Revelie N Niles: Good morning, and welcome to the information security institute's seminar series, my name is reveley and i'm the academic program administrator for the society Program.
Revelie N Niles: And today I have the pleasure of moderating our panel today, we will hear from Jeffrey Chen she got for novice and think attached go Paul.
Revelie N Niles: Representing three different companies mach five Cisco and aurora innovations these I prefer with these cyber professionals actually are MSI alumni, and so this makes us even more a treat for us, in my opinion.
Revelie N Niles: They finished their program the last six years, and definitely understand your current position as MSI students in the Program.
Revelie N Niles: Today Jeff will talk a little bit about news from the front lines technical areas and specialization in cybersecurity during the workforce, what should you do when you're looking for that sheikha will discuss.
Revelie N Niles: You know your first security internship and package negotiation What are those skills needed and the things that you need to be considering and, lastly, bank a dish.
Revelie N Niles: Kindly don't is venki he'll discuss security engineers in product these companies, secure devops and cloud security and security software development.
Revelie N Niles: So there's just one housekeeping note we'll have our Q amp a session at the end of the presentations So if you would like you can post your questions in the chat or at that point, you can unmute yourselves and we can finalize our presentations with any questions that you have.
Revelie N Niles: And so, without any further delay Jeffrey chin.
Jeffrey Chan (MOXFIVE): Thank you appreciate it so appreciate you all for having me today, I wanted to kind of give a little bit of an additional background, so you guys understand the full picture of.
Jeffrey Chan (MOXFIVE): Who Jeff Chan is and and what does he do so after I graduated from the MSI I moved on to multiple companies a couple of those being mandy and rapid seven.
Jeffrey Chan (MOXFIVE): corpses who is acquired by or was acquired by a Palo Alto and i've done a bunch of different things, specifically responded to state sponsored and criminal cyber attacks.
Jeffrey Chan (MOXFIVE): from small businesses to fortune 50 organizations i've led proactive assessments, which is doing red teaming pen testing.
Jeffrey Chan (MOXFIVE): i've gotten to Chile Brazil just doing these sort of social engineering tests and things of that nature.
Jeffrey Chan (MOXFIVE): i've also built in lead incident response and threat hunting teams for dozens of organizations, including fortune 100 firms i've.
Jeffrey Chan (MOXFIVE): focused on the development of the different tools for threat hunting the processes and procedures, specifically at HP making sure that we could reduce the.
Jeffrey Chan (MOXFIVE): The overall hunting efforts from a couple of days to just a matter of hours, if not minutes and I presented at various webinars both on site and.
Jeffrey Chan (MOXFIVE): Virtually as well in different panels and podcasts focusing on the incident response domain.
Jeffrey Chan (MOXFIVE): And just this is just a small little joke for you all I don't know if you notice that qr code in the bottom, if you guys have clicked on that qr code.
Jeffrey Chan (MOXFIVE): Trust me it's not malware don't worry it's just a link to my website that just goes to all things D for where I talk about everything that's digital forensics and incident response.
Jeffrey Chan (MOXFIVE): So with That said, I think one of the, the most important things to highlight, I think, is what's going on in the front lines, obviously, as you guys are studying I think one of the.
Jeffrey Chan (MOXFIVE): One of the most important things is understanding what's out there in the world, so you can figure out exactly where do you want to go and what do you want to do.
Jeffrey Chan (MOXFIVE): This is my bread and butter, this is what I deal with in day out last year i've had to deal with over 200 to 300 different clients all compromised.
Jeffrey Chan (MOXFIVE): clients that you've probably already seen in the news from time to time.
Jeffrey Chan (MOXFIVE): And these are some of the things that are really important to highlight first off, we know, the current situation and Eastern Europe and how tense those things are and that creates a lot of different issues on the cyber Friday specifically.
Jeffrey Chan (MOXFIVE): With regards to different groups such as anonymous or con T or different threat actors out there.
Jeffrey Chan (MOXFIVE): This leads into an increase in state sponsored types of activities or government organizations are actually sponsoring different threat actors to attack.
Jeffrey Chan (MOXFIVE): Different infrastructures and different organizations now you'll see an increase in ransomware cases.
Jeffrey Chan (MOXFIVE): Where these three actors are just deploying ransomware to encrypt organizations and then rendering them.
Jeffrey Chan (MOXFIVE): useless and unable to do anything or perform anything whatsoever, obviously, though there'll be a component of extortion as well, where they get to start you for money and ask you for millions of dollars in exchange for a description utility.
Jeffrey Chan (MOXFIVE): And now we're seeing this increase towards you know these organizations trying or these malicious organization is trying to target critical infrastructure.
Jeffrey Chan (MOXFIVE): you'll notice up on the right hand side there's two different types of warning signs This is specifically coming from conti threat actors dark website.
Jeffrey Chan (MOXFIVE): And their focus, as you can tell has been to protect the Russian Government to be able to retaliate against any any sort of.
Jeffrey Chan (MOXFIVE): You know threat group or savior what have you that is trying to attack the Russian Federation.
Jeffrey Chan (MOXFIVE): This is actually pulled directly from their side they keep updating from time to time.
Jeffrey Chan (MOXFIVE): And it's kind of scary to get to see these kinds of things, because obviously this is what's happening in our day to day lives we see this in the news, but not a lot of people see what's going on underground, so to speak now.
Jeffrey Chan (MOXFIVE): In this industry there's two main primary issues that we see ransomware and business email compromise ransomware is becoming.
