Lesley Carhart 

I guess I haven’t clearly articulated this in writing, but friends do not let friends without substantive IT work experience and/or a credible IT degree take cybersecurity career bootcamps in 2025.

They are up to no good. Shenanigans. Malfeasance. They are not a safe way to get a job.

Oct 8 at 3:25amWeb
Show threadLesley Carhart Oct 8
There are certainly good -courses- that can supplement a strong IT foundation and existing experience and credentials. Especially on targeted topics. But if it sounds too good to be true it is. You’re not landing a SOC job on a 6 month bootcamp, these days.
Show threadLesley Carhart Oct 8

People salty that I am gatekeeping - I am literally trying to keep them out of paying a bunch of money to skeevy organizations who will not help them land a job at all in the collapsing cybersecurity job market.

Get a degree in CS or computer/network engineering. Pick a general niche in cybersecurity, preferably less popular. Get your basic IT certs. Get a generalist IT support role. Get your second-tier certs. Network with people like hell for a couple years. Keep up your self-study. Participate in the community. Get somewhat lucky.

If you can't get the degree, then everything is the same but a lot more of the general IT work and all the other stuff to make a lateral career move later. The military is a possibility if that's your thing.

Show threadMartin Boller     Oct 8

@hacks4pancakes You, more than most, are welcoming everyone and actively helping people to break into cyber, so f... the detractors.
Bootcamps very often aren't conducive to learning anyways as many (not all) are not really using spaced repetition (due to time constraints etc) and while it is on the people participating to ensure continual learning it is hard if not applied in reality almost immediately after said bootcamp.
It would be awesome if corps accepted the need for juniors and accepted that as required for business continuity so we could all have one at work and make ourselves redundant eventually.

... Oh and for those wondering wtf he's ranting about, start by installing Anki (or similar) for your own learning :)

Show threadAdvanced Persistent TeapotOct 8
@hacks4pancakes omg who is saying this? if I was pressed to name the least gatekeeping-y person in infosec you would be at the front of the pack
Show threadLesley Carhart Oct 8
@http_error_418 when you say something like this there is always those people who are like, "back in my day I got into infosec with my bootstraps and a nintendo game" and its totally not reflective of the market right now.
Show threadChris Farris Oct 8

@hacks4pancakes @http_error_418

Back in my day, I got into security from a whistle I found in my cereal box. I don't see why kids these days are complaining. Probably the avocado toast.

(Narrator: I'm not _that_ old, but my path was about as relevant as Draper's to today's infosec).

Show threadIrishMASMSOct 8

@jcfarris @hacks4pancakes @http_error_418 you know draper had multiple sexual harassment allegations?

Ask about the jumping jacks in his room

There were folks assigned at hope to keep him out of trouble

Not sure that is the reference that would be prudent to make, sadly

Show threadMisuse CaseOct 8
@hacks4pancakes @http_error_418 Why are people like this. Infosec was much easier to get into 15-20 years ago and anyone paying attention can see things are very different now.
Show threadSteveOct 8
@hacks4pancakes @http_error_418 I always put it that people pulled themselves up by their bootstraps then slammed the door behind them
Show threadAmoshiasOct 8
@hacks4pancakes @http_error_418 back in my day, I got a CISSP on a lark because my company paid for the tests and I am very good at taking tests. Even back in the day, even as an experienced sysadmin, nobody ever took me seriously for an infosec job because it was obvious I had no actual experience.
Show threadLeighC2Oct 8
@hacks4pancakes in Australia, a relevant TAFE course will also help. They’re free too.
Show threadDavid Chisnall (*Now with 50% more sarcasm!*)Oct 8
@hacks4pancakes I guess you blocked those people, since I can't see their posts but accusing you of gatekeeping requires a pretty special mindset. Like the Teapot, I can't think of anyone who has given up more of their own time and effort to welcome people into the field. If that's what gatekeeping looks like, then I hope to see a lot more of it across more areas!
Show threadJustin KnoxOct 8

@hacks4pancakes this isn’t gatekeeping at all. Bootcamps seem to be everywhere, harkening back to the dot-bomb era. They want to turn a buck, not turn out solid analysts or engineers.

Your words here echo some of the best career advice I ever received-

“Excel at the things other people don’t want to do.”

That one-liner took a bit for me to process when it was delivered. However, internalizing it has been a fantastic motivator.

Show threadThat Anonymous CowardOct 8

@hacks4pancakes

*blinks slowly*

Yes the person in the field, who does cons, helps people out, helps them work on being a better candidate who isn't asking for a single fscking dollar, is TOTALLY the person trying to keep people out of the field by telling them to not waste money on something that won't help them move forward like the people who want your money tell you it will.

Got a better plan, then fscking share it, but don't be that piece of crap who poopoo's the attempt to actually help people get the things they need to get to where they want to be but can offer nothing but bad vibes and being a bitch to the person actively trying to help.

