Cyber Security Job Hunting with Owanate Bestman

Welcome to the Test Guild Security Podcast where we all get together to learn more about security testing with your host, Joe Calantonio.

Hey, it's Joe. And welcome to another episode of the Test Guild Security Podcast. Today we'll be talking with Owenati all about cybersecurity, job hunting and other tips for your career. Oyanati is the founder of Bessman Solutions that he started, I think this year with a search and selection firm dedicated to meeting the demands for cybersecurity skills. He spent almost a decade recruiting in the cybersecurity field and he's firmly embedded in the cybersecurity space, possessing a strong network of exceptional technical and non technical security practitioners who have assisted leaders in meeting their business objectives. If you want to know what employees are looking for in these uncertain times, you don't want to miss this episode. Check it out.

It's no secret that the number and complexity of applications are growing, but what is alarming is that 90% of security incidents result from exploits against defects in software. The need for better application security has never been higher and Micro Focus Fortify is here to help. Fortify is the recognized market leader in application security and it is the most comprehensive and scalable application security solution and that works with your current development tools and processes. With Fortify, you could start security applications in a single day, including custom code, open source or commercial components and scale as your needs grow with an on premise as a service or hybrid implementation. Check them out. Head on over to micro focus.com app security hey o Inani, welcome to the show.

Hey, thanks for having me.

Awesome. Great to have you. And I'll be honest, this is the first time actually having a recruiter on any of my podcasts and us it might have like a negative connotation. So I'm just curious to know like what is the life of a recruiter? Sometimes people think they just try to get them into jobs and then it's done, but it feels like you have more of a personal hands on approach than that.

Yeah, listen, I'll tell you something, it's not. The connotation doesn't only lie in the us. There's a little bit of a stigma attached to my role as a recruiter, but the further you climb up in the food chain, the more you add value and it can be seen as a pushy sales role. But as you get on, no one likes to be sold to, so it becomes more of a consultative role. But I'll tell you something, the stigma is strong and it's not just in.

The U.S. how do you overcome that stigma? This sounds like you do. More like you try to match the right person with the right job. You're not just trying to get a cut of whatever you get for getting that referral. Is that how it works?

Yes, that's how it works. I think, I mean how you get over that is you specialize within a certain area. I think the. I wouldn't advise recruiters to try and place any and everything because you can't then be a specialist. You can't try and place a first line support person. Then the next role you're working as a project manager. Then the next role is a Java developer. You burn bridges because you're learning and as you learn, you make mistakes. So if you're going to make mistakes, make them early, make them swift and make them within one particular area. Now how you overcome that is you don't give the hard sell, you just build relationships. And you need to be a people person. I won't say it's so much of a secret, but you don't need to do that much to stand out as a good recruiter. It's a case of knowing your subject matter, realize that you're dealing with people, not products. Get back to them. When you say you going to get back to them and sounds a bit of a cliche but just be straightforward and honest with it. If I don't have anything for you, buddy, I don't have anything for you. But tell you what we can do, we can try approach disorganizations and so forth. So. And people respect you more because you're. And the security. Just digress a little bit. Security is very incestuous and what I find is that it's initially hard to get people's trust. A lot of the security practitioners. Practitioners start with the glass half empty. So you need to earn the trust and once you've got the trust then it's cool, it's okay. And then they tell their people and you just spread organically from there and it's free doing it that way rather than paying for expensive advertisements.

Very nice. So you said it's good to have the recruiter that actually specializes in an area. So why cybersecurity for your specialty then?

Oh right. Well, number one, I fell into recruitment and any recruiter, at least on this side of the pond that says that they started recruitment consciously. I purposefully. I highly doubt that. So I fell into security and I started placing it first to third line support. Then I moved into operational risk at another organization and that blends nicely with security. I'm fortunate enough to have started my career in recruiting security before it was such a big thing when security was just seen as a blocker to the business. So I didn't have that much competition. So I wouldn't say that I chose security by design. I kind of fell into that as well. But once I got the taste for it, I wasn't going anywhere because it's a difficult area to break into. But once you're there, you've gone so far into the river that there's no turning back. You're in it for the long haul.

Awesome. Yeah, it sounds like it was a good choice because when I look at things like the US has something called a job outlook for different professions and one of them is cybersecurity professional. And I think they said the demand in this area for that type of role is going to be higher than average from 2018 to 2030. So why do you think there's such a demand now? Has there always been a demand for security and that's how you actually said, oh yeah, this is probably an area I definitely want to focus in on.