Jeffrey Chan (MOXFIVE): Really really crazy beast that it's tough to manage at this point ransomware as a service is the thing like software as a service with very similar where.
Jeffrey Chan (MOXFIVE): it's a business model to lease ransomware tools and kits you'll notice on the images below hopefully you guys can see my mouse but.
Jeffrey Chan (MOXFIVE): This darker image here, this is counties full you know tool kits are tool sets all the things that they do, they collect they run against different organizations it's a playbook.
Jeffrey Chan (MOXFIVE): Similar to how we all have playbooks on how to do red teaming how to do this, how to do that these threat actors can do the same thing.
Jeffrey Chan (MOXFIVE): So it's pretty scary to getting to see these organizations getting far more sophisticated where they're teaching other people.
Jeffrey Chan (MOXFIVE): How to grab what to grab what to look for when they're accessing these environment and it's democratizing the entire industry as a whole.
Jeffrey Chan (MOXFIVE): We saw a tremendous increase from 20 1720 even 2021 21 there's a significant increase in ransomware cases from small organizations, all the way to large ones as well.
Jeffrey Chan (MOXFIVE): And this is a very, very scary thing to see now business email compromise it's the the modern version of the Nigerian Prince scam where ideally now they're they're doing.
Jeffrey Chan (MOXFIVE): wire fraud extortion data best thing etc they're focusing on small to medium sized businesses, so I said bs and their focus is just.
Jeffrey Chan (MOXFIVE): Extraordinary for money, trying to fund, you know different bank accounts all over the world and moving the monies around in order for them to become extremely extremely rich so with That said, I wanted to kind of dig into some of the technical areas and specialization in cyber security.
Jeffrey Chan (MOXFIVE): it's true i've been jumping on to so many different companies but.
Jeffrey Chan (MOXFIVE): i've had the pleasure of actually being part of the majority of these different specializations and I thought it'd be great to kind of share with you all.
Jeffrey Chan (MOXFIVE): This map of cybersecurity domains is quite great because it actually showcases a lot of different expertise and areas, you can specialize in.
Jeffrey Chan (MOXFIVE): But, for me, I put digital forensics instant response up top because that's really my bread and butter I love doing threat hunting forensics and.
Jeffrey Chan (MOXFIVE): Identifying bad guys and figure out exactly what happened that's really the core essence of forensics and incident response.
Jeffrey Chan (MOXFIVE): But you can also specialize in malware analysis and threat intelligence which is pulling these data sets from.
Jeffrey Chan (MOXFIVE): You know the dark web and being able to analyze malware doing static dynamic analysis and figuring out.
Jeffrey Chan (MOXFIVE): Where these bad guys coming from right are they attributed to different governments or government entities, or what is going on right.
Jeffrey Chan (MOXFIVE): And then you've got other areas or other flavors that are a little bit more proactive, which is red teaming pen testing, you know doing web APP pen test or doing network pen test.
Jeffrey Chan (MOXFIVE): One of my most favorite engagements with actually going to Chile and trying to get into a bank and then dropping a lot of different USB drives across different.
Jeffrey Chan (MOXFIVE): Different terminals let's just say that it went well, but after the exercise i'm glad that I had my.
Jeffrey Chan (MOXFIVE): My safety card, which is essentially a letter that says hey i've been hired to do this, please don't arrest me otherwise it would have been a very, very tough conversation for me to have with my parents so.
Jeffrey Chan (MOXFIVE): Aside from that you've got vulnerability management bug bounty.
Jeffrey Chan (MOXFIVE): we're focusing more on coming up with this structure foundation, where you allow other people to.
Jeffrey Chan (MOXFIVE): Find issues across your applications and figure out exactly how to compromise them and then you've got governance risk and compliance, not that sexy have a.
Jeffrey Chan (MOXFIVE): specialization but it's still something that's extremely important understanding how to be compliant in an organization, so that if something bad were to happen.
Jeffrey Chan (MOXFIVE): you've got your ducks in a row, and he won't get a bunch of different lawsuits and places as well.
Jeffrey Chan (MOXFIVE): And I know value will cover the security devops and software development as well, so i'll defer that to venki have to dig into a little bit further so.
Jeffrey Chan (MOXFIVE): One of the things that have personally I found very enlightening is in the past couple of years i've you know, been moving from different organizations and, for me, the most important thing is understanding exactly why am I doing it.
Jeffrey Chan (MOXFIVE): How do I join the workforce and what should I do being in your shoes, for me it was probably one of the biggest things because I really never knew that I wanted to do security.
Jeffrey Chan (MOXFIVE): back when I was in high school I started pen testing without knowing it was called pen testing.
Jeffrey Chan (MOXFIVE): But never really knew that could be a career and, for me, one of the biggest things that I thought that I should share that I typically share with all of my mentees is.
Jeffrey Chan (MOXFIVE): You first want to look at yourself and you reflect where do you see yourself in the future, personally, I see myself as a cto and the future.
Jeffrey Chan (MOXFIVE): i've considered or contemplated being a CIO or CSO things like that, but it's not really going to be for everybody right, so you need to understand where do you see yourself.
Jeffrey Chan (MOXFIVE): what's important in your life, right now, for me, I really want to grow my professional career, I want to be able to.
Jeffrey Chan (MOXFIVE): be the the best incident responder out there and fight crime and all that stuff be the the the Internet Batman, so to speak, right.
Jeffrey Chan (MOXFIVE): And what do I want to specialize or what do you want to specialize in.
Jeffrey Chan (MOXFIVE): As I jumped into different organizations, I focused on incident response doing proactive assessments like red teams and things like that.
