on it, so we want to share as many of those with you as we can. Today we have a different guest, and I want to welcome Glen Sorenson to the show.

Wes Shriner: 

Glad to have you here, Glen. Thank you for joining us. It’s going to be a good show today.

Glen Sorenson: 

All right. Thanks Kip. Thanks Wes.

Kip Boyle: 

So Glen, when did you first start hiring people for cybersecurity jobs? Tell us a little bit about your experience doing that.

Glen Sorenson: 

Well, I’ve been a long time job seeker, and more recently, within the last couple of years, have been more of a hiring manager, both for cybersecurity professionals, and for people more generally in IT, or areas that touch IT or security in some way.

Kip Boyle: 

Okay, cool. We’re glad to have you here so that you can talk to us about the things that you think work well, things that job seekers should be using, techniques to get themselves noticed. So today, one of the things that you said you wanted to share when we were doing prep for the episode, LinkedIn, right? LinkedIn is a really valuable tool that our listeners should be using when they are hunting for cybersecurity jobs. You actually have a four step method for using LinkedIn, and I loved what you described. I loved the whole approach, because it’s really focused on people connection, and I think that’s an amazingly effective way to cut through the clutter and the noise, and to actually hot wire the system, because you’ve got a resume that you’ve submitted, it’s going through applicant tracking, it’s going through the HR department, but if the keywords aren’t firing, then your resume may never actually be elevated to consideration for an interview. But maybe you have a lot to offer, and finding the hiring manager, or somebody on the hiring manager’s team, is an effective way to cut through and to be seen.

So four steps, right?

Glen Sorenson: 

Yeah. LinkedIn is a gold mine. There’s so much information that you can use there to connect with people as people, and cut through some of the automation and some of the barriers that may be there to your getting the job that you’re after.

Kip Boyle: 

This is great. I think this is going to be really good stuff. Let’s go through each step one at a time. What’s the first step? How do I get started? How do I crank this thing up?

Glen Sorenson: 

The first step is to identify the job title that you’re after. Find the type of job that you want. The first part of this is pre-LinkedIn. There’s some introspection required. What are you good at? What do you want to do? Are you really good at it? Is it going to take some time for you to get good at it? These are things that you need to understand and be aware of as you’re taking this journey before you go into LinkedIn.

Kip Boyle: 

I hear a lot of people come up to me and say, “Hey man, how can I get into cyber security?” And this is one of the first things that I talk with them about is, well, what, what job do you want? And actually a lot of people are really surprised to find out that there isn’t just a cybersecurity job, that there’s actually a whole collection.

Glen Sorenson: 

Every flavor you can imagine.

Kip Boyle: 

Yeah. Right. So one of the first things I do with people is I say, well, look, there are some broad categories of jobs inside the career field that you could consider. I start by saying, look, do you want to build stuff? Kind of like blue team. Do you want to break stuff? Kind of like red team. So broad categories of different types of jobs. Let’s not trivialize it, it can be difficult to winnow it down to a specific job title, and I don’t know very many people who can, they usually have like, “Well, I’d like to do this, but I’m also open to doing that.”

Glen Sorenson:

Yeah, exactly. Once you get a category established, the sort of job that you’re interested in, that’s when you start drilling into specific titles that you might want that are different flavors or different parts, different subsets of that category. Examples of this might be a SOCK analyst, security operation center analyst. Maybe you want to be a consultant and get experience to a broad range of organizations, potentially something like a risk analyst or a compliance analyst, popular one being penetration tester, which is not always as easy as it sounds.

Kip Boyle:

Or as fun.

Glen Sorenson: 

Or as fun, yeah. Do you like writing reports, because you’re going to have to.

Kip Boyle:

Yeah. Do you like testing at two in the morning?

Wes Shriner: 

Kip, I think this might be an interesting episode in the future, breaking down some of the major categories of roles and responsibilities inside a security organization, and helping people find their focus.

Kip Boyle: 

Yeah, we should definitely do that. I’m going to take a note on that. Well, anyway, getting back to the four steps. Your first step, Glen, for our audience, is get a job title because I don’t think without a job title, you’re going to get very far in LinkedIn, right?