I wasn't aware of the demand at the time. When I got into it a few years afterwards, I kept on hearing this figure being banded out, 4 million. And the figure was that there will be 4 million unfilled positions in security by 2022. So I mean, I started when I started doing more research and becoming associated with more associations within security, I realized that there really was a skills gap. Now it's a skills gap. And whether that skills gap is translated into actual positions is something else. So what I found still was that even though it's an area that's high sought after and hiring managers want a lot of talent within there, they still want the best talent. And it's still tough to place people. So it's not a walk in the park by any means. So I wasn't aware that it would be such a. I won't call it lucrative, but reputationally lucrative path. I wasn't aware of that.

Gotcha. And so I'm curious to know also if things have changed. I think I watched a presentation of you in 2019. It's only a year ago, but it seems like a lifetime since everything we've been going through.

You're telling me.

Yeah.

And I think you said that it was a candidate driven market back then and that candidates could choose between three to four opportunities. Is that still the case this year? Especially with COVID 19 on the whole.

No, it's what we're finding is that there are more candidates on the markets fighting for fewer positions. But let's not forget that security is vast, security is broad. We have the non technical areas, the grc, governance, risk and compliance, even data protection that falls under security Business continuity that also falls under security policy assurance and right the way through to the technical side of things. From pen testing to security architecture, there are certain areas that do have a strong skill shortage and candidates can take their pick over where they go. Part of this or key area is DevSecOps and the need to promote more secure applications at a swifter pace. So there's a real skills gap here with organizations wanting to marry up the release of swift applications with secure applications and security practitioners who understand the language of the coders and to create a more adhesive culture as well as being able to roll out a secure application as swiftly as possible. That's a big skills gap and that's certainly an area that will grow. I mean the last record I checked was, I think it was an IBM study that there are 111 billion lines of code written every year. I think you'll know more than me and I'll be in every coder you speak to. I don't think you'll find one that say that the says that he or she is going to write less code this year. It's just constantly increasing. So with that increase comes more vulnerabilities and security is primed for that. But on the whole it's a buyer's market out there and a lot of hiring managers and firms can call the shots in terms of what they're looking for and more importantly what they pay as well because of COVID But this should not last forever. We are seeing some improvements.

Interesting. I think also in the same presentation you mentioned that the security positions were harder to fill remotely for some reason because people want everyone on site where obviously that's not the case. Can't be the case during the COVID 19. So do you think there's going to be a shift where security positions would be more accessible through remote positions or would it still be require someone to be on site?

No, most definitely. I think in terms of the mandates I'm working on now and the mandates I've been prompted to work on in the future unless there's a man managerial and by man I don't mean gender man or female managerial aspect of it, unless you're managing a team, then there is a very relaxed approach in regards to where you are Based now, the more technical you are, the more relaxed the approach is. And even pre Covid, I mean, most pen testers were working from home anyway. If you do get a pen tester for a contract position, one of the stipulations was, hey, I'm home based. It's a client cool with that. And they are becoming more cool with that over. Over several. Over a number of different areas within security. So, yes, we are expecting more flexibility and I'm seeing more flexibility as to where individuals are based. And it actually opens things up as well and actually works quite well for a diversity of reasons as well. Not to digress too much, but you have single parents with certain childcare responsibilities that can't travel halfway around the country to work and job with their dreams. But now at least there's an opportunity to do that.

Absolutely. And you know, you did mention there is a skill gap. There are some skill shortages, one of them being DevSecOps. So it seems like now where it was like a candidate can make and call the shots, it's like the employers are now being able to call a shot. So what could set someone up apart from other candidates in an employer's eyes in this times? Like any other skills besides DevSecOps or is there any certifications you think of really hot that a security professional could have to help their chances of getting hired?

Yeah, in terms of certifications, I'll start off with that first. I think sometimes firms can be a little bit OCD about certifications. Years ago, when you saw a job specification, all they listed was security certifications necessary. Now they meant anything. They meant cism, cissp, cisa, ceh. But now we're seeing firms being a lot more prescriptive with qualifications and certifications they're looking for. But I don't want to put certifications on a pedestal here because let's face it, and I don't mean to make any enemies by saying this, but it's a very lucrative industry. What certifications prove, from my conversations with hiring managers and from the people I've placed, is that it evidences that you have working experience of that particular field. Now, many people would pay for certifications and not have the adequate work experience and just assume that they're going to land that position. 9 out of 10. It doesn't really work that way. It's a case of getting the work experience first, which can be, you know, a lot harder, a lot harder than it sounds. Even if you put your hand up at your existing firm and get involved with project, even On a more voluntary basis, that will bridge the gap between where you are now and, and where you want to go that's more likely to land you that position. And the certification is just an icing on the cake. And it is the ability to demonstrate to the hiring manager that you can back up your experience with sound methodology around that.