Jeffrey Chan (MOXFIVE): But for me forensics is my bread and butter and security devops that's my jam that's where I live, the most that's where.
Jeffrey Chan (MOXFIVE): I can work late nights and not have to be worried about it because I enjoy and i'm passionate doing what I do so.
Jeffrey Chan (MOXFIVE): Once you reflect that yourself and understand what you want to do you evaluate your options consulting versus not consulting.
Jeffrey Chan (MOXFIVE): This is one of the biggest questions that I get from my mentees every single time Okay, I see you hopping from consulting and then you went HP doing non consulting.
Jeffrey Chan (MOXFIVE): What are the differences, I mean consulting gets far more intense its rapid growth you're involved in hundreds of different engagement.
Jeffrey Chan (MOXFIVE): Personally that's how I run I run very quick I sleep six hours a day, even though that's not healthy, so I don't recommend that but.
Jeffrey Chan (MOXFIVE): I love love jumping into incidents helping clients and trying to resolve issues when I moved into non consulting when I was at HP building these tools.
Jeffrey Chan (MOXFIVE): The great thing about is you can hone down on your skills even further, you can say Okay, I know forensics, how can I specialize in this a lot more.
Jeffrey Chan (MOXFIVE): And those are the real differences between consulting and not consulting it won't fit for everybody it's not consulting it's not going to be for everyone, so you need to pick which would make sense for you.
Jeffrey Chan (MOXFIVE): Again cybersecurity specialization I know we covered all of that so try to identify what do you like the most and one of the things that I found.
Jeffrey Chan (MOXFIVE): most interesting is understanding what's going to be your route, whether you want to be fully fully technical.
Jeffrey Chan (MOXFIVE): Or you want to be on the manager or route, you want to manage employees, you want to manage direct reports and things like that, what do you see yourself.
Jeffrey Chan (MOXFIVE): I had a big struggle trying to identify whether I want to be on the technical or the managerial side and I kind of gravitated a little bit more towards the technical side.
Jeffrey Chan (MOXFIVE): Where I wanted to be a distinguished technologies, I want to be focusing on this, I want to be the guy that people say hey Jeff probably knows the answer to this, this problem let's figure it out.
Jeffrey Chan (MOXFIVE): So evaluate your option and third and last pieces lay the groundwork, how do I get from where I am to where I want to be in the future.
Jeffrey Chan (MOXFIVE): and laying those pieces out and how you growth profession, how you grow professionally is going to get you to where you see yourself in the future for me.
Jeffrey Chan (MOXFIVE): In order to become a cto I need to dive into all these different areas of expertise to be able to say comfortably okay.
Jeffrey Chan (MOXFIVE): i've experienced this, I know how to do this, I know what the different hurdles, you know are involved in managing a tech group or technology team, how do we get to that cto face.
Jeffrey Chan (MOXFIVE): And I like to I do hopefully i'm not running a little bit over time, but this is probably one of the.
Jeffrey Chan (MOXFIVE): Most important graphs for me that one of my mentors that at mandaean he showed me this and it stuck with me and every every time.
Jeffrey Chan (MOXFIVE): I have my year review, personally, I take a look at this and it's essentially a professional growth graph or chart you can apply it, not only for your career, but also your personal life as well.
Jeffrey Chan (MOXFIVE): But you've got your knowledge and experience on one axis and time, on the other, when you're born you started zero you started nothing.
Jeffrey Chan (MOXFIVE): And you go to elementary middle school high school, you know undergraduate graduate and you start learning all these different things and get more and more experiences.
Jeffrey Chan (MOXFIVE): But it will come a time and or a point in your life, where things are going to plateau.
Jeffrey Chan (MOXFIVE): we're going to feel that you're not growing you're gonna feel that everything is the same i'm doing the same things over and over again and that's okay.
Jeffrey Chan (MOXFIVE): If that's what you want to do that is absolutely fine nobody's questioning that.
Jeffrey Chan (MOXFIVE): For me personally, I always want to go toward that upward direction and want to keep learning and growing and understanding what are the different things out there.
Jeffrey Chan (MOXFIVE): That I can learn more, whether it be technical, whether it be more on the managerial side, I want to be a better basketball player I probably won't won't grow that much but.
Jeffrey Chan (MOXFIVE): it's okay there's a lot of different opportunities for you to grow so every single time I re evaluate myself and at you know different points in my career, I say.
Jeffrey Chan (MOXFIVE): How am I growing my growing in the right directions, because for me my path has continued trending upwards So how do I continue getting to that point.
Jeffrey Chan (MOXFIVE): At one point in my life i'll probably start plateauing and that's Okay, but for me it's not that time in so.
Jeffrey Chan (MOXFIVE): Obviously I wanted to share this with you guys because it it definitely resonates with me as far as how I grow and how it has helped me get to where I am right now we're managing a group of people.
Jeffrey Chan (MOXFIVE): You know, developing a web application platform with a bunch of bunch of develop developers.
Jeffrey Chan (MOXFIVE): Help clients on the incident response side, help them recover from incidents and figure out exactly what happened and.