Glen Sorenson: 

Yep. So this is really where LinkedIn comes in. This is where you start putting in those job titles that you might be interested in. And when you start exploring LinkedIn, you’ll find more variants of that job title, or maybe something that’s peripheral, or something that leads into something else that might be of interest to you. So record these things, write them down, keep track of them. When I’m doing this, I keep a spreadsheet of things that might be of interest, or of notes related to those things, or my thoughts at the time.

Kip Boyle: 

Got it.

Glen Sorenson:

When you’ve settled on that, and searched for some, and identified some that might be of interest, you’re going to want to keep track of the requirements for those jobs, the educational requirements, the years of experience, certifications, and the skills that go with those jobs.

Kip Boyle: 

You know what I just realized, Glen, we should make absolutely clear that everybody understands that while you may be used to using LinkedIn for professional networking, for connecting with other people that you might want to do business with at some point in the future, there’s a whole jobs function in LinkedIn, and you can get to it by going to the top of the page. If you go to the homepage on LinkedIn, you look up at the center, and right now, as I’m looking at it, there is Home, My Network, and Jobs. There’s a little briefcase icon up there. There’s a whole universe of jobs in there.

Glen Sorenson: 

Yes. I’d like to say they’re limitless, it’s not truly limitless, but there’s more than you can deal with as an individual job seeker.

Kip Boyle: 

Yeah. So you get that title, you plug it in there, and you get a whole bunch of responses back. So now what you’re saying is really go through that stuff, keep a spreadsheet or a notebook, or something so that you can get to understand what are the common job titles? What are the common required skills? Am I following?

Glen Sorenson: 

Absolutely. When you come up with a search, just click on a role, and read through the description. In those descriptions, you’ll start to find themes in the requirements there. Such and such job title requires five years of experience, CISSP, whatever it may be.

Kip Boyle: 

Yeah. I just did a quick search, I’m sitting at my computer right now, and I put in “cybersecurity analyst in the United States,” and it gave me 4,911 results.

Glen Sorenson:

That is more than you have time to go through.

Kip Boyle: 

Just to get an idea. There’s a lot of jobs on here, and then I’m looking at this one job, and it actually identifies for me that, at this one particular job posting at this one particular company, it’s actually showing me that I know one person who works at that company, so what a shortcut that is.

Glen Sorenson:

Yeah. Absolutely.

Wes Shriner: 

Let’s be clear, Kip, that those 4,000 jobs for cybersecurity analyst could be a business analyst, it could be a functional analyst, could be a technical writer, it could be a policy handler. It could be a SOCK analyst or a SIM analyst. It could be a project analyst over in the governance risk and compliance space. It could be a risk analyst. So it could be a SOCKS or a PCI analyst. It could be focused in that area. So even the category of most commonly entry level analyst roles is a broad, broad category, some with more technical, some with more business. Some with a very technical focus, but a very business focus, like a compliance role. So we have, even in that 4,000, a vast differential of what we’re looking at, and that’s…

I’m not painting that picture to make it more difficult, I’m painting that picture to say, as you network, and as you get to know your space, you really do need to know what you’re looking for so you can ask people for help in the right direction.

Glen Sorenson: Absolutely.

Wes Shriner: 

If I go to somebody and ask them, “Can you help me cut this board?”, and they grab an ax, that’s not going to cut the board the way I want cut.

Kip Boyle: 

It won’t be worth much when it’s done.

Wes Shriner: 

Right. So being able to be very specific about how I’m asking for help in my networking role is going to be very important for that.

Glen Sorenson: 

Yes, absolutely.

Kip Boyle: 

Okay. Cool. Let’s get back to Glen, your four steps. Again, just to recap, step one, you’ve chosen your job by title, so you’ve gone on to LinkedIn and you’ve got this whole universe of jobs here. What’s next?

Glen Sorenson: 

These steps all kind of lead into each other, but before we finish with our job titles, keep track of the companies and the employers, organizations there that you might be interested in working for, and write those down too, because that may come to help us later.

