MyDFIR

I’ve had the privilege of being on some interview panels for SOC analyst roles in the last few months, and maybe at some point I’ll do a longer thread on it, but some quick unsolicited advice for whatever it’s worth - Please don’t just tell me names of tools, we all know the usual Impacket, Metasploit etc, I’m more interested in how you investigate their usage - Please polish up your resume, even if it’s small, bullet points should align, consistent font etc - If you’ve done something in a lab, I want to hear every juicy & nerdy detail - If your resume has “advanced”, “expert” or “mastery” type language in it, please be ready to speak to matters at this level - Please do not put “kali” on your resume, if you really want, tell me about how you’ve used kali instead - Try to be as specific as possible, with examples - “scripting”, “Linux”, “cloud” are too broad of categories to put on your resume - In the same vain, if “Active Directory” is on your resume, be prepared to speak to basic AD attacks, event IDs etc - don’t need to know every little nugget, but should know the basics at the very least - Every interview is different, but when asked an open-ended question, think of this as “your time to shine”, no wrong answers here, just looking for folks who are engaged, on the ball, able to pull thoughts together - An interview is a two way street, I love being asked good questions, it demonstrates that you’re engaged and generally give a shit 💙