Jeffrey Chan (MOXFIVE): make an impact in the industry, so I know I wanted to pass it over to chic as well, because I know she's going to cover a couple of different things that are related to securing you know these internships and all that stuff so chica i'll turn it over to you.
sfadnavi: And Peter that was great information I actually enjoyed your presentation, thank you.
sfadnavi: hey everyone check up on nervous and i'm a senior software engineer at Cisco Systems and currently i'm a part of the services organization which does everything from.
sfadnavi: From in house certificate signing to supply chain security to software signing solutions for secure boot so just everything practically crypto is under the bucket of the services organization.
sfadnavi: And prior to joining Cisco I will business software engineer for so force.
sfadnavi: In their network security group so that works on the next gen firewalls and I mainly focused on the data acquisition layer of the smart engine which is there is engine for the firewall.
sfadnavi: And something that I would like to mention here is that there is no overlap between these two jobs that i've.
sfadnavi: mentioned right from the programming language used.
sfadnavi: To the product or the solution itself, I mean I knew about firewalls and what they do, but I had no idea about supply chain, security, before I joined us for a didn't even know what what what's required for supply chain security.
sfadnavi: So it just goes to show how easy it is to switch from one provider to another, if you have your basics right.
sfadnavi: So yeah let's get down to the actual content next slide please Jeff.
sfadnavi: Thank you.
sfadnavi: Okay, so i'll talk about the internship experience and what you should do and what you what you shouldn't.
sfadnavi: And the first point is that you have to be aggressive in your search for internships or jobs even you're going to be doing that just once a week.
sfadnavi: You have to set aside a fixed amount of time every day to look for new openings and you may not always find new ones, but it will be worth your time.
sfadnavi: You should be so familiar with all the openings of your new profile out there, that if I gave you the job title and the company, you should remember, if you applied or not, so you have to be aggressive just keep looking every day, do not you know.
sfadnavi: just keep that for once a week once a month, you have to do that every day.
sfadnavi: The second point is that you should get in touch with everyone, you have ever worked with studied with or befriended basically just let the world know that you're looking for an internship i'm sorry.
sfadnavi: Now I prefer targeted personal messages or emails over linkedin posts which are for blanket audience and don't get me wrong linkedin posts may help some people may send you some leads.
sfadnavi: But always remember that your effort echoes their effort so if your effort was just uploading a blanket post on on linkedin.
sfadnavi: Then they are likely going to send you a link to their career speech which you would have already announced.
sfadnavi: But if you send them a personal message wasn't an email then they're more likely to take that one extra step of maybe reaching out to the hiring manager, or to the recruiter and put in a good word for you.
sfadnavi: So always remember that your effort echoes their effort, you are the one requiring an internship looking for internships, so you need to take those extra steps.
sfadnavi: Third point is in the interviews itself it's important that you are truthful but don't undersell yourself don't be overly modest be sure of yourself.
sfadnavi: If you're not if you know something.
sfadnavi: From a two X on a topic, and you don't know y and Z of it it's Okay, they 90% of the time they don't even care if you don't know y amp Z because they trust you that if you know, a two X, then you can pick up the rest of the remaining bits.
sfadnavi: So if you start off with suppose I asked you hey do you know about this and you'll say you know what I only know this and this.
sfadnavi: is highly likely that that's what they're looking for, but when you start but I only know this, it gives a negative connotation, and it sort of shows that all maybe you know she knows this.
sfadnavi: Would you go if you know something be assertive be short of yourself and let them know that you are pretty confident of your skills in those areas.
sfadnavi: And the last one take your coursework seriously, I cannot emphasize this enough personal experience, I still go back to my notes from courses like security and privacy practical crypto ethical hacking.
sfadnavi: For any of the interviews that i'm taking till day, like every now and then I just you know if if my pages to my notebooks and i'm like oh wow yeah that's a great explanation that I took down in the class.
sfadnavi: Sometimes I go to the YouTube and I check out the videos that were uploaded by by a very kind classmate of ours from.
sfadnavi: Professor matt Greene and they have some amazing explanations but padding Oracle attack and just just amazing lecture content in general, so please take your coursework seriously, we have some amazing coursework at.
sfadnavi: Jay chou in MSI take them to use me they would get the basics right now let's get down to the dogs.
sfadnavi: Now, the first point is pretty similar to what I said before, but this is in the in the category of please don't hesitate reaching out to that professional or academy acquaintance that you haven't spoken to in years.
sfadnavi: it's Okay, people are out there to help you it's Okay, if you haven't dropped them a hello, or a high in the last two years, or three years, they will be more than glad to help you trust me.
sfadnavi: The only recommendation would be don't start a conversation with small talk like you know how's the weather vane have you been able to see your family, the last two years, you know how's the dog doing.
sfadnavi: I would say just be a friend and get down to the actual reason of why you're reaching out to them, they appreciate honesty.
sfadnavi: To say hey you know, have you been I really need your help, I have found a really great profile in your company and I need to refer, for it would you be willing.
sfadnavi: We have frank be honest and they will be completely ready to help you.
sfadnavi: don't overthink go for what you find exciting and this is important it's your first security internship or even if it's a job if it's a full time job go over.
sfadnavi: If you like the profile, if you like, the people that you've worked with just go for it.
sfadnavi: As, as you have heard from Jeff and as you've seen my profile my previous job doesn't match what i'm doing right now, thank you we'll talk to you about what he has been doing.
sfadnavi: And it's it's actually very easy to switch if you ever basics right so don't over think about that phones job, if you like, it just go for it.
sfadnavi: The third point it's actually personal to me don't accept an offer, only two later rejected.
sfadnavi: So I actually accepted a full time offer from a company.
sfadnavi: And I honestly haven't stopped interviewing after that, but then I got a call from a recruiter at so force.
sfadnavi: And I was like you know it's a big company I don't want to not take the interview, so I took the interviews and then I got through and I got an offer which was to go to refuse, both in terms of package and the profile the work itself.