The second step ism now that you’ve got an idea of what the requirements ought to be for your job, now you need to see and take an honest look at where you sit now versus what that job is asking for. There’s going to be a gap. Most of these postings in this area are looking for people that don’t exist or barely exist. They’re looking for special people, they’re looking for unicorns.

Kip Boyle: 

Purple unicorns.

Glen Sorenson:

Purple unicorns that leave nice sunshiney rainbow trails behind them.

Kip Boyle:

In other words, it’s a wishlist.

Glen Sorenson:

It is a wishlist. Even if you only meet 50 or 60% of those requirements, don’t discount yourself. It still may very well be worth applying for, especially if you can connect with people down the road, which is where we get into later in the list.

Kip Boyle: 

Or maybe it’s just a practice interview. You only fit half the requirements, but you put your name in the hat anyway. It’s good practice anyway.

Glen Sorenson: 

It’s good practice for you. You will learn skills from that, that will help you forever, potentially.

Wes Shriner: 

In this gap analysis, I’ve got to recommend that we not just look at ourselves and see, am I there, and look at our resume and say, am I 50 or 60% of that wishlist, but let’s also focus our resume into those bullets that we see most common. If there’s something there that we need to highlight better than we are currently in our resume, so that we’re emphasizing the skills they’re looking for, let’s do that. It’s not enough just to be humanly similar, let’s get the paper similar too.

Glen Sorenson: 

Yes, absolutely. And play to your strengths. If you have certain strengths, and those are maybe half the requirements they’re looking for, maybe even just a couple of bullet points in the requirements, play to those strengths in your resume. You can talk about the things you’ve done that make you stand out in that area. And that can be something like even, even working in your home lab, something you’ve built, something you’ve done and posted to GitHub, anything along those lines that you’re great at building relationships with, with people that do different things. Those are all valuable skills. Those are all things that can help set you apart from somebody else that might be applying for this. So play to your strengths.

Kip Boyle: 

But you’re still going to have some gaps.

Glen Sorenson: 

You’re always going to have some gaps.

Kip Boyle: 

Don’t let that put you off because here’s what we know. The data, the research shows that women, as compared to men, are more likely to not apply for a job unless the match appears to be very high, say 70%, 80% of a match between what the job states, the requirements are compared to what they know that they can do. Men, in contrast, tend to apply when the fit isn’t nearly as high, say 50%, something like that. And the reason I bring this up is because I think what the data is telling us is that there’s no practical reason why you should have to skip over applying for a job if you’re only about 70% of a match. Maybe this is a temperament thing, maybe this is less of male versus female, but I just want people to know that if you’re looking for a 70 or 80% match, and you’re not going to apply, I think that you’re taking opportunities off the table for yourself.

Glen Sorenson: 

And I would also just throw out there that sometimes there are postings, there are requirements for a job that aren’t possible to meet. We’ve seen some examples of this lately, where they want four years of experience in a piece of technology that is a year and a half old. So you got to take them with a little bit of a grain of salt there. You’re not going to meet all the requirements. But in the areas that you don’t meet those requirements, look at where you are now, and look at what it might take you to get there. There are plenty of training opportunities. There is a wealth of online training opportunities, Some free, some minimally expensive.

Kip Boyle:

What’s the likelihood that I might get on the job training to close those gaps?

Glen Sorenson:

I feel like that depends a great deal. You’re going to get on-the-job training, whether you like it or not, when you land a job, but you may or may not be able to count on that depending on the company, the team. I’ve seen that go both ways.

Kip Boyle: 

You might want to be prepared to ask that question. Like is there training available when I get there, and if not, can I get my hands dirty? Can I just get in there and do it? Show that passion. Show that you’re motivated.

Glen Sorenson:

Yeah, absolutely. I’ve found that really good hiring managers often are looking for that passion. They can train the skills if you have the drive to learn things yourself and do things yourself. Those types of employees will be very valuable.

Kip Boyle: 

Are we ready to go into the third step, Glen?