Hi Lesley *waves*

Life lesson for those trying to break in...
I learned it from this dude on TV...

'Look for the helpers.'

Who is trying to help you?
Who is encouraging you?
Who is trying to save you from wasting time on something that won't help you?

Lesley is a damn fine helper (puts up with me babbling, so I am totes biased).

The world has been changing from what was & lets be honest a bunch of people think AI will fix everything & run perfectly... *bursts out laughing* so build your skills, get your certs, get to know people, help without expectations... and when the industry regains its mind, you'll be ready to deliver what they need & several companies will be offering you the rose to pick them...

(no i don;t know where the reality tv thing came from, don't question it just roll with it, I'm crazy afterall.)

Show threadwuestOct 8
@hacks4pancakes people have GOTTA learn to differentiate between describing something and cheerleading for it
Show threadGreg BellOct 8
@hacks4pancakes more like gate...warning? Gate advising?
Show threadMichael WeissOct 8

@hacks4pancakes you're doing the right thing here. And when you do the right thing in a big, visible way there will always be people telling you that you're doing the wrong thing.

Sometimes they'll be right, so it's always good to check in every now and then to be sure. But as someone who has been hiring security people for a long time, I agree with your position. They don't turn people into the sort I want to hire.

Show thread🦄Cyber Unicorn🦄Oct 8
@hacks4pancakes many people end up with unrealistic expectations because of these places telling them they'll find a job and the cyber security industry has many open vacancies.
The other thing I find is that people have very skewed perceptions of what people in cyber security roles do. There has been many times when I talk to people wanting to get into cyber security and when asked why it's because they believe they'll avoid some part of their current job they find tedious. I tend to usually disappoint them when I tell them that this tedious part is exactly what they'll be doing a lot of.
*This is all based on blue team roles as that's what I'm in.
Show threadFaraiweOct 9

@hacks4pancakes a hard lesson to learn is to not put too much effort in saving idiots from the consequences of their ill informed, ill thought and ill conceived actions.

Some people seem to only learn from pain, IF they do, at all.

I recall a professor mentioning there are three types of people:
- the Smart, who suffer once and say "not gonna do that again!"
- the Wise, who see the Smart suffer once and say "Well, *I* ain't gonna do THAT"
- and those who are perennial examples of suffering.

Show threadDROP\ TABLE Hacker of EarthseaOct 8
@hacks4pancakes you are so brave, people hate me talking about the truth lol
Show threadJohn LuskOct 8

@hacks4pancakes

Are *any* "boot camps" legit these days?

Show threadLesley Carhart Oct 8
@tarheel I cannot speak to other fields.
Show threadlitOct 8
@hacks4pancakes @dymaxion this. We get swamped with these applications whenever we open up a SOC role. By now I don’t even see them anymore, as we asked HR to filter out anyone without reasonable foundations. Somethingsomething 6 mo security is not very helpful, if one has little to no understanding of the systems used in the environment to be monitored. Even with SOC being a near-ideal blue team entry environment, with the SOC being the garbage collector of any large IT ops.
Show threadBiggles 20X6!Oct 8

@hacks4pancakes this week i found out that our local cyber security uni DEGREES do not teach SQLi, HTML or SMTP.

I told my intern to go look up the protocols on ietf.org so they can understand how and why email is a clusterfuck we cannot easily solve, and what a stateless protocol is and what kind of attacks that enables

Show threadLesley Carhart Oct 8
@Taco_lad tbh friends don’t let friends get a cybersecurity degree either over CS or engineering but that’s a different conversation
Show threadBiggles 20X6!Oct 8
@hacks4pancakes 1000% on board with you, our org has a cybersec internship and I do my damndest to ensure they go away with open eyes.
Show threaddarthPandaOct 8
@hacks4pancakes I take time to tell those I teach to apply for any entry level IT job. If a job has the work security in the title, HR hates it as it means higher salary. But IT generalist gets to do most info sec tasks without the job title...manage firewall, deploy EDR...so get the job with whatever title, get the experience to add to the resume for the next hop upwards.
Show threadLesley Carhart Oct 9
@darthPanda plus you practically need a couple years to even compete these days.
Show threadBen RushOct 8
@hacks4pancakes 'struth
Show threadSu_GOct 8

@hacks4pancakes
It is good to have this clearly stated: “ friends do not let friends without substantive IT work experience and/or a credible IT degree take cybersecurity career bootcamps in 2025.

“They are up to no good. Shenanigans. Malfeasance. They are not a safe way to get a job.”

Thank you! 🙂

Show threadnickOct 8
@hacks4pancakes yeah I've heard a lot about those and the whole cert 4 in cybersecurity thing (not really my field) but I've always doubted their usefulness unless there really is a huge corporate demand for compliance paperwork pushers.