sfadnavi: And then I had to go through a very awkward and disappointing and upsetting call with my other hiring manager who's offer accepted to about two months ago.
sfadnavi: And I tell him that I wouldn't be able to join this company I wouldn't recommend that, if I could go back and change it, I would I would either not accept the previous offer or if I did, I wanted my board.
sfadnavi: So yeah it's a it's just a it's just ugly for everyone involved there was also you know, I was referred to that company by a friend and that friend is still a great friend, but it was just you know awkward for them to that I accepted and then I later rejected.
sfadnavi: So yeah just you know, think about what offer you're accepting and if you do if it's an internship it's okay it's going to be three months big deal, but if it's a full time offer think about if you are really willing to keep doing that work for a good year two years right.
sfadnavi: yeah that's about it from this slide Thank you Jeff.
sfadnavi: Okay let's get down to the interesting part here package negotiation um.
sfadnavi: Let me call out here that this is in no way related to the previous slide and talking about package negotiation for full time jobs do not go about negotiating your hourly rate for internships it's okay like I said it's three months big deal.
sfadnavi: At the end of the three months period, you will probably be $500 short, then you appear it's okay you'll get over it, do you have time to start on my student loans so don't worry about internships are needed do what you want.
sfadnavi: But for full time jobs because you know that's longer than an internship it will probably be a year, two years, three years, who knows, if you like, the job right then it's important to start off with the with the VIP.
sfadnavi: um now The first point is almost always never accept the first offer.
sfadnavi: it's a business transaction for the company at the end of the day, so they are going to offer you less than what they can actually afford to afford to pay so it's your responsibility to get to a number, which is convenient for the company and also more than decent for you.
sfadnavi: also remember that you have to be polite but decisive don't be rude don't say hey you know, this is unacceptable and i'm rejecting it but don't do that you have to be polite you have to tell them hey.
sfadnavi: You know this is not same as what I was as as my expectation is not matching my expectation and so.
sfadnavi: You can either there is, there are two possibilities you either had done your research prior to that phone call when when they told you about the compensation package or you haven't.
sfadnavi: If you haven't if you haven't done your research then it's best to let them know that hey you know I need some time, maybe let's get back to it in a day or two.
sfadnavi: let's get a little call, let me do some research on my side and I didn't want to give you a number that is too ridiculous and also I don't want to give you a number that is not fair for me so.
sfadnavi: Let me, you know, give me some time let's hang up right now and i'm thankful that you're extending the offer i'm really glad that people like me over there and i'm excited, let me just give you the right number.
sfadnavi: And then you hang up you do your research you go to last, or you go to linkedin you find out the average based thing, and you talk to as many people as you can.
sfadnavi: that's important now, I understand that you may not be comfortable to share the exact.
sfadnavi: numbers of your offer letter with someone but just give me a ballpark and see what what your what your peers are your seniors from a Grad school or your you know someone in family that we look up to who has who has the similar sort of career trajectory talk to everyone that you can.
sfadnavi: But also remember that you want to do your research on the average pay for that position in that location, now I have underlined that point.
sfadnavi: Make sure that you are not swayed by the numbers that the exorbitant packages that the companies and West Coast pay, they have to because it's so expensive to live there.
sfadnavi: But you don't need that kind of package to live in Ohio Pennsylvania North Carolina Virginia, you will be more than comfortable with with much less than that.
sfadnavi: So, so do not be swayed by that there will be some fears of yours will be going to West Coast with those exorbitant packages don't be swayed by that go to cost of living calculator.
sfadnavi: check out how much they are you know your offerings you how much you get in hand of the taxes, your vendors your you know, whatever your grocery bills.
sfadnavi: And just just all kinds of you know expenses that you're you're looking at just check out or just make sure that whatever you get in hand is more than me so for you to live comfortably.
sfadnavi: and always try to do the negotiation or phone, as opposed to email because phone is just more personal.
sfadnavi: In email what happens is when you're trying to be assertive It may come up as well because you're not we know how many mo geez you add it's an email it's it's a it's a tool.
sfadnavi: you're not really talking to them, so if you're talking to the recruiter on phone it's just more personal that recruited me understand the.
sfadnavi: Urgency no voice, or may try to understand your side of you when you're explaining to them something why you why you think you deserve higher is because you have a.
sfadnavi: You have this fancy degree, you have you have an amazing skill set that you know, nobody in European has and things like that so it's always better to have a phone.
sfadnavi: um and now let's get down to the the components of compensation package, it actually mostly involves these four points and not all companies may have all these four, but a lot of.
sfadnavi: So there's a base pay there's a restricted stock unit, which is the issue which is basically the stock of the company.
sfadnavi: there's a sign on bonus and there's a relocation benefit now that relocation benefit could be a friend, or it could be the investment so they may say that oh you're just going to give you $10,000 up front or $5,000 up front.
sfadnavi: or they may say just give us a bill of whatever you incurred and just reimbursed whenever that was.
sfadnavi: Now I would say that for the first security job for the first job rather focus on your base pay.
sfadnavi: You want to make sure that you start off at the right pace and you're in this period is probably going to define how soon you can keep going higher.
sfadnavi: higher numbers so maybe if you don't pay attention to the relocation benefit or sign on bonus it's okay just make sure that your base pay is something that you're comfortable with and if you're starting with a startup it's likely that the base pay won't be that high, but then.
sfadnavi: It didn't give you stocks and in those cases, what you need to check is you know, do you believe in that company's.
sfadnavi: Growth like do you think that that stock value is going to give you that much.