How do you stand apart now from all these other candidates? Since it seems like the job market is a little heating up more for candidates or for employers, standing apart is.

Somewhat challenging because for every application you put into a position, it's extremely competitive at the moment in terms of who you are up against. Even individuals with more experience looking to take less money because of the current climate. And by standing apart, you need to promote yourself and you need to be a salesperson. That starts in your public profile, starts in your LinkedIn profile, and that also starts in your CV as well. The 63 million decision makers on LinkedIn. But yet, when I look at some LinkedIn profiles of security practitioners, they, number one, don't sell themselves. And sometimes it's hard to tell specifically what they do within security. Now, I say that because 77% of recruiters use LinkedIn globally. Now, I'm not too sure what the other 23% are doing, be frank with you. But by raising your profile and putting a good effort into your LinkedIn profile, as well as looking for positions, instead of going to the Martin, you also let the Martin come to Mohamed. Now, there are recruiters that not just myself who works for an external headhunter, there are people that work internally as recruiters for an organization whose main role is to find people for their position. How are they going to find them? They're going to find them doing a keyword search. So it's sometimes going back to basics. When you apply to positions, you must spell out security over and over again. You must spoon feed the first person viewing your CV your LinkedIn profile. Without giving too much away. You don't necessarily need to give out any confidential tooling, but you must be able to sell your skill set and specifically what you do within security, either what you do or what you want to do. And you can tailor your profile to what you want to do. I'll tell you something that surprised me, that a lot of people didn't know this. When you apply for a position, the first person to look at your CV have the assumption that they don't know security, because the first person to look at your CV is not the decision maker at all. Often the decision maker will review your CV at The latter stages, the second stage, the third stage of the assignment. Now, if you're dealing with someone that doesn't know what security is, what they're going to be doing is they're going to be looking out for security, Security, security. If security is not in your cv, if it's, let's just say it's pen testing, or you just abbreviate and use soc, or you use SIEM all the time, there's a strong likelihood that your CV will be relegated down the list, even though you have this suitable skill set. So it's almost a case of stepping back and thinking in a more simplistic manner. On top of that, there are algorithms that will decipher whether your CV is shortlisted or whether your CV is rejected. And if these algorithms aren't programmed correctly by the first line, and by that I mean Those viewing your CVs, then if you use too many abbreviations, then your CV could just get lost, whereas you very well could be suitable for that position. So it's good to go back to basics and realize some of those fundamentals.

I'm glad you addressed that. One of my questions that I had was how do most HR folks know what they're looking for in a security professional? It sounds like most of them don't. So besides security, I know you don't want people just stuffing their resume with random keywords, but are there any, like, essential keywords every security professional should have? Besides spelling it out? Like, what are some examples of other keywords?

Yeah, all right, yeah. One of the good thing is to go straight to the qualifications instead of, I mean, obviously you need to be quite experienced for this, but instead of cisp, spell it out. Certified Information Security System Security Practitioner. Then put sysp in brackets. Teh, instead of putting that spell out, put Security qualifications and then hyphen Certified Ethical Hacker, the same as CompTIA. If you've got CompTIA, which is Security plus, which is a really good entry level qualification by the way, I strongly, highly recommend that spell that out. If you're just starting off in the field and you have degree in information systems and your dissertation was on something to do with security, spell that out. If even to the point of physical security, you need to spell that out. But also there's something called, and I revert back to the phrase spoon feeding. Moving the LinkedIn profile aside, I want to let the listeners know something. There's nothing wrong with having three or four different versions of your cv. Nothing wrong with that at all. Let's just say you're experienced and you apply for a position that's more project orientated and you've been, you've led the number of projects to do with implementation of a new tool. You can have a PM orientated cv. Let's just say you also manage a team. You can have more managerial related CV per cv. It must tie in with the job specs you are actually applying for the position you are applying to and look at the first few bullet points of what they're looking for and your CV ideally should reflect this. So once again you're either spoon feeding the person that doesn't know that much about security, or you're spoon feeding the algorithm and letting them know exactly what they're looking for. So everything on a reactive basis is within the job spec on a proactive basis it must be a happy medium within your LinkedIn profile. So security vulnerabilities, threats, mitigation, spelling out your certification, even within your interest, you know, follower of this security association or that security association there has to be spoon fed to, you know, assume you're speaking to a child and it sounds a little strange because if you're in security, let's face it, you're pretty smart or at least smarter than me. But you need to dumb down what you've done because the person looking at, and I don't mean to patronize anyone here, I'm sure there are a few exceptions to the rule, but in many situations the person looking at your CV on the first instant is not a security expert and may not be working on the security role next that in mind.