Glen Sorenson:

Yeah, and we kind of did a little bit. The third step is really put yourself in the hiring manager’s shoes. How can you be useful immediately? How can you be useful quickly?

Wes Shriner:

And this is my favorite step. I love it.

Glen Sorenson: 

Somebody that shows that passion that we were just talking about, that type of person can be useful immediately. There is some task that you’ve got that you need done as a hiring manager that that person can go do. And even if it takes them a little bit of time to learn, they will go learn it.

Wes Shriner: 

This is the big one, because this is the one that says, how do I convince that hiring manager to swipe right on me? How much time do people put into their Tinder to make sure that they can get the swipe right? Why don’t we put that much time into our LinkedIn profile so we can get that swipe right also?

Glen Sorenson: 

Get the job, yeah. Absolutely.

Kip Boyle: 

We’re in the danger zone now.

Wes Shriner: 

No, this is the perfect space to be, because that’s how we got to think about this. We’re attracting someone who we need to convince that we are trustworthy, and everything we do from here on out is to reduce the risk for them to trust you in that hiring process, and then in that employment experience. Reduce the trust risk, every chance you get.

Glen Sorenson:

Yeah, show your passion. Talk about the certifications that you’ve gone out on and gotten on your own. Talk about what you’ve done in your home lab, talk about how you helped at a conference, or spoke at a conference, contributed open source projects. The options there are literally limitless.

Wes Shriner: 

Tell me about your home lab. Tell me how you’re volunteering to help a community center be more effective, more secure or more something.

Glen Sorenson:

How do you help people in your community with technology?

Wes Shriner: 

Don’t lead with that. That’s just what makes you a whole human being, and that’s what makes you a safe person, the hire, but we’ve got to get to know that hiring manager. How do you find that hiring person that you want to talk to to start this conversation?

Glen Sorenson:

Yeah, so that’s really what brings us back to LinkedIn again. We’ve identified some job titles that we’ve wanted. We’ve hopefully closed some of the gaps that we might have had there. Now we’re looking to connect with people via LinkedIn that might help us get those jobs. When you’re looking at those job titles, and maybe the companies that you would like to work for, those companies all have connections. They all have people that work for them. Sometimes, the hiring managers even post it on the job posting itself, so that makes it fairly easy. But when you start drilling these jobs a little bit, you’ll notice the thing that Kip mentioned earlier, that maybe you have connections that already work for that company. So that’s fantastic. You can reach out to those people that you may know already, and see about getting more information on what that team looks like, who the hiring manager is, an introduction to that hiring manager, or maybe internal referrals. It’s so much easier to be entertained for a job if someone you know can vouch for you with the hiring manager, or with somebody on the team,

Wes Shriner:

Having a trusted advocate really changes the game. It reduces my trust gap that I have to overcome because somebody just came in and gave me a reference. In fact, that could be how I was introduced.

Glen Sorenson: 

Yes, definitely. So let’s say for a second that maybe you don’t know anybody there, but you you find a company, you find a role that you’re interested in at the company. And then LinkedIn has … There’s a People tab, and there’s a Jobs tab, and you can use those to find other people that work in those similar roles at the company. If you’re looking for a security operations analyst job, there will be other people on LinkedIn that work for this company that work on the security operations team. There may be people that have the title of manager of the security operations team, or director. You can reach out to those people. You can look at their profiles, you can find personal things that connect you. Maybe you went to the same school, maybe you’re part of the same group. Maybe you’re part of a professional organization.

You can take those personal details, and now you’ve got something that connects you to that person, and you can reach out to that person on LinkedIn with, “Hey, I see that you’re connected with this person, or you’re a part of this group. I’m interested in a role at this company, do you think you can help me?”

Wes Shriner: 

So Glen, that’s really interesting. What I just heard from you is, let’s use open source intelligence available to us in public squares, whether it’s LinkedIn, or any other public resource repository, let’s apply that information using our social engineering skills to serendipitously appear at the same place at the same time as where they are, and have a magical experience after that.