sfadnavi: amount that that that you will come you're compromising on your base pay so that's something to you know, think about.
sfadnavi: Your sign on bonus and restricted stock units and times they don't.
sfadnavi: They are not given to you on day one, so with restricted stock units.
sfadnavi: almost always get like a four year period or wish them the best it could be four years, it could be two years.
sfadnavi: So, think about how much they're giving you and what's the vesting period.
sfadnavi: If they're giving you $100,000 worth of scarves and they're giving you it over four years 25,000 per year is a good money, yes, but if they give you $50,000 over four years, then I don't think that that's worth.
sfadnavi: Signing that up for four years right so always you know calculate everything together, there are some companies which may not give you a sign on bonus.
sfadnavi: And that, basically, maybe more but they actually have a bonus percentage which is almost always given unless the company goes bankrupt I don't like it's almost certain that we will get that bonus percentage so calculate that also.
sfadnavi: really talk to your recruiter understand what it is and understand which one you are willing to compromise on which one you're not and then stick to your beliefs and then try to make them understand why.
sfadnavi: You think you deserve more than what they give you Okay, and definitely do not accept an offer that you're going to reject once again so yeah that's that's pretty much what I had from my side, and I will hand over to reiki now.
Venky Gopal: With the security.
and
sfadnavi: Software engineering integrated.
Venky Gopal: Oh, thanks, and thanks Jeff yes, I think, they say, like one never stop learning new ways to look at things and get motivated and I think both of your talks are a good example of that and I still do have some goosebumps from from some aspects of it.
Venky Gopal: fully agree with the do's and don'ts of internship and negotiation, I really wish someone had told me this back in the day right.
Venky Gopal: So anyways Hello everybody i'm i'm vicki and i'm based out of Pittsburgh Pennsylvania for folks who I haven't met a quick primer on my background.
Venky Gopal: i'm from the 20 1617 backup MSI and have about six to seven years of overall industry experience with software and security i've largely lead towards.
Venky Gopal: The software development side of security so i'm mostly been in non consulting kind of roles that and i've helped companies architect design and implement software for security conference services legalese as part of the and you know overall ecosystem.
Venky Gopal: Most of our most Hopkins I work for so force a computer computer security company, and I was part of the team that Chicago was in and we help them realize they are deep packet inspection scheme.
Venky Gopal: In the next generation firewalls and then sometime in 2019 I got offered from uber etc it's basically uber self driving team, and since then i've been in this.
Venky Gopal: autonomous bacon security space, been a pretty pleasant right sometimes a bumpy ride being self driving but.
Venky Gopal: already seen God brought by another self driving giant called aurora in 2021 I moved I moved into other as part of that acquisition so for those who aren't aware.
Venky Gopal: Self driving vehicle technology company, and they are on a mission to deliver the benefits of self driving back safely quickly and broadly we have office locations and multiple cities across the US and i'm based out of Pittsburgh, and I lead some of the vehicle security efforts.
Venky Gopal: So yeah that's I mean for me so now let's move on to the some more cool stuff next slide please Jeff.
Venky Gopal: Thanks yeah I think Jeff gave a great overview of different domains, we have within cyber sex and a leader to you know devops and.
Venky Gopal: development opportunities as well, so i'm going to sort of the words from that and give a quick overview of roles you'd find the internal security teams you'd seen companies like product based companies.
Venky Gopal: and focus on a subset of roles that in all opportunities from a security, development standpoint, and you know.
Venky Gopal: How, you can see yourself, being a part of that in the future if you're interested right.
Venky Gopal: So what kind of security engineers, do you usually find that product based companies right there's definitely not a one size fits all categorization.
Venky Gopal: there's a lot of contextualization involved, based on the environment you're in and there's definitely a lot of overlap and coordination between.
Venky Gopal: The folks in these different polls, even within an internal security organization, but you generally find these in some shape or form in a company right so you're not executing and yes.
Venky Gopal: We focus a lot on security review style of work internal consultancy for different partners within your organization.
Venky Gopal: i'm doing a lot of security assessments, they do a lot of security as tlc style of work, helping secure things in the supply chain.
Venky Gopal: Helping internal development teams with things like you know dynamic application security testing static application security testing some of these I think Jeff alluded to this right.
Venky Gopal: Then you have your team that does a lot of IP security, you know, helping security or or or or processes data and assets within your company.
Venky Gopal: The next category is infrastructure security engineers, I think, over the last decade, this has matured more into cloud security specific roles just due to the you know why are often we have seen on the cloud and.
Venky Gopal: The cloud tech has benefited us in so many ways it has its own set of security implications and does brings a lot of you know.
Venky Gopal: New engineering opportunities as well right which we've seen some of the hugest late.
Venky Gopal: Then you have your security software developers are engineers who support a good chunk of design and implementation portion of your product lifecycle.
Venky Gopal: These are engineers who have some sort of programming or development expertise and also a good chunk of security, expertise and then they help teams realize our products in La some security components of your ecosystem.
Venky Gopal: You don't have full to in policy and regulatory side of work.
Venky Gopal: I think Jeffrey that's a bit on this, but i'm going to mostly skip this part you know, this could be compliant with regards to hipaa is 27 one pci standards or you know, whatever the standard is relevant for the industry that you know your company operating and.
Venky Gopal: Finally, I think you'll see this management professionals and folks doing things like pen testing, and let me.
Venky Gopal: Do must be well known, but I think the takeaway for you guys as you've seen these kind of goals, not only in like pure consulting firms, but also an internal security teams, do you have in you know any company, for that matter.
