- So let's talk about cybersecurity skills.
There are different levels
of knowledge that you have to have,
and there are technical skills that you need to achieve
in order to fulfill the requirements to apply
and to be successful in a cybersecurity job.
The technical skills necessary
for a cybersecurity job will vary according to the position,
which is something that by now you should be very aware.
There are different levels of jobs.
There are different types of job in cybersecurity.
So one job may require you to have knowledge in networking.
The other job may require you to have knowledge in database.
All those things related to cybersecurity.
Now it's not only about the the requirements,
it's about what you already have.
How can you leverage your knowledge
to easy the migration to the cybersecurity field.
So if you think
about what is your current knowledge on something.
You need to do this self-assessment, is it very basic?
Is it medium level, advanced level, or even expert level?
That's how we qualify level 100,
so you're gonna hear a lot about,
"I'm level 200 in this subject,"
"I'm level 300 on this subject,"
because this helps to create the expectation.
So during the interview,
if someone asks you What's your level
of knowledge in computer networks,
you can say, "Well, I have level 300."
Assuming that you have level 300,
you can say, "I have level 300."
At that point,
the interviewer immediately understand that,
"This guy is an advanced level,
"so let's start asking question on that level."
So super important to set the right expectation.
Be careful to not exaggerate on your level,
which is something that sometimes I've seen
in interviews where the candidate says,
"I'm level 300,"
and then you start asking questions on that level
and the candidate really doesn't know.
So be sincere and be transparent.
You can even say, "Currently I'm level 200,
"but I'm very motivated to keep moving forward
"and learning more
"so I can be level 300 according to your expectations."
It's much better to show this enthusiasm,
to be transparent and be sincere,
than giving the wrong answer,
and on the follow up question you failed
because you set the wrong expectation.
So part of the learning process for you to migrate
to the cybersecurity field means doing a self-assessment,
this is super important.
Here you have to be extremely sincere
with yourself and transparent.
So this table is a suggestion that I'm giving out to you
so you can enumerate the topic,
which I consider some of the key topics
for core knowledge in cybersecurity.
Operating systems, something that you need to know,
you need to know operating,
even if it is only one operating system,
let's say you only know Windows,
it's fine as long as you know how to assess yourself
and say I'm actually only 200 level in operating systems.
I don't know anything about threads, about processes,
about memory dump.
I don't know those details about an operating system,
so I'm not 300 level for sure, not even 400.
So be sincere with yourself
when you are doing this self-assessment.
Computer networks is another one
that you have to rank, okay?
And I'm suggesting in this table, if we think about,
I'm suggesting the minimal level.
Of course, the minimal level will vary according
to the position,
but what I'm saying here is,
as you start your journey to migrate
to the cybersecurity level,
that's your starting point.
You should be at least 200 level knowledge
in operating system,
at least 200 level knowledge in network security,
at least 100 in director service,
at least 100 in encryption.
That's the minimum to get started.
And if you're not there, that's fine.
You're gonna get there,
because you're gonna establish a plan to how to get there.
But make sure to use this table as a reference.
And the table in the book has even more domains
that you can use as an example.
So let's talk about soft skills, which is critical.
Soft skills nowadays is super important.
And when I interview candidates,
one of the things that I see a lot is people failing
because of soft skills.
They focus so much
on the technical that they really do a poor job
in the soft skills.
Now, the technical questions will often come later,
and that's, sometimes,
at least according to the company,
of course this can vary.
But my experience is
that there is a natural triage that takes place
in the beginning of the interview process
where they look at,
is this candidate a good fit for the company?
Because many times you are applying for a job,
but the recruiter and the hire manager,
the interviewer is looking at you and thinking,
"This this person may not be a good fit
"for this position,
"but this person is so good in other things
"that I'm gonna recommend to another position."
So be mindful about that.
What you are, the way that you behave,
the way that you show yourself is very important
because, okay, you may not get that position,
but you may be offered another one.
And that's where soft skills plays a big role,
because the candidate, you,
will been seen as someone that will add value
to the team's culture, to the company's culture.
So it's very important for you to understand that.
And understand also that there are different opportunities
within that company that you're applying for.
So don't fix it mindset
that only that position is important for you.
You may be offer a different position.
That's the reality.
The list below is some
of the soft skills
that over the years I've noticed gain
much more momentum in cybersecurity.
So let's go through some of the soft skills
that you should have as a cybersecurity professional.
And if you are migrating to cybersecurity field,
you should start exercising those things more often.
So the first one is the growth mindset.
This is such an important soft skills for cybersecurity
because things are changing
every single day in cybersecurity.
So what you learn yesterday is great,
but it may change today.
The reality may change according to the threat landscape.
So you've gotta be always open minded.
You cannot be fixed mindset and say,
"No, this is the way it works,"
and it doesn't change your opinion.
Your opinion will change based on your evidence.
Your opinion will change based on your facts.
Cybersecurity is very dynamic
and you need to be willing
to be comfortable in uncomfortable situations.
That's the reality, right?
Because when you have this fixed mindset
that things need to go this way
because that's how you learned
and that's how you've done in the past,
you lose the opportunity to learn something new,
and you are perceived as someone difficult to work with
because you do not accept new perspectives.