Glen Sorenson: 

Yeah, kind of. The goal here is really to-

Wes Shriner: 

To, that sounds like a Disney movie, sir.

Glen Sorenson: 

Short Circuit? That’s the goal, but obviously, it doesn’t always work quite that easily. You may not make the connection the first time or two or three, but if you do it enough and get good at it, people will respond to you, and you will make connections. Even if you just get the connection request on LinkedIn and make that connection, even if they, they say, “Well, okay, maybe you’re not quite the right person for this, or maybe that role’s been filled, or it’s no longer available for whatever reason,” you’ve still made a connection. And that connection-

Wes Shriner: 

You’re saying play the long game. Is that, is that going to be pretty valuable to play that long game and build that connection over time?

Glen Sorenson: 

Absolutely. You never know what sort of opportunity might come up later just via having made that connection. “Hey, remember that conversation I had with you on this front five years ago?” Sure. There’s a barrier that’s been removed. Now you have a connection to this person, and maybe they’re hiring in the future. Maybe you’re hiring them in the future.

Kip Boyle: 

Oh, that happens.

Wes Shriner: 

Help us out here, Glen, because I could be really shy. I could be a very shy individual. Who’s afraid to reach out to people. I don’t know very well, much like myself. Help me out here, Glen, what do I say in that text message? I think you get 200 characters or something in that LinkedIn invitation to say why you might be interested in connecting with me. What’s the pickup line there? How do I get them to swipe right?

Glen Sorenson:

I always do this individually every time, I don’t have a copy and paste template or anything, but there are always details. There are always things that you can pick out. Maybe their profile picture has a Seattle Seahawks Jersey in it. Then you can talk to them about that. You can create that connection, that way that you have, what you know about the Seattle Seahawks and what they know. Talk about the game that may have that may have happened recently. There are so many details like that that you can pick out, and lead into a conversation that way.

Wes Shriner: 

Is there an example you can think of, maybe walk us through what an example might be?

Glen Sorenson: 

I’m not sure I have a great specific example, but let’s say for a second that a person has contributed to an open-source project, or has some GitHub source code out there. Let’s say you go look at that, and play with it a little bit, get to understand it a little bit. Then maybe you can reach out to them about that and say, “Hey, so I saw this, I looked at it, I checked it out. I think it looks great. Or have you thought about this,” especially if you can give them something another direction to go with it, or some ideas to spark conversation there. There’s so many things like that that you can do.

Wes Shriner: 

So engaging them on a personal project they already have sounds like a really good way to do that.

Glen Sorenson: 

Yeah. They wouldn’t be, they wouldn’t be contributing to an open-source project if they weren’t passionate about it and want to talk about it.

Kip Boyle: 

You could even help. You could even volunteer. If you go and check out their open source project and see their documentation’s not very good, you could put together a piece of documentation in a space where there’s an obvious gap, and then just offer it to them. Here you go. One way that I made a connection, one time I was tuning into a webcast. There was a guy that was speaking on a topic that was super interesting to me. And during the opening minutes, he made a remark. He said, “God, I really wish I was recording this. I’d love to have a record of it, but I just didn’t do that.” A comment to that effect.

Well, I was on my computer, so I just started recording what was on my screen using the tools that were built into my computer. And then when it was all over with, I shipped it off to a transcription service, and I paid 20 bucks or something like that for it. And then I got it back, and I sent it over to him, and I said, “Here, I was at your presentation the other day, and I just happened to be able to get my recording going, and I made you this transcript. I hope it helps.” And it created a huge positive interaction between us. It was a little thing that I could do that I was perfectly set up to do, took very little effort, but I knew that he valued it. That’s my story about something that you can do.

Wes Shriner: 

Maybe there’s a white paper that you’ve contributed to, and maybe you send that over and say, “Hey, I’ve been working on this white paper, and I’m really interested in your company, and I thought this might be an interesting way to introduce myself.” That might be possible. Another one. If I know a guy named Joe, and you know a guy named Joe, and LinkedIn tells me we both know a guy named Joe, then I can reach out to Joe and say, “Hey Joe, should I talk to that hiring manager?” And Joe will say, “Yeah, you should talk to him.” And at that point, I’ve got an introduction from Joe, whether Joe sends the email saying, “Hey, I’d like you to meet my friend Wes,” or I can send an email and say, “Joe recommended I talk with you. I’m looking for a role in your industry, in your space, and I’d love it if you had some recommendations or ideas for me.” We’re not asking for the job at this point, we’re asking for recommendations or ideas or referrals or connections, something like that.