Venky Gopal: anyways yeah def I think we can move on to the next slide.
Venky Gopal: So i'm pretty sure most of you have some idea of what of how things out your best in the cloud space, I thought cloud space in general.
Venky Gopal: But sign up the perfect some context to be I think over the last decade we have seen a huge adoption of cloud the major players have been you know folks like aws.
Venky Gopal: Actually, on the CB and many more, so this adoption is not just because of flexibility in cloud computing solutions right it's just been more than that.
Venky Gopal: But obviously if you're building an application or let's say you're building a simple http server in a data Center you have to.
Venky Gopal: You know, write your own code and tooling to manage the entire life cycle right, you have to think about scalability security backups load balancing.
Venky Gopal: development and testing networking routing monitoring your infrastructure auditing just just too many things, I think, each of these individual features are complex in nature.
Venky Gopal: Based on the requirements, and I think more than this, based on the type of the data you're handling baby are also subject to different types of appliances and you know this policies and.
Venky Gopal: Standards right, so the move to cloud space has generally benefited industries and companies in almost all of these aspects right because it's like some standardized way of achieving something you can literally do all of these now in minutes or hours, using the tooling that we have.
Venky Gopal: And, even in the aspects of compliance and regulations right, it has benefited the industry heavily.
Venky Gopal: So now, because the cloud providers largely try to you know adhere to some sort of best practices and you as a consumer of those services are given the flexibility to make the next city needs from a user standpoint.
Venky Gopal: So, though, it becomes simpler from a user standpoint, it opens up a big umbrella of opportunities for you know cyber attacks endless so.
Venky Gopal: All of this kind of falls under the stage of development operations for devops, in short, mainly because it's abstracts away these.
Venky Gopal: You know augmented pieces for you and helps you focus on the core business logic.
Venky Gopal: Right, but again, as the scene that expanded there are tons and tons of tools and techniques available in the market to achieve.
Venky Gopal: Something right which comes with its own techniques for things like authentication authorization confidentiality all of your security for them, it gives them, so it actually opens up the space for someone to make impact on the security side.
Venky Gopal: And you know that's definitely and, ultimately, if I don't remember this.
Venky Gopal: One feature of devops that has made life simple or the last folder bias is the sponsored by he they wasted effort to as infrastructure as code.
Venky Gopal: This is basically a technique, where you can represent your entire infrastructure in the form of a board in a city in a single.
Venky Gopal: day like let's say you want to you can you want to spend up to database instances for containers to load balancers one one web application firewall.
Venky Gopal: You can do all these in literally minutes or seconds like without the progress of cloud SEC or cloud computing this was something that would take teams months or even years, in some cases right and.
Venky Gopal: 50 people, this is already used to just a one person effort right so with all this right, it has become really simple to manage infrastructure.
Venky Gopal: But it's super easy to get it wrong if you can do something in seconds or minutes you're naturally inclined to do it pretty and.
Venky Gopal: That can lead to unintended disasters so it's truly like a shared responsibility model between the cloud provider and the consumer that that sort of using this.
Venky Gopal: So anyways I think the takeaway here this there's a lot of development happening in the industry to guard against almost every possible challenge you see in devops and cloud security they are managing infrastructure, for example.
Venky Gopal: In fact, a lot of these things in this space are driven by security requirements and this phase has a massive massive requirement for security engineers to get it right.
Venky Gopal: So, if this is something of interest to you and you want to check more i'd be happy to help recommend some companies that are bigger this.
Venky Gopal: Next slide yeah.
Venky Gopal: cool so and the other category of engineers, you find a software security developers like these are folks who do a lot of programming.
Venky Gopal: Or you know, have already acquired some sort of software is getting skill set and also have a general security skill set and background hey this looks at me.
Venky Gopal: In word to all the products lifecycle so there's not a great way to generalize what they work at because it's very product specific.
Venky Gopal: You might be building a firewall you might be writing a cryptographic service as she said, or you might be writing code to you know build an identity and access management solution for your company.
Venky Gopal: Or you might be implementing some sort of you know cool hardware security solution like secure boot or trust and good.
Venky Gopal: You might be building a new feature in your operating system or you might just be you know sending that back or some some software engineering work.
Venky Gopal: I think I definitely see a lot of opportunities in this space for security engineers who also have an interest or passion towards.
Venky Gopal: Programming or general software engineering Okay, the reason as security engineers, like you, guys see a big you'll have the best context of how security works.
Venky Gopal: what the implications are of doing so and of not doing so thank you, you know what could go wrong if you don't have the right security fundamentals in your body so.
Venky Gopal: Many also pick up the programming expertise and understand the product like you natalie also comprehend what it takes for the product to make use of all those security parameters.
Venky Gopal: So you can now answer questions like what is the performance impact you do the security feature, what does the usability impact.
Venky Gopal: What is, how does this affect scalability How does this affect monitoring how does this affect our future goals of the product.
Venky Gopal: So now you sort of have the context of a pure software engineer, and also a security engineer, and you are able to bridge this gap and help your company might make those foundations of open.
Venky Gopal: So I think folks who are open to some programming or generally interested in it should definitely consider exploring these kind of roles and I think the decor slots that we have it offends me the power, the best of challenges.
Venky Gopal: That you know things like cryptography operating systems network security, which are all called to software security and then.
Venky Gopal: Again, if this is something that excites you happy to suggest some companies based on interest.
Venky Gopal: yeah and I think that that i'll hand it over to w for the q&a.
Revelie N Niles: Thank you frankie Thank you.