So I don't know, does this technique overboard then? If someone really wants a position, they would look at the job requirements and just create a unique CV or resume specifically for that position rather than having like broad four of them. Maybe is it overboard to have one tailored specifically in the words that the employer that they want to work for is using?

Yes. The reason I say that is not because it would look like subterfuge or anything, but because it's a lot of time and effort.

Right.

And we are seeing one position released and up to 200 applicants applying for that position in the first 48 hours. And that is not an exaggeration. So I wouldn't in good faith advise that. I think I have some. A few threats by my email say that, you know, I've just wasted 10 years of the life. But what will eventually happen is if you start off within that vein, you can have about four, maybe five different versions of your CV and then you will turn them out per their assignments. But I will add a disclaimer in this and that is your LinkedIn profile must be a happy medium. And that takes a little bit of skill because you don't want to look like you're. I'm not advocating anyone lying this CV at all, but if most experienced practitioners put everything they've done in their career within their cv, you'll be looking at, oh, as you Americans say, resume. So I'll stick to that. Sorry. Right guys, CV is not curriculum vitae, it's resumes.

So if you were to list everything you've done in your resume, that resume would be 15, 17 pages long and no one would read it. So be selective based on the positions you are applying to and it's going to get to a point you're going to have resume 1, 2, 3, 4 and 5. You see this position arts, managing a team must have technical knowledge of this tool. Boom. CV4 is perfect for that. And your LinkedIn profile and all other social medias must be a happy medium.

Very cool. So besides technical skills, are there any like common skills, I guess particularly in security that people look for, you know, teamwork I guess is just a buzzword everyone throws in. But is there anything like kind of niche within security that's more of a soft skill that a lot of teams seem to be looking for?

Yes, this is, this is niche but it's often cliched and I've heard it for a number of years and I keep hearing it. And that is the ability to relay technical aspects to a non technical audience. And that is from mid level positions all the way through to seesaw positions. And it makes sense because if you were in front of the business or if you're a Cecil and you're in front of the board, you know, they don't care how many, you know, false positives you found in this month's metrics. What they care about is what does this mean for the organization? You know, how this affects our risk appetite? Does it mean are we going to get fined? You know, have we been breached? How does that affect our bottom line? How does it affect the shareholders? So an appreciation for business as well and also an appreciation that security works for the business and it is in line with their risk appetite. So that's a soft skill that has not gone away and it's pretty transient from mid to senior level. Every now and again if I speak to a hiring manager about maybe junior ish position, they might bring that up, but it's not really the end all and be all things, such as an inquisitive mindset. I think that's absolutely crucial not to accept things as they are. Those seem to be the key things. Yes, we hear of team player as well. That's also important. Yeah, I think that's how I would summarize it.

Nice. So I guess another question I have, this probably hurts for a recruiter is I know the last time I got a position based on my resume, it's always been I knew someone and they go to my website and then they contact me. So with 200 people applying to the same position with the CV or a resume, is there anything else they could do to stand out? Is it best to have someone within that company that they could reach out to or any other hacks like that that they could use to help elevate themselves?

Yep, you're absolutely right. And you know, and a lot of these positions where you'd have 200 people apply in the first couple of days, it's often not from a recruiter. It's often from the internal recruitment team. And yes, it does kind of hurt. However.

Who do you know within that organization? You know, often you knew the predecessor in that organization.

Saying this, remember? Are you familiar with the phrase six shades of Kevin Bacon?

Yes, yes, yes. Yep, yep.

Yeah. Well, I feel like it's two shades of security.