So be careful.
This is a very important soft skills.
So during the interview,
you're gonna be evaluated
on how flexible you are to change your mind about things.
You may be exposed to some scenarios
that if you had knowledge in the past,
you may not change.
And that's really not interesting.
You have to be willing to learn and to grow,
and based on new evidence and new facts,
change your opinion as well.
The other one is being coachable.
This is big because mainly for people
that already have knowledge,
because sometimes you reach a point
in your career technically speaking
that you may feel like, "Okay, I know so much.
"I know more than everyone."
And then you start to get into a point
that you feel like you don't need to learn anymore.
And in that point you become really hard to be coachable
because you may say,
"Well, what this manager wants to coach me about
"if I have 15 years of experience in this
"and this this person just started?"
Never ignore the power
of learning from someone
that has less knowledge in something than you.
That person has always something to teach you.
So you gotta be willing to listen,
very important to listen and to absorb.
And even if it's something that you already know,
show appreciation, show that you acknowledge that advice
and you're gonna move forward.
You're gonna implement.
So you gotta be coachable.
If you are difficult to be coachable
because you feel so much of yourself,
that's a problem.
Critical thinking, super important.
Mainly when you are working with cybersecurity,
because you are analyzing data,
you are making decisions.
Depending on the field
that you work in cybersecurity,
this can be extremely important.
For example, if you are working with instant response,
you gotta analyze things
from the critical thinking perspective.
You have to understand how to connect the dots
in an incident.
So don't be too biased
about things that you already learned.
Again, be open-minded, growth mindset
to analyze the data, look at the new evidence,
and then come up with a potential action plan
to move forward.
Effective communication, so important,
nowadays that we are in this hybrid mode
where we have people working from home,
we have people working from the office
or working from many places.
The body language sometimes is not available
for you when you are communicating,
so written communication becomes critical.
You need to be careful on how you write,
how you portray to what you want to say.
So be careful to not come out as someone rude
or someone that is fixed mindset.
You always have to take care
of your written communication.
And again, this is super important nowadays,
because remote workers,
they spend most of the time chatting on Teams
or having conference calls.
Some people don't like to turn
on the camera during conference calls,
which is super important
to at least have some sort of visual representation
of your reaction.
When someone says something,
you can express yourself visually.
So it's very important.
Always turn on your camera, if you can,
so that you can express yourself better
and ask other people to do as well.
So effective communication
in a remote workplace is super important.
Be mindful of what you write,
because the it can be received from someone
and the way
that the person receive may give misinterpretation, right?
So be clear,
bring clarity on your communication,
not confusion, bring clarity.
Be inclusive and empathetic.
One of the things about securities
that over the years a lot of secure professionals
always blame the user.
Always, "It's the user's fault to doing that."
And you create that stigma
that everything that goes wrong is because of the user.
Be more empathetic.
People are busy.
People make mistakes, they're humans.
They're doing things differently.
They are focused on their daily work
and then they receive a phishing email
that was not blocked by your spam filter.
And suddenly now that person is
in the middle of something
and that person click on the link.
You cannot just blame the user.
You have to educate the user.
You have to be empathetic about the situation, right?
So it doesn't fit anymore that mentality
that you can blame the user for everything.
And that's just an example.
When I say be inclusive, empathetic, is
if you are going to a meeting,
make sure that you give the voice
for other people to talk and make sure
that if someone is not talking,
invite them to talk.
And all those things that I'm saying here are important
for you to highlight during the interview process,
because during the interview process,
you may receive scenarios
that will explore those soft skills.
So you need to be mindful about that.
And that goes again to the next one,
which is know how to collaborate.
You can be a genius, you can be great,
but if everyone around you tells your manager
that "This person is so difficult to work with,
"I mean, I know this person gets the work done,
"but it's so difficult to work with this."
Look, you're not gonna evolve.
You have to empower others.
Others in the team, outside the team,
they need to feel motivated to work with you.
They need to come to you and say,
"I love working with you because we get things done.
"You help me to get things done.
"You empower me to get things done."
So collaboration is super important.
Not only that,
but you don't know everything in cybersecurity.
Gotta collaborate across different domains
across different roles.
If you are a instant responder,
you will definitely have to collaborate
with the cybersecurity analyst.
You're gonna have to collaborate
with the system administrator,
gonna have to collaborate with compliance.
There is a lot of collaboration going on.
So you need to be mindful about that
and make sure that you know how to collaborate.
And last but not least,
know how to delegate.
You cannot do everything.
And if you feel like you have to do everything
because you are afraid
of sharing your knowledge with others,
that's the wrong approach.
You need to know how to delegate.
And by delegating, you are empowering others,
which is a very important attribute nowadays,
because by lifting others to do better,
you will also do better.
And the companies out there,
they recognize this,
because they see you not only
as one individual contributor that is doing a great job,
but you are enabling others to also do a great job.
So by delegating, you empower that person
to deliver a project or to lead the project
at the same time you are coaching that person.
So this is super important.
So these are some of the critical soft skills
that are important for cybersecurity,
but are important across the board.
But for cybersecurity, they are very critical.