Revelie N Niles: Jeff and chickens was great information in the interest of time here, I want to open the floor for any questions that anyone might have at this point, feel free to unmute yourselves and just ask or if you're more comfortable post in the chat I can read it.
Jeffrey Chan (MOXFIVE): um.
Liyin Li: I got a question.
Liyin Li: Sure, so yeah so to to the free guess so anyone's like who wants to answer cancer, so I was like I think i'm i'm curious on so i'm kind of like choosing.
Liyin Li: So I got some like intuition, to offer and then our site, but they have like different focus of security domain and then some.
Liyin Li: Very like Neil, for example, it could be like, he said, every security something like that or some something.
Liyin Li: Some other tasks would be like, for example, like a website pen tests type of task so like the way that I was designed between them is that because I think.
Liyin Li: If I really want to like learn the like the core you know security skill, I think the latter, one might be better because to my perspective, I think the like the security.
Liyin Li: I mean these areas.
Liyin Li: One would be is still a relatively new so I i'm afraid I will been with them be learned on so much in that job so i'm just curious like what was your your guy's perspective on on choosing.
Liyin Li: My like first internship and or even like like like just say, overall, you know perspective on on the you know the development trend of like future some security in the industry industry.
sfadnavi: So I can take that but I want i'm sorry I heard that the second job that the second undercover they talked about was pen testing, what was the first one again.
Liyin Li: is about on like.
Liyin Li: He said some doctoring.
Liyin Li: develop something like that yeah.
sfadnavi: I see okay um yeah they're actually both exciting i'm so it would really boiled down to what you want to go into.
sfadnavi: I would say that if you don't don't worry about anything new, because actually it is being implemented in a lot of people industrial services also.
sfadnavi: So if you, if you like going into blockchain and securing blockchain that should be.
sfadnavi: It don't worry about you know you want learning a lot there.
sfadnavi: But also pen testing is you know, like the.
sfadnavi: It is for security in terms of offensive security and also teach you how to defend your systems and everything so that is great too so that's an easy one.
Jeffrey Chan (MOXFIVE): yeah I agree as well, I think it really depends on on your gut and know it's going to sound very.
Jeffrey Chan (MOXFIVE): You know subjective but trust your gut at the end of the day, your gut will tell you if you if you really like to jump into a new space or not people are going to be risk adverse to try new things and that's okay.
Jeffrey Chan (MOXFIVE): The one thing you need to consider that I know she was mentioning was.
Jeffrey Chan (MOXFIVE): it's an internship right, so if you're looking at this internship for three months and it doesn't work out.
Jeffrey Chan (MOXFIVE): that's good that's still unexperienced that you learn that you know, this is something that is not for me right, I jumped into.
Jeffrey Chan (MOXFIVE): HP doing internal security for two years, great loved it was it a thing for me not really doesn't say that it's a wrong thing to do, it's more of a building your experiences so you can't go wrong with either.
Liyin Li: I see I see, thank you for you guys perspective.
sfadnavi: yeah.
Venky Gopal: And just just to sort of the idea right like.
Venky Gopal: Early in your startup your video right it doesn't really matter a lot, you want to learn as much as possible at this stage right like and.
Venky Gopal: me, for example, I started off as a network consultant, and now i'm in the self driving software industry building software for cars and security and safety and all those things, so you always have the opportunity to switch at any point in your life right like.
Venky Gopal: You can you can go for ATM and blockchains right now, you might end up learning things like how the company operates our product is actually being built.
Venky Gopal: You know, one of the different people involved in an organization those kind of things.
Venky Gopal: Many start doing pen testing right, you have a more broader view of things you see a lot of different products and you kind of see these products from a consumer standpoint.
Venky Gopal: So versatility you end up taking right, you will end up gaining a lot of knowledge from either of those and you can sort of you know, particular to keep applying knowledge as you move on, you know as you progress in your career in the future.
Liyin Li: Thank you.
Revelie N Niles: well.
Revelie N Niles: Thank you all, thank you for answering that question I didn't see any other questions in the chat and even at this point, it is time for this.
Revelie N Niles: session to be done so again, I really do appreciate your experience your valuable insight a time that you've shared with us today it's great seeing you all.
Revelie N Niles: meeting you Jeff and seeing banking and chica We appreciate you and that's the end of our session, unless you have something you want to add.
Xiangyang Li: yeah I just want to say again, is so nice seeing you guys bike ride was laid back.
Xiangyang Li: Hopefully, in future, we can.
Xiangyang Li: really see down, you know in person, you know, have a coffee or something to chat about your progress, and thank you so much for all the I think very, very.
Xiangyang Li: useful information to the students, so we are recording this session we will post it, you know, on our website so our students can you reveal, I think we can get a lot from this, yes, thank you guys very much I wish the best to each of you.
sfadnavi: Thank you so much, thank you, thank you so much.
Jeffrey Chan (MOXFIVE): Thank you appreciate it and me i'll open it up, if you guys have any any questions that you guys want to reach out personally i'm more than happy to chat.
Jeffrey Chan (MOXFIVE): I felt helped a lot of folks that have graduated from the MSI school to you know get internships or.
Jeffrey Chan (MOXFIVE): or even chat about you know life in general and where you want to pursue your career, so I want to throw my personal email in there, in case you guys want to want to reach out so happy to chat and.
Revelie N Niles: I can help facilitate that I will speak with our three speakers gather their information and i'll send it out to the group so that you can contact them if you wish.
Xiangyang Li: Okay, so I think that's hot with the seal guys.
Xiangyang Li: yeah.
Liyin Li: Thank you bye.