It really is because it's so incestuous. So there's anyone you know within that organization reach out to them so that they can put a good word for you. And the thing is, let me tell you something. And I. Last week I got. I received a call from, well, she's not Chief Information Security Officer, but she may as well be in regards to the level she's at. She said to me, yeah, we're recruiting for this position. I'm not allowed to use recruiters, otherwise I would have used you. We've had 200 applicants, over 200 applicants, and this position has been out three days. We've got one internal recruiter guy because we let go of the rest. We don't know what to do, how we're going to, you know, how we're going to manage this. I said, well, you know, 200, how are you going to shift through that? I said, I tell you what, I worked on a similar position recently, which is true. And let me. I'll send you some profiles. These guys are good, you know, I know you can't use me within them. So sent her the profiles. I know at least one of them got an interview I'm not getting anything for it. But the fact that someone close to her was able to get into her ear and said, look, this is the kind of individual you want to be going for, you know, any sort of connection. So it doesn't need to be someone that's worked there. And that's a beautiful thing about LinkedIn as well. I don't know any other network that can give you that sort of exposure to who you're connected with and who he or she is connected with at all. I think you need to be a little bit brave. You need to get out of your comfort zone and you need to ask the questions as well. If you see that position and you've seen how many applicants are applied. Well, nothing wrong with picking up the phone to the hiring manager or sending an email to the hiring manager or hr, whoever's listed, pick up the phone to them, send them a message. These are all little things that help you stand apart. And I'm assuming that it may very well be out of your comfort zone because those kind of behaviors are usually associated with salespeople, people that can. Yeah, people that can sell themselves and, you know, it's not in everyone's nature, but it pays a lot to get out of your comfort zone because you immediately stand yourself apart from the competition. Because you could tailor your CV all you want, but if you're 146 out of 200 applicants and they just looked at the first 50, well, it's much ado about nothing.

So I guess that's one of the benefits of using a really good recruiter like yourself, like, oh, this is Owenati certified person, so we'll bump them up in the queue. Is that one of the reasons or benefits of using a recruiter as well?

Yes, but it all depends on the organization as well. For my want and my advice and everything I'm willing to give, even before I earn any sort of fee, a lot of the times I don't know. We got a phrase in the uk, I don't know whether the US have it. It's computer says no. And that phrase is. Epitomizes. Epitomizes the fact that processes can get in the way of common sense. So it could be a case of, no, we're not using any recruiters for this or you're not on our preferred suppliers list. So we're just dealing directly with it all this time they could just look at the first 50 people and just do a word search and interview individuals that are not suitable. In the meantime, leave suitable applicants hanging out, whereas a recruiter such as myself can come in and say, look, all right, gone to the market with this, you're looking for someone to with these particular skill set? Well, I've shortlisted these five profiles for a number of reasons, one of them being that they come from a similar organizational size so they can roll the sleeves up or they're not siloed off within one particular skill set. I've got reservations about this one for this reason. However, this one's a shot and you can really add color and real commentary to it and it's left on the organizations to open their minds to that. Let me know if I'm going off on a rant here, but it amazes me how organizations will sing from the rooftops about we do things differently and you know, we want a diverse workforce, we like to think outside the box, but they still follow the same stringent, archaic processes many organizations do. And that's to the detriment of the talent pool. They're getting into their organization to not only secure their systems, peoples and assets, but also to be an ambassador for their organization as well. So it's just one of the ongoing battles of a recruiter.

Okay, Wainani, before we go, is there one piece of actionable advice you can give to someone to help them with their security, career or job finding efforts? And what's the best way to find contact you or learn about Bestman solutions?

Sure. The main piece of advice I'd give is get out of your comfort zone and network. The more you network, the more individuals you'll meet, the more knowledge you will have about the organization's unique challenges they are facing in terms of finding me. If you go to bestmansolutions.com and also on LinkedIn Owenati Bestman at LinkedIn, I'm very approachable and happy to answer any questions. One thing I will add as well is that we were talking about certifications. Last month I compiled A list of 10 free training courses and security and the free so instead of necessarily investing into a certification you're not sure you want to do because there's, you know, there's time and more importantly, financial implications associated, feel free to check that out as well. So it's got cryptography and some of the basics, pen testing as well, AWS fundamentals. So these are all free and it just gives you a chance to test it before you spend money on it. And that's, you know, I don't run courses myself, but those are some free ones for you. So it's of no benefit to me.

Thank you for your security recruitment awesomeness, the links to everything and value we covered in this episode. Head on over to test guild.com.

And while you're there, make sure to click on the Try It Today link under the Exclusive Sponsor section to learn all about Micro Focus Fortify, which is the recognized market leader in application security. So that's it for this episode of the Test Guild Security Podcast. I'm Joe. My mission is to help you succeed with creating end to end full stack security testing awesomeness. As always, test everything and keep the good. Cheers.

Thanks for listening to the Test Guild Security Podcast. Head on over to testguild. Com for full show notes, amazing blog articles, and online testing conferences. Don't forget to subscribe to the Guild to continue your testing journey.