Glen Sorenson:

You’re building the connection. You’re building connections with people as people. The goal of this is really to circumvent the hiring process, and not have to go through the same pool of people that everyone else has to do in order to to get in front of this hiring manager. I can’t place emphasis enough on the people connection there,. The people will help you get the job much more than the system or the automation, or what you can write on a piece of paper.

Wes Shriner: 

And it could be as easy an introduction as, “Hey, are you going to go to the ISSA meeting tonight, or this week? I’m asking because I’d like to meet up with you for a couple minutes if you’re going to be there.” Pretty casual way to get a LinkedIn connection and schedule a three minute “If they’re going to be there, look for you” connection.

Glen Sorenson: 

And LinkedIn is great about showing those, those organizations that you may be part of, or that that person may be part of, and that you can go be a part of too..

Wes Shriner:

Just for the record, we are not sponsored by Microsoft or LinkedIn. It’s just a powerful tool we’re using in the process.

Kip Boyle: 

Exactly. So we’re coming to the end of our episode. So Glen, you said you had four steps. I know we’ve talked over three, I think we’ve bled into the fourth one, right?

Glen Sorenson: 

We’ve bled in the fourth one, and the fourth one is really identify the hiring managers, the team members.

Wes Shriner:

And cultivate that relationship. Once you’ve done the introduction, now you’ve got to pivot and build that relationship, and you’ve got to actually go from “Hi, my name is” to reducing that trust gap so that it’s safe to bring you in.

Glen Sorenson: 

Exactly, and play the long game with this. There may not be a short term game, but you never know what your connections can bring down the road. Opportunities will fall into your lap, will fall out of the sky in the future-

Kip Boyle: 

It’s magic.

Glen Sorenson:

If you cultivate enough of these relationships over time.

Wes Shriner: 

And to be clear, it’s not about collecting business cards. It’s about doing favors for others. It’s about helping people get where they want to go, and they remember you in such a way that when they can tell you are looking, they can help you because they want to help you.

Glen Sorenson:

Making genuine human connections.

Kip Boyle: 

Excellent. Four steps, ladies and gentlemen, four steps. Thank you, Glen, so much for being our guest today, walking us through that, helping us understand LinkedIn is not just this sterile place to have interactions with people. It’s actually a really fertile ecosystem where you can actually do job hunting, and play the long game, and build those connections. And I wasn’t joking when I said that somebody that you might be seeking a job from today might actually be coming to you and seeking a job from you in the future. That has happened to me. So I’ve absolutely seen that to be the case. Well, ladies and gentlemen, if you liked our podcast, then I’ve got something here that you should consider doing. We’ve created a free guide, and you can get your hands on it. It’s called Play to Win: Getting your Dream Cybersecurity Job. And so what we did is we sat down and we asked ourselves, “How can we create something that’d be super helpful for listeners of the podcast?”

And so we put our heads together, and we realized that getting a job is sometimes very similar to playing capture the flag, which information security people do these days. It’s an electronic game that you can use to sharpen your skills. Of course, when I was a kid, we actually played it in the woods and the dirt and stuff, and it was an actual flag. But anyway, play capture the flag and get a job. So it’s a really helpful guide. I think of it as a field manual, actually, because it contains lot of the stuff that Glen was talking about today with screenshot and steps that you can take, and sample messages that you can send. I think you ought go get it, check it out, and here’s what you do. You go to yourcyberpath.com/pdf, as in the format of the file that it’s going to be in, and let us know what you think. If it could be better, I’d love to hear how it could be better. So until next time, I want you to remember that you’re just one path away from your dream cybersecurity job. See you later.